AnsweredAssumed Answered

Create AD Group Form

Question asked by Andrea Saldamarco on May 5, 2016
Latest reply on Feb 23, 2018 by Shlomo Katz

Like • Show 1 Like1
Comment • 4

Hi,

I'm trying the user/group provisioning on Active Directory, in particular I want to create a new group on AD server.

The AD connector capability "Create a Group on an AD server" is able and it is configured as follow:

I also mapped a"Group DN suffix" (i.e. DC=company,DC=local) in the AD Connector in the DN field.

I created a request button in order to trigger a request form, which has the following fields:

title
Group Name (string)
Common Name (string)
group description
provisioning command

I have two questions:

1) How can I create an AD group in a specific OU or path?

The paths are not unique so I can not map it in the "Group DN Suffix" in the AD connector settings.

2) How can I populate the AD Group scope "DomainLocal/Unversal /Global" AD attribute througth the request form?

Thank you in advance.

Best regards.

Paul Douglas

May 5, 2016 9:45 PM

Correct Answer

Hi Andrea,

In this instance, I would suggest using a drop down select for the Group Scope. You can display Domain/local/universal/global, but use the relevant value associated with the scope.

You'll have to remove the default value from the AFX capability, and update your provisioning command in the form to use this form value.

For the group location, depending on how many locations are potentially available, you could also do this with a drop down

You would then have to change your provisioning command to include this value.

I've just tested this in my sandbox and it is working correctly.

See the reply in context

No one else had this question

Outcomes

Paul Douglas

May 5, 2016 9:45 PM

Hi Andrea,

In this instance, I would suggest using a drop down select for the Group Scope. You can display Domain/local/universal/global, but use the relevant value associated with the scope.

You'll have to remove the default value from the AFX capability, and update your provisioning command in the form to use this form value.

For the group location, depending on how many locations are potentially available, you could also do this with a drop down

You would then have to change your provisioning command to include this value.

I've just tested this in my sandbox and it is working correctly.

2 people found this helpful

Actions

Andrea Saldamarco @ Paul Douglas on May 6, 2016 7:05 PM

Thanks you for answer, I solved my issue to create AD group

Now I want to delete a group on AD server. The AD connector capability “Delete Group on AD server” is enabled and it has only “GroupName” input parameter, as follow:

"GroupName" parameter must contain a DN of interested group. I mapped the groupDN within “External ID” attribute, in Active Directory Account Collector, as follow:

To remove an AD group I created a form, setting with the following fields:

1. GroupPicker control type named "adgroupname" and setted on "Name" value

2. ProvisioningCommand control type, setted to “Active Directory” Business Source and “Delete a Group on AD Server” capability command. I mapped the only one capability parameter GroupName (above mentioned) with group-name, in particular ${avform.adgroupname}

When I launch the debug form to delete a group test (i.e. TESTGROUP), I select the group within the GroupPicker filed. After I have only the CN (CN=TESTGROUP) within provisioningCommand parameter. This behavior is not correct, because to delete an AD group I must collect whole the DN (CN=TESTGROUP,OU=xxx,DC=COMPANY,DC=LOCAL).

In my configuration, DN is contained within “External ID” attribute and if possible, I don’t want remap it in other attribute.

How I can map the “External ID” attribute into the provisioningCommand parameter?

Thanks in advance

Andrea Saldamarco

CyberSecurity

Business Integration Partners

Roma, Via Sicilia 43

tel +39 06 4540161 cell +39 344 1555023

Attachments

Actions

Andrea Saldamarco @ Paul Douglas on May 6, 2016 7:05 PM

Thanks you for answer, I solved my issue to create AD group

Now I want to delete a group on AD server. The AD connector capability “Delete Group on AD server” is enabled and it has only “GroupName” input parameter, as follow:

"GroupName" parameter must contain a DN of interested group. I mapped the groupDN within “External ID” attribute, in Active Directory Account Collector, as follow:

To remove an AD group I created a form, setting with the following fields:

1. GroupPicker control type named "adgroupname" and setted on "Name" value

In my configuration, DN is contained within “External ID” attribute and if possible, I don’t want remap it in other attribute.

How I can map the “External ID” attribute into the provisioningCommand parameter?

Thanks in advance

Andrea Saldamarco

CyberSecurity

Business Integration Partners

Roma, Via Sicilia 43

tel +39 06 4540161 cell +39 344 1555023

Attachments

Actions

Shlomo Katz @ Paul Douglas on Feb 23, 2018 12:20 PM

Thank you for this post. Can anybody assist with my issue?
My request is stuck in pending action for createGroup.

