CODELESS PROVISIONING SYNC RULES

1 . In a computing environment including a resource manager, the resource manager comprising programmatic code for managing resources in an enterprise, a method of managing resources including managing permissions for entities to access the resources, the method comprising

generating a detected rules list, the detected rules list specifying existing permissions for an entity for resources in an enterprise, wherein generating a detected rules list comprises examining objects in downstream resource systems and correlating the examined objects in downstream resource systems with resource manager objects managed by the resource manager;

accessing an expected rules list, the expected rules list defining permissions that should exist for the entity for resources in the enterprise;

comparing the detected rule list to the expected rule list and determining that the detected rule list includes permissions not included in the expected rule list;

providing an indication that the detected rules list includes permissions not included in the expected rules list.

2 . The method of claim 1 , further comprising:

receiving user input indicating the permissions included in the detected rules list and not included in the expected rules list should be removed;

in response to the user input, removing the permissions included in the detected rules list and not included in the expected rules list by modifying the expected rules list and executing a workflow, wherein the workflow is configured to cause the removal of permissions in downstream resource systems.

3 . The method of claim 2 , wherein modifying the expected rules list comprises including an entry in the expected rules list indicating removal of one or more permissions.

4 . The method of claim 1 , wherein correlating the examined objects in downstream resource systems with resource manager objects managed by the resource manager comprises:

determining that an object does not exist in the resource manager that can be correlated with an object in the downstream resource manager; and

creating an object in the resource manager to correlate with the object in the downstream resource manager.

5 . The method of claim 1 , wherein the expected rules list comprises one or more synchronization rules, wherein each of the one or more synchronization rules comprises:

an indicator used to identify the synchronization rule;

a definition of flow type specifying that the synchronization rule can be used for at least one of importing data into the resource manager from a downstream resource system or exporting data from the resources manager to a downstream resource system;

specification of an object type in the resource manager that the synchronization rule applies to;

specification of a downstream resource system;

specification of an object type in the downstream resource system to which the synchronization rule applies;

specification of relationship criteria including one or more conditions for linking objects in the resource manager and the downstream resource system; and

specification of attribute flow information.

6 . The method of claim 5 , wherein at least one of the one or more synchronization rules further comprises a description of the synchronization rule.

7 . The method of claim 5 , wherein at least one of the one or more synchronization rules comprises information defining a dependency on the existence of another synchronization rule.

8 . The method of claim 5 , wherein at least one of the one or more synchronization rules further comprises a filter used for identifying objects in the downstream resource system to which the synchronization rule will be applied.

9 . The method of claim 8 , wherein the filter comprises conditions that must be satisfied to apply the synchronization rule.

10 . The method of claim 5 , wherein at least one of the one or more synchronization rules further comprises specification of relationship creation acts that can be used when the relationship criteria specified in the relationship criteria is not satisfied, wherein the relationship creation acts comprise one or more of:

creation of an object in the resource manager if absent from the resource manager;

creation of an object in a downstream resource system if absent from the downstream resource system;

creation of an object hierarchy in a downstream resource system; or

deletion of an object from a downstream resource system when a corresponding object is removed from the resource manager.

11 . A method of creating rules for use in an expected rule list, the rules configured to be used in synchronizing objects at a resource manager with objects at one or more downstream resource systems for granting and removing permissions to access resources at the downstream resource systems, the method comprising:

displaying a user interface, the user interface comprising user selectable components for receiving user input;

at the user interface, receiving user input specifying an indicator used to identify a synchronization rule;

at the user interface, receiving user input specifying a definition of flow type specifying that the synchronization rule can be used for at least one of importing data into the resource manager from a downstream resource system or exporting data from the resources manager to a downstream resource system;

at the user interface, receiving user input specifying a specification of an object type in the resource manager that the synchronization rule applies to;

at the user interface, receiving user input specifying a specification of a downstream resource system;

at the user interface, receiving user input specifying a specification of an object type in the downstream resource system to which the synchronization rule applies;

at the user interface, receiving user input specifying a specification of relationship criteria including one or more conditions for linking objects in the resource manager and the downstream resource system;

at the user interface, receiving user input specifying a specification of attribute flow information; and

forming a synchronization rule defined by the user input.

12 . The method of claim 11 , further comprising storing the synchronization rule in an expected rules list.

13 . The method of claim 11 , further comprising at the user interface, receiving user input specifying a description of the synchronization rule.

14 . The method of claim 11 , further comprising at the user interface, receiving user input specifying information defining a dependency on the existence of another synchronization rule.

15 . The method of claim 11 , further comprising at the user interface, receiving user input specifying a filter used for identifying objects in the downstream resource system to which the synchronization rule will be applied.

16 . The method of claim 11 , further comprising at the user interface, receiving user input specifying conditions that must be satisfied to apply the synchronization rule.

17 . The method of claim 11 , further comprising at the user interface, receiving user input specifying relationship creation acts that can be used when the relationship criteria specified in the relationship criteria is not satisfied, wherein the relationship creation acts comprise one or more of:

creation of an object in the resource manager if absent from the resource manager;

creation of an object in a downstream resource system if absent from the downstream resource system;

creation of an object hierarchy in a downstream resource system; or

deletion of an object from a downstream resource system when a corresponding object is removed from the resource manager.

18 . In a computing environment including a resource manager, the resource manager comprising programmatic code for managing resources in an enterprise, a method of managing resources including managing permissions for entities to access the resources, the method comprising

adding expected rule entries to an expected rules list, wherein each of the expected rule entries comprises:

an indicator used to identify a synchronization rule;

a definition of flow type specifying that the synchronization rule can be used for at least one of importing data into the resource manager from a downstream resource system or exporting data from the resources manager to a downstream resource system;

a specification of an object type in the resource manager that the synchronization rule applies to;

a specification of a downstream resource system;

a specification of an object type in the downstream resource system to which the synchronization rule applies;

a specification of relationship criteria including one or more conditions for linking objects in the resource manager and the downstream resource system; and

a specification of attribute flow information; and

synchronizing objects in downstream resource systems with objects at the resource manager based on the expected rule entries in the expected rules list.

19 . The method of claim 18 , wherein at least one of the expected rule entries comprises a specification of relationship creation acts that can be used when the relationship criteria specified in the relationship criteria is not satisfied, wherein the relationship creation acts comprise one or more of:

creation of an object in the resource manager if absent from the resource manager;

creation of an object in a downstream resource system if absent from the downstream resource system;

creation of an object hierarchy in a downstream resource system; or

deletion of an object from a downstream resource system when a corresponding object is removed from the resource manager; and

wherein synchronizing objects in downstream resource systems based on the expected rule entries in the expected rules list comprises at least one of:

creating an object in the resource manager;

creating an object in a downstream resource system;

creating an object hierarchy in a downstream resource system;

or

deleting an object from a downstream resource system.

20 . The method of claim 18 , wherein at least one of the expected rule entries comprises a specification of a filter used for identifying objects in the downstream resource system to which the synchronization rule will be applied and wherein synchronizing objects in downstream resource systems based on the expected rule entries in the expected rules list comprises using the filter to identify which objects in a downstream resource system a synchronization rule will be applied.