Changing group names (5.x)

Question

We are using ADAWS in a version 5 portal. We need to change the names of some groups in Active Directory (AD). To test this, I changed one group name in AD and ran the AWS and PWS synchronizations. It appears that the group is still synchronized; however, the name of the group in the portal did not get changed. It still has the old name.
Will I have to manually change the group names in the portal to match the new AD names? It appears that after creation, Active Directory and the portal deal with groups only on the basis of objectGUID/AUTHUNIQUENAME and memberships, not the Active Directory "CN", "name", or "sAMAccountName" entries. (We have set "Group Name Attribute" to "CN" in the PWS Agent Configuration.) ---Ken

Answer 1

I doubt this will help you in the short term, but I would encourage anyone developing portlets to use portal "Activity Rights" to check for whether a user should be allowed to do things rather than just checking for a specific group name. Activity Rights are exactly what they sound like: the right to do something, but basically, they are just a named key that is attached to a group (or several groups). The EDK provides a simple call to check if a person has any specific Activity Right.
The advantages of Activity Rights are that: they can be managed in the portal; they can be assigned to multiple groups, and removed from all groups; the portlet doesn't need to hard code a Group name, just the Activity Right key value; Activity Rights are migratable objects, which means that (unlike object ids) they can be migrated and checked by the same code in Dev, Test, and Prod systems.