ActiveSync IDM 6.0

I am trying to do activeSync between IDM 6.0 and Remedy 5.1.2 ,
for activeSync to be enaled on remedy it says that we need to assign a 'process rule' (I selected Rule - User Name matches AccountId and also tried by selecting Update User workflow)and I have used input form with only one field to update email in IDM , all the tasks created during activeSync operation show 'Missing Account Id' error
Any response in this will be of great help.

Hi Steve,
I have tried this same on MSSQL resource, it worked.
But same approach is not working on AD any special things?
--sFred

Similar Messages

Password sync, activesync idm ad and ldap question

Hi,
can someone please clarify for me? We are trying to configure password sync between DSEE 6.3.1 and Active Directory.
We are using IDM 8.1 as our Identity Manager.
We have a JMS and the password sync plugin enabled on the IDM UNIX side. On the AD side we have the MSI file connector
installed and communicating with the JMS.
What I need to know in setting up the passwd sync, is what is required on the AD side encryption wise?
No where in the Sun documentation does it mention about AD passwd encryption.
What my question pertains to, is how does the IDM sync work against AD? Is there something special to do to
make this work? We have encrypted passwords in the AD - I believe this is a one way encryption.
If this is the case, how do we sync the password between AD, IDM and DSEE or does IDM not care?
thanks!

You'll need the IDM PasswordSync software installed and configured on every domain controller in your AD forest. As Alex indicated, it works as a password filter (via Microsoft APIs) that routes the clear text password to the IDM servers for synchronization.
There are lots of configuration details you'll need to set (for instance, specifiying what resources should be synchronized, setting the JMS listener polling period, setting the threshold for ignoring password changes from AD, etc). Be sure to review the section in PasswordSync in the IDM Administration documentation.
Jason

How to configure ActiveSync for a database table in IdM 7.0

Hi All,
Please suggest me the steps to configure ActiveSync in IdM 7.0.
when i try it by resource-->activeSync wizard it gives
"The ActiveSync Wizard has been deprecated in Identity Manager 7.0 in favor of using MetaView and the resource action "Edit Synchronization Policy". "
how to configure ActiveSync for a database table.
Thanx
Shant

Hi,
You need to a script and run it on os level. Here is an example:-
emcli relocate_targets -src_agent=agentmachine1.domain:3872
-dest_agent=agentmachine2.domain:3872 -target_name=RACDB
-target_type=oracle_database -copy_from_src -force=yes
-changed_param=MachineName:agentmachine2.domain
Regards
Jomon
Edited by: JohnJomon on Nov 17, 2011 2:27 PM

Pulling data into IDM via ActiveSync Adapter

Hello,
I am doing a proof of concept on IDM and am trying to import user data from MySQL table into IDM. I wrote an active sync adapter to do this so that whenever a new row is added to the MySQL table, the information is automatically fetched into IDM and a new IDM user is created.
However here is my requirement and I am not sure if this can be done. When I pull data from the table, I want to associate this user with a resource that has already been defined within IDM and the user account thus created should have the resource assignment.
Can someone post some tips/ sample code for this if you have done this earlier.
Thanks,
Prithi.

for the active sync transaction you have two options:
1) call a workflow (i prefer to use this)
2) use the input forms. You have access to two forms. the first is the form assigned to the active sync. the other is the form assigned to the admin user assigned to running the active sync.
variables come in on the "global." namespace. So you refer to them as "global.firstname" etc.
the docs say that you have a "activesync" namespace..but if you dump the context, it doesnt exist.
Perform your mappings either in a workflow or via the forms. I dont like the forms, as they only allow a create, and update, or a delete. And what client only has those types of transactions?
best of luck.
Dana Reed
AegisUSA
773.412.3782
Denver, CO

