IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  IGI - How to Create Account Automatically

    Posted 04/07/21 01:08 PM
    Hello All,

    I have a connector to SDS using a LDAP Connector. I was successful read from the SDS for accounts and write to SDS when I manually added new SDS account from IDEAS user.

    How to create an SDS account when I create a new IDEAS users? I have read the documentation, it says we can use creation policy, but I don't know how the rules are. Does anyone have an example of account creation rules? And howis the correct steps for automatically create account to other application when I created an IDEAS users?

    Thanks,
    Julian

    ------------------------------
    Julian Fazri
    ------------------------------


  • 2.  RE: IGI - How to Create Account Automatically

    Posted 04/22/21 07:58 PM
    Hi Julian,
        I'm new to IGI,too.
    For create account automatically, the following was that I try:
    1. Add IDEAS user to any roles that sync from SDS
    2. With HR feed
        you can write igi rules to assign default role in SDS when new identity add to IGI.
    All above two methods will add random(depends on Password Policy) password to create Account
    3. Create Account with HR feed
        The following rules can set any default password to Account
    when
    event : EventInBean( )
    userErcBean : UserErcBean( )
    userBean : UserBean( )
    extInfoBean : ExternalInfo( )
    orgUnitBean : OrgUnitBean( )
    then
    Map<String, List<PwdManagementAttrValBean>> pwdManagementAttrs = new HashMap<String, List<PwdManagementAttrValBean>>();
    PwdManagementAttrValBean defaultHomeDir = new PwdManagementAttrValBean();
    defaultHomeDir.setValue("true");
    List<PwdManagementAttrValBean> pwdManagementValues = new ArrayList<PwdManagementAttrValBean>();
    pwdManagementValues.add(defaultHomeDir);
    pwdManagementAttrs.put("erPosixDefaultHomeDir", pwdManagementValues);
    AccountBean mailAccount = new AccountBean();
    mailAccount.setPwdcfg_name("Mail");
    mailAccount.setPerson_id(userBean.getId());
    mailAccount.setAttributesToAdd(pwdManagementAttrs);
    mailAccount.setPwdpolicy_id(104);
    mailAccount.setPwdpolicy_name("Mail");
    UserAction.addAccount(sql, mailAccount);

    EntitlementBean filterEntitlement = new EntitlementBean();
    filterEntitlement.setApplication_name("Mail");
    filterEntitlement.setName("users");
    BeanList entitlementBeanList = _EntitlementAction.findEntitlement(sql, filterEntitlement, null);
    if (!entitlementBeanList.isEmpty()) {
    //EntitlementBean users = (EntitlementBean) entitlementBeanList.get(0);
    //_UserAction.addEntitlements(sql, false, true, orgUnitBean, entitlementBeanList, userBean);
    OrgUnitAction.addRoles(sql, orgUnitBean, entitlementBeanList, false);
    UserAction.addRole(sql, userBean, orgUnitBean, entitlementBeanList, null, null, false, false);
    UtilAction.addResourcesToEmployment(sql, userBean, (EntitlementBean)entitlementBeanList.get(0), orgUnitBean);
    }

    UserAction.changePwd(sql, mailAccount, "P@ssw0rd");



    ------------------------------
    Andy Wu
    ------------------------------



  • 3.  RE: IGI - How to Create Account Automatically

    Posted 04/23/21 02:43 AM

    Hello ,

    If this is just about creating LDAP account when IDEAS users created ,then in this case simply assign any common entitlement from LDAP to OU and make it default .

    In this case , when Ideas user will created and assigned to the OU , it will trigger OUT_EVENT for new LDAP account and assign default entitlement  to the account.

    Regards
    Ranvijay



    ------------------------------
    Ranvijay Singh , IAM SME
    IBM , Pune
    ------------------------------



Related Content