eDirectory LDAP fulfillment -- calling for example /use

[sma2006]

So, I tried to start again from scratch with the ADIR permissions/accounts:

1) Delete the current AD application data source --> OK
2) Create new application data source --> OK
3) Add AD account collector with default value --> OK
4) Collect & publish --> get new accounts for AD users that are mapped with Identities --> OK
5) Add AD permission collector with default value --> OK
6) Collect & publish again --> get new permisssions for group membership of AD account --> OK
7) All identities from AD Identity source are mapped with AD account (same source) and get permissions (AD group) and also groups (same AD group).


This looks ok , now , I'm going to configure and test the LDAP fulfillment.

[sma2006]

I made a try with a CSV fulfillment for AD permission, just to see attributes availability and I get this:

changeItemId,changeRequestType,fulfillmentInstructions,userName,account,appName,reason,permName
"19","ADD_PERMISSION_TO_USER","","John Demo","","AD Account Permissions","Add Permission to user for permission ERP_Administrators to be given to John Demo requested by John Demo. Reason for request: test; test","ERP_Administrators"

And I can see there is no account ?

Let's try now with LDAP fulfillment.

[sma2006]

Still error : y
May 21, 2019 5:53:58 PM
Comment: Item 'ADD_PERMISSION_TO_USER' does not contain all required provisioning attributes (permProvAttr, permProvId, accountProvId).

With LDAP Fulfillment

[sma2006]

Reading your answer again, I think I found the problem, the default mapping for "permission-account or user mapping" is User ID from source and NOT Account ID from source.


Now after changing this I get the following with CSV fulfillment :

changeItemId,changeRequestType,fulfillmentInstructions,userName,account,appName,reason,permName
"22","ADD_PERMISSION_TO_USER","","John Demo","CN=John Demo,OU=users,OU=idsa,DC=demoidsa,DC=com","AD Account Permissions","Add Permission to user for permission ERP_Administrators to be given to John Demo requested by John Demo. Reason for request: Test; Test with member mapped to Account ID from source","ERP_Administrators"


And finally , the LDAP AD Fulfillment get :

Fulfilled Via DAAS
May 21, 2019 6:07:13 PM
Comment: Change Item '23' Fulfilled. Type: ADD_PERMISSION_TO_USER, Target Account: CN=John Demo,OU=users,OU=idsa,DC=demoidsa,DC=com, Target Permission: CN=ERP_Administrators,OU=groups,OU=idsa,DC=demoidsa,DC=com
Verification required

Great , it works !!!!

Thanks a lot for you valuable help.

Sylvain

[geoffc]

On 5/21/2019 12:14 PM, sma wrote:
>
> Reading your answer again, I think I found the problem, the default
> mapping for "permission-account or user mapping" is User ID from source
> and NOT Account ID from source.
>
>
> Now after changing this I get the following with CSV fulfillment :
>
> changeItemId,changeRequestType,fulfillmentInstructions,userName,account,appName,reason,permName
> "22","ADD_PERMISSION_TO_USER","","John Demo","CN=John
> Demo,OU=users,OU=idsa,DC=demoidsa,DC=com","AD Account Permissions","Add
> Permission to user for permission ERP_Administrators to be given to John
> Demo requested by John Demo. Reason for request: Test; Test with member
> mapped to Account ID from source","ERP_Administrators"
>
>
> And finally , the LDAP AD Fulfillment get :
>
> Fulfilled Via DAAS
> May 21, 2019 6:07:13 PM
> Comment: Change Item '23' Fulfilled. Type: ADD_PERMISSION_TO_USER,
> Target Account: CN=John Demo,OU=users,OU=idsa,DC=demoidsa,DC=com, Target
> Permission: CN=ERP_Administrators,OU=groups,OU=idsa,DC=demoidsa,DC=com
> Verification required

Woo Hoo! I got one right! See what I mean about thiis aspect being a
little bit confusing?

[stevewdj]

On 5/21/19 12:14 PM, sma wrote:
>
> Reading your answer again, I think I found the problem, the default
> mapping for "permission-account or user mapping" is User ID from source
> and NOT Account ID from source.
>
>
> Now after changing this I get the following with CSV fulfillment :
>
> changeItemId,changeRequestType,fulfillmentInstructions,userName,account,appName,reason,permName
> "22","ADD_PERMISSION_TO_USER","","John Demo","CN=John
> Demo,OU=users,OU=idsa,DC=demoidsa,DC=com","AD Account Permissions","Add
> Permission to user for permission ERP_Administrators to be given to John
> Demo requested by John Demo. Reason for request: Test; Test with member
> mapped to Account ID from source","ERP_Administrators"
>
>
> And finally , the LDAP AD Fulfillment get :
>
> Fulfilled Via DAAS
> May 21, 2019 6:07:13 PM
> Comment: Change Item '23' Fulfilled. Type: ADD_PERMISSION_TO_USER,
> Target Account: CN=John Demo,OU=users,OU=idsa,DC=demoidsa,DC=com, Target
> Permission: CN=ERP_Administrators,OU=groups,OU=idsa,DC=demoidsa,DC=com
> Verification required
>
> Great , it works !!!!
>
> Thanks a lot for you valuable help.
>
> Sylvain
>
>
Greetings,
This shows that you were not correctly set-up. As I outlined
earlier you have to go Permission -> Account -> Identity. You were sill
going Permission -> Identity.


--
Sincerely,
Steven Williams
Principal Enterprise Architect
Micro Focus