Linking a new resouce with user account in Sun IDM via activesync

Hi,
I am having a new resource which contains the user records. Now I want to link that resource to the existing and new users in Sun IDM.
I do not want to update and create user in the new resource. I just need that a link is created in Sun IDM when ever activesync runs on users account.
Please guide me how to achieve the same.
Regards,
Nitin

I'm afraid I can't share the exact code but it should be straight forward through the following:
1. define a field (call it ldapDN)
2. create a rule to user getResourceObjects to search for the user DN and return the DN to ldapDN.
3. when ldapDN is not null, expand waveset.resources and add your LDAP resource, like:
<Field name='waveset.resources'>
<Expansion>
<append>
<s>LDAP</s>
4. Then set the accountId for that resource as
<Field ........ accounts[LDAP].accountId>
<Default><s>ldapDN</s></Default>
and you should be set... hope it helps.

IDM flatfile activeSync diffAction

We have a user form that implements activeSync diffAction on a flatfile ... our observation is that the full set of pipe delimited records are processed and written out regardless of whether a record is unchanged or not causing a lot of unnecessary work to be done and killing our performance. Our expected behavior is:
* only new records or changed records should be processed and written out
* we want omitted records NOT to be deleted
* As a workaround I have a utility script which does the following which is what we think the FFAS behavior should be (note A70.LDAP.MAINT is the latest authoritative full flatfile and FFAS-<timestamp> is the last good flat file that was synced ... and Unix diff is taking the place of the diffAction in IDM which isn't working; the script defers to the LVAL (<) from the A70 file and filters out the ('< ') symbol. the reconciled_file is then used to run activeSync:
#!/bin/ksh
# assumptions: as the latest ff the A70 user records are authoritative
# and deletion of users is not accomplished via omission from the A70 file
# a deleted user from the ff sync doesn't need reconciliation in IDM
diff A70.LDAP.MAINT FFAS-20091103_114450_000.FFAS | awk '{ if ($1 == "<") print $0 }' \
| sed 's/< //' > reconciled_file
Any suggestions as to how to code a proper diffaction for these forms whose records look something like this:
1196435|j1196435|Whitbread, Felix R|Whitbread|Felix|R||NEVER|NEVER|ACTIVE||3860|05/12/92|||||||||||[email protected]|

our settings on the production box (running 7.1 update 1 patch 15) look like that already and it still doesn't work. I've also set up an 8.1 IDM at patch level 5 to prototype this on a later release and I cannot even get that far although I can create accounts and load them from the FlatFile resource but then I cannot administer them as I see the following sorts of errors:
* Unable to contact resource flatfileactivesync ... which I guess makes sense since it is NOT a daemon resource that would communicate with IDM
* it assumes that since the bulk load came from a flatfile that I want the users to have flatfile as a resource in their user attributes ...
* I merely want IDM to leverage the changes an ADMINISTRATOR make to the FFAS file ... but when I load the accounts from the flatfile it just assumes that I want the accounts to have resource FlatFileActiveSync as a part of the user's extended attributes ... which effectively makes the account I created useless from an administrative perspective as I can't even use my user 'proxy admin' to save or update the users manually i.e. to delete the FFAS resource they apparently own (to make the account useful again by not having ownership of a resource that cannot be updated).
* if I go ahead and try to do an activeSync with the users anyway I see the following error:
Action failed because feature 'account.UPDATE' is not supported by resource FlatFileActiveSync:
Syslog ID =SV-1130-192036
I'm told this also makes some sort of ironic sense presumably because the resource can't be contacted ... which begs the question why doesn't IDM just manage the flat file by processing my original file and re-writing it out with a timestamp ... and then if I make updates and re-run; process and update the user's Identity properties based on the contents of those files like the literature says it is supposed to do instead of treating it like FFAS is some sort of running daemon that needs to update users in real time and be able to iterate and update accounts without the administrator's intervention.
I'm amazed at the hidden complexities in what would seem to be a very simple scenario with very simple mappings between identity attributes and resource attributes. Perhaps what is confusing IDM is that I have ldap resources that map to the same sort of user attributes I'm trying to update via a flatfile.
Edited by: bozo2 on Dec 3, 2009 2:49 PM

