# AssignmentType (Complex Type)

### Namespace: http://midpoint.evolveum.com/xml/ns/public/common/common-3

Generic assignments of one object to another object. This will usually be assignment of a role to a user, assignment of an organizational unit, team or whatever. It may also be used to assign role to another role, creating a role hierarchy. Assignment is an abstract concept. It can be anything that gives the "receptor" object additional access rights, privileges, capabilities or similar ability or right. But it may also constraint the object with policy, e.g. to implement separation of duties. Roles, organizations and privileges in IDM system are examples of assignments. The assignment may target either existing IDM object (such as a role) or abstract resource account that may or may not exist. In case of resource objects it is constrained to accounts, as accounts are the only resource objects that can be assigned to a user. Other resource objects (entitlements) can be assigned to accounts, but not to users. TODO: constraints

Item Summary
Name | Type | Multiplicity | Description
--- | --- | --- | ---
identifier | property string | [0,1] | Identifier of assignment.
description | property string | [0,1] |
documentation | property string | [0,1] |
subtype | property string | [0,-1] | Type of the assignment.
extension | container ExtensionType | [0,1] | The assignment extension used to add parameters to the assignment.
lifecycleState | property string | [0,1] | Lifecycle state of the assignment.
metadata | container MetadataType | [0,1] | Meta-data about data creation, modification, etc.
targetRef | reference ObjectReferenceType | [0,1] | Target of assignment or inducement.
construction | container ConstructionType | [0,1] | Projection construction.
personaConstruction | container PersonaConstructionType | [0,1] | Persona construction.
focusMappings | container MappingsType | [0,1] | Set of mappings that are applied to a focus in addition to object template.
policyRule | container PolicyRuleType | [0,1] | Policy rule that should be applied to the target object.
activation | container ActivationType | [0,1] | Type that defines activation properties.
order | property int | [0,1] | Order of the inducement.
orderConstraint | container OrderConstraintsType | [0,-1] | Constraint that defines the range of "orders" and relations when this assignment/inducement should be applied.
limitTargetContent | container AssignmentSelectorType | [0,1] | Limitations that selects only some assignments/inducements from the target.
limitOtherPrivileges | container OtherPrivilegesLimitationType | [0,1] | Limitations related to other privileges, like the ability to complete work items.
focusType | property QName | [0,1] | Type of focal object that this assignment/inducement applies to.
tenantRef | reference ObjectReferenceType | [0,1] | Reference to the tenant which this assignment is associated with.
orgRef | reference ObjectReferenceType | [0,1] | Reference to the organization (org.
condition | container MappingType | [0,1] | The assignment is applied only if the condition is evaluated to true.
policySituation | property anyURI | [0,-1] | The policy situation(s) of this assignment.
triggeredPolicyRule | property EvaluatedPolicyRuleType | [0,-1] | Triggered policy rules for this assignment.
policyException | container PolicyExceptionType | [0,-1] | Recorded exception from a policy rule.
assignmentRelation | container AssignmentRelationType | [0,-1] | Specifies what types of assignments can be made to the focal object when it is a target of an assignment.
effectiveMarkRef | reference ObjectReferenceType | [0,-1] | Marks assigned to the assignment.

- ### Items

  - #### identifier

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Identifier of assignment. Have to be unique to the object. It is now used for merging.

  - #### description

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

  - #### documentation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

  - #### subtype

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Type of the assignment. It is used to describe the assignment e.g. from the point of view of its origin or purpose. A typical use could be marking assignments created by a given inbound mapping in order to efficiently delineate the mapping's range.

  - #### extension

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    The assignment extension used to add parameters to the assignment.

  - #### lifecycleState

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Lifecycle state of the assignment. This property defines whether the assignment represents a draft, proposed definition, whether it is active, deprecated, archived, and so on. See "Object Lifecycle" in the documentation.

  - #### metadata

    Flags: RAM,runtime,oper

    Multiplicity: [0,1]

    Display order:

    Meta-data about data creation, modification, etc. It may apply to objects but also parts of the object (e.g. assignments).

    Meta-data only apply to successful operations. That is obvious for create, but it also applies to modify. For obvious reasons there are no metadata about delete. We keep no metadata about reading. That would be a huge performance hit.

    Meta-data only describe the last operation of its kind. E.g. there is a record of last modification, last approval, etc. There is no history. The last operation overwrites data about the previous operation.

    These data are informational only. They should not be used for security purposes (use auditing subsystem for that). But presence of metadata simplifies system administration and may provide some basic information "at the glance" which may be later confirmed by the audit logs.

    Meta-data are also supposed to be searchable. Therefore they may be used to quickly find "candidate" objects for a closer examination.

