do-remove-role

The <do-remove-role> action initiates a request to the Roles Based Provisioning Module (RBPM) to revoke the Role specified by role-id from an Identity. The target Identity is specified by either <arg-dn> or <arg-association> if specified or by the current object otherwise. If specified by <arg-dn>, the DN must in LDAP format. The request is made to the RBPM enabled User Application server specified by url using credentials specified by id and <arg-password>. Additional optional arguments to the Role assignment request may be specified by named <arg-string>'s.

	Description
description	A description of the reason for the request used for auditing purposes. Default: Request generated by policy.
effective-time	The time (in CTIME format) the role revocation should become effective. Default: now

If any type of error occurs while requestion the role assignment, the error string will be available to the enclosing policy in the local variable named error.do-remove-role. Otherwise that local variable will be unavailable.

Example

<do-remove-role
    id="cn=RoleAdmin,o=People"
	url="http://localhost:8080/IDMProv"
	role-id="cn=Contractor,cn=Level30,cn=RoleDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=DriverSet,o=novell">
  <arg-password>
    <token-named-password name="role-admin"/>
  </arg-password>
  <arg-string name="description">
    <token-text>Requested by policy because isContractor set to false</token-text>
  </arg-string>
</do-remove-role>