Prototype Merge Policy (baja-UserPrototypeMergePolicy)

As of Niagara 4.12, you can optionally configure SAML, LDAP and Kerberos authentication schemes to merge user prototypes that match a user's prototype attributes, instead of just using a single prototype. If you enable the Prototype Merge Policy, user prototypes will be merged according to the policy’s configuration when you create remote users upon login. You benefit from this feature, for example, when an organization has multiple user groups for each building and it is not feasible to create additional groups for each possible combination.

Figure 1. User Prototype Merge Policy


For the KerberosScheme, you access this view by expanding Config > Services > AuthenticationService > KerberosScheme and double-clicking Prototype Merge Policy.

For the LDAPScheme, you access this view by expanding Config > Services > AuthenticationService > LdapScheme and double-clicking Prototype Merge Policy.

For the SAMLAuthenticationScheme, you access this view by expanding Config > Services > AuthenticationService > SAMLAuthenticationScheme and double-clicking Prototype Merge Policy.

PropertyValueDescription
Enabledtrue, false (default)Determines whether or not user prototypes are merged according to your policy configuration.
Roles Merge Modedrop-down listProvides two modes:

  • Union (default): the resulting user has all roles of all user prototypes.

  • Use first: the value from the first user prototype is used.

Expiration Merge Modedrop-down listProvides two modes:

  • Prefer Earliest (default): the earliest expiration is used.

  • Use first: the value from the first user prototype is used.

Allow Concurrent Sessions Merge Modedrop-down listProvides two modes:

  • Prefer False (default): if any value is false, false is used.

  • Use first: the value from the first user prototype is used.

Auto Logoff Settings Merge Modedrop-down listProvides two modes:

  • Prefer Shortest (default): the shortest auto-logoff setting is used. If there is a tie, the default system setting configured in the UserService is preferred.

  • Use first: the value from the first user prototype is used.