Powershell Connector M:N Membership Provisions fail

Hi Julian,

during the provisioning process modifications of several kinds are send to the connector depending on the configuration/process. Such modifications can be of type Add, Remove or Replace. To handle this, the following method should help you out:

1. Create a Custom cmdlet that looks similar to the following one. Make sure, that it has at least the parameters Mode, AddItems, RemoveItems and ReplaceItems. Further parameters (such as the identity of the "group" can be added as required)

function Set-Members
{
 param (
 [parameter(Mandatory=$true,ValueFromPipelineByPropertyName=$true)]
 [ValidateNotNullOrEmpty()]
 [String]$identity,

[parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)]
 [ValidateNotNullOrEmpty()]
 [String]$Mode,
 
 [parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)]
 [String[]]$AddItems,
 
 [parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)]
 [String[]]$RemoveItems,
 
 [parameter(Mandatory=$false,ValueFromPipelineByPropertyName=$true)]
 [String[]]$ReplaceItems
 )
 
 switch($mode.ToUpper())
 {
 "MODIFY" #add/remove
 {
 if($AddItems -ne $null)
 {
 #custom cmdlet/script calls to add items
 }
 
 if($RemoveItems -ne $null)
 {
 #custom cmdlet/script calls to remove items
 }
 }
 "REPLACE"
 {
 #custom cmdlet/script calls to replace all existing items
 }
 default
 {
 throw "Invalid mode $mode"
 }
 }
}

2. When you define the property itself (i.e. "Members", make sure that you use the CustomMVP converter)

<Property Name="Members" DataType="String" IsMultivalue="true">
 <ReferenceTargets>
   <ReferenceTarget Class="YourClass1" Property="Identifier" />
   <ReferenceTarget Class="YourClass2" Property="Identifier" />
 </ReferenceTargets>
 <ReturnBindings>
   <Bind CommandResultOf="Get-Group" Path="Members" />
 </ReturnBindings>
 <ModifiedBy>
   <ModBy Command="Set-Members" />
 </ModifiedBy> 
 <CommandMappings>
   <Map ToCommand="Set-Members" Converter="CustomMVP"/>
 </CommandMappings>
 </Property>

3. Add a call to "Set-Members" to your Insert/Update command sequence (don't forget to add the mappings required for the other parameters of Set-Members such as Identity)

 

Hope that helps,

Stefan

Hi Stephan,

your answer helped me a lot as I had similar issue. The one thing I've noticed using the Browse is that I always get the Mode = REPLACE, I wasn't able to get the MODIFY action.
Is it the Browser limitation or is there anything else to configure?

Thanks,
Piotr

Hi Piotr,

unfortunately the Browser always sends "Replace" modifications. When I write those PowerShell definitions I usually create the CustomCommand as script in the PowerShell ISE and test it there in the different modes before putting it in the XML.

Regards,
Stefan

Hi Stefan,

I guess this might be due to some mapping issue, but Provisioning is also always sending REPLACE.

Log:

Mapping configuration:

The mapping has "Maps objects referenced by multi-reference (...)" set.

 

Hi,

Might this behaviour be related to the 'Enable Merging' option for memberships?

https://support.oneidentity.com/technical-documents/identity-manager/8.0/target-system-synchronization-reference-guide/8#TOPIC-863236

cheers,

Rob.

You need to check the "Enable relative complement handling (requred for member rules)" Option and use the "Multi reference rule" for mapping. The engine then calculates the adds/removes and there should be no replace anymore.

@Rob: The "Enable Merging" mode just supresses the difference calculation and just sends the new "adds" or new "removes" stored in DPRMembershipAction to the connector. This prevents overwriting changes, that were done directly in the target system.

Hi Stefan.Boerner

what exactly do you mean with "don't forget to add the mappings required for the other parameters of Set-Members such as Identity"?

Do you mean f.e. the unique key for the users (members)? But this is automatically provided from OIM with the "AddItems" or "RemoveItems" parameter isn't it?

I am asking because in my case the "Set member" function isn not called anymore after I have done the changes in the Mapping that you have requested.

Do you have an idea what could be the problem?

Thanks and kind regards

Kirsten