• State Verified Answer
  • Replies 2 replies
  • Subscribers 96 subscribers
  • Views 903 views
  • Users 0 members are here
Options
Related

ADSGroup membership management

roberto berardi
over 2 years ago

Hi,

I would like to make OneIM authoritative for several AD groups' membership, so I created a mapping and a workflow to achieve it. Every day I run the synch to add or remove membership on AD depending on what I have in ADSAccountInADSGroup, the result is that if users are added or removed manually in AD, then OneIM revert the changes. All seems work good, but the problem is that I do not manage some kind of users, for example users with specific attribute that belong to another company.
The question is, can I "overwrite" the AD group membership just for those user account I have to manage and exclude some other users depending on some attributes? It would be great if I can do it through the synch project directly. Or do you think I have to implement something more "complex" like import membership on OneIM and create a process that checks the membership and then re-provisions?

Version:8.2.1

Thanks,

Roberto

Parents
  • +1 over 2 years ago

    This OneIM feature can be used for filtering memberships.

    Start: Manager.exe > Data Synchronisation > Basic configuration > Target system types > Active Directory > Configure tables for publishing

    Target systemtypes | Can be published | Merge mode | Condition | Rootobjectpath
    ADSAccountInADSGroup | [v] | [v] | see example SQL below |

    EXISTS (
    SELECT TOP 1 1
    FROM ADSAccount a
    WHERE a.UID_ADSAccount = i.UID_ADSAccount
    AND a.ExtensionAttribute1 = 'Only include this user'
    )

    For more info see:
    support.oneidentity.com/.../4

Reply
  • +1 over 2 years ago

    This OneIM feature can be used for filtering memberships.

    Start: Manager.exe > Data Synchronisation > Basic configuration > Target system types > Active Directory > Configure tables for publishing

    Target systemtypes | Can be published | Merge mode | Condition | Rootobjectpath
    ADSAccountInADSGroup | [v] | [v] | see example SQL below |

    EXISTS (
    SELECT TOP 1 1
    FROM ADSAccount a
    WHERE a.UID_ADSAccount = i.UID_ADSAccount
    AND a.ExtensionAttribute1 = 'Only include this user'
    )

    For more info see:
    support.oneidentity.com/.../4

Children