Where to change search logic

[Anonymous_User]

Hi all: When we first started using IDM, it was simply to add eDir users to a domain in a flat structure. I still do not need a full mirrored sync, I do want to move users into different OUs just to keep them straight. I can manually move newly created users, but I need to change where/how the driver searches for users.



Currently the driver just looks in:

CN=Users,DC=XXX,DC=AD



I would like the driver to look in these three locations:

CN=Users,CN=SITE1,DC=XXX,DC=AD

CN=Users,CN=SITE2,DC=XXX,DC=AD

CN=Users,CN=SITE2,DC=XXX,DC=AD



Which policy controls the searching?

[geoffc]

On 3/9/2015 9:23 AM, cmosentine wrote:
> Hi all: When we first started using IDM, it was simply to add eDir
> users to a domain in a flat structure. I still do not need a full
> mirrored sync, I do want to move users into different OUs just to keep
> them straight. I can manually move newly created users, but I need to
> change where/how the driver searches for users.
>
> Currently the driver just looks in:
> CN=Users,DC=XXX,DC=AD
>
> I would like the driver to look in these three locations:
> CN=Users,CN=SITE1,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
>
> Which policy controls the searching?

Searching for users, might be called Matching users?

Thus the sub-mp set of policies.

The shipping policies are not as directly simple as 1 place to look.
They try to interact in a way that allows additional policies.

Thus I would consider adding a policy, linked after the shipping
policies that does a series of Find Matching objects, one for each
subtree you are looking into.

The Find Matching token is smart enough to know, that when a Destination
DN (XPATH @dest-dn) is found to not search again.

So if you had 5 do-find-matching tokens, one after another, as soon as
one of those 5 found a match, it sets the Destintation DN, and the
following tokens see it, and basically silently do nothing.

[Anonymous_User]

On Mon, 09 Mar 2015 13:23:52 +0000, cmosentine wrote:

> Hi all: When we first started using IDM, it was simply to add eDir
> users to a domain in a flat structure. I still do not need a full
> mirrored sync, I do want to move users into different OUs just to keep
> them straight. I can manually move newly created users, but I need to
> change where/how the driver searches for users.
>
>
>
> Currently the driver just looks in:
>
> CN=Users,DC=XXX,DC=AD
>
>
>
> I would like the driver to look in these three locations:
>
> CN=Users,CN=SITE1,DC=XXX,DC=AD
>
> CN=Users,CN=SITE2,DC=XXX,DC=AD
>
> CN=Users,CN=SITE2,DC=XXX,DC=AD

I don't think you're talking about searching here, I think you're talking
about placement. See the Subscriber channel, Placement policy rules.

For an overview of "what goes where", you might want to read my
CoolSolutions article here:

https://www.netiq.com/communities/cool-solutions/guided-tour-novell-
identity-manager-2/


--
--------------------------------------------------------------------------
David Gersic dgersic_@_niu.edu
Knowledge Partner http://forums.netiq.com

Please post questions in the forums. No support provided via email.
If you find this post helpful, please click on the star below.