Synchronization Service - Step Handlers

Aidar.Karabalaev

• Thank you for your incredibly detailed response. I am not going to lie, it went a little over my head.
• The "source" or "HR" data is a DB. I unfortunately do not have any control over the data coming from the DB. 
• I wish I could post screenshots easily as it would be slightly easier to explain, I will try and give additional details below.

JohnnyQuest

• Cool name!
• I will try and provide more detail below.

Details about our environment

• Source: Database
• Target: ARS/AD

Creation Step

• We have a step that takes users from the DB and creates them in ARS/AD.
• This step has a filter. Attribute_A = Employed, Attribute_B = true

What I would like to do

• Any user that has the following: 
  • Attribute_A = Employed
  • Attribute_B = false
  • This means the user will not be created
• A notification will be sent to the HR department with details about the user explaining that there is an issue with the provided details and it will not be created.

I thought I might be able to use a Step Handler to trigger this alert. Preferably, if I could send the alert prior to any commits, that would be great. But it could also happen after the fact.

I am just looking for a way to trigger some sort of alert based on the data that the Sync Service is reading from the source. If this can also be accomplished while the "creation step" is actually running. That would be great as well.

I created a simple script to basically demonstrate what I would want to do collect and then send:

$strSourceFname=$srcObj["First_Name"]
$strSourceLname=$srcObj["Last_Name"]
$strSourceOffice=$srcObj["Office_Location"]
$strSourceEmployeeID=$srcObj["Personnel_Number"]
$strSourceDataV=$srcObj["Data_Validation"]

$body = "First Name: " + $strSourceFname
$body += "Last Name: " + $strSourceLname
$body += "Office: " + $strSourceOffice
$body += "EmployeeID: " + $strSourceEmployeeID

If ( $strSourceDataV -eq "false" )
{
     Send-MailMessage -From "some email" -To "some email" -Subject "Clean Data" -SmtpServer 'some server' -Body $body
}

Maybe Step Handler isn't the right place to do something like this?

One approach to this is to clear all other Synchronization Scope filtering (at the connection level) as well as Creation Criteria conditions (at the Provisioning step level) and write a customer PowerShell script to analyze the source data and make the determination if the object should be created or skipped and an alter sent out.

Here is a very crude sample script I wrote to demonstrate how you might accomplishing this. You add this script to the Source section in the Provisioning workflow step. Expand Creation Criteria and click Add condition in the "Source objects must meet these conditions". Click the down arrow next to Attribute and select "PowerShell Script". Use the script below modified with your script to get the results you want. My script simply logs to a file, but use your Send-MailMessage cmdlet to send an email. Just be sure to set the proper return value. Then back on the "Add Condition" screen, select "Is Exactly" and enter the return value that the script is returning if you want the object to be created, "True" in my example. Otherwise, if the value is not True then the record will be skipped.

This is a very intriguing solution and is fairly easy to implement.

I will definitely give this a try.

Give me a little time to implement and I will update this thread once tested.

Cheers

Side note, One Identity should allow screenshots to be directly uploaded to their forums. It would make communicating issues and solutions a lot easier in my opinion!

That's correct. Provision (Update, Terminate) Job Step | "Source Object Must Meet the Criteria" filtering. Example IF "Contract End Date" < Today THEN do not create, do not update, Deprovsion.

Hi Richard,

Sorry I haven't responded in forever, I am just curious if there is a way to reference the target object?

You reference the source object using "$srcobj". I am curious if there is something similar to reference the target object?

Cheers

Hi Richard,

Sorry I haven't responded in forever, I am just curious if there is a way to reference the target object?

You reference the source object using "$srcobj". I am curious if there is something similar to reference the target object?

Cheers

You can use $dstobj in a similar fashion for mapped target objects.

Todd,

You can use "$dstObj" to reference the target object. For example:

$dstObj["DisplayName"]

Hi Terrance,

Thank you!

Can you reference any target object attribute? Or only attributes that are set to be synced?

I'm pretty sure the attribute has to be "mapped" in the workflow step if you want to reference it via the $DstObj hash table.

Hey, 

So I tested this out, it appears to be able to reference any attribute, not just ones set for synchronization.

I tested with the deprovision status attribute. I queried for it's value and was able to send an email based on it's value.

This is really handy for our case!