Novell IDENTITY MANAGER 3.6.1 - ENTITLEMENTS User manual

Novell®
www.novell.com
novdocx (en) 13 May 2009
AUTHORIZED DOCUMENTATION
Identity Manager 3.6.1 Entitlements Guide
Identity Manager
3.6.1
June 05, 2009
Entitlements Guide

novdocx (en) 13 May 2009
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities
on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export
laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.
See the Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information
on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export
approvals.
Copyright © 2008-2009 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009

Contents 5
Contents
novdocx (en) 13 May 2009
About This Guide 7
1 Entitlements Overview 9
1.1 How Entitlements Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.2 Why Use Entitlements? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.3 Drivers with Preconfigured Entitlements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
2 Checklist for Implementing Entitlements 13
3 Enabling Entitlements on a Driver 15
3.1 Using Designer to Enable Entitlements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
3.2 Using iManager to Enable Entitlements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
4 Creating Entitlements 17
4.1 Sample Entitlements for the Active Directory Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.2 Creating Entitlements in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
4.2.1 Administrator-Defined Entitlements with Value Lists . . . . . . . . . . . . . . . . . . . . . . . . . 19
4.2.2 Administrator-Defined Entitlements without Value Lists . . . . . . . . . . . . . . . . . . . . . . 20
4.2.3 Valued Entitlement that Queries an External Application . . . . . . . . . . . . . . . . . . . . . 21
4.3 Creating Entitlements in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
5 Creating Policies to Support Entitlements 27
6 Editing Entitlements 29
6.1 Editing Entitlements in Designer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
6.1.1 Using the Entitlement Editor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
6.1.2 Using the XML Source and XML Tree Views . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
6.2 Editing Entitlements in iManager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
A Writing Entitlements in XML 35
A.1 Novell Entitlement Document Type Definition (DTD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
A.1.1 Explaining the Entitlement DTD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
A.1.2 Other Headings in the DTD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
A.2 Examples to Help You Write Your Own Entitlements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
A.2.1 Example 1: Account Entitlement: Valueless . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
A.2.2 Example 2: Application Query Entitlement: External Query . . . . . . . . . . . . . . . . . . . 40
A.2.3 Example 3: Administrator-Defined Entitlement: With Lists. . . . . . . . . . . . . . . . . . . . . 43
A.2.4 Example 4: Administrator-Defined Entitlements: Without Lists . . . . . . . . . . . . . . . . . 43

6Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009

About This Guide 7
novdocx (en) 13 May 2009
About This Guide
The guide explains how to create and use entitlements as part of your Identity Manager solution.
Chapter 1, “Entitlements Overview,” on page 9
Chapter 2, “Checklist for Implementing Entitlements,” on page 13
Chapter 3, “Enabling Entitlements on a Driver,” on page 15
Chapter 4, “Creating Entitlements,” on page 17
Chapter 5, “Creating Policies to Support Entitlements,” on page 27
Appendix A, “Writing Entitlements in XML,” on page 35
Audience
This guide is intended for Identity Manager administrators, partners, and consultants.
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of the Entitlements Guide, visit the Identity Manager Documentation
Web site (http://www.novell.com/documentation/idm36/).
Additional Documentation
For additional Identity Manager 3.6 documentation, see the Identity Manager Documentation Web
site (http://www.novell.com/documentation/idm36/).
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

8Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009

Entitlements Overview
1
9
novdocx (en) 13 May 2009
1
Entitlements Overview
Novell®Identity Manager uses entitlements as a way for you to provide users with access to
resources in connected systems.
You can think of an entitlement as a permission slip. For example, if you want a new employee to be
given an Active Directory* account when he or she is added to your Human Resource system, the
user must have a permission slip, or entitlement, for the Active Directory account. If the user doesn’t
have the permission slip, he or she doesn’t receive the account.
The following sections explain how entitlements work and how they make administration of your
Identity Manager system more efficient.
Section 1.1, “How Entitlements Work,” on page 9
Section 1.2, “Why Use Entitlements?,” on page 10
Section 1.3, “Drivers with Preconfigured Entitlements,” on page 11
1.1 How Entitlements Work
The following diagram shows the basic entitlement process.
Figure 1-1 Overview of Entitlements
1. An entitlement agent grants an entitlement to a user. There are three ways that entitlements are
granted to a user:
Role-Based Entitlements: The Entitlements Service driver grants the entitlement based
on criteria that place the user in a particular role (or group). The criteria can be based on
any event that occurs in the Identity Vault. For example, adding a new employee in an HR
system causes a User object to be created in the Identity Vault. Creation of the new User
object is the criterion that causes the Entitlements Service driver to grant the Active
Directory User Account entitlement to the user.
User Application Roles Based Provisioning: The user receives a role assignment
through the User Application. The User Application’s Role Service driver grants the user
any entitlements associated with the new role. For example, a user is assigned an

