IDM8 resource attribute.

Dear Experts,
I am using IDM8 and created a AD resource with resource attribute like
"Exchange Server" . I want to create a select box for this resource
attribute. I know that i can create a field with "Display Class: Select"
in Tabbed User Form > MainTabs > FMATTRIBUTES.
However, this select box will be display in attribute tab when user creation, no matter AD roles assigned or not.
Question: How to make this resource attribute with select box available when user assigned AD role.?
Thanks,
Angus

Hi Angus,
Try the following
<Field....
<Disable>
 <and>
 <eq>
 <length>
 <ref>user.update.accounts[Lighthouse].changes[roles].new</ref>
 </length>
 0
 </eq>
 <eq>
 <length>
 <ref>user.update.accounts[Lighthouse].changes[roles].old</ref>
 </length>
 0
 </eq>
 </and>
</Disable>
</Field>

Similar Messages

File download uielement resource attribute

Hello,
I am following the blog [link|http://wiki.sdn.sap.com/wiki/display/Snippets/WebDynproforJava-+FileDownloadUIElement]
this works fine except for the fact that resource attribute is indeed needed for filedownload element coz it otherwise gives a dump
so how should I populate the resource ? if i just simple keep a resource type attribute then the dump is gone but there is no file.
thanks in advance
B

Hi,
If you are using 7.0 then you need to bind the file download ui to an attribute of type binary and if you are using CE 7.1 then ui must be binded to an attribute of type Resource.
The best way to set the binary attribute is
wdContext.currentContextElement().setBinary(str.getBytes());
And for CE 7.1, set the Resource attribute like
IWDResource resource = WDResourceFactory.createResource(str.getBytes(), "MyFile", WDWebResourceType.TXT);
wdContext.currentContextElement().setResource(resource);
Regards,
Amol

Resource Attributes not saving in Queriable User Extended Attributes

Howdy,
I added a few queriable user extended attributes to IDM. I originally added them in through the configure user attributes interface. I then edited the UserUIConfig to specify that they were queryable. I then edited the User Search Defaults form's getSearchableAttrs function to include these attributes. My added attributes now show up in the search user form, etc., just like I expected them to. Next I configured a new resource adapter for a database table that contained some values I wanted to use to populate these queriable attributes. I wrote a correlation rule, and ran reconciliation on the new resource. It matched up the account entries and automatically matched and linked the account information. So far so good. However, the user extended attributes I defined are not getting populated with the data from the new resource. The mapped resource attributes are treated as part of the user view, but only under the given resource, not as a queriable attribute. I really want to be able to use the find user interface with these datafields. Does anyone know why my data is ot making it into the queriable fields? Do I need to write another rule or workflow? Any advice would be most helpful.
Thanks!
Jim

Queryable attributes refer to attributes stored in the IDM user object, and so need to be referenced as such.
If you want attribute 'foo' in resource 'bar' to be stored as a Queryable attribute, you need to define it like so in your User Form :
<Field name='accounts[Lighthouse].foo'>
 <Expansion>
 <ref>accounts[bar].foo</ref>
 </Expansion>
</Field>This should pull the value from the resource attribute and put it in the IDM attribute. If you refer to it as a global.foo everywhere, that might work (but I find globals to be problematic).
Let me know if it works...
Jason

User View not showing the assigned resources attributes in idm 7.0

Hi,
In a Remediation Form I am using a text field
<Field name='user.accounts[SimAD].group'>
<Display class='Text'>
<Property name='title' value='Title'/>
</Display>
</Field>
but here i am not able to get the value of group. when i dumps the user view its shows only Lighthouse resource under accounts attribute.
<Attribute name='accounts'>
<List>
<Object name='Lighthouse'>
<Attribute name='firstname' value='Magnet'/>
<Attribute name='fullname' value='Magnet Mangentta'/>
<Attribute name='idmManager'/>
<Attribute name='lastname' value='Mangentta'/>
</Object>
</List>
</Attribute>
while the user has three resources.
when I use the getView method in form using following code
<invoke name='getView'>
<ref>:display.session</ref>
<concat><s>User:</s><ref>user.waveset.accountId</ref></concat>
<map>
<s>authorized</s>
<s>true</s>
<s>subject</s>
<s>configurator</s>
</map>
</invoke>
this time I m able to get the value resource attribute.
please give the solution how can I get the editable user view in Remediation Form so that I can change the attribute of resource.
Thanks,
Amit

i got the solution there was one attribute on workflow
<Argument name='NoFetch' value='true'/>
remove this to false it will fetch all the resource attributes

Update IDM Account and Resource attribute

How can i update the resource attribute of users while updating their IDM account from file upload?

