Update AD groups via resourceObjectUpdate?

Question

Hello idm experts,
I need to update to update an object in AD - move in into a different container, update some attributes and add AD security groups.
Is that possible to do all at once via updateResourceObject com.waveset.provision.WorkflowServices call?
Trying to do it - rename (move to different OU) is correct, modifying attributes is correct. Group membership gets completely wiped out.
Here is the user object I'm passing:
<Object>
<Attribute name='user'>
<Object>
<Attribute name='attributes'>
<Object>
<Attribute name='description' value='xxxx111'/>
<Attribute name='groups'>
<List>
<String>CN=na_approver,OU=FWD Groups,OU=Ldap Data,OU=INT,DC=msqa,DC=qa,DC=ms,DC=com</String>
<String>CN=NA_BranchAdmin1,OU=Common Groups,OU=ISG,OU=INT,DC=msqa,DC=qa,DC=ms,DC=com</String>
</List>
</Attribute>
<Attribute name='objectGUID' value='106d443e62585a469d0ddf6dfdbaacfe'/>
<Attribute name='sAMAccountName' value='xxxxxtest09'/>
<Attribute name='ws_newAccountId' value='cn=paveltest0909,ou=gwm,ou=exchange,ou=isg,ou=int,dc=msqa,dc=qa,dc=ms,dc=com'/>
</Object>
</Attribute>
<Attribute name='objectId' value='CN=xxxxxtest0909,OU=GWM,OU=Exchange,OU=ISG,OU=INT,DC=msqa,DC=qa,DC=ms,DC=com'/>
<Attribute name='objectType' value='User'/>
<Attribute name='resourceId' value='#ID#Resource:AD'/>
</Object>
</Attribute>
</Object>
And here is the call:
<Action name='Update User' application='com.waveset.provision.WorkflowServices'>
<Argument name='op' value='updateResourceObject'/>
<Argument name='objectId' value='$(iden)'/>
<Argument name='objectType' value='User'/>
<Argument name='object' value='$(ldapObject.user)'/>
<Argument name='resourceId' value='#ID#Resource:AD'/>
<Argument name='action' value='update'/>
<Return from='applicationError' to='applicationError'/>
</Action>
Update seems to be OK, the object is moved, attributes are updated, but group membership is wiped out.
WavesetResult contains this:
<WavesetResult>
<ResultItem type='result' status='UI_MSG_SEVERITY_OK'>
<WavesetResult>
<ResultItem type='ACCOUNT_RENAMED'>
<String>CN=xxxxxtest0909,OU=GWM,OU=Exchange,OU=ISG,OU=INT,DC=msqa,DC=qa,DC=ms,DC=com</String>
</ResultItem>
<ResultItem type='message' status='UI_MSG_SEVERITY_OK'>
<Message id='WF_RESOURCE_OBJECT_UPDATED'>
<String>WF_RESOURCE_OBJECT_TYPE_USER</String>
<String></String>
</Message>
</ResultItem>
</WavesetResult>
</ResultItem>
</WavesetResult>
What happened with group membership? Is there something I'm missing in object parameters or WorkflowServices parameters?

Answer 1

You can "nest" an AD group in a SharePoint group and that will work just fine. What does not work is if you add users to an AD group, then nest that group in another AD group, and apply that second AD group to SharePoint. SharePoint is unable to crack open
the nested group to parse the users.
What do you mean by Site Collection Web Policy? Policies are applied at the Web Application level (in Central Administration).
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.