Can IdM make LDAP modrdn operations? (No replies = No can do)

Question

Maybe I am flogging a dead horse, but I am trying to get idM to manage a LDAP resource where the LDAP entries may move in the Directory Information Tree... the usual situation when a person moves department/location/job etc.
I am prepared to believe it can, yet I am starting to dispair of IdM.
If anyone is prepared to answer "Yes", could they please take time to explain to an IdM novice, just how I can influence the Update user workflow so that it is aware of any changes to attributes which affect the DN, ie we need to do a modRDN on the LDAP resource.

Answer 1

Still trying to get this to format correctly - If it doesn't appear OK this time, then reply to the above msg, then hit "Quote Original" and the true code that I added will show up.
>
Checkout the user view:
        <Action id='1' name='Fetch userview'
application='com.waveset.session.WorkflowServices'
hidden='true'>
<Argument name='op' value='getView'/>
<Argument name='type' value='User'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='TargetResources'>
<list>
<s>LDAP_Resource</s>
</list>
</Argument>
<Argument name='subject'
='subject' value='Configurator'/>
<Return from='view' to='user'/>
</Action>Update the 'Location' attribute
<set
name="user.accounts[LDAP-Resource].location"><ref>loca
tionVariable</ref></set>Build the new DN:
                <concat>
<s>ou=</s>
<ref>locationVariable</ref>
<s>ou=people,o=company.com</s>
</concat>Checkout a Rename view to change the DN.
<Activity id='13' name='Update LDAP'>
<Action id='0' name='Modify LDAP User'
AP User'
application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkoutView'/>
<Argument name='subject'
='subject' value='Configurator'/>
<Argument name='authorized' value='true'/>
<Argument name='type' value='RenameUser'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='toRename'
'toRename' value='[LDAP-Resource]'/>
<Argument
<Argument
name='resourceAccounts.currentResourceAccounts[LDAP-Re
source].selected' value='true'/>
<Return from='view' to='newViews'/>
</Action>
<Action id='1'>
<expression>
<block>
<invoke name='toXml'>
<ref>newViews</ref>
</invoke>
<set
<set
<set
<set
set
name='newViews.accounts[LDAP-Resource].identity'>
<ref>new_identity</ref>
</set>
<set
<set
<set
<set
name='newViews.resourceAccounts.currentResourceAccount
s[LDAP-Resource].identity'>
<ref>new_identity</ref>
</set>
<set
<set
<set
<set
name='newViews.resourceAccounts.currentResourceAccount
s[LDAP-Resource].selected'>
<s>true</s>
</set>
<invoke name='toXml'>
<ref>newViews</ref>
</invoke>
</block>
</expression>
</Action>
<Action id='2' name='Rename Checkin'
Checkin'
application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkinView'/>
<Argument name='view'
ame='view' value='$(newViews)'/>
<Argument name='subject'
='subject' value='Configurator'/>
</Action>--------------
Be Careful, make sure you have the business
requirements well defined, moves can be pretty
serious operations to automate.
You might think about changing the users
waveset.organization if the change in facillity also
effects their location in Identity Manager.
Matt Walters
CPSG
[email protected]
[phone]
You should look at directory Junction - The premise
is that the DIT and the structure in Identity manager
should mirror one another.
Most IdM implementations have strict rules that
follow moves, job transfers and such - so they are
usually put through a custom workflow.
In this case you would need to customize the Update
workflow to handle the case when a e.g. 'location' is
changed. I've been doing this a while, and this is
how I did it at a client.
Lets say they go from
ou=location33,ou=people,o=company.com to
ou=location45,ou=people,o=company.com. What
you need to do is put a transtion (triggered by a
change in the location) that goes to an update and
rename activity.
Checkout the user view:
        <Action id='1' name='Fetch userview'
application='com.waveset.session.WorkflowServices'
hidden='true'>
<Argument name='op' value='getView'/>
<Argument name='type' value='User'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='TargetResources'>
<list>
<s>LDAP_Resource</s>
</list>
</Argument>
<Argument name='subject'
='subject' value='Configurator'/>
<Return from='view' to='user'/>
</Action>Update the 'Location' attribute
<set
name="user.accounts[LDAP-Resource].location"><ref>loca
tionVariable</ref></set>Build the new DN:
                <concat>
<s>ou=</s>
<ref>locationVariable</ref>
<s>ou=people,o=company.com</s>
</concat>Checkout a Rename view to change the DN.
<Activity id='13' name='Update LDAP'>
<Action id='0' name='Modify LDAP User'
AP User'
application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkoutView'/>
<Argument name='subject'
='subject' value='Configurator'/>
<Argument name='authorized' value='true'/>
<Argument name='type' value='RenameUser'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='toRename'
'toRename' value='[LDAP-Resource]'/>
<Argument
<Argument
name='resourceAccounts.currentResourceAccounts[LDAP-Re
source].selected' value='true'/>
<Return from='view' to='newViews'/>
</Action>
<Action id='1'>
<expression>
<block>
<invoke name='toXml'>
<ref>newViews</ref>
</invoke>
<set
<set
<set
<set
set
name='newViews.accounts[LDAP-Resource].identity'>
<ref>new_identity</ref>
</set>
<set
<set
<set
<set
name='newViews.resourceAccounts.currentResourceAccount
s[LDAP-Resource].identity'>
<ref>new_identity</ref>
</set>
<set
<set
<set
<set
name='newViews.resourceAccounts.currentResourceAccount
s[LDAP-Resource].selected'>
<s>true</s>
</set>
<invoke name='toXml'>
<ref>newViews</ref>
</invoke>
</block>
</expression>
</Action>
<Action id='2' name='Rename Checkin'
Checkin'
application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkinView'/>
<Argument name='view'
ame='view' value='$(newViews)'/>
<Argument name='subject'
='subject' value='Configurator'/>
</Action>--------------
Be Careful, make sure you have the business
requirements well defined, moves can be pretty
serious operations to automate.
You might think about changing the users
waveset.organization if the change in facillity also
effects their location in Identity Manager.
Matt Walters
CPSG
[email protected]
[phone]