Hi
we have a similar requirement ?Were you able to solve it and how please let us know.
Thanks

Limit User View To Not Include Resource Attributes

Although I've created custom workflow and forms I'm still unclear on what exactly initiates the loading of views when starting for example the Tabbed User Form. Can you control what gets loaded into the view, specifically not load resource attributes?
We currently have approximately 700 resources and growing. This significantly lengthens the load time of the Tabbed User Form because Identity Manager connects to several hundred resources. We normally do not edit resource attributes directly but instead set them using globals or role attributes. This latency also has an affect throughout the tool, for example end-users requesting roles requires the Tabbed User Form to load.
Ideally the view would only load the waveset and globals values and only connect to the necessary resources upon saving the view.
Any ideas or further explanation on what controls the view attributes would be greatly appreciated.

Dynamic Tabbed User Form will not help here as the resource attributes are loaded anyway, regardless whether the form displays it or not.
The problem is the user view itself that checks every linked resource. I don't think you can limit the view by providing some arguments. You would have to create your own view along with the necessary handlers for checkout and checkin.

Load from resource attributes.

Hello,
I want to do a Load from Reasource (IdM7). When I start it I specify my input resource (a db table) and a form which should process all the input records. The form, for each input record, creates a new user ad some accounts on assigned resources.
I am guessing how should I refer to the input resorce attributes inside the form: should they be referenced as accounts[INPUT-RESOURCE].attribute or something else?
TIA

I mapped accountID to CN. I changed it and mapped it back to uid
Thank you
Vivek Shashwat

Issue Setting Resource Attributes via Workflow Process

I'm currently trying to set resource attributes via a workflow process, but for whatever reason the attribute is not detected as "changed" and the update object has nothing about the attribute. I'm wondering if I'm just doing something wrong with the way I'm setting it, or if I'm missing a piece to apply the upate.
What I'm doing is...
1. Checking out the user view
2. updating the attribute via code something like this...
<set name='user.accounts[ldap].attributeIWantToChange'>
Logic in here
</set>
3. then I'm checking the view back in.
Anyone know why this isn't working(I can set other attributes like waveset.roles fine this way)?
Edited by: UNO-AD-HM on Jul 6, 2009 12:54 PM

Figured it out, have to load a different form in when I check the view out, the tabbed user's form will not update resource attributes.

Fetch a resource attribute using Last name

Hi All,
I need to fetch a resource attribute 'employeeID' from AD, all I know is only Last Name (I don't know the accountId). How can I acheive this?
Is it possible through EXPRESS or do I need to write a java program.
Please share your ideas.
Thanks in advance

It is possible (with XPRESS) but the search criteria of Last Name will result in lots of erroneous matches. If at all possible, find additional or alternative search criteria to narrow down the field.
Here's some example code for retrieving results from an Active Directory resource. It was written to be used in the Form context (changes would be required if you were executing from a Workflow context).
 <defvar name='results'>
 <invoke name='getResourceObjects' class='com.waveset.ui.FormUtil'>
 <ref>:display.session</ref>
 <s>person</s>
 <s>Active Directory Resource Adapter</s>
 <map>
 <s>searchContext</s>
 <ref>baseDN</ref>
 <s>searchAttrsToGet</s>
 <List>
 <String>cn</String>
 </List>
 <s>searchFilter</s>
 <concat>
 <s>(sn=</s>
 <ref>lastnameValue</ref>
 <s>)</s>
 </concat>
 <s>searchScope</s>
 <s>oneLevel</s>
 </map>
 </invoke>
 </defvar>baseDN specifies where in the AD tree to start searching (e.g. "cn=Users,dc=Acme,dc=com")
lastnameValue is the lastname you're searching on (e.g. "Smith")
results will be a List of the cn attributes that came back from the search (specified in the List under searchAttrsToGet). You need to put logic around the results to handle the List appropriately.
Use standard LDAP-style search filters in the searchFilter section if you need to add additional qualifiers.
Jason

