How long does the calculation of dynamic roles take?

Hello Community,

we are using One Identity Manager version 8.1.5

We have a schedule to which about 100 dynamic roles are currently assigned. A request came up to create more dynamic roles that we would need to assign to this schedule.
The question we have is how long does it take to calculate these roles? Is the frequency of 1 hour still sufficient or is it now already critical?
Is there a procedure to determine the calculation time?

Thanks for any hints or ideas

  • Hi,

    Well that really is a 'How long is a piece of string?' question.

    The calculation of dynamic roles will take as long as it takes.  It's up to you to ensure that the SQL used for the condition is efficient and fast.  So if you have bad SQL or a huge dataset it's going to take a long time.

    Of course it's a good idea to keep the number of dynamic roles to a minimum and you might also want to think about if you really need ALL of them to be recalculated ALL of the time.  So you might have some that recalculate hourly on the OOB schedule and you might move some to recalculate every 6/8/24 hours depending on how the contents change and how up to date they need to be.

    HTH, Barry.

    P.S. The answer:  'Twice the distance from the middle to one end.'

  • In addition, with the current versions of OneIM, you are able to fine-tune the direct or scheduled re-calculation on a single dynamic role basis including the definition of changed columns that should trigger the direct re-calculation. So you have way more options to optimize the calculation in a way similar to what Barry has proposed.

  • Thanks for the feedback, Barry and Markus. Even if they are not necessarily as we had hoped.
    In order to be able to better distribute the dynamic roles to the various schedules, the calculation time would be of interest - it is clear that this depends on factors such as the SQL server.

    We will look at new functions of current versions, if we aim for the update to this version - currently we have as written version 8.1.5 in use, so we should focus on this.
    Therefore, we will think about this, and initiate tests ourselves. We had the hope that the community can help us e.g. with tips or SQL commands.

  • I would also suggest looking at your tempdb. I have had previous situations where the tempdb would get full after a dynamic role calculation that had hundreds of dynamic roles.