IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Update attributes in Cloud Directory

    Posted 22 hours ago

    Hi all,

    I need to populate two fields in IBM Verify SaaS when the user is added to the Cloud Directory: the username (which is already populated via API, but I need to change its value) and the email address (which is initially empty), before provisioning them to Active Directory.

    Regards,

    Rodrigo



    ------------------------------
    Rodrigo Xavier
    ------------------------------


  • 2.  RE: Update attributes in Cloud Directory

    Posted 15 hours ago

    Hi,

    There are a couple of options, which allow to update the user profile in the cloud directory before triggering a provisioning on Active Directory

    You could configure AppRoles (AppRole mgmt)  where you assign permissions (AD account) and cloud group(s)/roles to the AppRole. Once you have modified the user with the values , add the user to a specific group (part of the appRole) and the AD account will be provisioned

    Another option is to use Dynamic groups which you also can use with the AppRole.  The Dynamic group feature works on user attributes (or condition set )

    https://www.ibm.com/docs/en/security-verify?topic=verify-requestable-features (Dynamic groups (Beta CI-46644))

    This should allow to first update the user profile before the provisioning is scheduled.

    Hope this helps

    Regards

    Serge Vereecke



    ------------------------------
    Serge Vereecke
    ------------------------------



  • 3.  RE: Update attributes in Cloud Directory

    Posted 8 hours ago
    Hi Serge,

    Thanks for your reply.
    I´m aware about dynamics groups, but my case is a bit more complex.
    Let me try to explain:
    A customer is sending me new HR employee creations via API, but they aren't sending the user's email and are reluctant to change it. Consequently, I don't receive the new employee's email in Verify, but I use a custom rule in the AD attribute mapping to provision the correct email into AD. However, I need to return this value to populate the email field in that user's profile. What would be the best way to do this?

    Regards,
    Rodrigo



    Original Message


Related Content