Adding User to Active Directory Groups Based on Privileges

[#1]

Hello All,

I am using Netweaver IDM 7.2 and attempting to provision user accounts and group membership to Active Directory. I am using the SAP Provisioning Framework Task 'ProvisionADSUser'. Underneath this is the 'ProvisionADSUserToSystem' task which ultimately runs the CreateADSUser pass. I have the top-level task linked a as a provining task to a privilege I have created in the SAP_Master Identity store. The privilege is called 'PRIV:GROUP:AD_Repository:Group_Name '.

When I assign the privilege to a user in the UI an AD account is provisioned and everything works as expected. The problem is, I also want the user added to the group in AD that corresponds to the privilege. Judging from everything I've read, the proper way to do this is to add the task ProvisionADSGroupAssignment' task underneath the 'ProvisionADSUser' task. I have done this. When I then assign a privilege to the user in the UI the pass 'AssignUserToADSGroup' ultimately runs but the user is not added to the group. This is the error I get in the job log:

15.12.2011 11:20:46 :I:Pending Object MSKEY: not-existing-mskey

15.12.2011 11:20:46 :I:PrivilegeMSKEY : !ERROR:No such attribute

15.12.2011 11:20:46 :I:GroupDN:!ERROR:Entry does not exist

15.12.2011 11:20:46 :I:Account attribute value: cn=NEIL.FERGUSO,dc=kiewittest,dc=com

15.12.2011 11:20:46 :E:Failed storing !ERROR:Entry does not exist

15.12.2011 11:20:46 :E:Exception from Mod operation:ToDSADirect.modEntry !ERROR:Entry does not exist failed with NamingException. (LDAP error: The distinguished name has an invalid syntax)

Explanation: !ERROR:Entry does not exist: [LDAP: error code 34 - 0000208F: NameErr: DSID-031001F7, problem 2006 (BAD_NAME), data 8350, best match of:

'!ERROR:Entry does not exist'

]

Remaining name: !ERROR:Entry does not exist

Resolved name:

javax.naming.InvalidNameException: !ERROR:Entry does not exist: [LDAP: error code 34 - 0000208F: NameErr: DSID-031001F7, problem 2006 (BAD_NAME), data 8350, best match of:

'!ERROR:Entry does not exist'

]; remaining name '!ERROR:Entry does not exist'

If my setup is correct, I believe the problem is that the users MSKEYVALUE is what is being given to the 'ProvisionADSGroupAssignment' task. It appears the script that ultimately runs is looking for the MSKEY of the privilege. So my questions are:

1. Is my task hierarchy setup correctly?

2. If so or if not, how do I get the ADS group task to add the user to an AD group based on the privilege that was just assigned?

I have searched the forum and found this thread: It appears very similar to my problem, but not the same. The scripts that he references are not available in my global scripts. I'm assuming that's because he was using a version of IDM older than 7.2.

Thanks in advance for any help you can provide in helping me solve this problem. I'm going on my 2nd full day of banging my head against the wall with this one.

[Former Member]

Thank you very much for the reply. I agree that the problem is the wrong value is being passed. My question is, how do I configure this to send the privilege to the AssignUserToADSGroup pass?

Below is what is in the destination tab of assignUserToADSGroup pass:

dn $FUNCTION.sap_core_getGroupACCOUNTFromPrivilege(%MSKEY%)$$

changetype modify

member $FUNCTION.sap_core_checkAccountAttributeValueExists(%ACCOUNT%$rep.$NAME%%)$$

I know I could hardcode the value of my privilege in the first line rather than using %MSKEY%. But this would mean I would have to create a seperate task for every single privilege that we have. That doesn't seem like it would be the best way. I want to make it work such that I only have a single ProvisionADSGroupAssignment that is linked as a provisioning task to all of the privileges. Then whenever a user is assigned that privilege it kicks off the task to add the user to the corresponding AD group. I will admit that I'm fairly new to to IDM. This is just what I am envisioning after the class I've taken and all the research I've done. If there is a better way to provision users/privileges/groups I would love to hear it.

Thanks again for your time.