OpenAM v11 has a basic dashboard service, that can be used to provide SSO links to internal and cloud apps, in form of a personalised portal or dashboard. It is pretty simple to setup out of the box.
A question I get asked quite often, is how to manage the apps a user gets? Can we provision them just like say groups within AD?
The simple answer is yes. Once the service is setup for a particular realm and an app is assigned to a user, an attribute called assignedDashboard is added and populated on the users profile.
The assignedDashboard attribute, is an array, that can be manipulated just like any other on the user object. The items in the array, are the names of the app given within the config in OpenAM.
Within OpenIDM it is then fairly simple to add the assignedDashboard attribute into the provisioner configuration as an array, the native type of the items as strings.
One thing to remember, is that the assignedDashboard attribute is part of the forgerock-am-dashboard-service object class with OpenDJ. As such, the forgerock-am-dashboard-service needs adding into the provisioner JSON file within the object classes that are to be synchronized on the OpenIDM side.
To populate the assignedDashboard attribute in production, you'd probably use a business role based on a business characteristic such as job title, or manager or location.
OpenAM Dashboard Configuration - http://docs.forgerock.org/en/openam/11.0.0/admin-guide/index/chap-dashboard.html
The code for the above example is available here - https://github.com/smof/openIDM_artifacts/tree/master/dashboard_provisioning