10 Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009
Accountant role that requires access to the Accounting group in Active Directory. The
Role Service driver grants the Active Directory Group Membership entitlement to the
user.
User Application Workflow-Based Provisioning: A provisioning workflow grants the
entitlement to the user. For example, a new employee is added to the HR system, which
causes a User object to be created in the Identity Vault. Creation of the new User object
initiates a workflow that grants the Active Directory User Account entitlement to the user.
2. When an entitlement is added to or removed from a user’s DirXML-EntitlementRef attribute,
any entitlement-enabled drivers begin to process the event. Only drivers that have the DirXML-
EntitlementRef attribute added to their Subscriber channel filter can monitor users for
entitlement changes.
3. The driver processes the entitlement event against the Subscriber channel policies. If the
entitlement event is for an entitlement that applies to the driver, the policies are processed.
Otherwise, no processing occurs. In the diagram above, the Grant User Account policy is
processed because 1) the Active Directory User Account entitlement was added to the user’s
DirXML-EntitlementRef attribute and 2) the User Account entitlement is defined on the Active
Directory driver. If the Active Directory User Account entitlement is later removed from the
user’s DirXML-EntitlementRef attribute, the Revoke User Account policy is processed.
4. The policies trigger the granting or revoking of access to the entitled resource. In the diagram
above, the Grant User Account policy triggers the creation of a user account in Active
Directory.
1.2 Why Use Entitlements?
Both roles-based provisioning and workflow-based provisioning require the use of entitlements. If
you use either of these User Application provisioning methods, you must use entitlements.
If you are not using the User Application for roles-based or workflow-based provisioning, you might
still want to use Role-Based Entitlements (RBEs) through the Entitlements Service driver. Using
Role-Based Entitlements enables you to remove the business logic, or decision-making, from your
driver policies. In the example used in Section 1.1, “How Entitlements Work,” on page 9, the Active
Directory driver policies include only the information required to grant or revoke an Active
Directory user account. The decision about whether or not a user receives an Active Directory user
account is handled through the entitlement agent, not the driver policies. In this case, the entitlement
agent is the Entitlements Service driver.
Removing the business logic from drivers provides several benefits:
If you have multiple drivers that are the same (for example, multiple Active Directory drivers)
and your business logic changes, you don’t have to change the logic in each driver. The logic
only needs to change in the entitlement agent.
You can use any of the three entitlement agents to grant an entitlement to a user. You can even
use all three entitlement agents together. However, you should have only one entitlement agent
handle an entitlement for a given user. For example, you could have an Active Directory User
Account entitlement granted to a user by the Entitlement driver and a Linux User Account
entitlement granted to the same user through the User Application’s Role Service driver.
However, you should not have the same entitlement (for example, the Active Directory User
Account) managed by both the Entitlement driver and the User Application’s Role Service
driver. Doing so can cause unintended granting and revoking of the entitlement.

Entitlements Overview 11
novdocx (en) 13 May 2009
1.3 Drivers with Preconfigured Entitlements
The following drivers include configuration files that already contain entitlements and the policies
required to implement them. These entitlements support the most common scenarios, including
granting and revoking user accounts, groups, and e-mail distribution lists.
Active Directory: Grant and revoke accounts, group membership, Exchange Mailbox
GroupWise®: Grant and revoke accounts, grant and revoke members of distribution lists
LDAP: Grant and revoke user accounts and group memberships
Linux and UNIX: Grant and revoke accounts
Lotus* Notes*: Grant and revoke user accounts and group memberships
RACF*: Grant and revoke group accounts and group memberships
These are example entitlements and policies that you can use if they meet your needs. If not, you can
modify them to meet your needs, or you can use them as examples as you implement additional
entitlements.

