If you enable role assignment synchronization, create a security group for each system-defined role and Data Vault access role that exists in Data Archive. After you create security groups, you can assign the security groups to users and to groups of users. When Data Archive synchronizes users, Data Archive reviews the security groups that are assigned to users and groups. If a security group name matches the technical name of a Data Archive role, then Data Archive assigns the role to the user.

Use the following rules and guidelines when you create security groups in the LDAP directory service:

Create one security group for each Data Archive system-defined role and Data Vault access role.
The name of the LDAP security group for a Data Vault access role must match the unique name of that Data Vault access role.
To get the names of Data Vault access roles, go to Data Archive, click
Administration
Manage Roles
and select the
Access Roles
tab. You will see the list of Data Vault access roles.
The name of the LDAP security group for a system-defined role must match the technical name of that system-defined role.
To get the technical names of system-defined roles, view the
AM_ROLES
table in the ILM repository or see the reference table below.
LDAP security group names are not case sensitive.
LDAP security groups are not managed as groups in Data Archive. You must enter the appropriate value in the
User Filter
field of the
Sync with LDAP Server
job to enable Data Archive to identify individual users in an LDAP security group.