Problem with activesync provisioning user from ldap to red hat

hello,
i am using activesync to provision the user from ldap to red hat linux . i am getting the following error message
An error occurred adding user '#########' to resource 'Red Hat Linux'.
Script failed waiting for " PASSWORD:" in response "passwd: Only one user name may be specified.
_,)#+(:"
Script processor timed out with nothing to read and the following unprocessed text: "passwd: Only one user name may be specified.
_,)#+(:".
when to try to assign redhat resource to a user from the idm the user is getting provisioned to redhat successfully .active sync form is working for all the other resource except the redhat.
can anyone give me solution for the above problem
thanks in advance.

Have you set the xhost as ROOT (xhost +hostname), and then as the ORACLE user type "export DISPLAY:0.0" (without the quotes of course) ? This needs to be done prior to running the installer. Try this site for further information - http://www.puschitz.com/OracleOnLinux.shtml

Issues with subject in idm 8.1

Below are details about issue we are facing. I am using IDM 8.1 version
We have used Checkout View in the provisoning workflows.
The arguments of the Checkout view are -
<Argument name='op' value='checkoutView'/>
<Argument name='type' value='User'/>
<Argument name='id' value='$(activeSync.accountId)'/>
<Argument name='TargetResources'>
<list>
<ref>resourceNm</ref>
</list>
</Argument>
*<Argument name='subject' value='configurator'/>*
<Argument name='Form' value='Empty Form'/>
Now, we have created a user with accountId: SPMLUser and assigned the capabilitiies -
SPML Access
View Configuration
Update USer
so that using SPML 2.0, this user can login into Identity manager and launch workflows.
Request was sent successfully but when I checked the Server Tasks below error was generated.
com.waveset.util.WSAuthorizationException: Modify access denied to Subject SPMLUser on Resource: ABC.
Any help would be appreciated.
Thanks,
Sanhita

Is there any specific capability in IDM which can be assigned to SPMLUser so that this conflict of subject in provision workflows can be avoided?
I have created this SPMLUser account only to serve all the SOAP requests and trigger the provision workflows.
Please help as it is urgent!
Thanks,
Sanhita

Can't create accounts from IDM to AD group

Hi!
When I want to create an account in an AD (dc=rascal,dc=net), I wish create it in "GlobalADM" group.
I have defined the Account Attribute in Resource ( I have used "groups").
So, in the Attibutes section in User Form, it prints "groups" and the rest of AD attributes. In this textbox I write cn=GlobalADM,cn=Users,dc=rascal,dc=net
But it prints the following error:
Unable to set user info: 'SetInfo(): 0X8007200A: , 00000057: LdapErr: DSID-0C090B38, comment: Error in attribute conversion operation, data 0, vece, Attribute or directories services value specified doesn't exist.
In Idm Resource Reference document, I read that "groups" is the correct attribute. In AD I can create accounts manually in this group. And I have tried with other groups with the same error.
can anyone help me?
Thanks!!!

AD and all directories require a distinguished name for a user. Where the user actually lives in the directory. If you are doing this through a custom workflow and form you need to set the dn in the form. If you are using the tabbed user form and admin interface you need to set the identity template.
For the template:
cn=$lastname$\,$firstname$,ou=Domain Users,dc=yourcompany,dc=com Note:This string must match where the users will be created in the tree.
If doing this in a sync process or some type of workflow calling a form set the following:
<Field name ='accounts[AD].dn'>
<Expansion>
<concat>
<s>cn=</s>
<ref>accounts[Lighthouse].lastname</ref> (if doing a sync this would be activeSync.lastname)
<s>,</s>
<ref>accounts[Lighthouse].firstname</ref>
<s>,</s>
<s>,ou=Domain Users,dc=yourcompany,dc=com</s>
</concat>
</Expansion>
</Field>
If you are doing this through custom workflow don't forget to update waveset.resources:
<Field name='waveset.resources'>
<Expansion>
<filterdup>
<append>
<ref>waveset.resources</ref>
<s>AD</s>
</append>
</filterdup>
</Expansion>
</Field>