12 Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009

Checklist for Implementing Entitlements
2
13
novdocx (en) 13 May 2009
2
Checklist for Implementing
Entitlements
Use the following checklist to ensure that you complete all of the tasks required to implement
entitlements for an Identity Manager driver. The tasks are listed in the recommended order of
completion, but you can change the completion order if necessary.
Table 2-1 Entitlements Checklist
Details
Enable the driver to
support entitlements
The driver must be configured to listen for entitlement events. You enable
the driver by modifying the driver filter to add the DirXML-EntitlementRef
attribute to the User class.
The following drivers are already enabled for entitlements. You do not
need to complete this task for these drivers:
Active Directory
GroupWise®
LDAP
Linux and UNIX
Lotus Notes
RACF
For enablement instructions, see Chapter 3, “Enabling Entitlements on a
Driver,” on page 15.
Create entitlements Entitlements represent resources in connected systems. When creating an
entitlement, you create it on the driver that is associated with the
connected system where the entitlement’s resource is located.
For instructions, see Chapter 4, “Creating Entitlements,” on page 17.
Create policies to
support the
entitlements
Entitlements are implemented by adding new driver policies or modifying
existing policies.
For instructions, see Chapter 5, “Creating Policies to Support
Entitlements,” on page 27.

14 Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009
Set up an entitlement
agent to manage the
entitlements
The entitlement agent is responsible for granting or revoking entitlements
for users. You can use any of the following entitlement agents:
Entitlements Service Driver: Manages entitlements based on
events that occur in the Identity Vault. For instructions, see the
Identity Manager 3.6 Driver for Role-Based Entitlements:
Implementation Guide (http://www.novell.com/documentation/
idm36drivers/entitlements/data/bktitle.html).
User Application Roles-Based Provisioning: Manages
entitlements based on roles that are assigned to users. For
instructions, see the Identity Manager Roles Based Provisioning
Module 3.6.1 documentation (http://www.novell.com/documentation/
idmrbpm361/).
User Application Workflow-Based Provisioning: Manages
entitlements through provisioning workflows. For instructions, see the
Identity Manager Roles Based Provisioning Module 3.6.1
documentation (http://www.novell.com/documentation/idmrbpm361).
Details

Enabling Entitlements on a Driver
3
15
novdocx (en) 13 May 2009
3
Enabling Entitlements on a Driver
A driver must be enabled in order to use entitlements. You enable a driver by modifying the driver
filter to add the DirXML-EntitlementRef attribute to the User class. Refer to the following sections
for instructions:
Section 3.1, “Using Designer to Enable Entitlements,” on page 15
Section 3.2, “Using iManager to Enable Entitlements,” on page 15
The following drivers are already enabled for entitlements. You do not need to manually enable
these drivers:
Active Directory
GroupWise®
LDAP
Linux and Unix
Lotus Notes
RACF
3.1 Using Designer to Enable Entitlements
Designer is the recommended tool for creating entitlements (see Section 4.2, “Creating Entitlements
in Designer,” on page 17). During the entitlement creation process in Designer, you are given the
opportunity to have Designer automatically enable the driver to support entitlements. You should do
so at that time.
3.2 Using iManager to Enable Entitlements
1In iManager, click to display the Identity Manager Administration page.
2In the Administration list, > click Identity Manager Overview.
3If the driver set is not listed on the Driver Sets tab, use the Search In field to search for and
display the driver set.
4Click the driver set to open the Driver Set Overview page.
5Click the driver to display the Driver Overview page.

16 Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009
6On the Driver Overview page, click the Driver Filter icon for the Subsciber channel. By
default, Organizational Unit is highlighted.
7Click User and select Add Attribute, then scroll to the bottom and select Show all attributes.
8Select the DirXML-EntitlementRef attribute, then click OK.
9Select DirXML-EntitlementRef in the Filter page, then under the Subscribe heading, select
Notify.
10 Click OK to save the changes.
This process is performed automatically when you create entitlements through Designer on a
driver.

