Pre-populate the process form as part of Role Alignment - Need suggestion

Question

Hi,
As part of implementation we are going to take over the Provisioning of AD (Via Groups-->Access Policy) using OIM which was initially configured to provision manually. Now as part of migration we required to assign a base group to the users who has already AD reconciled resource (and align it with policy via SQL updates -->POL_key is process form, OIU_POLICY_BASED in OIU table). We are doing this as part of direct SQL updates. The other part of the requirement to align the process form values using the configured pre-populate adapters (for e.g. if the current value of any attribute is X and the prepopulate adapter suggest that it should be Y then the migration should also update this attribute.) We tried to use the prepopulateProcessForm API of tcFormInstanceOperationsIntf but it seems this is working only when the System Validation is in Pending state. The other option we are thinking of putting java code and then call the prepopulate adapter by passing each input params and updating tha value via API if any update is required. Just wondering if there is anything else we can use as part of bext practices. If anyone has done this kind of implemntation please let us know your inputs. Thanks

Answer 1

Hero,
You want to ...
1. create users
2. give them privileges
3. assign them to groups
4. assign a default groups to users
You will need to do this in the following sequence of steps...
1. Populate the user entries in OID, and assign the default group
2. Create the groups in OID and assign the users to them
3. Assign the appropriate portal privileges to the groups
For step 1 and 2, I'll have to refer you to the OID Administrator's Guide for Release 9.0.2.
This document contains a lot of good information, but in particular, you'll want to review Appendix I ...
"Migrating User Data from Application-Specific Repositories". This addresses the LDIF migration tool
and describes the schema elements needed for the IAS user accounts.
For step 3, the easiest way would be to assign the privileges to the groups through the user interface. Once the groups are defined
in OID, you can select them via the Portal UI to assign the portal privileges to them.
The proper place to locate portal instance-specific groups is under the portal instance group base, which is
cn=portal_groups, cn=groups, <subscriber_base>. The following white paper
may be helpful to understand the organization of the directory information tree.