Get a list of IDM roles in a workflow

Hi,
I have a workflow and I need to
get a list of roles that are defined in IDM.
How do you do this ?
I know that in a form you can call:
<invoke name='getRoles' class='com.waveset.ui.FormUtil'>
<ref>:display.session</ref>
</invoke>
but I need to do the same from a workflow that gets run
from ActiveSync, where there is no :display.session variable.
Thanks,
John I

Ah, I just found the answer myself:
<invoke name='getRoles' class='com.waveset.ui.FormUtil'>
<invoke name='getLighthouseContext'>
<ref>WF_CONTEXT</ref>
</invoke>
</invoke>

Oracle ActiveSync Adapter issue

Hi,
I am facing an issue with oracle activeSync adapter. I am trying to connect to an oracle table and pull some records into IDM. I created the resource and tested connection to the resource and everything seems to work fine. Also I am able to poll the oracle table and create some records within IDM. The issue is with updates.
The following is are the two scenarios in which I am getting errors.
1) When the XML content of the activeSync form is (This is the same entry when the feedOp is create and Update) This works fine when the operation is create
     <Field name='waveset.accounts[Lighthouse].firstname'>
          <Expansion>
          <block trace='true'>
               <ref>activeSync.firstname</ref>
          </block>
          </Expansion>
     </Field>
     and so on for all the fileds, update fails totally, though create works. It does not push the changes to IDM and throws an error "An error occurred connecting to resource 'NBCIDMDeltaActiveSync'".
2) When the XML content of the activeSync form is (Since the previous entry did not work, I added this entry only when feedOp is Update)
     <Field name='global.firstname'>
          <Expansion>
          <block trace='true'>
               <ref>activeSync.firstname</ref>
          </block>
          </Expansion>
     </Field>
     The values are getting pushed into IDM. However the error "An error occurred connecting to resource 'NBCIDMDeltaActiveSync'". still prevails.
Though the second one throws an error, it still works the way it should.
Can anyone help me figure out how I can fix the error. Though the error says that it has something to do with the connection, it is working fine for creates and I can test the resource connection successfully.

Create and Update use different default resource, user forms and views. Is the resoruce error you get is the name of one of your adapters? NBCIDMDeltaActiveSync
Look for Proxy admin assinged to the adapter, if it has a form attached. Review the logic.
Look for update user form assigned to the update. Review logic in the forms.
Look for the Update Workflow, review logic differences in the create Workflow.

Processing records using Flat file ActiveSync resource

Hi Folks,
I was working on flat file activeSync resource adapter. Documentation says the following..
The Flat File Active Sync adapter can track the timestamp of a flat file. In addition, the adapter can archive the last file processed and then compare it to the most recent version. Identity Manager will then act on the accounts that are different in the two files.
If these features are enabled, the first time Identity Manager polls the source flat file, the system copies the file and places it in the same directory. The copied (archived) file is named FFAS_timestamp.FFAS, with the timestamp indicating the last time the original file was changed. The format of the timestamp is determined by the operating system on which the source file resides.
On each subsequent poll, Identity Manager compares the timestamp on the original file with the most recent timestamp. If the new timestamp value is the same as the previous value, then the file has not changed, and no further processing is performed until the next poll. If the timestamp values are different, Identity Manager checks for the presence of the FFAS file. If the file does not exist, Identity Manager processes the updated source file as if it were a new file.
If the timestamps are different and the archived FFAS file exists, Identity Manager compares the source file with the archived file. The comparison will filter any users that have not changed. If a user has changed, then it will be sent through the adapter in the normal manner, and the configured process, correlation and delete rules determine what to do with the user.
I have set the following attributes in synchronization policy as
Track Last Processed Timestamp : true
Process Differences Only : true
Unique Key for Diff : <some attribute>
I have the following flat file..
PERSONID,accountID,FIRSTNAME,LASTNAME,NATID,BIRTHDATE,EXTERNALID,TYPE,COUNTRY
10004,,test,4,123444,12/01/1804,204,A,USA
10005,,test,5,,12/01/1805,205,M,USA
There is no user account in IDM repository. After processing this file, my code creates the above accounts in IDM.
I deleted the above two accounts from IDM using admin interface and the accounts are not created again. So far good.
Now I opened the above flat file and just saved again. It creates the account in IDM.
According to the above documentation, it should not create the account as the flat file is already processed based on diff operation. Then Why it is creating the account again in IDM? Any logic??
Your repsonse will be appreciated.