Creating UserMembersRule with conditions on the value of resource attribute

Hi all.
I am trying to create a UserMembersRule to be used for provisioning an Organization. This rule should select users with a given value for an attribute mapped in a distant Resource.
For instance, it would select all users with "typeTest = test1" in the "Simu1" Resource. Most examples I have seen by now do this for the Waveset resource (querying attributes which are in the IDM Schema, not in distant Resources)
Form the results I have had, I suppose the first syntax (in which the Rule returns a list of AttributeCondition) doesn't work in this case.
I will still give you several syntax I tried to do this :
PLEASE NOTE that I've added "<" characters before each <<s> and <</s> tag, to prevent these from being interpreted by the Forum engine...
Syntax 1 :
<Rule authType='UserMembersRule' id='#ID#Rule:CustomTestRule1' name='Custom Test Rule 1' primaryObjectClass='Rule'>
<block trace='true' name='CustomTestRule1'>
<list>
<new class='com.waveset.object.AttributeCondition'>
*<<s>accounts[Simu1].typeTest<</s>*
<<s>equals<</s>
<<s>type1<</s>
</new>
</list>
</block>
<MemberObjectGroups>
<ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
</MemberObjectGroups>
</Rule>
Syntax 2 :
<Rule authType='UserMembersRule' id='#ID#Rule:CustomTestRule1' name='Custom Test Rule 1' primaryObjectClass='Rule'>
<block trace='true' name='CustomTestRule1'>
<list>
<new class='com.waveset.object.AttributeCondition'>
*<<s>typeTest<</s>*
<<s>equals<</s>
<<s>type1<</s>
<</new>
</list>
</block>
<MemberObjectGroups>
<ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
</MemberObjectGroups>
</Rule>
Syntax 3 :
<Rule authType='UserMembersRule' id='#ID#Rule:CustomTestRule1' name='Custom Test Rule 1' primaryObjectClass='Rule'>
<block trace='true' name='CustomTestRule1'>
<list>
<new class='com.waveset.object.AttributeCondition'>
*<<s>waveset.typeTest<</s>*
<<s>equals<</s>
<<s>type1<</s>
</new>
</list>
</block>
<MemberObjectGroups>
<ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
</MemberObjectGroups>
</Rule>
Syntax 4 :
<Rule authType='UserMembersRule' id='#ID#Rule:CustomTestRule1' name='Custom Test Rule 1' primaryObjectClass='Rule'>
<block trace='true' name='CustomTestRule1'>
<list>
<new class='com.waveset.object.AttributeCondition'>
*<<s>Simu1.typeTest<</s>*
<<s>equals<</s>
<<s>type1<</s>
</new>
</list>
</block>
<MemberObjectGroups>
<ObjectRef type='ObjectGroup' id='#ID#Top' name='Top'/>
</MemberObjectGroups>
</Rule>
Then, since it didn't work, I tried the second syntax, in which the Rule returns a list of accountIds (in the form of "accountId:Resource") : as the examples on the web and in Waveset's documentation suggested, I queried the Resource with "com.waveset.ui.FormUtil.getResourceObjects".
Syntax 5 :
<Rule authType='UserMembersRule' id='#ID#Rule:CustomTestRule2' name='Custom Test Rule 2' primaryObjectClass='Rule'>
<defvar name='Members'>
<block trace='true' name='CustomTestRule2'>
<defvar name='MembersNames'>
<list/>
</defvar>
<dolist name='person'>
<invoke class='com.waveset.ui.FormUtil' name='getResourceObjects'>
<ref>context</ref>
<<s>User<</s>
<<s>Simu1<</s>
<map>
<<s>searchFilter<</s>
<<s>
(typeTest=type1)
<</s>
</map>
</invoke>
<append name='MembersNames'>
<concat>
<ref>person.waveset.accountId</ref>
<<s>:Lighthouse<</s>
</concat>
</append>
</dolist>
<ref>MembersNames</ref>
</block>
</defvar>
<ref>Members</ref>
</Rule>
This doesn't work, the "getResourceObjects" method returns null...
Then I tried replacing the "searchFilter" option with a "searchAttrsToGet = typeTest" option, but this throws the following exception :
com.waveset.util.WavesetException: Can't call method getResourceObjects on class com.waveset.ui.FormUtil
==> com.waveset.util.WavesetException: Unsupported option 'searchAttrsToGet'.
However the "searchAttrsToGet" option is listed in the Javadoc of Sun IDM !
I can't grasp why this doesn't work... Has any of you tried to do something similar, to give me an example ?
Thanks,
Alexis
Edited by: user8989858 on Oct 4, 2010 3:56 AM

