How Create LDAP Group Inside Active Sync Form?

Question

I have an Active Sync form that is working well to synchronize (and slightly massage) data from an Active Directory source to a Sun Directory Server destination.
I need to synchronize group information from AD to DS. It must automatically create groups during the Active Sync processing. It can't be done externally using another scripting language; it must be done within IdM.
I have the following code...
<Action id='0' application='com.waveset.provision.WorkflowServices'>
<Argument name='op' value='createResourceObject'/>
<Argument name='object'>
  <Object>
  <Attribute name='resourceId' value='DS'/>
  <Attribute name='resourceName' value='DS'/>
  <Attribute name='resourceType' value='LDAP'/>
  <Attribute name='objectName' value='abcd'/>
  <Attribute name='attributes'>
    <Object>
    <Attribute name='cn' value='abcd'/>
    <Attribute name='groupType' value='abcd'/>
    </Object>
  </Attribute>
  <Attribute name='objectType' value='group'/>
  <Attribute name='objectId' value='CN=abcd,ou=Groups,dc=blah,dc=com>
  </Object>
</Argument>
<Argument name='objectType' value='group'/>
<Argument name='resourceId' value='DS'/>
</Action>However with that code inside the <Field><Expansion>...</Expansion><Field> section the group is not created. I've enabled tracing and as best I can determine the code isn't even executed.
I have created resource schemas for accounts[DS].ldapGroups and accounts[AD].groups and that works well. I can read group memberships from those lists. However I can't simply append to those lists to automatically create groups (which would be nice). That's why I've gone down this path of attempting to create the groups programatically.
I've scoured the groups and the course notes and found nothing relevant here. The examples all refer to creating the groups within an interactive form. I'm trying to do the same within the <Field> section of an Active Sync form.

Answer 1

TTSLSAB wrote:
Hi Vladimir,
can you please tell me what should i import in the java class inorder to avoid the below error (session) for the line
          Resource resource = (Resource)session.getObject(Type.RESOURCE, resId);
         ResourceAdapter ra = ResourceOp.findAdapter(resource, session.getCache());Error, which i am getting is
Exception in thread "main" java.lang.Error: Unresolved compilation problems:
     session cannot be resolved
     session cannot be resolvedsession is your LighthouseContext handle so depending on how you are implementing the class you quoted, you will either need to pass it in, for example via the invoke tag from your form/workflow, or get your own - don't know how this is done but I'm assuming authenticating to IdM would have to be done.
For all those interested, I have implemented the Java code snippet listed by Vladimir in XPRESS.
idmSessionHandle - is the LighthouseContext for the current session
currentOUDN - is a string representing the AD DN of the OU to be created
                <defvar name='resourceAdapterHandle'/>
                <set name='resourceAdapterHandle'>
                  <invoke name='findAdapter' class='com.waveset.provision.ResourceOp'>
                    <ref>resourceObject</ref>
                    <invoke name='getCache'>
                      <ref>idmSessionHandle</ref>
                    </invoke>
                  </invoke>
                </set>
                <defvar name='newOUGenericObject'/>
                <set name='newOUGenericObject'>
                  <new class='com.waveset.object.GenericObject'>
                    <map>
                      <s>objectId</s>
                      <ref>currentOUDN</ref>
                      <s>objectType</s>
                      <s>Organizational Unit</s>
                    </map>
                  </new>
                </set>
                <invoke name='createObject'>
                  <ref>resourceAdapterHandle</ref>
                  <ref>newOUGenericObject</ref>
                  <new class='java.util.HashMap'/>
                </invoke>
[...]Although the above works well, to create OUs in AD, I have not yet tested its real life application with regards to the initial mass loading of users (from LDAP (auth source) to IdM to AD) and ActiveSyncing. My concerns are two threads attempting to create the OU at roughly the same time, the first succeeds, and second one fails because AD will reply with the fact that the object already exists. The workaround would be to do a recheck of the existence of the OU, after a failure was encountered. This ties into exception handling in general in this approach.
If anyone can contribute exception handling and possibly a create with retries approach, to the above code, I'd appreciate it.
Cheers.