Hi,
I am pretty sure this has been working for me but with IAPI.Cancel. Please try to capitalize the C.
Regards,
Patrick

Database ActiveSync and Conditional Role

Hello IDM Experts,
I am trying to provision a Business Role during an Oracle Table ActiveSync that has conditional IT roles that set attributes in Active Directory and Google.
Business Role (Student):Student
Conditional Roles (Applicants,Students, Graduated, etc ): Provisions AD Org Unit, Security Groups and triggers the creation of a unique email address (for Students only)
Example Condition for applicants
IDM_STUDENT_DEV: CSU_CMS_ROLE starts with constant: Applicants
OR
Lighthouse: CSU_CMS_ROLE starts with constant: Applicants
Required Role (Student-NG): This is a required role that creates the common AD attributes such as Distiguished name, CN etc.
During ActiveSync Update the conditional roles are applied correctly. During CREATE they are not.
I understand that during activeSync the activeSync namespace is available.
My thought was to find a way to configure the conditional roles to look at the incoming role from the Oracle Table but I have been unsuccessful with defining the condition to evaluate the activeSync namespace.
How do I configure the Conditional role to evaluate at the activesync namespace?
Has anyone been successful with provisioning using conditional Roles during Active Sync Create?

I found that the problem was that a required attribute for Google needed to be generated for the idenitity template within the ActiveSync Form. The conditional logic was not being processed because of this missing attribute and IDM was exiting without creating accounts.

IdM 6.0 SPE SP1 querying LDAP for changenumbers

We are using IdM 6.0 SPE SP1 to manage creates and updates to a Sun One Directory Server 5.2. In looking at the access logs, we are seeing lots of LDAP queries for cn=changenumbers. What is changenumber being used for? We are not using ActiveSync or any other sync.
Any insight would be greatly appreciated.
Here is a snippet of the access log:
[07/Feb/2007:17:06:20 -0800] conn=154495 op=10 msgId=11 - RESULT err=0 tag=101 nentries=1 etime=0
[07/Feb/2007:17:06:23 -0800] conn=154495 op=11 msgId=12 - SRCH base="cn=changenumbers,ou=system,ou=spe,o=spe.xxx.com" scope=0 filter="(objectClass=*)" attrs=ALL
[07/Feb/2007:17:06:23 -0800] conn=154495 op=11 msgId=12 - RESULT err=0 tag=101 nentries=1 etime=0
[07/Feb/2007:17:06:27 -0800] conn=154495 op=12 msgId=13 - SRCH base="cn=changenumbers,ou=system,ou=spe,o=spe.xxx.com" scope=1 filter="(objectClass=*)" attrs=ALL

Answer courtesy of IDM Engineering:
"Changenumbers" is used for storing the lastMod counters when using Service Provider Edition. Obviously, this entry is read frequently to verify that the cache is up-to-date (i.e. by comparing the lastMod counters in the cache and the entry).
You shouldn't worry about the performance hit. This is a base object search (i.e. it can only return at most 1 entry)

