IDM policy: get members of dynamics group

[motios]

I am trying to get dynamics group members using query from policy

I have dynamics group(not nested) with filter which set 1 member.

When I try to get members from policy query:

<do-set-local-variable name="groupQuery" scope="policy">
<arg-node-set>
<token-query datastore="src" max-result-count="1" scope="entry">
<arg-dn>
<token-local-variable name="groupDN"/>
</arg-dn>
<arg-string>
<token-text xml:space="preserve">Member</token-text>
</arg-string>
<arg-string>
<token-text xml:space="preserve">Description</token-text>
</arg-string>
</token-query>
</arg-node-set>
</do-set-local-variable>

if group is not dynamics i receive members.

if group is dynamics i not receive members.

[geoffc]

There is a specail attribute, whose name I cannot find, and I think it [pseudo] or .[pseudo] to search for.

I am not sure if the engine will return the members of a dynamic group, but you could use the LDAP ECMA search in LibLDAP that MF provides or Lothars better version.

[klasen]

See https://community.microfocus.com/t5/eDirectory-User-Discussions/Problem-with-dynamic-group-members/m-p/2209793/highlight/true#M3033

[geoffc · Accepted solution]

Thanks Norbert!  My Google-Fu failed me on that one... I knew I knew it but coould not remember the details.

The highlight of the thread is what Lothar wrote:

---

Yes, token-src-attr can do it. There's an ECV that controls how the Member
attribute of dynamic groups is read. In 3.6 Member would return dynamic
members, in 4.x that changed to only static members and [pseudo].Member was
added to access the dynamic member list. The ECVs (i) button in Designer
explains this quite well.

---

[motios]

ELC for ever!!!

thanks

it's work!!!