Exclude some AD groups from automatic removal due to expired employee's exitdate

One idea is to do this via MatchPatternForMembership.

That means: The TSBBehavior is configured so that memberships are always retained.

The categories [0] "NormalGroup" and [1] "KeepGroup" are defined for "Group", above which the (manual) identification of the groups takes place.

For "Account" there are the categories [0] "InheriteNormalGroups" and [1] "InheriteKeepGroups". These are set on the accounts using a template.

First of all, all accounts have set [0] and [1]. For example, if an account is disabled, [0] is removed. The account then loses all inherited NormalGroups and only keeps the KeepGroups.

BUT: This only works for inherited groups. 

Solution: You need to build a process that converts all direct membership into orders for terminated users.

It's not as small as you might have hoped but it should work.

Hello Markus,

Thank you for your feedback. Although I do not yet understand what you are telling me, it seems interesting. I tried to look for more information on the concept of MatchPatternForMembership but could not find much of that. Can you point me to a reference page that tells me more about MatchPatternForMembership?

Thank you in advance.

Regards,

Wilke

Hello Markus,

Thank you for your feedback. Although I do not yet understand what you are telling me, it seems interesting. I tried to look for more information on the concept of MatchPatternForMembership but could not find much of that. Can you point me to a reference page that tells me more about MatchPatternForMembership?

Thank you in advance.

Regards,

Wilke

Sorry, Wilke. MatchPatternForMembership is the property name at a group used for the feature "group inheritance based on categories". You will find more here:

https://support.oneidentity.com/technical-documents/identity-manager/8.1.5/administration-guide-for-connecting-to-active-directory/36#TOPIC-1645496

Hello Markus,

Works like a charm. Thank you. Can you confirm that when we would like to take advantage of AD group inheritance using categories we need to attribute all AD groups with the required categories?

Thank you.

Regards,

Mrs. Wilke Jansoone

When you want to take advantage of your solution for every group you need to tag them, yes. But in general, untagged groups will be inherited regardless if the user is tagged or not (at least this is how I am remembering it). But this should be explained in the docs as well.

Hello Markus,

Do I have it correct that when you disable the 'retain groups' options for AD manage levels, AD group membership is controlled via inheritance. The inheritance is then either based on assignment via roles or based on categories. So the only way to remove AD group membership is to disable inheritance, either by removing role assignment or category mapping.

One last question, is AD group membership via inheritance through categories a robust way to manage ad group membership in a more granular fashion?

Thank you in advance.

Regards,

Mrs. Wilke Jansoone

Wilke Jansoone said:

Do I have it correct that when you disable the 'retain groups' options for AD manage levels, AD group membership is controlled via inheritance. The inheritance is then either based on assignment via roles or based on categories. So the only way to remove AD group membership is to disable inheritance, either by removing role assignment or category mapping.

No, when you disable "retain groups on..." all group memberships will be inactived (XIsInEffect=1) but the entries are still in the database to be able to re-activate those memberships.

Wilke Jansoone said:

One last question, is AD group membership via inheritance through categories a robust way to manage ad group membership in a more granular fashion?

Yes, but it depends on how many categories you are having (current limit is 32, coming with version 8.2 it will be 64)