Hi,
Need you help again :-) I am creating a workflow where is must look at AD group membership and depending on which AD groups the user is member of, then is should do something.
My qustion is how can i using SQL ,select membership of a specified user? Is there an table in the DB where i can select from? like the pvuser?
Lookin forward to hear from you.
/Martin
Hi Koos,
We need in our rehire flow to look if a AD user account is member of a speciale AD group, if so, then remove the user from that group and add the user account to a different AD group, depending on which AD group he was original in.
regards,
Martin
Hi Martin,
Please remind me what the rehire process is currently doing. Only enabling the AD account of the user through an attribute change rule ?
If the new logic does not involve a large number of AD groups, you might want to look at the options to extend the current re-joiner rule by creating additional re-hire rules, each one for the AD group that you want to check.
So for example if you have the following logic:
- if the AD account of the re-hire is a member of group A, then remove this membership and add membership to group X
- if the AD account of the re-hire is a member of group B, then remove this membership and add membership to group Y
If you look at the Condition section of the attribute change rule, it allows you to select the set of users the rule will apply to (For particular users). Here you can use the "Related Entities" options to filter all the users that are member of a specific AD group.
So you could create 2 extra rehire rules, one for A->X and one for B->Y.
In the first rule use Related Entities: user in group A
In the second rule use Related Entities: user in group B
The Actions section of the rule gives you capabilities to Revoke and Add selected entitlements to the user.
In the first rule you can Remove entitlement Group A and add Group X
In the second rule you can Remove entitlement Group B and add Group Y.
With this approach you will be using the OOTB capabilities of IG&L instead of 'programming' it into a workflow.
Let me know if this works. Happy to have a short call/zoom session to discuss offline.
regards,
Koos
Hi Koos
Thank you for helping out, and a very good suggestion. But I am not able to remove and add to a AD group in the same rule?
Regards,
Martin
Hi Martin,
Yes of course, my mistake.
That will mean will have to split the actions over multiple rules. Using my example above:
So you could create 4 extra rehire rules, one for A->X and one for B->Y:
Not ideal, but it should work.
regards.
Koos
Hi Koos.
As fare as i know, the Rules are not executing by a priority. What I mean is that i can not tell RSA to run a certain Rule first and after that run another rule.
This give me a problem because i could make a rule were i said that:
- Rule 1: For user member of Group A, add entitlement group X
- Rule 2: For user member of Group A, remove entitlement group A
- Rule 3: For user member of Group B, Add entitlement group Y
- Rule 4: For user member of Group B, remove entitlement group B
But how can i prevent that Rule 2 execute before Rule 1, when it is not possible to make in which order the rule should run. Or will the CR first bee executed after it has finished running though all the rules?
Regards;
Martin
Hi Martin,
What exactly are your trying to do ? What is the requirement here ? There might be different alternative solutions to accomplish what you want to achieve in IG&L.
regards,
Koos