This doesn't work, the "getResourceObjects" method returns null...The method responsible for listing objects in SimulatedResourceAdapter.java looks like this, sorry:
 public ArrayList listObjects(String type, Map options) {
 // ArrayList result = null;
 // return new ArrayList(_objects.keySet());
 return null;
 }

Get a resource attribute value in a form

Hi,
I have a resource assigned to a user . before he logs in I should query the resource that is assigned to him and get the value of a attribute .
How can I get the value of the attribute that is there in the resource in the form.
Should I check out the view to userview and ref something like userview.accounts[xxxx].attribute1
or
does it work like accounts.attribute1
thank you

If it is for display purpose, use getView and view.accounts[resource name].attribute. use checkout if u have to edit attribute.

Workflow not working correctly when removing resource attributes

(Comment: I have to say that posting to this forum is a real pita. It takes me upwards of 20 minutes to figure out why various words are not allowed, with no indication of what is wrong. For some reason ba lt im ore is a forbidden word so I replaced it with FirstLocation.)
I have a bulk action script that calls a workflow (below) to remove some locations from a users resource. What is happening is that it loops through and correctly removes 'FirstLocation'. Then it loops through the second pass and correctly removes 'Portland', however, on the third pass, Portland comes back - it's like the removal doesn't take for some reason. Is there something I should be updating differently to get this to remove the locations correctly?
This is the Task Definition:
<Variable name='remLocation'>
<list>
 <s>FirstLocation</s>
 <s>Portland</s>
 <s>Chicago</s>
 <s>Charleston</s>
 <s>Cleveland</s>
 <s>Lynnfield</s>
 <s>Roanoke</s>
 <s>Worthington</s>
 <s>Yorktown</s>
 <s>Hawthorne</s>
</list>
</Variable>
<Variable name='newJustification'>
<s>Obsolete Locations remd</s>
</Variable>
<Activity id='0' name='start'>
 <Transition to='Initialize' />
 <WorkflowEditor x='43' y='10' />
</Activity>
<Activity id='1' name='Initialize'>
 <Action id='0' name='Set variables'>
 <expression>
 <block name='INIT' trace='true'>
 </block>
 </expression>
 </Action>
 <Transition to='Make Account Changes' />
 <WorkflowEditor x='105' y='10' />
</Activity>
<Activity name='Make Account Changes'>
 <Action id='1' name='update lh account'>
 <expression>
 <block trace='true'>
 
 <defvar name='tmpLocMap2'>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref>
 </defvar>
 
 <dolist name='elLoc'>
 <ref>remLocation</ref>
 <block trace='true'>
 <set name='tmpLocMap2'>
 
 <cond>
 <neq>
 <indexOf>
 <ref>user.accounts[FACILITIES].properties.locationMap[*].name</ref>
 <ref>elLoc</ref>
 </indexOf>
 -1
 </neq> 
 <block trace='true'>
 