  - #### targetRef

    Flags: RAM

    Multiplicity: [0,1]

    Display order:

    Target of assignment or inducement. This is the user, role, org or service that is assigned.

  - #### construction

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Projection construction. This structure defines how a projection (e.g. account) should be constructed.

  - #### personaConstruction

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Persona construction. This structure defines how a persona (e.g. virtual identity) should be constructed.

  - #### focusMappings

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Set of mappings that are applied to a focus in addition to object template.

  - #### policyRule

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Policy rule that should be applied to the target object.

  - #### activation

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Type that defines activation properties. Determines whether something is active (and working) or inactive (e.g. disabled).

    It applies to several object types. It may apply to user, account, assignment, etc. The data in this type define if the described concept is active, from when it is active and until when. The "active" means that it works. If something is not active, it should not work or not cause any effect. E.g. inactive user should not be able to log in or run any tasks, the non-active role should not be assigned and if assigned it should not be taken into account when computing the accounts.

  - #### order

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Order of the inducement. Simply speaking order specifies the number of assignments that the evaluation must traverse to apply the inducement. The high-order inducements are used in meta-roles. These high-order inducements apply to the object that is assigned to the role instead of meta-role. This property specifies the summary order. This is a sum of all the (non-delegation) assignments along the assignment path. More precise control over the order can be achieved by using the orderConstraints. If not specified and no orderConstraints are specified then the values of 1 is assumed.

  - #### orderConstraint

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Constraint that defines the range of "orders" and relations when this assignment/inducement should be applied. Set of orderConstraint definitions are evaluated together. Each orderConstraint item specifies number (or number range) of assignment path elements with a given relation. Therefore assignment path containing one manager relation and two default relations should be specified by two orderConstraint items. First one specifying relation manager and order 1, the other specifying default relation and order 2 - even though the total "order" of the assignment path is three. This is rather counter-intuitive, but it is current implementation.

  - #### limitTargetContent

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Limitations that selects only some assignments/inducements from the target. It may be used to incorporate only a part of the subrole in the role hierarchy. But it is most frequently used to limit the scope of a delegation to the deputy. If not specified, no limitations of this kind take place.

  - #### limitOtherPrivileges

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Limitations related to other privileges, like the ability to complete work items. If not specified, no limitations of this kind take place.

  - #### focusType

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    Type of focal object that this assignment/inducement applies to. E.g UserType, RoleType, OrgType, ...

  - #### tenantRef

    Flags: RAM

    Multiplicity: [0,1]

    Display order:

    Reference to the tenant which this assignment is associated with. This is an argument to the target of this assignment. E.g. is if frequently used to parametrize the role which is assigned by this assignment. However the exact interpretation of this value depends on the logic of the target role. It may be significant or it may be entirely ignored.

  - #### orgRef

    Flags: RAM

    Multiplicity: [0,1]

    Display order:

    Reference to the organization (org. unit, project, ...) which this assignment is associated with. This is an argument to the target of this assignment. E.g. is if frequently used to parametrize the role which is assigned by this assignment. However the exact interpretation of this value depends on the logic of the target role. It may be significant or it may be entirely ignored.

  - #### condition

    Flags: RAM,runtime

    Multiplicity: [0,1]

    Display order:

    The assignment is applied only if the condition is evaluated to true. If condition is not present, it is assumed to be true.

  - #### policySituation

    Flags: RAM,runtime,oper

    Multiplicity: [0,-1]

    Display order:

    The policy situation(s) of this assignment. The situations are result of evaluation of the policy rules. This property is recorded for each assignment and can be used for reporting, diagnostics, target selection in certification campaigns, etc.

  - #### triggeredPolicyRule

    Flags: RAM,runtime,oper

    Multiplicity: [0,-1]

    Display order:

    Triggered policy rules for this assignment. (Not necessarily complete; subject to specified storage strategy.) This is EXPERIMENTAL functionality. It is possibly to change in the near future.

  - #### policyException

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Recorded exception from a policy rule. The exceptions that are approved are recoded here to avoid re-evaluating and re-approving them all the time. This is EXPERIMENTAL functionality. It is likely to change in the near future.

  - #### assignmentRelation

    Flags: RAM,runtime

    Multiplicity: [0,-1]

    Display order:

    Specifies what types of assignments can be made to the focal object when it is a target of an assignment. This specifies possible relations of the assignment, type of assignment holder and so on. Simply speaking, this specifies "who can have assignment to me" or "who can hold assignment with me as a target". Limitations: assignmentRelation can appear only in archetype. It can appear in assignment or inducements, but it must not have any order specification (i.e. it must be order 0 or 1).

  - #### effectiveMarkRef

    Flags: RAM

    Multiplicity: [0,-1]

    Display order:

    Marks assigned to the assignment. TODO