Navigation Tree

Access certification campaign template definition

Last modified 30 Sep 2026 14:26 UTC

Access certification feature

This page describes configuration of Access certification midPoint feature. Please see the feature page for more details.

Table of Contents

Campaign template definition elements
Campaign definition example

Access certification campaigns are created using templates that are usually called certification campaign definitions, or certification definitions for short.

You can configure campaign templates using midPoint graphical user interface (GUI) in Certification* > *Campaign definitions, as well as using XML. This article describes the underlying concepts and the related XML definition options.

Campaign template definition elements

A certification campaign template definition contains the following elements:

name: The name of the certification campaign definition, e.g. "All user assignments".
description: A more verbose description of the definition, e.g. "Certifies assignments for all users. Everything is certified by the administrator."
handlerUri: Defines the software element (handler) that implements all the processing required by the certification campaigns of the given type.
Currently, there is one bundled handler named http://midpoint.evolveum.com/xml/ns/public/certification/handlers-3#direct-assignment that is able to handle certifications of many types of direct assignments, e.g. user-to-role, user-to-org, role-to-role, etc. However, you can create your own handlers.
scopeDefinition: While the handler provides basic character of the certification (e.g., "we will be dealing with direct assignments"), the scope definition says more precisely which objects (in this case, assignments) are involved. For example, the scope can be limited to user-to-role, only certain users, certain roles, etc.
See campign workflow and terminology for details.
ownerRef: Defines the owner of the definition and the related campaigns. Campaign owner may be different from the owner of the campaign definition.
remediationDefinition: Defines the remediation phase, for example, if it is automated or manual.
reiterationDefinition: Defines the iteration part. For example, if it starts automatically (manual by default), or how many iterations are allowed.
stageDefinition: Defines the individual review stages. One campaign may contain multiple stageDefinition elements, each per stage. It defines, for example, the duration of stages, the reviewer selection process, etc.
reviewStrategy: Defines the strategy used to compute the review outcome for a given case: what happens when no answer is given by reviewers or how to handle conflicting answers from multiple reviewers of one case.
view: Specifies a view for the presentation of the certification items collections which are created on the basis of the current certification definition. This means that every certification campaign created on the basis of this definition will use this view while displaying certification items collection.

Campaign definition example

See an example of a campaign definition ():

<accessCertificationDefinition
        xmlns='http://midpoint.evolveum.com/xml/ns/public/common/common-3'
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <name>All user assignments</name>
    <description>Certifies all users' assignments. Everything is certified by the administrator.</description>
    <handlerUri>http://midpoint.evolveum.com/xml/ns/public/certification/handlers-3#direct-assignment</handlerUri>
    <scopeDefinition xsi:type="AccessCertificationAssignmentReviewScopeType">
        <objectType>UserType</objectType>
    </scopeDefinition>
    <ownerRef oid="00000000-0000-0000-0000-000000000002" type="UserType"><!-- administrator --></ownerRef>
    <remediationDefinition>
        <style>automated</style>
    </remediationDefinition>
    <stageDefinition>
        <number>1</number>
        <name>Administrator's review</name>
        <description>In this stage, the administrator has to review all the assignments of all users.</description>
        <duration>P14D</duration>   <!-- 14 days -->
        <notifyBeforeDeadline>PT48H</notifyBeforeDeadline> <!-- 48 hours -->
        <notifyBeforeDeadline>PT12H</notifyBeforeDeadline>
        <notifyOnlyWhenNoDecision>true</notifyOnlyWhenNoDecision>  <!-- this is the default -->
        <reviewerSpecification>
            <defaultReviewerRef oid="00000000-0000-0000-0000-000000000002" type="UserType" />   <!-- administrator -->
        </reviewerSpecification>
    </stageDefinition>
</accessCertificationDefinition>

This example originates from the samples/certification/def-all-user-assignments.xml file

In the example above, the scope definition is missing. It means that the default values are used, i.e., all assignments of all users are taken into account.

In the example above, there is only one stage.

Aside name and description, a stage definition consists of the following:

number: As lists are generally not ordered in midPoint data structures, each stage has a number that specifies in which order it will be executed. Numbers have to start at 1 and increase consecutively.
duration: This property defines the duration of the stage and influences notifications and automated closure of the stage.
notifyBeforeDeadline: Defines how long before the deadline (given by the stage duration) notifications are to be sent. This is a multi-valued property, so it is possible to specify more than one notification. In the example above, the first notification is sent 48 hours and the second one 12 hours before the deadline.
notifyOnlyWhenNoDecision: If set to true (the default), notifications are sent only to reviewers that have not decided yet.
reviewerSpecification: Defines how reviewers are selected. In our example, everything will be reviewed by the administrator.

Refer to Configuring certification campaign stages for a complete list of options for stage definitions and a more detailed explanation.

Compliance

This feature is related to the following compliance frameworks:

Was this page helpful?

YES NO

Thanks for your feedback