Anonymous_User

Absent Member.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
2015-03-09
13:23
172 views
Where to change search logic
Hi all: When we first started using IDM, it was simply to add eDir users to a domain in a flat structure. I still do not need a full mirrored sync, I do want to move users into different OUs just to keep them straight. I can manually move newly created users, but I need to change where/how the driver searches for users.
Currently the driver just looks in:
CN=Users,DC=XXX,DC=AD
I would like the driver to look in these three locations:
CN=Users,CN=SITE1,DC=XXX,DC=AD
CN=Users,CN=SITE2,DC=XXX,DC=AD
CN=Users,CN=SITE2,DC=XXX,DC=AD
Which policy controls the searching?
2 Replies

Knowledge Partner
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
2015-03-09
13:35
Re: Where to change search logic
On 3/9/2015 9:23 AM, cmosentine wrote:
> Hi all: When we first started using IDM, it was simply to add eDir
> users to a domain in a flat structure. I still do not need a full
> mirrored sync, I do want to move users into different OUs just to keep
> them straight. I can manually move newly created users, but I need to
> change where/how the driver searches for users.
>
> Currently the driver just looks in:
> CN=Users,DC=XXX,DC=AD
>
> I would like the driver to look in these three locations:
> CN=Users,CN=SITE1,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
>
> Which policy controls the searching?
Searching for users, might be called Matching users?
Thus the sub-mp set of policies.
The shipping policies are not as directly simple as 1 place to look.
They try to interact in a way that allows additional policies.
Thus I would consider adding a policy, linked after the shipping
policies that does a series of Find Matching objects, one for each
subtree you are looking into.
The Find Matching token is smart enough to know, that when a Destination
DN (XPATH @dest-dn) is found to not search again.
So if you had 5 do-find-matching tokens, one after another, as soon as
one of those 5 found a match, it sets the Destintation DN, and the
following tokens see it, and basically silently do nothing.
> Hi all: When we first started using IDM, it was simply to add eDir
> users to a domain in a flat structure. I still do not need a full
> mirrored sync, I do want to move users into different OUs just to keep
> them straight. I can manually move newly created users, but I need to
> change where/how the driver searches for users.
>
> Currently the driver just looks in:
> CN=Users,DC=XXX,DC=AD
>
> I would like the driver to look in these three locations:
> CN=Users,CN=SITE1,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
>
> Which policy controls the searching?
Searching for users, might be called Matching users?
Thus the sub-mp set of policies.
The shipping policies are not as directly simple as 1 place to look.
They try to interact in a way that allows additional policies.
Thus I would consider adding a policy, linked after the shipping
policies that does a series of Find Matching objects, one for each
subtree you are looking into.
The Find Matching token is smart enough to know, that when a Destination
DN (XPATH @dest-dn) is found to not search again.
So if you had 5 do-find-matching tokens, one after another, as soon as
one of those 5 found a match, it sets the Destintation DN, and the
following tokens see it, and basically silently do nothing.
Anonymous_User

Absent Member.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content
2015-03-09
14:30
Re: Where to change search logic
On Mon, 09 Mar 2015 13:23:52 +0000, cmosentine wrote:
> Hi all: When we first started using IDM, it was simply to add eDir
> users to a domain in a flat structure. I still do not need a full
> mirrored sync, I do want to move users into different OUs just to keep
> them straight. I can manually move newly created users, but I need to
> change where/how the driver searches for users.
>
>
>
> Currently the driver just looks in:
>
> CN=Users,DC=XXX,DC=AD
>
>
>
> I would like the driver to look in these three locations:
>
> CN=Users,CN=SITE1,DC=XXX,DC=AD
>
> CN=Users,CN=SITE2,DC=XXX,DC=AD
>
> CN=Users,CN=SITE2,DC=XXX,DC=AD
I don't think you're talking about searching here, I think you're talking
about placement. See the Subscriber channel, Placement policy rules.
For an overview of "what goes where", you might want to read my
CoolSolutions article here:
https://www.netiq.com/communities/cool-solutions/guided-tour-novell-
identity-manager-2/
--
--------------------------------------------------------------------------
David Gersic dgersic_@_niu.edu
Knowledge Partner http://forums.netiq.com
Please post questions in the forums. No support provided via email.
If you find this post helpful, please click on the star below.
> Hi all: When we first started using IDM, it was simply to add eDir
> users to a domain in a flat structure. I still do not need a full
> mirrored sync, I do want to move users into different OUs just to keep
> them straight. I can manually move newly created users, but I need to
> change where/how the driver searches for users.
>
>
>
> Currently the driver just looks in:
>
> CN=Users,DC=XXX,DC=AD
>
>
>
> I would like the driver to look in these three locations:
>
> CN=Users,CN=SITE1,DC=XXX,DC=AD
>
> CN=Users,CN=SITE2,DC=XXX,DC=AD
>
> CN=Users,CN=SITE2,DC=XXX,DC=AD
I don't think you're talking about searching here, I think you're talking
about placement. See the Subscriber channel, Placement policy rules.
For an overview of "what goes where", you might want to read my
CoolSolutions article here:
https://www.netiq.com/communities/cool-solutions/guided-tour-novell-
identity-manager-2/
--
--------------------------------------------------------------------------
David Gersic dgersic_@_niu.edu
Knowledge Partner http://forums.netiq.com
Please post questions in the forums. No support provided via email.
If you find this post helpful, please click on the star below.