we have a use case that seems insane to me, but people want to do the
darndest things.

We want to make a custom entitlement that will query objects in IDV
instead of target and pull back a list of object names, not DNs.

Then our custom Entitlememnt will do the work of properly implementing
it. But wait you say, the Entitlement query for Code map refresh is
against the target directory, not IDV.

The way to do that is non-obvious, but if you have read any of my Driver
walk throughs you will know that many drivers take this approach.

If you look at most drivers, there is some query that it seems they must
all respond too, even with mostly nonsense. So there are OTP policies
that tag it as this funny case, and ITP policies that rebuild the tagged
response to look like what UA is looking for.

Ergo do the same thing, silly, easily identifiable query defined in your
Entitlement object. Reformat the result of some real, single object in
ITP to be all the IDV objects.

Ok that is all simple stuff. Might just package that up and offer it
around since it is a clever trick if you need it.

But here is the question. Say we are reading objects out of IDV that
represent locations. new locations comes from HR, we make the location
object. We get a user, we want to grant that new Location value in a
Resource->Entitlement mapping (We will call a PRD with an Integration
activity to do that, so SOAP based, we are supportable).

Thing is, CODE MAP refresh hasn't happened yet. So the value won't be in
the CODE MAP table. If I call a CODE MPA refresh either by PRD with IA,
or via the way PCRS does it via a Java command to do the Refresh one
entitlement (faster than all, clever!) I have to wait many seconds.

I would rather just grant a value I know is valid in the
Resource->Entitlement assignment.

Right now, it would work, but is invalid per CODE MAP table.
Tomorrow it will be a valid entry when 1440 minute interval passed.

So question is, what will happen in UA in that case? Will my assignment
not officially work today, but work proper tomorrow?

Never tried, curious if anyone knows.

I have seen UA show an assignment as **INVALID***entitlementValue. But
I have never made that actually valid, afterwards.