On 3/9/2015 9:23 AM, cmosentine wrote:
> Hi all: When we first started using IDM, it was simply to add eDir
> users to a domain in a flat structure. I still do not need a full
> mirrored sync, I do want to move users into different OUs just to keep
> them straight. I can manually move newly created users, but I need to
> change where/how the driver searches for users.
>
> Currently the driver just looks in:
> CN=Users,DC=XXX,DC=AD
>
> I would like the driver to look in these three locations:
> CN=Users,CN=SITE1,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
> CN=Users,CN=SITE2,DC=XXX,DC=AD
>
> Which policy controls the searching?
Searching for users, might be called Matching users?
Thus the sub-mp set of policies.
The shipping policies are not as directly simple as 1 place to look.
They try to interact in a way that allows additional policies.
Thus I would consider adding a policy, linked after the shipping
policies that does a series of Find Matching objects, one for each
subtree you are looking into.
The Find Matching token is smart enough to know, that when a Destination
DN (XPATH @dest-dn) is found to not search again.
So if you had 5 do-find-matching tokens, one after another, as soon as
one of those 5 found a match, it sets the Destintation DN, and the
following tokens see it, and basically silently do nothing.
