# AssignmentType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Generic assignments of one object to another object. This will usually be assignment of a role to a user, assignment of an organizational unit, team or whatever. It may also be used to assign role to another role, creating a role hierarchy. Assignment is an abstract concept. It can be anything that gives the "receptor" object additional access rights, privileges, capabilities or similar ability or right. But it may also constraint the object with policy, e.g. to implement separation of duties. Roles, organizations and privileges in IDM system are examples of assignments. The assignment may target either existing IDM object (such as a role) or abstract resource account that may or may not exist. In case of resource objects it is constrained to accounts, as accounts are the only resource objects that can be assigned to a user. Other resource objects (entitlements) can be assigned to accounts, but not to users. TODO: constraints

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
description | property string | [0,1] |
subtype | property string | [0,-1] | Type of the assignment.
extension | container ExtensionType | [0,1] | The assignment extension used to add parameters to the assignment.
lifecycleState | property string | [0,1] | Lifecycle state of the assignment.
metadata | container MetadataType | [0,1] | Meta-data about data creation, modification, etc.
targetRef | reference ObjectReferenceType | [0,1] | Target of assignment or inducement.
construction | container ConstructionType | [0,1] | Projection construction.
personaConstruction | container PersonaConstructionType | [0,1] | Persona construction.
focusMappings | container MappingsType | [0,1] | Set of mappings that are applied to a focus in addition to object template.
policyRule | container PolicyRuleType | [0,1] | Policy rule that should be applied to the target object.
activation | container ActivationType | [0,1] | Type that defines activation properties.
order | property int | [0,1] | Order of the inducement.
orderConstraint | container OrderConstraintsType | [0,-1] | Constraint that defines the range of "orders" and relations when this assignment/inducement should be applied.
limitTargetContent | container AssignmentSelectorType | [0,1] | Limitations that selects only some assignments/inducements from the target.
limitOtherPrivileges | container OtherPrivilegesLimitationType | [0,1] | Limitations related to other privileges, like the ability to complete work items.
focusType | property QName | [0,1] | Type of focal object that this assignment/inducement applies to.
tenantRef | reference ObjectReferenceType | [0,1] | Reference to the tenant which this assignment is associated with.
orgRef | reference ObjectReferenceType | [0,1] | Reference to the organization (org.
condition | container MappingType | [0,1] | The assignment is applied only if the condition is evaluated to true.
policySituation | property anyURI | [0,-1] | The policy situation(s) of this assignment.
triggeredPolicyRule | property EvaluatedPolicyRuleType | [0,-1] | Triggered policy rules for this assignment.
policyException | container PolicyExceptionType | [0,-1] | Recorded exception from a policy rule.
assignmentRelation | container AssignmentRelationType | [0,-1] | Specifies what types of assignments can be made to the focal object when it is a target of an assignment.

- ### Items

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

  - #### subtype

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Type of the assignment. It is used to describe the assignment e.g. from the point of view of its origin or purpose. A typical use could be marking assignments created by a given inbound mapping in order to efficiently delineate the mapping's range.

  - #### extension

    Flags: dyn,RAM,runtime

    Multiplicity: [0,1]

    The assignment extension used to add parameters to the assignment.

  - #### lifecycleState

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Lifecycle state of the assignment. This property defines whether the assignment represents a draft, proposed definition, whether it is active, deprecated, and so on.

    There are few pre-defined lifecycle states. But custom lifecycle states may also be defined. Pre-defined lifecycle states are:

    - draft: Definition of the assignment in progress. The assignment is NOT active. The definition may change at any moment. It is not ready yet.
    - proposed: Definition of a new assignment is ready for use, but there is still a review process to be applied (e.g. approval). The assignment is NOT active. However the definition should not change in this state. This is the state applied to requested and not yet approved assignments.
    - active: Active and working definition.
    - deprecated: Active definition which is being phased out. The definition is still fully operational. But it should be replaced by a new assignment.
    - archived: Inactive historical definition. It is no longer used. It is maintained only for historical, auditing and sentimental reasons.
    - failed: Unexpected error has occurred during assignment lifecycle. Result of that event is that the assignment is rendered inactive. The situation cannot be automatically remedied. Manual action is needed.

  - #### metadata

    Flags: RAM,runtime,oper

    Multiplicity: [0,1]

    Meta-data about data creation, modification, etc. It may apply to objects but also parts of the object (e.g. assignments).

    Meta-data only apply to successful operations. That is obvious for create, but it also applies to modify. For obvious reasons there are no metadata about delete. We keep no metadata about reading. That would be a huge performance hit.

