New Active Roles Policies

Question

Hi, 
 We want to add 2 new policy's on user creation these are 
 Property Generation and Validation 
 . accountExpires (accountExpires) 
 .edsaMemberOf (edsaMemberOf) 
 
 But we want them to be optional not Must be specifed, how can this be done? 
 
 regards, 
 Ben

Terrance.Crombie · Answer

This resource should help: 
 
Title: Unable to modify an attribute controlled by Property Generation and Validation policy 
Solution Number: 95699 
URL: support.quest.com/.../95699

Terrance.Crombie · Answer

The MemberOf attribute is special. It's actually computed and back-synced based on the Members attribute of Group objects. You cannot add something to that attribute directly. 
 
If you want this optional, and triggered during User account creation, the best method would be to create a custom virtual attribute, expose it, and populate it with a list of options. Then, have a Workflow listen to changes to this virtual attribute and populate Group Memberships accordingly. 
 
accountExpires is also special because of the way that it is stored. Timestamps are stored in integer time format. So, you're likely going to have to implement a script which would calculate the appropriate integer time.

Endpoint Privilege Management

New Active Roles Policies