Sun LDAP to IDM synchronization issue

Hello friends, I am trying to synchronize all the new accounts created in sun LDAP to IDM. It runs every 10 minutes as configured but does not pick the new user from LDAP. Here is the brief configuration detail.
(1) I have switched on the "Retro Plugin" for LDAP and found the changes are getting logged. The sample entry of the change log looks like :-
dn: changenumber=665,cn=changelog
objectClass: top
objectClass: changelogentry
changeNumber: 665
targetDn: uid=zorouser7,ou=people,ou=appuser,dc=educ,dc=mde
changeTime: 20090518211551Z
changeType: modify
changes:: cmVwbGFjZTogb2JwYXNzd29yZGNoYW5nZWZsYWcKb2JwYXNzd29yZGNoYW5nZWZsYWc6IGZhbHNlCi0KcmVwbGFjZTogb2JwYXNzd29yZGNyZWF0aW9uZGF0ZQpvYnBhc3N3b3JkY3JlYXRpb25kYXRlOiAyMDA5LTA1LTE4VDIxOjE1OjUwWgotCnJlcGxhY2U6IG1vZGlmaWVyc05hbWUKbW9kaWZpZXJzTmFtZTogY249b2JsaXgKLQpyZXBsYWNlOiBtb2RpZnlUaW1lc3RhbXAKbW9kaW
Z5VGltZXN0YW1wOiAyMDA5MDUxODIxMTU1MFoKLQoA
creatorsname: cn=Retro Changelog Plugin,cn=plugins,cn=config
modifiersname: cn=Retro Changelog Plugin,cn=plugins,cn=config
createtimestamp: 20090518211551Z
modifytimestamp: 20090518211551Z
nsuniqueid: 081d2284-1dd211b2-80b380e1-7558dd15
parentid: 1
entryid: 666
entrydn: changenumber=665,cn=changelog
numsubordinates: 0
subschemasubentry: cn=schema
hassubordinates: FALSE
(2) Here is my synchronization policy for LDAP resource :-
o Object class to synchronize : inetorgperson mdeUser mdeAuthZ OblixPersonPwdPolicy OblixOrgPerson (Last four are custom object)
o Ldap Filter for account synchronize : objectClass=inetOrgPerson
o Attributes to synchronize : uid userPassword givenName sn cn mail telephoneNumber objectClass mdeApplicationId mdeRoleId
o change log block size : 100
o Change Number Attribute Name : 665
o Proxy Administrator : Configurator
o Input form : Tabbed : User Form
o Create Unmatched Accounts : yes
o Assign source resource on create events : yes
(3) The IDM log for synchronization shows the following detail for each polling :-
2009-05-18T17:20:00.069-0500: Pause completed
2009-05-18T17:20:00.131-0500: Polling
2009-05-18T17:20:00.209-0500: Start of poll - lastUpdated = {changenumber=266}
2009-05-18T17:20:00.209-0500: buildSearchParams:BEGIN
2009-05-18T17:20:00.209-0500: Block Size: 100
2009-05-18T17:20:00.209-0500: Change Number Attribute Name: 665
2009-05-18T17:20:00.209-0500: Searching for: (&(665>=267)(665<=366))
2009-05-18T17:20:00.209-0500: Search attributes: [targetdn, changetype, changes, changetime, changenumber, newrdn, deleteoldrdn, newsuperior]
2009-05-18T17:20:00.225-0500: buildSearchParams:END
2009-05-18T17:20:00.240-0500: End of poll - lastUpdated = {changenumber=266}
2009-05-18T17:20:00.240-0500: Poll complete.
2009-05-18T17:20:00.240-0500: SARunner: loop 1
2009-05-18T17:20:00.272-0500: Started, paused until Mon May 18 17:30:00 CDT 2009
Please help .....
- Kabi
Edited by: kpp on May 18, 2009 5:21 PM