The variables seem to be accurate (Group is full DN, truncated for security):

These are my parameters for the AFX Connector > create group on AD server

Thank you

Actions

4 Replies

Paul Douglas May 5, 2016 9:45 PM
Unmark Correct
Correct Answer
Hi Andrea,
In this instance, I would suggest using a drop down select for the Group Scope. You can display Domain/local/universal/global, but use the relevant value associated with the scope.
You'll have to remove the default value from the AFX capability, and update your provisioning command in the form to use this form value.
For the group location, depending on how many locations are potentially available, you could also do this with a drop down
You would then have to change your provisioning command to include this value.
I've just tested this in my sandbox and it is working correctly.
2 people found this helpful
Like • Show 2 Likes2
Actions
- Andrea Saldamarco @ Paul Douglas on May 6, 2016 7:05 PM
  Mark Correct
  Correct Answer
  Thanks you for answer, I solved my issue to create AD group
  
  Now I want to delete a group on AD server. The AD connector capability “Delete Group on AD server” is enabled and it has only “GroupName” input parameter, as follow:
  
  "GroupName" parameter must contain a DN of interested group. I mapped the groupDN within “External ID” attribute, in Active Directory Account Collector, as follow:
  
  To remove an AD group I created a form, setting with the following fields:
  
  1. GroupPicker control type named "adgroupname" and setted on "Name" value
  
  2. ProvisioningCommand control type, setted to “Active Directory” Business Source and “Delete a Group on AD Server” capability command. I mapped the only one capability parameter GroupName (above mentioned) with group-name, in particular ${avform.adgroupname}
  
  When I launch the debug form to delete a group test (i.e. TESTGROUP), I select the group within the GroupPicker filed. After I have only the CN (CN=TESTGROUP) within provisioningCommand parameter. This behavior is not correct, because to delete an AD group I must collect whole the DN (CN=TESTGROUP,OU=xxx,DC=COMPANY,DC=LOCAL).
  In my configuration, DN is contained within “External ID” attribute and if possible, I don’t want remap it in other attribute.
  
  How I can map the “External ID” attribute into the provisioningCommand parameter?
  
  Thanks in advance
  
  Andrea Saldamarco
  
  CyberSecurity
  Business Integration Partners
  Roma, Via Sicilia 43
  tel +39 06 4540161 cell +39 344 1555023
  Attachments
  - image005.png12.9 KB
  - image004.jpg1.2 KB
  - image003.jpg16.3 KB
  - image002.jpg16.0 KB
  - image001.jpg7.5 KB
  Like • Show 0 Likes0
  Actions
- Andrea Saldamarco @ Paul Douglas on May 6, 2016 7:05 PM
  Mark Correct
  Correct Answer
  Thanks you for answer, I solved my issue to create AD group
  
  Now I want to delete a group on AD server. The AD connector capability “Delete Group on AD server” is enabled and it has only “GroupName” input parameter, as follow:
  
  "GroupName" parameter must contain a DN of interested group. I mapped the groupDN within “External ID” attribute, in Active Directory Account Collector, as follow:
  
  To remove an AD group I created a form, setting with the following fields:
  
  1. GroupPicker control type named "adgroupname" and setted on "Name" value
  
  2. ProvisioningCommand control type, setted to “Active Directory” Business Source and “Delete a Group on AD Server” capability command. I mapped the only one capability parameter GroupName (above mentioned) with group-name, in particular ${avform.adgroupname}
  
  When I launch the debug form to delete a group test (i.e. TESTGROUP), I select the group within the GroupPicker filed. After I have only the CN (CN=TESTGROUP) within provisioningCommand parameter. This behavior is not correct, because to delete an AD group I must collect whole the DN (CN=TESTGROUP,OU=xxx,DC=COMPANY,DC=LOCAL).
  In my configuration, DN is contained within “External ID” attribute and if possible, I don’t want remap it in other attribute.
  
  How I can map the “External ID” attribute into the provisioningCommand parameter?
  
  Thanks in advance
  
  Andrea Saldamarco
  
  CyberSecurity
  Business Integration Partners
  Roma, Via Sicilia 43
  tel +39 06 4540161 cell +39 344 1555023
  Attachments
  - image005.png12.9 KB
  - image004.jpg1.2 KB
  - image003.jpg16.3 KB
  - image002.jpg16.0 KB
  - image001.jpg7.5 KB
  Like • Show 0 Likes0
  Actions
- Shlomo Katz @ Paul Douglas on Feb 23, 2018 12:20 PM
  Mark Correct
  Correct Answer
  Thank you for this post. Can anybody assist with my issue?
  My request is stuck in pending action for createGroup.
  The variables seem to be accurate (Group is full DN, truncated for security):
  These are my parameters for the AFX Connector > create group on AD server
  
  Thank you
  Like • Show 0 Likes0
  Actions

Create AD Group Form

Outcomes

Attachments

Attachments

Related Content

Recommended Content