 <defvar name='objectIndexNo'>
 <indexOf>
 <ref>user.accounts[FACILITIES].properties.locationMap[*].name</ref>
 <ref>elLoc</ref>
 </indexOf>
 </defvar>
 <rem>
 <filternull>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref>
 </filternull>
 <get>
 <filternull>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref>
 </filternull>
 <ref>objectIndexNo</ref>
 </get>
 </rem>
 </block>
 <ref>tmpLocMap2</ref>
 </cond>
 </set>
 <set>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref>
 <ref>tmpLocMap2</ref>
 </set>
 </block>
 </dolist>
 <set>
 <s>user.accounts[FACILITIES].properties.justification</s>
 <ref>newJustification</ref>
 </set>
 <set>
 <s>user.accounts[FACILITIES].justification</s>
 <ref>newJustification</ref>
 </set>
 </block>
 </expression>
 </Action>
 . . . and here's some of the debug code showing what happens:
<dolist name='elLoc'>
<ref>remLocation</ref> --> [FirstLocation, Portland, Chicago, Charleston, Cleveland, Lynnfield, Roanoke, Worthington, Yorktown, Hawthorne, ...truncated...]
<block trace='true'>
 <set name='tmpLocMap2'>
 </set> --> null
 <set name='tmpLocMap2'>
 <cond>
 <neq>
 <indexOf>
 <ref>user.accounts[FACILITIES].properties.locationMap[*].name</ref> --> [FirstLocation, Shelbyville, Portland, Syracuse]
 <ref>elLoc</ref> --> FirstLocation
 </indexOf> --> 0
 -1 --> -1
 </neq> --> 1
 <block trace='true'>
 <defvar name='objectIndexNo'>
 </defvar> --> null
 <rem>
 <filternull>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [GenericObject:FirstLocation, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </filternull> --> [GenericObject:FirstLocation, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <get>
 <filternull>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [GenericObject:FirstLocation, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </filternull> --> [GenericObject:FirstLocation, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <ref>objectIndexNo</ref>
 [<defvar name='objectIndexNo'>]
 <indexOf>
 <ref>user.accounts[FACILITIES].properties.locationMap[*].name</ref> --> [FirstLocation, Shelbyville, Portland, Syracuse]
 <ref>elLoc</ref> --> FirstLocation
 </indexOf> --> 0
 [</defvar>] --> 0 --> 0
 </get> --> GenericObject:FirstLocation
 </rem> --> [GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </block> --> [GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </cond> --> [GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </set> --> null
my comment: At this point FirstLocation has been remd successfully from tmpLocMap2.
<remAll>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [GenericObject:FirstLocation, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </remAll> --> [GenericObject:FirstLocation, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <set>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [GenericObject:FirstLocation, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <ref>tmpLocMap2</ref> --> [GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </set> --> null
</block> --> null
<block trace='true'>
 <set name='tmpLocMap2'>
 </set> --> null
 <set name='tmpLocMap2'>
 <cond>
 <neq>
 <indexOf>
 <ref>user.accounts[FACILITIES].properties.locationMap[*].name</ref> --> [Shelbyville, Portland, Syracuse]
 my comment: the locationMap above shows that FirstLocation was successfully remd.
 <ref>elLoc</ref> --> Portland
 </indexOf> --> 1
 -1 --> -1
 </neq> --> 1
 <block trace='true'>
 <defvar name='objectIndexNo'>
 </defvar> --> null
 <rem>
 <filternull>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </filternull> --> [GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <get>
 <filternull>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </filternull> --> [GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <ref>objectIndexNo</ref>
 [<defvar name='objectIndexNo'>]
 <indexOf>
 <ref>user.accounts[FACILITIES].properties.locationMap[*].name</ref> --> [Shelbyville, Portland, Syracuse]
 <ref>elLoc</ref> --> Portland
 </indexOf> --> 1
 [</defvar>] --> 1 --> 1
 </get> --> GenericObject:Portland
 </rem> --> [GenericObject:Shelbyville, GenericObject:Syracuse]
 </block> --> [GenericObject:Shelbyville, GenericObject:Syracuse]
 </cond> --> [GenericObject:Shelbyville, GenericObject:Syracuse]
 my comment: and here Portland was successfully remd.
 </set> --> null
 <remAll>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </remAll> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <set>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <ref>tmpLocMap2</ref> --> [GenericObject:Shelbyville, GenericObject:Syracuse]
 </set> --> null
</block> --> null
<block trace='true'>
 <set name='tmpLocMap2'>
 </set> --> null
 <set name='tmpLocMap2'>
 <cond>
 <neq>
 <indexOf>
 <ref>user.accounts[FACILITIES].properties.locationMap[*].name</ref> --> [Shelbyville, Portland, Syracuse]
 my comment: but above, when referenced, Portland hasn't really been remd. Why not??
 <ref>elLoc</ref> --> Chicago
 </indexOf> --> -1
 -1 --> -1
 </neq> --> 0
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </cond> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </set> --> null
 <remAll>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </remAll> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <set>
 <ref>user.accounts[FACILITIES].properties.locationMap</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 <ref>tmpLocMap2</ref> --> [null, GenericObject:Shelbyville, GenericObject:Portland, GenericObject:Syracuse]
 </set> --> null
</block> --> null
<block trace='true'> Any suggestions would be appreciated. Thanks much!
Edited by: user12836258 on Sep 7, 2011 10:14 AM
Edited by: user12836258 on Sep 7, 2011 10:15 AM