Creating Entitlements
4
17
novdocx (en) 13 May 2009
4
Creating Entitlements
Because entitlements represent resources in a connected system, each entitlement must be created on
the driver associated with the connected system. For example, to create an entitlement for an Active
Directory User Account, you would create it on the Active Directory driver that connects to the
directory where you want the account created.
The following sections provide instructions for creating entitlements in Designer and iManager.
Although you can use either tool to create entitlements, we strongly recommend that you use
Designer. Designer includes an Entitlement Wizard that creates the entitlement XML from the
information you provide in the wizard. iManager does not include this wizard; instead, you must
write the XML required for the entitlement.
Section 4.1, “Sample Entitlements for the Active Directory Driver,” on page 17
Section 4.2, “Creating Entitlements in Designer,” on page 17
Section 4.3, “Creating Entitlements in iManager,” on page 24
4.1 Sample Entitlements for the Active Directory
Driver
By default, the Active Directory driver includes the entitlements listed below. You can use these
entitlements as examples of the types of entitlements you might want to create for other drivers.
User Account Entitlement: Grants or revokes an account in Active Directory for the user.
When the account is granted, the user is given an enabled logon account. When the account is
revoked, the logon account is either disabled or deleted, depending on how the driver is
configured.
Group Membership Entitlement: Grants or revokes membership in a group in Active
Directory. When membership is revoked, the user is removed from the group. The group
membership entitlement is not enforced on the Publisher channel; if a user is added to a
controlled group in Active Directory by some external tool, the user is not removed by the
driver. Further, if the entitlement is removed from the user object instead of being simply
revoked, the Active Directory driver takes no action.
Exchange Mailbox Entitlement: Grants or revokes an Exchange mailbox for the user in
Microsoft Exchange.
4.2 Creating Entitlements in Designer
Designer is the recommended tool for creating entitlements.
Designer provides an Entitlement Wizard that steps you through the creation of entitlements. The
wizard creates the entitlement XML from the information you provide. In iManager, you must
manually create the entitlement XML (see Section 4.3, “Creating Entitlements in iManager,” on
page 24)
1In the Modeler view for your Designer project, right-click the driver icon , then click New >
Entitlement to launch the Entitlement Wizard.
2Fill in the following fields:

18 Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009
Name: Specify the name you want used for the entitlement. This is the name used for the
entitlement object in the Identity Vault, and the name that is seen in both Designer and
iManager.
Display Name: By default, the entitlement agents that consume the entitlements use the name
specified in the Name field. If you want to specify a different name for the entitlement agent to
use, deselect the Use this name for the display name box, then enter a name in the Display
Name field.
For example, the GroupWise driver’s default configuration file includes a predefined
GroupWise account entitlement. The entitlement’s name is gwAccount and its display name is
GroupWise User Account.
Description: Specify any information you want to use to describe the entitlement. This field is
optional.
3Click Next to display the Set Entitlement Values dialog box.
There are two types of entitlements that you can create. Valued entitlements contain values that
are passed to the driver policy that enforces the entitlement. Valueless entitlements do not
contain any values to pass.
4Select No if the entitlement does not need to include values, then click Finish. If the Add to
Filter dialog box is displayed, select Yes, then click OK to enable the entitlement for the driver.
Skip the remaining steps in this section.
or
Select Yes if the entitlement needs to include values, click Next, then continue with the next
step.
There are two types of values that you can use with valued entitlements.
Administrator-defined values are defined by you or another administrator. You can define a
specific list of values from which the entitlement consumer must select, or you can designate a
free-form value that the entitlement consumer defines.
Application Query values are supplied by the application to which the driver is connected. For
example, the GroupWise driver’s default configuration includes a predefined GroupWise
Distribution List entitlement that enables users to be added to GroupWise distribution lists. The
available distribution lists are discovered through a query of the GroupWise system.
5Select Administrator-defined values if the valued entitlement requires values that you will
define, click Next, then skip to Section 4.2.1, “Administrator-Defined Entitlements with Value
Lists,” on page 19 or Section 4.2.2, “Administrator-Defined Entitlements without Value Lists,”
on page 20.
or
Select Values from an application query if the valued entitlement requires values that must be
discovered by querying the connected application, click Next, the skip to Section 4.2.3,
“Valued Entitlement that Queries an External Application,” on page 21.

