Introduction
The CoreOne Suite offers different ways to create and manage resources - see Resource Type. Approaching the CoreOne Suite’s access management features, it is important to understand which type of resource best suit your needs. This article should help you to decide between Linked Resources and Managed Resources. In this article, the target system Active Directory is used as a basis, as this is one of the most commonly use case amongst the supported target systems.
Resources in the CoreOne Suite are the equivalent of groups in an Active Directory. Due to different terminologies in all the target systems supported by the CoreOne Suite, we’ve settled on the terminology “resources”.
Simply put: A resource is a permission that is assignable to an identity within a target system. In Active Directory terms, this is a group (resource) where users (identities) are added into as members.
Step 1 - Understand the differences between resource types
The following documentation is recommended for a better understanding of what resource types are and what the cleanup task can do:
Linked Resources
In this scenario, existing resources within a target system are mapped into the CoreOne Suite and each of them is available in the CoreOne Admin UI as a “Linked Resource”. These Linked Resources can then be used to add members from the CoreOne Admin UI. As the name suggests, the resources themselves are only “linked”. This is comparable to a shortcut within a filesystem. Using this example, if the folder iteself is deleted, the shortcut will remain unaffected, and trying to access it will result in an error. If the shortcut is renamed, the name of the folder will not be affected. Neither will deleting the shortcut affect the folder itself in any way.
Managed Resources
This scenario is recommended whenever a new target system is integrated into the CoreOne Suite that is built up from scratch. With Managed Resources, the CoreOne Suite will maintain data sovereignity and automatically provision any changes into the target system. To facilitate creating new Managed Resources, Resource Definition Templates are available to help with following a naming concept for example.
In addition to managing access to Resources for Identities, like Linked Ressources allows you to do, Managed Resource allow for attribute values of the resources themselves to be managed.
With the CleanUp Task enabled, using Managed Ressources will ensure consistency of both the resource memberships, as well as the resource’s attribute values between the CoreOne Suite and the target system.
Example with Active Directory: In a Managed Resources scenario, any changes made to groups within AD, like moving them into other OUs or changing their names, will be reverted by the CoreOne Suite’s CleanUp Task, if enabled.
Step 2 - Understand, what the limitations are
They won’t be added automatically as resource in the CoreOne Suite, if you create them directly in the target system.
Linked Resources: You have to link the newly created AD-Group in the CoreOne Suite Admin UI to be able, to assign it to a Core-Identity. See: /wiki/spaces/IKB/pages/1796997245
Managed Resources: You’ve chosen the wrong way. It is not possible to use this group. You have to delete it in the target system and recreate it in the CoreOne Suite Admin UI and the CoreOne Suite creates the group in the target system automatically. See: /wiki/spaces/IKB/pages/1796997245
Only the creation of the resources is not enough. You need to make sure, that the corresponding system-Features are enabled and also the CleanUp-Task runs on a schedule.
Step 3 - Compare the Pro’s & Con’s
It’s not that easy, that you can decide easily, what type of resource it’s the right one for you. You will gain expirience with time and working with these different resource types. In some cases it can help you, to compare the Pro’s a& Con’s:
Managed Resources
Pro’s
You can centralize the create process of AD-Groups into the CoreOne Suite. Your powe users can create them by theirself → Decentralization of dutie’s.
You can define templates for creating Resources
The CoreOne Suite and the target system will converg as long the CleanUp Task is running
Con’s
More efforts needed for taking over existing groups from your target system as Managed Resource.
Linked Resources
Pro’s
You can easily reuse your existing groups
Con’s
Can be irritating for power users to deprovision a linked resource
In the most cases the CoreOne Suite and the target system will diverge
Step 4 - Make your decision
Now you should be able to make a well considered decision. Make your own Pro’s & Con’s list. Think wisely and keep an eye in the future. Is the chosen resource type also feasable for your requirements in five years?
Frequently Asked Questions
Technically: Yes you can.
Logically: It’s not that simple. 
We recommend, to focus on one type per target system and type of Group. We observed, that new IAM Manager’s are often confused, if there are different ways, of how they have to handle rights.
For Example: The IAM Manager’s goal is to create a new Active Directory Group. In some OU-Path’s where you work with Linked Resources he have to do that directly in the target system Active Directory. For an another OU-Path where you work with Managed Resources he have to get the job done through the Admin UI of the CoreOne Suite. It makes sense, to define one type of resource per OU-Path for example. And not for technical reason, this ist just because of manageability for IAM Manager.