Active Role access template exclusion

Question

Active Role access template exclusion : I have created Access template for access management team for managing groups like adding\removing members and I have linked that access template to entire domain so access management team can manage the groups in entire domain but I need few groups to be excluded and only Domain admin can manage those groups.

Stu.Pollock · Accepted Answer

Hi bhupeshkumar matwale 
 I agree with Terrance.Crombie , with the information you've suplied above, you're going to be better having a managed unit, but I'd flip it on its head a bit. 
 If you're going to need to set a value on a group, it might be better to do that on the groups you don't want them to manage. 
 So the option here would be either as Terrance mention, 
 1) create a VA linked to a group object, which is stored and of type boolean, then set it for groups that cannot be managed by the Access Management Team 
 2) Identify an existing attribute/property of the group, which is already used (consistanly) which can have some value to exclude these grousp 
 Then create a managed unit, with some membership rule similar to the below LDAP (but changed for your purposes) 
 (&(objectCategory=group)(objectClass=group)(!(edsvaExcludeFromGroupManagement=true)) 
 or 
 (&(objectCategory=group)(objectClass=group)(!(Description=ADMIN GROUP)) 
 Note: carefully plan your query, 1) so you don't accidentally include the wrong groups, but also 2) try to ensure you're using exact queries, and if possible if an AD query, an indexed attribute,

Stu.Pollock · Answer

Hi bhupeshkumar matwale 
 There are a couple of different ways you could achieve what is needed here 
 
 Instead of linking your AT (Access Template) against the "Active Directory" or managed domain, selectively assigned against the OU's where the group that Access Management Team should be able to manage 
 Create a managed unit, which membership rules which include all the groups the Access Management Team should manage (you could also include an additional exclude rule if needed, but you should aim to use one membership rule). Once created, and happy with the groups listed, remove the existing ATL (Access Template Link), where you've linked you Access Management Team, and your AT against the domain, then create the link against the managed unit. This way any group in scope of the managed unit, will grant your Access Management Team permissions assigned by the AT. This is generally useful when you have the groups you do and dont want to be managed in the same OUs. Your membership rule will need to have something set (or already set) against the group to be managed, so you can seperate the two. Or explicity add the groups that should be managed. 
 If there are only a small number of groups that don't need to be managed, you could create another AT, which deny's the permissions, then link to the group you don't want to be managed by these users. I'm personally not a fan of using Deny permissions, when you can just not grant the permissions or assign the permissions to the objects in the first place. 
 
 Hope this helps 
 
 Stu

Terrance.Crombie · Answer

So: you have a small set of Active Directory groups that are not related in any way. I would suggest creating a relationship and then using Option 2 suggested by Stu. 
 Create an Active Roles Virtual Attribute linked to group objects. Stored, boolean syntax. Call it something like: edsvaExcludeFromGroupManagement. 
 Create a Managed Unit that populates all groups and excludes groups where edsvaExcludeFromGroupManagement is set to TRUE 
 Set this flag manually on each of the desired groups. 
 Delegate management permissions on the Managed Unit.

Endpoint Privilege Management

Active Role access template exclusion

Top Replies