↓ Skip to main content
Belkast
Belkast

Role Matrix

·
Belkast Code
Table of Contents

Belkast Consulting has developed Rhino JavaScript (Mozilla JavaScript engine) script designed to generate, process, and export a Role Matrix for the OpenText Identity and Access Management (IAM) system. It interacts with LDAP directories, Active Directory (AD), Okta, AWS, and other platforms to:

  1. Query and aggregate role data from multiple sources.
  2. Enrich role information with members, approvers, categories, platforms, and resources.
  3. Generate structured XML/JSON outputs for role matrices.
  4. Support cleanup, zipping, and email notifications for generated reports.

Key Features

1. Core Functionalities

Feature Description
Role Matrix Generation Creates a hierarchical XML/JSON structure of roles, permission roles, and associated resources.
LDAP Querying Connects to LDAP servers (with TLS support) to fetch role, user, and group data.
Multi-Source Integration Supports Active Directory (AD), Okta, AWS, and Platform Sets.
Data Enrichment Injects members, approvers, categories, assignment dates, and platform details into the role matrix.
Cleanup & Archiving Compresses (ZIP) and deletes old log files (--cleanup mode).
Email Notifications Sends success/failure emails with attachments (ZIP or raw files).
Debug Logging Extensive logging to debug.log for troubleshooting.

2. Input/Output

Type Format Description
Input JSON/XML/LDAP Configuration files (servers/), LDAP queries.
Output XML/JSON/ZIP Role Matrix (_role_matrix.xml or .json), debug logs, and optional ZIP archives.

3. Available Arguments

Core Options

Argument Type Default Description
--help Flag - Display help information.
--config Path ./servers/ Directory containing server configuration files.
--regex Regex ^.+$ Filter for configuration files.
--data-dir Path <timestamp> Directory for input/output files.
--matrix Boolean true Generate the Role Matrix.
--refresh Boolean false Refresh input data files from LDAP.
--output String _role_matrix.xml Suffix for the output file.

Query Filters

Argument Type Default Description
--query-name String - Generate matrix for a specific role (supports wildcards *).
--query-member String - Generate matrix for roles assigned to a specific user.
--query-approver String - Generate matrix for roles with a specific approver.
--query-category String - Generate matrix for roles in a specific category.
--query-inactive Boolean false Export only roles with inactive members.

Data Enrichment

Argument Type Default Description
--level20 Boolean true Include I.T. Roles (Level 20).
--level30 Boolean true Include Business Roles (Level 30).
--members Boolean false Inject role member information.
--approvers Boolean false Inject role approver information.
--role-date Boolean false Inject role assignment dates.
--categories Path - Path to category metadata file (e.g., category_meta.txt).
--ad Boolean false Inject Active Directory (AD) group information.
--sets Boolean false Inject Platform Set information.
--okta Boolean false Inject Okta App information.
--aws Boolean false Inject AWS account information.
--aws-acct-url URL - URL to fetch AWS account details (JSON).

Output Formatting

Argument Type Default Description
--json Boolean false Convert XML output to JSON.
--zip Boolean false Compress output into a ZIP file (password: yyyy.MM.dd).
--email Email(s) - Send email notification on success (comma-separated).
--email-matrix Boolean false Attach the unzipped Role Matrix to the email.
--error-email Email(s) - Send email notification on fatal errors.