ARS Quesry Based Distribution Group

Question

Is it possible to create a query based distribution group where the LDAP query compares two attributes and adds a user to the group if they are not the same? 
 
 The two attributes that I want to compare are 'mail' and a virtual attribute 'edsvaFirstEmailAddress'. 
 
 If the two values are not the same then the user should be added to the group. 
 
 Is that possible?

Terrance.Crombie · Accepted Answer

Active Roles Dynamic Groups use LDAP, and LDAP cannot perform comparisons. 
 However, you can abstract this using a Workflow. 
 Create a new Boolean attribute called something like edsvaCompareFlag. Then, create a Change Workflow which is triggered by a change to either of your two attributes of interest. The Change Workflow runs an IF/Else branch which sets a true value to edsvaCompareFlag if the attributes are not the same. This is the Workflow which keeps up on real-time changes. 
 Now create an Automation Workflow which performs a search in Active Directory and sets the edsvaCompareFlag flag for existing user accounts. You might only need to use this once, or you can choose to run it nightly as a sanity check. 
 Now, just build your Dynamic Group based on the value of edsvaCompareFlag.

Terrance.Crombie · Answer

Active Roles will fire a single instance of the Change Workflow for each object which is changed. If your script references the $Request object properly, then it will resolve the individual user which is spawning that Change Workflow. 
 How you want to handle this is up to you. You could have script logic in the If/Else branch check, or have the entire thing scripted and then update the attribute of the $Request object. I suggest the latter option. 
 The SDK is a good resource for references to Active Roles Workflow context objects, like $Request and $DirObj, which will be useful.

JohnnyQuest · Answer

Yes - the in-process object is always available in the $Request. 
 I typically reference it as $Request.GUID or $Request.DN - the latter being the friendlier textual representation. There's also $Request.Name which gives you the Domain\User style name if you don't need to know where the object lives.

Endpoint Privilege Management

ARS Quesry Based Distribution Group

Top Replies