    Meta-data only describe the last operation of its kind. E.g. there is a record of last modification, last approval, etc. There is no history. The last operation overwrites data about the previous operation.

    These data are informational only. They should not be used for security purposes (use auditing subsystem for that). But presence of metadata simplifies system administration and may provide some basic information "at the glance" which may be later confirmed by the audit logs.

    Meta-data are also supposed to be searchable. Therefore they may be used to quickly find "candidate" objects for a closer examination.

  - #### targetRef

    Flags: RAM

    Multiplicity: [0,1]

    Target of assignment or inducement. This is the user, role, org or service that is assigned.

  - #### construction

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Projection construction. This structure defines how a projection (e.g. account) should be constructed.

  - #### personaConstruction

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Persona construction. This structure defines how a persona (e.g. virtual identity) should be constructed.

  - #### focusMappings

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Set of mappings that are applied to a focus in addition to object template.

  - #### policyRule

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Policy rule that should be applied to the target object.

  - #### activation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Type that defines activation properties. Determines whether something is active (and working) or inactive (e.g. disabled).

    It applies to several object types. It may apply to user, account, assignment, etc. The data in this type define if the described concept is active, from when it is active and until when. The "active" means that it works. If something is not active, it should not work or not cause any effect. E.g. inactive user should not be able to log in or run any tasks, the non-active role should not be assigned and if assigned it should not be taken into account when computing the accounts.

  - #### order

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Order of the inducement. Simply speaking order specifies the number of assignments that the evaluation must traverse to apply the inducement. The high-order inducements are used in meta-roles. These high-order inducements apply to the object that is assigned to the role instead of meta-role. This property specifies the summary order. This is a sum of all the (non-delegation) assignments along the assignment path. More precise control over the order can be achieved by using the orderConstraints. If not specified and no orderConstraints are specified then the values of 1 is assumed.

  - #### orderConstraint

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Constraint that defines the range of "orders" and relations when this assignment/inducement should be applied.

  - #### limitTargetContent

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Limitations that selects only some assignments/inducements from the target. It may be used to incorporate only a part of the subrole in the role hierarchy. But it is most frequently used to limit the scope of a delegation to the deputy. It not specified, no limitations of this kind take place.

  - #### limitOtherPrivileges

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Limitations related to other privileges, like the ability to complete work items. If not specified, no limitations of this kind take place.

  - #### focusType

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Type of focal object that this assignment/inducement applies to. E.g UserType, RoleType, OrgType, ...

  - #### tenantRef

    Flags: RAM

    Multiplicity: [0,1]

    Reference to the tenant which this assignment is associated with. This is an argument to the target of this assignment. E.g. is if frequently used to parametrize the role which is assigned by this assignment. However the exact interpretation of this value depends on the logic of the target role. It may be significant or it may be entirely ignored.

  - #### orgRef

    Flags: RAM

    Multiplicity: [0,1]

    Reference to the organization (org. unit, project, ...) which this assignment is associated with. This is an argument to the target of this assignment. E.g. is if frequently used to parametrize the role which is assigned by this assignment. However the exact interpretation of this value depends on the logic of the target role. It may be significant or it may be entirely ignored.

  - #### condition

    Flags: RAM,runtime

    Multiplicity: [0,1]

    The assignment is applied only if the condition is evaluated to true. If condition is not present, it is assumed to be true.

  - #### policySituation

    Flags: RAM,runtime,oper

    Multiplicity: [0,-1]

    The policy situation(s) of this assignment. The situations are result of evaluation of the policy rules. This property is recorded for each assignment and can be used for reporting, diagnostics, target selection in certification campaigns, etc.

  - #### triggeredPolicyRule

    Flags: RAM,runtime,oper

    Multiplicity: [0,-1]

    Triggered policy rules for this assignment. (Not necessarily complete; subject to specified storage strategy.) This is EXPERIMENTAL functionality. It is possibly to change in the near future.

  - #### policyException

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Recorded exception from a policy rule. The exceptions that are approved are recoded here to avoid re-evaluating and re-approving them all the time. This is EXPERIMENTAL functionality. It is likely to change in the near future.

  - #### assignmentRelation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Specifies what types of assignments can be made to the focal object when it is a target of an assignment. This specifies possible relations of the assignment, type of assignment holder and so on. Simply speaking, this specifies "who can have assignment to me" or "who can hold assignment with me as a target". Limitations: assignmentRelation can appear only in archetype. It can appear in assignment or inducements, but it must not have any order specification (i.e. it must be order 0 or 1).