• State Suggested Answer
  • Replies 11 replies
  • Answers 1 answer
  • Subscribers 67 subscribers
  • Views 5994 views
  • Users 0 members are here
Options
Related

Detect changes that occur in Active Directory (not AR) and trigger an action?

todd harrison

Hey,

Is it at all possible for Active Roles to trigger off of a change made in the underlying Active Directory as opposed to within Active Roles itself?

Scenario:

  • A computer has BitLocker enabled and the keys are transferred to associated Active Directory computer object.
  • When Active Roles detects that the computer object now has keys or those keys have been updated, a script is triggered to do some thing.

I suspect this is not possible because when I check the Change Log in AR, there is no mention of keys being added to the computer object. I understand why this happens and didn't expect to see that in the AR logs, but I am just curious if there are any other methods for detecting something like this.

Regards,

Todd

Parents
  • 0

    This ask can be done in Active Roles in two ways:

    1) Via a custom policy script.

    2) Via a scheduled Automation Workflow.

    A custom policy script can be triggered by native changes if the associated policy is set to "Handle changes from DirSync control"

    For more information, see this solution:

    Title: Active Roles Provisioning Policies are only triggered by Active Roles clients

    Solution: 311680

    URL: https://support.oneidentity.com/kb/311680

    Although an Automation Workflow is not a "triggered change", the end result may be just about the same due to delays resulting from Active Directory replication.

  • 0 in reply to Terrance.Crombie

    Hello 

    I'm trying to configure a password change in AD to trigger a modification of a virtual attribute in ARS using Dir Sync control via policy object script. 

    The script is below however when I change the password in native AD I don't see any modification. Is there something wrong with the script? 

    function IsAttributeModified ([string]$AttributeName, $Request)
    {
    $objEntry = $Request.GetPropertyItem($AttributeName, $Constants.ADSTYPE_CASE_IGNORE_STRING)
    if ($objEntry -eq $null) { return $false }
    if ($objEntry.ControlCode -eq 0) { return $false }
    return $true
    } #-- IsAttributeModified

    function onPostModify($Request)
    {
    if($Request.class -ne 'user'){return}

    if(IsAttributeModified 'userPassword' $Request)
    {
    Set-QADObject -proxy $Request.DN -ObjectAttributes @{'edsvaAmundiInviteMailboxCreation'=$TRUE}
    }
    }

  • 0 in reply to enda walsh

    "userPassword" is not a real attribute.

    Try changing the trigger to check for when "pwdlastset" is updated. This attribute is typically only updated by a password change.

  • 0 in reply to enda walsh

    I had an onPostModify script output the attributes it is seeing from DirSync upon a password reset/change made outside of Active Roles (same attributes are logged in each case), so as Terrance indicated, pwdlastset could be a good candidate to queue off of.

    dBCSPwd
    unicodePwd
    ntPwdHistory
    pwdLastSet
    supplementalCredentials
    lmPwdHistory

Reply
  • 0 in reply to enda walsh

    I had an onPostModify script output the attributes it is seeing from DirSync upon a password reset/change made outside of Active Roles (same attributes are logged in each case), so as Terrance indicated, pwdlastset could be a good candidate to queue off of.

    dBCSPwd
    unicodePwd
    ntPwdHistory
    pwdLastSet
    supplementalCredentials
    lmPwdHistory

Children
No Data