Hi,
I am trying to create an LDAP group using AFX's Ldap connector with 'createGroup' capability.
How do I add multiple members and multiple owners?
>The connector does not let me use the same parameter multiple times
>The member attribute is not accepting comma seperated userDNs or semicolon separated user DNs.
-Sunita
Hello Ian,
I am taking about "Create Group" capability. In my requirements, I have to create a group with its attributes along with initial set of members and at minimum two owners.
Rgds
Sunita
That is not how the connectors are designed to work. Each action from what you said should be a separate call to the respective capability. To do this, they your initial change request should contain the following change items:
I agree that members could be added later but what about Group owners.
In my organization, we mandate that each group should have at least two owners.
My question is how can I create a group which takes two owner attributes?
Rgds
Sunita
Ah I understand now. Yes there is a different answer for your question about the Owner attribute.
AFX does not currently support updating multi-valued LDAP attributes. You cannot set the Group Owner attribute to multiple values. The Update A Group capability results in an LDAP MODIFY REPLACE action on the multi-valued attribute. This will add or replace the first value of the multi-valued attribute.
We also do not collect multi-valued attributes so you cannot collect multiple group owners. (At least not directly using a normal Account collector, although owner information may be collected using other types of collectors. ).
The unique use case of adding multiple members of a group is handled separately in the product and does support adding and removing multiple accounts from groups.
Really these advanced use cases are not practicable using the default AD LDAP connector.
You may be able to do this using a custom PowerShell connector. The design and use of PowerShell connectors is beyond the scope of what I can go into here. I would suggest you engage RSA Professional Services who may be able to provide you with guidance on provisioning and collecting group owners in AD. This really is a advanced technique with implications beyond just the connector design.
Does this information help you plan for your solution?
Thank Ian for that clarification. I will open a new feature request on Link for multi valued attribute.
You are right, few years back we had issue with collection as we support multi valued email address and collector was not able to pick up all or the last email.
Lack of such ootb features make us look for alternate technical solution. In this case we resorted to ldif dump.
What type of LDAP directory are you provisioning against?
If this is Microsoft, then you may find that custom PowerShell connector provides you with more flexibility for advanced provisioning scenarios. RSA Professional Services can provide you with custom solutions that precisely fit your needs.
If you want to request new features for the LDAP connector (collector?) you can post them on RSA Ideas page.
RSA Ideas for RSA Identity Governance & Lifecycle
Be aware that even if the collector were to support multivalued LDAP attributes that does not necessarily mean the product would support managing that data. For example, SQL connectors can collect multiple rows for a column containing email address, but the current product does not know how to map multiple values to a user without some customization.
The Create a Group and Add Account to Group are separate commands. Are you referring to the Add Account to Group command?
I believe the Add Account to Group only accepts a single Account. If you wish to add multiple Accounts you must create a change request with multiple items.