Differences

This shows you the differences between two versions of the page.

--- tutorial:adm:systems_-_ad_remove_group_membership_when_the_contract_is_excluded [2020/03/03 15:38]
doischert created
+++ tutorial:adm:systems_-_ad_remove_group_membership_when_the_contract_is_excluded [2020/03/04 08:28]
tsunami ↷ Page moved and renamed from tutorial:adm:systems_-_ad:remove_group_membership_when_the_contract_is_excluded to tutorial:adm:systems_-_ad_remove_group_membership_when_the_contract_is_excluded
@@ Line 1: / Line 1: @@
 ====== Systems - AD: Remove group membership when the contract is excluded ======
-By default, when a contract is excluded, IdM will not remove the account's group membership but only set the account as inactive. However, it is possible turn this behavior on for selected roles.
+By default, when a contract is excluded, IdM will not remove the account's group membership but only set the account as inactive. However, it is possible to turn this behavior on for some AD roles or even all AD roles.
-As a result, when an identity's contract becomes inactive, this role will be removed from the contract and the account will stop being a member of the respective group in AD.
+As a result of the setting shown below, when an identity's contract becomes inactive, this role will be removed from the contract and the account will stop being a member of the respective group in AD.
 ===== Change behavior for individual roles =====
@@ Line 15: / Line 15: @@
 {{ :tutorial:adm:systems_-_ad:02.png?direct&1000 |}}
-Open the detail by clicking the magnifying glass, you will see this.
+Open the detail by clicking the magnifying glass. You will see this.
+{{ :tutorial:adm:systems_-_ad:03.png?direct&600 |}}
+Open the detail of the attribute ldapGroups by clicking the magnifying glass. You will see this.
-===== Set it on for all roles in the AD synchronization workflow =====
+{{ :tutorial:adm:systems_-_ad:04.png?direct&600 |}}
+{{ :tutorial:adm:systems_-_ad:05.png?direct&600 |}}
+Check the checkbox next to "Skip value when contract is excluded" and save your changes. That's it, now the role and the account's group membership will be removed when the contract becomes inactive.
+===== Set this behavior on using the AD synchronization workflow =====
+Alternatively, you can use the regular synchronization of AD groups to set this behavior for some or all AD roles since this synchronization uses our [[tutorial:dev:ad_groups_sync_workflow|workflow]] to do many things related to managing AD groups.
+First, I will show you how to turn this feature on for all AD roles.
+<note tip>This requires you to have the current workflow from the Extras module! Older versions will not support this.</note>
+<note warning>Be very careful here and make sure that you really want all AD roles to be removed from the contract when the contract becomes inactive!</note>
+In the left menu, go to Settings > Configuration.
+{{ :tutorial:adm:systems_-_ad:06.png?direct&600 |}}
+Then when you click the green button Add, a dialog will open. Type in Key
+<code>idm.pub.acc.syncRole.roles.update.nameOfRoles.manageSentValueOnExclusion</code>
+and Value "true" as shown here.
+{{ :tutorial:adm:systems_-_ad:07.png?direct&600 |}}
+Click save. During the next synchronization of AD groups, all AD roles will automatically set to be removed from inactive contracts (even existing ones.
+You can also use this workflow to set this behavior for individual roles in bulk. As shown above, add a new property with Key
+<code>idm.pub.acc.syncRole.roles.nameOfRoles.doNotSentValueOnExclusion</code>
+and as a Value, type in the names of the relevant roles separated by comma. You can only use this if your roles do not have a comma in their names!
+{{ :tutorial:adm:systems_-_ad:08.png?direct&600 |}}
+Click save. When the next synchronization runs, all roles specified in the Value here will be set to be removed the contract becomes inactive.