Identity Template

Question

Is this template only used for the creation of users?
if my template for creating users on Active Directory is
cn=$upn$,ou=Siirto,dc=ad,dc=saku
$upn$ is the userprincipalname fetched from a field in FF Active Sync.
If a record in the FF has a changed upn then I would expect the AD entry to get a different DN but it dont seem to work that way.
Is it true that once the resource entry is created it is fixed - tied to the IdM account in the repository... even though its NAMING attribute alters?
This has big impact on LDAP resources where people can move departments and their DN changes e.g. from uid=EMP12345,ou=sales,o=acme to uid=EMP12345,ou=administration,o=acme

Answer 1

You can get the current user's identity on a resource from the User view variable accountInfo.accounts[<resname>].accountId, so you should be able to use that to compare with what the account's new identity should be, given the updated attrs from the FF active sync adapter.
Here's an example subprocess that you can use to invoke the rename user view. This example assumes the the identity templates for the user's resources use newLogin, newDepartment, and newDivision, so you'll need to change that.
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Configuration PUBLIC 'waveset.dtd' 'waveset.dtd'>
<Configuration name="Training - Rename User">
  <Extension>
    <WFProcess name="Rename User" title="User Update Workflow">
      <Variable name="accountId" external="true">
        <Comments>AccountId of user to be renamed</Comments>
      </Variable>
      <Variable name="user.newLogin" external="true">
        <Comments>New common name of the user to be updated</Comments>
      </Variable>
      <Variable name="user.newDepartment" external="true">
        <Comments>New department in which to place user to be updated</Comments>
      </Variable>
      <Variable name="user.newDivision" external="true">
        <Comments>New division in which to place user to be updated</Comments>
      </Variable>
      <Variable name="renameView"/>
      <Activity name="start">
        <Transition to="Check if Move / Rename Applicable">
          <or>
            <ref>user.newDepartment</ref>
            <ref>user.newDivision</ref>
            <ref>user.newLogin</ref>
          </or>
        </Transition>
        <Transition to="end"/>
      </Activity>
      <Activity id="7" name="Check if Move / Rename Applicable">
        <Variable name="object"/>
        <Action id="0" application="com.waveset.session.WorkflowServices">
          <Argument name="op" value="getObject"/>
          <Argument name="type" value="User"/>
          <Argument name="name" value="$(accountId)"/>
        </Action>
        <Transition to="Rename / Move User">
          <and>
            <isFalse><ref>WF_ACTION_ERROR</ref></isFalse>
            <ref>object</ref>
            <rule name='Training:Check if Ready for Rename/Move'>
              <argument name="wsUser" value="$(object)"/>
            </rule>
          </and>
        </Transition>
        <Transition to="end"/>
      </Activity>
      <Activity id="8" name="Rename / Move User">
        <Comments>
          Current case owner has a lock on the object, so do not need to release the lock in order to
          checkout the user view.
        </Comments>
        <Variable name="WF_ACTION_ERROR"/>
        <Variable name="view"/>
        <Action id="0" name="Checkout Rename View" application="com.waveset.session.WorkflowServices">
          <Argument name="op" value="checkoutView"/>
          <Argument name="type" value="RenameUserViewer"/>
          <Argument name="id" value="$(accountId)"/>
          <Argument name="subject" value="$(WF_CASE_OWNER)"/>
          <Return from="view" to="renameView"/>
        </Action>
        <Transition to="Set Naming Attributes">
          <isnull>
            <ref>WF_ACTION_ERROR</ref>
          </isnull>
        </Transition>
        <Transition to="end"/>
      </Activity>
      <Activity name="Set Naming Attributes">
        <Action name="Set Parameters for Identity Rename">
          <expression>
            <block>
              <dolist name="resource">
                <ref>renameView.accounts[*].name</ref>
                <set>
                  <concat>
                    <s>renameView.resourceAccounts.currentResourceAccounts[</s>
                    <ref>resource</ref>
                    <s>].selected</s>
                  </concat>
                  <s>true</s>
                </set>
                <cond>
                  <ref>user.newLogin</ref>
                  <block>
                    <set name="renameView.resourceAccounts.currentResourceAccounts[Lighthouse].selected">
                      <s>true</s>
                    </set>
                    <set name="renameView.newAccountId">
                      <ref>user.newLogin</ref>
                    </set>
                    <set>
                      <concat>
                        <s>renameView.accounts[</s>
                        <ref>resource</ref>
                        <s>].login</s>
                      </concat>
                      <ref>user.newLogin</ref>
                    </set>
                    <set>
                      <concat>
                        <s>renameView.accounts[</s>
                        <ref>resource</ref>
                        <s>].accountId</s>
                      </concat>
                      <ref>user.newLogin</ref>
                    </set>
                  </block>
                </cond>
                <cond>
                  <ref>user.newDepartment</ref>
                  <set>
                    <concat>
                      <s>renameView.accounts[</s>
                      <ref>resource</ref>
                      <s>].department</s>
                    </concat>
                    <ref>user.newDepartment</ref>
                  </set>
                </cond>
                <cond>
                  <ref>user.newDivision</ref>
                  <set>
                    <concat>
                      <s>renameView.accounts[</s>
                      <ref>resource</ref>
                      <s>].division</s>
                    </concat>
                    <ref>user.newDivision</ref>
                  </set>
                </cond>
              </dolist>
            </block>
          </expression>
        </Action>
        <Action id="2" name="Checkin Rename View" application="com.waveset.session.WorkflowServices">
          <Argument name="op" value="checkinView"/>
          <Argument name="view" value="$(renameView)"/>
        </Action>
        <Transition to="end"/>
      </Activity>
      <Activity id="9" name="end">
        <WorkflowEditor x="375" y="10"/>
      </Activity>
    </WFProcess>
  </Extension>
  <MemberObjectGroups>
    <ObjectRef type="ObjectGroup" id="#ID#All" name="All"/>
  </MemberObjectGroups>
</Configuration>
Again, hope that helps.
sbr