prevent remove-all-values in group membership

sitrep

2 AD's, IDM in the middle

We need to be able to sync groups across from one AD to another,  but the destination AD may have different members of the same groups. destination AD does not write back to the vault.

Tried to do this on the sub OTP for groups only

 

<actions> <do-strip-xpath expression="modify-attr[remove-all-values and not(add-value)]"/> </actions>

 

 

but that didn't seem to work properly . 

Basically, we need to remove the "remove-all-values" from the transactions so that only the members from the Vault  get sync'd without overwriting the complete group membership in the destination AD 

Thanks in Advance!

Parents
  • Verified Answer

    You can try this expression:
    do-strip-xpath("modify-attr[@attr-name="memberOf"]/remove-all-values")

    You can "adjust" filter according to your attribute name (in this example I used attribute "memberOf"


    Example from Designer Simulator:
    <?xml version="1.0" encoding="UTF-8"?><nds dtdversion="4.0" ndsversion="8.x">
    <source>
    <product version="4.8.0.1">DirXML</product>
    <contact>NetIQ Corporation</contact>
    </source>
    <input>
    <modify class-name="User" qualified-src-dn="o=dirXML Test\ou=Users\cn=User1">
    <association>o=dirXML Test\ou=Users\cn=User1</association>
    <modify-attr attr-name="memberOf">
    <remove-all-values/>
    <add-value>
    <value type="string">group1</value>
    </add-value>
    </modify-attr>
    <modify-attr attr-name="Generational Qualifier">
    <remove-all-values/>
    <add-value>
    <value type="string">Qu1</value>
    </add-value>
    </modify-attr>
    </modify>
    </input>
    </nds>
    Generic Null :Applying policy: % CCgroup%-C.
    Generic Null : Applying to modify #1.
    Generic Null : Evaluating selection criteria for rule 'remove-all-group'.
    Generic Null : Rule selected.
    Generic Null : Applying rule 'remove-all-group'.
    Generic Null : Action: do-strip-xpath("modify-attr[@attr-name="memberOf"]/remove-all-values").
    Generic Null :Policy returned:
    Generic Null :
    <nds dtdversion="4.0" ndsversion="8.x">
    <source>
    <product version="4.8.0.1">DirXML</product>
    <contact>NetIQ Corporation</contact>
    </source>
    <input>
    <modify class-name="User" qualified-src-dn="o=dirXML Test\ou=Users\cn=User1">
    <association>o=dirXML Test\ou=Users\cn=User1</association>
    <modify-attr attr-name="memberOf">
    <add-value>
    <value type="string">group1</value>
    </add-value>
    </modify-attr>
    <modify-attr attr-name="Generational Qualifier">
    <remove-all-values/>
    <add-value>
    <value type="string">Qu1</value>
    </add-value>
    </modify-attr>
    </modify>
    </input>
    </nds>

Reply
  • Verified Answer

    You can try this expression:
    do-strip-xpath("modify-attr[@attr-name="memberOf"]/remove-all-values")

    You can "adjust" filter according to your attribute name (in this example I used attribute "memberOf"


    Example from Designer Simulator:
    <?xml version="1.0" encoding="UTF-8"?><nds dtdversion="4.0" ndsversion="8.x">
    <source>
    <product version="4.8.0.1">DirXML</product>
    <contact>NetIQ Corporation</contact>
    </source>
    <input>
    <modify class-name="User" qualified-src-dn="o=dirXML Test\ou=Users\cn=User1">
    <association>o=dirXML Test\ou=Users\cn=User1</association>
    <modify-attr attr-name="memberOf">
    <remove-all-values/>
    <add-value>
    <value type="string">group1</value>
    </add-value>
    </modify-attr>
    <modify-attr attr-name="Generational Qualifier">
    <remove-all-values/>
    <add-value>
    <value type="string">Qu1</value>
    </add-value>
    </modify-attr>
    </modify>
    </input>
    </nds>
    Generic Null :Applying policy: % CCgroup%-C.
    Generic Null : Applying to modify #1.
    Generic Null : Evaluating selection criteria for rule 'remove-all-group'.
    Generic Null : Rule selected.
    Generic Null : Applying rule 'remove-all-group'.
    Generic Null : Action: do-strip-xpath("modify-attr[@attr-name="memberOf"]/remove-all-values").
    Generic Null :Policy returned:
    Generic Null :
    <nds dtdversion="4.0" ndsversion="8.x">
    <source>
    <product version="4.8.0.1">DirXML</product>
    <contact>NetIQ Corporation</contact>
    </source>
    <input>
    <modify class-name="User" qualified-src-dn="o=dirXML Test\ou=Users\cn=User1">
    <association>o=dirXML Test\ou=Users\cn=User1</association>
    <modify-attr attr-name="memberOf">
    <add-value>
    <value type="string">group1</value>
    </add-value>
    </modify-attr>
    <modify-attr attr-name="Generational Qualifier">
    <remove-all-values/>
    <add-value>
    <value type="string">Qu1</value>
    </add-value>
    </modify-attr>
    </modify>
    </input>
    </nds>

Children