it is working over there and changing the status also.
But when through workflow same values come, it didnt work
Check the authorizations associated with WF-BATCH user, i feel like it can be a authorization issue, as you were saying that it is working fine from the BOR method and when it is trying to update the same through workflow the workitem is gogin into error state.
Make sure that teh WF-BATCH user is having SAP_ALL

Custom resource/attribute not visible in FIM portal for non-admins

hi all
I have a problem I am not able to solve and hope somebody can help. We have created an custom Resource in the FIM portal called Customer. It is an User Resource Type and attribute type customer, data type=reference.
We have made this attribute visible in the Users Properties by editing the RCDC for Configuration for User Creation, Configuration for User Editing and Configuration for User Viewing. It is now visible for alle users in the FIM Portal.
But when an non-admin searches for an attribute in that Field, nothing shows up.... only member of the administrator set, are able to display the results.
I have added the Resource to Filter permission - Administrator Filter permission + non-administrator filter permission.
I have added the Resource to MPR - General: Users can read non-administrative configuration resources?
Can anyone help?
Best regards Andre
Andre

Hi,
To be clear,
You have create one new resource type 'Customer' and one attribute 'Customer' (Reference, binded to Person object)
Update RCDC for Person (create/edit/view) to add a picker attribute with those parameters
UsageKeywords: This is an optional string property. You can define a list of search scopes to be used in the Resource Picker by providing a list of the usage keywords that are supported by the SearchScopeConfiguration structure, where each keyword is separated by a (‘).
ResultObjectType: This is an optional string property. The resource type is used to render resources in the pop-up dialog-box list. This is used with the Filter to help the Identity Picker identify what resource type is returned by the Filter, and render the data accordingly. This property is mutually exclusive with the UsageKeywords property (see above). When the search scope is applied, this has no effect. The string that is accepted for this property is any single, valid, resource-type name, for example, Person. When the filter is expected to return multiple resource types, Resource is used.
Modify MPR "User management: Users can read attributes of their own" and "User management: Users can read selected attributes of other users" to add this new attribute
Create a new MPR to give the right of all users to view new resource 'Customer' on all attributes
Is that right?
Regards,
Sylvain

Reporting on resource attributes

We have a system with a few resources such as AD, which we pull information from, and push them all into an LDAP resource which will become the central identity repository. However we want to run reports on identities, and we'd like to dump a report similar to the all users report, but with a bunch of LDAP attributes as well.
Is this possible? It seems like we can only access IdM attributes when generating the report?

Hi Tom,
I think this will not be possible, because time is read from query date - and there can be given only one date.
So in one query, you can read only one information about the atribute.
You could consider using an infoset instead of a multi provider - there are special topics about time dependencies there - please read SAP help about this.
regards
Cornelia

Roles Setting and Removing Resource Attributes

Hello All,
I have a quick question (Which I hope has a quick answer). I am trying to set up a role, so that when it is assigned to a user, sets an attribute value on an LDAP resource. Then, when the role is removed from the user, the attribute value is cleared. When setting up the role, I specified the resource as assigned, and then set the attribute. When I set the role on a user, it is successfully setting the value in the attribute. When I remove the role from the user, it is not removing the value in the attribute. Is there an easy way to do this?
Thanks!

Hi,
When setting the RoleAttribute you need to set "Authoritive Set to Value, Clear Existing", then when the Role is removed from the user the attribute value is deprovisioned. Unfortunately this also has the affect of removing any other value that the attribute may have (especially true since many LDAP attributes are multi-valued).
HTH,
Paul Walker

IDM8 resource attribute.

Similar Messages

Maybe you are looking for