DirXMLScript DTD

DirXML Script is the primary method of implementing policies in the Novell Identity Manager metadirectory engine. DirXML Script describes a <policy> that is implemented by an ordered set of <rule>'s. A <rule> consists of a set of <conditions> to be tested and an ordered set of <actions> to be performed when the <conditions> are met.

Changelog

• Changes in 4.0.2
  • Added <do-add-resource> and <do-remove-resource>
• Changes in 4.0.1.1
  • Changed <token-unique-name> to allow searching of all objects for unique name construction.
  • Updated description for changing and available operators of <if-op-attr>.
• Changes in 3.6
  • Added <do-add-role> and <do-remove-role>
  • Changed <do-send-email-from-template> to allow sending html content from policy.
  • Made attribute policy-dn optional for <token-generate-password>.
  • Changed <do-find-matching-object> to set a local variable if they encounter an error and provide additional information in the server log.
  • Added offset, offset-unit attribute to <token-convert-time>.
  • Added optional default-value attribute to <token-map>.
• Changes in 3.5.1
  • Changed <do-set-src-password> and <do-set-dest-password> to support specifying old-password.
  • Support passing :InitiatorOverrideDN and :CorrelationID named parameters into <do-start-workflow>.
  • Added class-name attribute to <do-delete-dest-object>, <do-delete-src-object>, <do-move-dest-object>, <do-move-src-object>, <do-rename-dest-object>, <do-rename-src-object>, <do-set-dest-password>, <do-set-src-password>. Note that the attribute has actually been implemented in the DirXML Script processor since the initial release of IDM 2.0, but was missing from the DTD, documentation, and Policy Builder.
  • Support variable expansion of id attribute of <do-generate-event>.
  • Changed the behavior of <if-local-variable> for variables of type node-set to be more consistent with how other conditions with multiple values behave.
• Changes in 3.5
  • Added description of variables and table of predefined variables.
  • Added support for variable expansion.
  • Added built-in local variable current-op.
  • Added support for implicitly defined namespaces.
  • Added notrace attribute to <rule>, <and>, <or>, <if-*>, <do-*>, and <token-*>.
  • Added operators equal and not-equal to <if-password>.
  • Added mode attribute to <if-association>, <if-operation>, <if-password>.
  • Added operators lt, not-lt, gt, not-gt to <if-association>, <if-attr>, <if-class-name>, <if-dest-attr>, <if-entitlement>, <if-global-variable>, <if-local-variable>, <if-operation>, <if-op-attr>, <if-op-property>, <if-password>, and <if-src-attr>.
  • Added <if-xml-attr>.
  • Added <arg-conditions>.
  • Added <arg-password>.
  • Updated <arg-actions> to reflect that it is now used by more than just <do-for-each>.
  • Added <do-if>.
  • Added <do-while>.
  • Added <do-start-workflow>.
  • Added optional before attribute to <do-append-xml-element>, <do-append-xml-text>, and <do-clone-xpath>.
  • Added scope attribute to <do-set-local-variable> and updated descriptions of <if-local-variable> and <token-local-variable> to support the idea of scope.
  • Changed <do-set-src-password> and <do-set-dest-password> to support specifying a target object.
  • Changed <do-for-each> to support <query-ex> paged result sets.
  • Changed <do-send-email> and <do-send-email-from-template> to use <arg-password>, and deprecate the password attribute on same.
  • Changed <do-send-email> and <do-send-email-from-template> and <do-start-workflow> to set a local variable if they encounter an error.
  • Changed <do-send-email> and <do-send-email-from-template> to allow comma separated lists of recipients in the "to", "cc", and "bcc" fields.
  • Chagned to <do-send-email> and <do-send-email-from-template> to support custom SMTP headers.
  • Added <token-base64-decode>.
  • Added <token-base64-encode>.
  • Added <token-char>.
  • Added <token-time> and <token-convert-time>.
  • Added <token-document>.
  • Added <token-split> and <token-join>.
  • Added <token-map>.
  • Added <token-query>.
  • Added <token-resolve>.
  • Added <token-xml-parse> and <token-xml-serialize>.
  • Added <token-generate-password>.
  • Added counter-use, counter-pattern, and on-unavailable attributes to <token-unique-name>.
  • Changed descriptions of tokens saying "If its parent element is <arg-node-set>..." to "If this token is evaluated in a context where a node-set result is expected ..." to account for the fact that some verb tokens now expect node-set content.
  • Simplified the description of many tokens to get rid of the overly verbose "concatenation of the expansion of the the enclosed tokens."
• Changes in 3.0.1
• • Added <do-set-sso-credential>, <do-clear-sso-credential>, and <do-set-sso-passphrase>.
• Changes in 3.0
  • Added <do-implement-entitlement>. Updated <do-for-each> to include implied <do-implement-entitlement>.
  • Updated <token-entitlement>, <token-added-entitlement>, and <token-removed-entitlement> to return <entitlement-impl> in a node-set context and to change behavior relative to granted vs. revoked entitlements.
  • Updated <if-entitlement> to change behavior relative to granted vs. revoked entitlements.
  • Replaced all usages of nodeset to node-set to make terminology consistent.
  • Updated <comment> to add support for multiple comments and comment names.
• Changes in 2.0.1
  • Added special handing for fatal and retry status levels to <do-status>.
  • Added disabled attribute to <rule>, <and>, <or>, <if-*>, and <do-*>.
  • Allow <do-for-each> as content to <arg-actions>. This effectively removes the restriction disallowing nesting of <do-for-each>.
  • Allow <do-generate-event>, <do-send-email>, and <do-send-email-from-template> as content to <arg-actions>. This corrects their inadvertant omission in the original spec.
  • Changed description of <do-status> to clarify the event-id of the reported status.
  • Added <do-clone-xpath>.
  • Added <token-parse-dn>.
  • Added <if-named-password> and <token-named-password>.
  • Added <do-trace-message>.
  • Added <if-op-property>, <do-set-op-property>, <do-clear-op-property>, and <token-op-property>.
  • Added encoding to list of tags for <do-send-email> and <do-send-email-from-template>.
  • Added counter-pad attribute to <token-unique-name>.
  • Added when attribute and deprecated direct attribute for all actions that cause changes to the destination datastore.
  • Added <comment>.
  • Added <include>.