Systems - AD: Remove group membership when the contract is excluded

By default, when a contract is excluded, IdM will not remove the account's group membership but only set the account as inactive. However, it is possible to turn this behavior on for some AD roles.

As a result of the setting shown below, when an identity's contract becomes excluded, the account will stop being a member of the respective group in AD.

However, the role will not be removed from the contract. When the exclusion of the identity's contract ends, the account will be set to the group in AD again. The business use case is simple: during the contract exclusion (e.g. parental leave), remove the accounts of the identities from some AD groups, but once the exclusion ends, return original group membership to them so they can work again.

If you don't want all the roles to behave this way, you can set this behavior for each role separately. First, go to the detail of the role in IdM by clicking the magnifying glass next to the role's name.

In the detail, go to Systems.

Open the detail by clicking the magnifying glass. You will see this.

Open the detail of the attribute ldapGroups by clicking the magnifying glass. You will see this.

Check the checkbox next to "Skip value when contract is excluded" and save your changes. That's it, now the the account's group membership will be removed when the contract becomes excluded.

Alternatively, you can use the regular synchronization of AD groups to set this behavior for some AD roles since this synchronization uses our workflow to do many things related to managing AD groups. You can configure the workflow to set the behavior only on creating of the roles, or anytime the synchronization runs.

In the left menu, go to Settings > Configuration.

Then when you click the green button Add, a dialog will open.

Type in Key

idm.pub.acc.syncRole.roles.nameOfRoles.doNotSentValueOnExclusion

and as a Value, type in the names of the relevant roles separated by comma. You can only use this if your roles do not have a comma in their names!

Click save. When the next synchronization runs and creates new roles, the roles specified in the Value here will be set so their respective groups will be removed from the account, when the contract of the account's owner becomes excluded.

If the roles already exist and you want to set this behavior to them during the synchronization, you must specify also another property. As shown above, add a new property with Key

idm.pub.acc.syncRole.roles.update.nameOfRoles.manageSentValueOnExclusion

and Value "true" as shown here.

Click save. During the next synchronization of AD groups, all AD roles specified in the property idm.pub.acc.syncRole.roles.nameOfRoles.doNotSentValueOnExclusion will be set to this behavior.