Differences

This shows you the differences between two versions of the page.

--- tutorial:dev:ad_groups_sync_workflow [2019/08/29 13:35]
stloukalp
+++ tutorial:dev:ad_groups_sync_workflow [2019/11/21 11:50]
kopro add information about core version
@@ Line 1: / Line 1: @@
 ====== Systems - Groups synchronization workflow ======
+{{tag>workflow ad ldap roles groups synchronization member memberOf}}
+<note important>Current stable version of this workflow can be found in [[devel:documentation:modules_extras|extras module]]. Please **is highly recommended** use version from extras instead of core version.</note>
 This tutorial is intended as a guide to modify workflow for synchronization groups from Active Directory.
@@ Line 51: / Line 54: @@
 With button **Add** you can add any property described bellow and configure workflow.
   * **idm.pub.acc.syncRole.role.canBeRequested** - (true/false, default: false) - sets to all roles, if the role can be requested by identity
+  * **idm.pub.acc.syncRole.role.update.manageCanBeRequested** - (true/false, default: false) - enable/disable setting can-be-requested role attribute
   * **idm.pub.acc.syncRole.system.mapping.objectClassName** - (default: \_\_ACCOUNT\_\_) this is important to provisioning member attribute of identity. It is an object class name of identity schema. It supposedly can stay as "\_\_ACCOUNT\_\_"
   * **idm.pub.acc.syncRole.system.mapping.attributeMemberOf** - (default: ldapGroups) - it is the name of an attribute in a mapping of identity provisioning. It is usually memberOf or ldapGroup. This attribute will be added to role's mapping with tramsformation script (which will be set later). -
   * **idm.pub.acc.syncRole.system.mapping.attributeRoleIdentificator** - (default: distinguishedName) - the name of an attribute in the connector, which holds the distinguished name of a role.
-  * **idm.pub.acc.syncRole.provisioningOfIdentities.system.code** - (default: null) - it is code (name) of the system, where identities have provisioning.
+  * **idm.pub.acc.syncRole.provisioningOfIdentities.system.code** - (default: null, _**mandatory**_) - it is code (name) of the system, where identities have provisioning.It is now mandatory attribute, otherwise workflow will not be working.
   * **idm.pub.acc.syncRole.identity.eav.externalIdentifier.code** - (default: null) - code of eav of a distinguished name of identities. it is used in creating entity in the situation of a Missing entity. It is important when groups in AD already have members and some of the identities DNs cannot be calculated again.
   * **idm.pub.acc.syncRole.roleCatalog.ResolveCatalog** - (true/false, default: true) - This property will disable creating of catalogue.
@@ Line 60: / Line 64: @@
   * **idm.pub.acc.syncRole.roles.allToOneCatalog** - (default: null) - Add name of catalog. all roles will be added to this 'folder'
   * **idm.pub.acc.syncRole.roles.attributeNameOfMembership** - (default: member) - it is name of attribute of role in source system, which holds identificators of identities
-  * **idm.pub.acc.syncRole.roleCatalog.catalogueTreeInOneCatalog** - (default: null) - if creating of catalog like DN is enabled, this property will create tree of catalogues under root catalog. Name of this root catalog set in this property.
+  * **idm.pub.acc.syncRole.roleCatalog.catalogueTreeInOneCatalog** - (default: null) - if creating of catalog like DN is enabled, this property will create tree of catalogues under root catalog. Name of this root catalog set in this property. Catalogue folder have to and will be created in workflow process. If this property will be changed, new catalog folder will be created. Name of catalogues can be changed in IdM.
   * **idm.pub.acc.syncRole.roleSystem.forwardManagement.value** - (default: false) - When role is created with connected system and it manages membership. In this case there is option 'forward management'. This property will set this option.
   * **idm.pub.acc.syncRole.roleSystem.update.manageforwardManagement** - (default: false) - This property will manage 'forward management' option even on update roles.