Creating Entitlements 19
novdocx (en) 13 May 2009
4.2.1 Administrator-Defined Entitlements with Value Lists
The example in the following procedure is an administrator-defined entitlement that allows you to
select a listed entry. This type of entitlement is best used through Workflow entitlements rather than
Role-Based Entitlements.
1Make sure you’ve completed Step 1 through Step 5 on page 18. The following steps start where
those steps ended.
2In the Define Values dialog box, make sure that Yes is selected.
3In the Entitlement Value field, type the value you want to add to the list, then click Add. Repeat
this step for each value you want to add to the list, then click Next.
In this example, the values are corporate buildings: Building A through Building D. Through
an entitlement client, such as an iManager Role-Based Entitlement task or through the user
application, users or defined-task managers can specify the building information, which is then
included in an external application, such as Novell eDirectory.
4In the Assign Multiple Values dialog box, select Yes if you want the entitlements to be able to
be granted to a user more than once and with different values, then click Next.
or
Select No if the entitlement can only be granted once, then click Next.
For example, you might only want to use an entitlement one time to assign a building location
to a user. However, because a user could belong to multiple groups, you might want an
entitlement that assigns a user to a group to be able to be used multiple times to assign the user
to multiple groups.

20 Identity Manager 3.6.1 Entitlements Guide
novdocx (en) 13 May 2009
5You are asked if this entitlement is intended to be used by Role-Based Entitlement policies
through iManager. If you want this entitlement to be granted or revoked automatically, select
Yes to the Role-Based Entitlements question, click Next, then continue with Step 6.
or
If you want the granting or revoking of this entitlement to be a manual process (approved by
someone), select No to use the User Application, then skip to Step 7.
6(Conditional) If you selected Yes to the Role-Based Entitlements question, you are asked if you
want to use the Role-Based Entitlements priority to resolve any conflicts that might happen
when this entitlement is assigned by different Role-Based Entitlement Policies with different
values. You can resolve the conflict by either using the Role-Based Entitlements priority, or by
merging the values.
Merging the values merges the entitlements of all involved Role-Based Entitlement policies, so
if one policy revokes an entitlement but another policy grants an entitlement, the entitlement is
eventually granted. Solving conflicts by priority works if you need to ensure that only one
policy is applied to this entitlement at any time.
7Click Finish.
8If you see the Add To Filter dialog box, answer Yes if you want the driver to listen for this
entitlement. This enables entitlements for the driver. The DirXML-EntitlementRef attribute
allows the driver filter to listen for entitlement activities, which is necessary in order to use the
entitlements you are creating.
or
If you don’t want to see the Add To Filter window on entitlements you are creating for any
driver in Designer, select Remember Selection - Don’t Prompt Again, then click OK. However,
after the attribute is added to this driver filter, you won’t see the Add To Filter window again.
Before you can edit this entitlement, you are asked to save the editor’s changes before continuing.
Once the editor is saved, the entitlement displays in the Modeler view.
4.2.2 Administrator-Defined Entitlements without Value Lists
The example in the following procedure is an administrator-defined entitlement that forces the
administrator to type a value. You can use this kind of entitlement if you do not have all of the
information at the initial setup, so you cannot create a value list.
1Make sure you’ve completed Step 1 through Step 5 on page 18. The following steps start where
those steps ended.
2In the Define Values dialog box, select No to the question “Do you want to define a list of
values?” on the Define Values page, then click Next.
Selecting this option allows the administrator or users to type in a value. Using this option can
be risky however since wrong or misspelled information can cause the value to be incorrect and
the action in the entitlement to fail.
3In the Assign Multiple Values dialog box, select Yes if you want the entitlements to be able to
be granted to a user more than once and with different values, then click Next.
or
Select No if the entitlement can only be granted once, then click Next.