Active Directory sync - OneIM as master on specific groups

Question

Hi,

Is it possible to configure One Identity as master on a subset of all AD-groups? We want to be able to take full control over specific groups (preferably via a flag on the groups) while still remaining in partial control over all other groups.

Full control:
- If a user is added directly in AD and not in OneIM, this membership is removed in the next sync

Partial control:
- If a user is added directly in AD and not in OneIM, this membership is synced into OneIM

I'm thinking that I can create a new mapping/workflow in the sync-project for the full control groups, but I'm not sure how to solve this.

Are Sandnes · Accepted Answer

I think I got it to work. Here is what I have done: 1. Extended the ADSGroup table with a new Boolean column, "CCC_FullControl" 2. Created two new schema classes for OneIM, one named "ADSGroup(OneIM as Master)" with select objects condition CCC_FullControl='True' and one named "ADSGroup(AD as Master)" with CCC_FullControl='False' 3. Created two new schema classes for AD, one named "group(OneIM as Master)" with select objects condition extensionAttribute1='True' and one named "group(AD as Master)" with extensionAttribute1<>'True' 4. Edited the default group-mapping to map between "ADSGroup(AD as Master)" and "group(AD as Master)" and added mapping between CCC_FullControl and extensionAttribute1 5. Added a new mapping to map between "ADSGroup(OneIM as Master)" and "group(OneIM as Master)" based on the previous mapping, with mapping direction: Target system. Some of the mapping rules (such as Members_OUT) are set to correct rouge modifications. The Members_IN mapping is removed. 6. Added a new workflow called "Group Sync (OneIM as Master)" with sync-direction One Identity Manager. This is responsible for overwriting changes done directly in AD. Contains only one step, group (OneIM as Master), that updates modified objects when synchronizing from target system to One Identity Manager 7. Edited the default Provisioning workflow to add a step for "group (OneIM as Master)" 8. Added a Start up configuration for Group Sync (OneIM as master) Thank you for pointing me in the right direction, Tomi

Endpoint Privilege Management

Active Directory sync - OneIM as master on specific groups

Top Replies