To provide group membership associated to the user, you must reverse that idea and update the account (__ACCOUNT__) and the ICF will then acknowledge if the account has group membership associated to the account. To allow OOTB implementation as well as focusing on connector updates, the AD group membership must be populated during the AD account creation or update but the AD group MUST be associated to the ldapGroup attribute. As highlighted in the first image, I have altered the openidm attribute and mapped it to the ldapGroup attribute.

OpenIDM_AD_Group_Provisioning In the Samples guide it is referenced: sample2c

However this doesn't really explain what ldapGroups actually does and there's no real worked example of how to go from an Assignment to ldapGroups to an assigned group in AD. I wrote up a wiki article for my own reference: AD group memberships automatically to users

This is just my view, others may disagree, but I think the implementation experience could be improved with some more documentation and a more detailed example here.

To provide group membership associated to the user, you must reverse that idea and update the account (__ACCOUNT__) and the ICF will then acknowledge if the account has group membership associated to the account.

To allow OOTB implementation as well as focusing on connector updates, the AD group membership must be populated during the AD account creation or update but the AD group MUST be associated to the ldapGroup attribute.

As highlighted in the first image, I have altered the openidm attribute and mapped it to the ldapGroup attribute.

Furthermore, the AD group membership cannot be generated within the sync.conf. As highlighted, you must have the association of the AD group to the user BEFORE the sync.conf association. If you try and associate the attribute during the sync.conf, then you would typically see this stack trace error response

In order to achieve this, you must populate the user object prior to the provisioning. To do this, you can perform this during the user import but you can also perform a PATCH REST API call to OpenIDM user object, as illustrated.

The other thing to note that the provisioner file doesn't necessary accomodate the attribute required to provision AD groups during the provisioning. As highlighted, I included the ldapGroups attribute to the provisioner file.

Please leave a comment - I will always read them :-)

About the author