Introduction
The CoreOne Suite offers different types of how you can create and manage resources, see Resource Type. In the beginning of implementing the CoreOne Suite, you have to decide, what type of resources you would like to use. This article should help you to decide between Linked Resources and Managed Resources. The behaviour of these resource types are pretty similiar in the different we do support. We decided to focus in this article on the target system Active Directory as this is one of the most used target systems by our customers.
Resources in the CoreOne Suite are nothing else than a group in an Active Directory. Due to different terminations in all our supported target systems, we decided to use the termination “resources”. Simple said: A resource is a right you can assign to an Identity in a target system. In an Active Directory it is a group (resource) where you add a user (identity) as member. This nesting results most commonly in a right.
How-To decide between Linked Resources and Managed Resources
The described behaviour implies, that on you’re CoreOne Suite Instance the following configuration is enabled:
Relevant target system-features
CleanUp Task for this target system runs with a scheduler on a regulary base
Step 1 - Understand, what the differences are between these resource types
In general, you should read the following documentations. They will give you a good overview of what resource types are and how they are connected to the cleanup task:
Linked Resources
With Linked Resources you’re using existing groups in your target system anf only map them in the CoreOne Admin UI as “Linked Resource” so you can use them to add members through the CoreOne Suite.
As the name already explains: You only link it. You can compare that with a shortcut (would be the Linked Resource) to a folder (AD-Group) on your desktop. If you delete the folder itself, the shortcut is still there. If you then click on the shortcut, it will thow you an error message. If you rename the shortcut, the name of the folder itself won’t be changed. If you delete the shortcut, the folder will still be there.
Managed Resources
Managed Resources are the way to go, if you start with a target system from scratch. With Managed Resources, you will create a newly needed AD-Group directly within the CoreOne Suite. The CoreOne Suite will then create the needed AD-Group automatically and link them. You can define templates for the creation of new Managed Resources which will help you to propagate a naming concept for example.
With the CleanUp Task enabled, Managed Ressources make sure, the CoreOne Suite and the target system attributes of a Managed Resource/target system Group will converge. Like a Linked Ressource, it will also controll the memberships for all known entities but also controll attribute values of the Managed Resource itself.
For Example: Within the creation process of a Managed Resource you define the OU-Path (it also can be given by the template). If someone by accident moves the AD-Group directly in the target system into a new OU-Path, the CoreOne Suite will move back the AD-Group to it’s correct place. This also means: All defined attributes for creating a ressource you are only able to change them in the CoreOne Suite.
Step 2 - Understand, what the limitations are
They won’t be added automatically as resource in the CoreOne Suite, if you create them directly in the target system.
Linked Resources: You have to link the newly created AD-Group in the CoreOne Suite Admin UI to be able, to assign it to a Core-Identity. See: /wiki/spaces/IKB/pages/1796997245
Managed Resources: You’ve chosen the wrong way. It is not possible to use this group. You have to delete it in the target system and recreate it in the CoreOne Suite Admin UI and the CoreOne Suite creates the group in the target system automatically. See: /wiki/spaces/IKB/pages/1796997245
Only the creation of the resources is not enough. You need to make sure, that the corresponding system-Features are enabled and also the CleanUp-Task runs on a schedule.
Step 3 - Compare the Pro’s & Con’s
It’s not that easy, that you can decide easily, what type of resource it’s the right one for you. You will gain expirience with time and working with these different resource types. In some cases it can help you, to compare the Pro’s a& Con’s:
Managed Resources
Pro’s
You can centralize the create process of AD-Groups into the CoreOne Suite. Your powe users can create them by theirself → Decentralization of dutie’s.
You can define templates for creating Resources
The CoreOne Suite and the target system will converg as long the CleanUp Task is running
Con’s
More efforts needed for taking over existing groups from your target system as Managed Resource.
Linked Resources
Pro’s
You can easily reuse your existing groups
Con’s
Can be irritating for power users to deprovision a linked resource
In the most cases the CoreOne Suite and the target system will diverge
Step 4 - Make your decision
Now you should be able to make a well considered decision. Make your own Pro’s & Con’s list. Think wisely and keep an eye in the future. Is the chosen resource type also feasable for your requirements in five years?
Frequently Asked Questions
Technically: Yes you can.
Logically: It’s not that simple. 
We recommend, to focus on one type per target system and type of Group. We observed, that new IAM Manager’s are often confused, if there are different ways, of how they have to handle rights.
For Example: The IAM Manager’s goal is to create a new Active Directory Group. In some OU-Path’s where you work with Linked Resources he have to do that directly in the target system Active Directory. For an another OU-Path where you work with Managed Resources he have to get the job done through the Admin UI of the CoreOne Suite. It makes sense, to define one type of resource per OU-Path for example. And not for technical reason, this ist just because of manageability for IAM Manager.