Maybe something like this. Keep in mind, your LDAP may have specific rules for what really constitutes a Create, Update, or Delete.
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Configuration PUBLIC 'waveset.dtd' 'waveset.dtd'>
<Configuration name='LDAP Active Sync Form' wstype='UserForm'>
     <Extension>
          <Form name='LDAP Active Sync Form' objectLocationID='objectType=UserForm&objectName=LDAP+Active+Sync+Form&objectPath=0&isBegin=true'>
               <Field name='IAPI.cancel'>
                    <Expansion>
                         <s>true</s>
                    </Expansion>
                    <Disable>
                         <isnull>
                              <select>
                                   <ref>activeSync.changedAttributes.accountType</ref>
                                   <ref>activeSync.accountType</ref>
                              </select>
                         </isnull>
                    </Disable>
               </Field>
               <Field name='password.password'>
                    <Expansion>
                         <s>TestPassword1</s>
                    </Expansion>
               </Field>
               <Field name='waveset.accountId'>
                    <Expansion>
                         <ref>activeSync.accountId</ref>
                    </Expansion>
                    <Disable>
                         <neq>
                              <upcase>
                                   <ref>feedOp</ref>
                              </upcase>
                              <upcase>
                                   <s>create</s>
                              </upcase>
                         </neq>
                    </Disable>
               </Field>
               <Field name='waveset.resources'>
                    <Expansion>
                         <list>
                              <s>LDAP_RESOURCE_NAME</s>
                         </list>
                    </Expansion>
                    <Disable>
                         <neq>
                              <upcase>
                                   <ref>feedOp</ref>
                              </upcase>
                              <upcase>
                                   <s>create</s>
                              </upcase>
                         </neq>
                    </Disable>
               </Field>
               <Field name='waveset.organization'>
                    <Expansion>
                         <s>Top:Something</s>
                    </Expansion>
                    <Disable>
                         <neq>
                              <upcase>
                                   <ref>feedOp</ref>
                              </upcase>
                              <upcase>
                                   <s>create</s>
                              </upcase>
                         </neq>
                    </Disable>
               </Field>
               <Field name='accounts[Lighthouse].email'>
                    <Expansion>
                         <ref>activeSync.mail</ref>
                    </Expansion>
               </Field>
               <Field name='global.idmManager'>
                    <Expansion>
                         <ref>activeSync.supervisor</ref>
                    </Expansion>
                    <Disable>
                         <neq>
                              <upcase>
                                   <ref>feedOp</ref>
                              </upcase>
                              <upcase>
                                   <s>create</s>
                              </upcase>
                         </neq>
                    </Disable>
               </Field>
               <Field name='waveset.idmManager'>
                    <Expansion>
                         <ref>global.idmManager</ref>
                    </Expansion>
                    <Disable>
                         <neq>
                              <upcase>
                                   <ref>feedOp</ref>
                              </upcase>
                              <upcase>
                                   <s>create</s>
                              </upcase>
                         </neq>
                    </Disable>
               </Field>
               <Field name='viewOptions.Process'>
                    <Expansion>
                         <switch>
                              <upcase>
                                   <ref>feedOp</ref>
                              </upcase>
                              <case>
                                   <s>CREATE</s>
                                   <s>Active Sync Create User Workflow</s>
                              </case>
                              <case>
                                   <s>UPDATE</s>
                                   <s>Active Sync Update User Workflow</s>
                              </case>
                              <case>
                                   <s>DELETE</s>
                                   <s>Active Sync Disable User Workflow</s>
                              </case>
                              <case default='true'>
                                   <null/>
                              </case>
                         </switch>
                    </Expansion>
               </Field>
          </Form>
     </Extension>
     <MemberObjectGroups>
          <ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
     </MemberObjectGroups>
</Configuration>

ActiveSync IDM 6.0

Similar Messages

Maybe you are looking for