Maximo

Maximo

Come for answers, stay for best practices. All we're missing is you.

 View Only

  • 1.  MAS LDAP user registry synchronization - custom attributes mapping

    Posted Tue February 20, 2024 04:21 PM

    Hello Community,

    one of our customers, currently in the proces of upgrade from Maximo 7.6.1.x to MAS 8.11, is using VMM user registry synchronization.
    For historical reasons current LDAP to Maximo user mapping looks as follows:

    <?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE ldapsync
  SYSTEM 'ldapuser.dtd'>
<ldapsync>
	<user>
		<basedn>[edit]</basedn>
		<filter>[edit]</filter>
		<scope>subtree</scope>
		<attributes>
			<attribute>sAMAccountName</attribute>
			<attribute>extensionattribute2</attribute>
			<attribute>givenName</attribute>
			<attribute>sn</attribute>
			<attribute>displayName</attribute>
			<attribute>mobile</attribute>
		</attributes>
		<datamap>
			<table name="MAXUSER">
				<keycolumn name="USERID" type="UPPER">extensionattribute2</keycolumn>
				<column name="LOGINID" type="ALN">sAMAccountName</column>
				<column name="PERSONID" type="UPPER">extensionattribute2</column>
			</table>
			<table name="PERSON">
				<keycolumn name="PERSONID" type="UPPER">extensionattribute2</keycolumn>
				<column name="FIRSTNAME" type="ALN">givenName</column>
				<column name="LASTNAME" type="ALN">sn</column>
				<column name="DISPLAYNAME" type="ALN">displayName</column>
				<column name="STATUSDATE" type="ALN">{:sysdate}</column>
			</table>
			<table allowdelete="true" name="PHONE">
				<keycolumn name="PERSONID" type="UPPER">extensionattribute2</keycolumn>
				<keycolumn name="TYPE" type="UPPER">{WORK}</keycolumn>
				<keycolumn name="ISPRIMARY" type="YORN">{1}</keycolumn>
				<column name="PHONENUM" required="true" type="ALN">mobile</column>
			</table>
		</datamap>
	</user>
</ldapsync>

    What's special about this setup is that:

    1. MAXUSER.USERID and PERSON.PERSONID are being mapped to a custom LDAP attribute extensionattribute2
    2. MAXUSER.LOGINID is mapped to LDAP attribute sAMAccountName.

    Once upgrade process completes we have all users synchronized to MAS Core and User record/document in MongoDB is effectively populated as follows:

    • id <-- MAXUSER.USERID <-- LDAP(extensionattribute2)
    • username <-- MAXUSER.LOGINID <-- LDAP(sAMAccountName)

    So far so good!

    According to MAS 8.11 documentation of LDAP user registry synchronization (Limitations section) "The only customized mapping property is userName. Other attributes are mapped by using IBM Liberty defaults.". Yet, the same documentation states in Customizations in ScimCfg Custom Resource section that "you can change some configurations in the ScimCfg Custom Resource as the configurations are not available in the Maximo Application Suite user interface".

    I must admit I'm confused... I'm new to Websphere Liberty (what are those IBM Liberty defaults?) and don't really know how the user synchronization process works under the hood in MAS.

    I'm seeking in the first place for an advice whether it's somehow possible to achieve the same mapping in MAS as we had in 7.6.1.x?
    If it's not supported yet then does anyone know when that is expected to be supported?
    Could you think of any alternative or a workaround how to eventually avoid scripting user IDs throughout Maximo database?



    ------------------------------
    Andrzej Więcław
    Maximo Technical Consultant
    AFRY
    Wrocław, Poland
    ------------------------------


  • 2.  RE: MAS LDAP user registry synchronization - custom attributes mapping

    Posted Fri January 24, 2025 08:25 AM

    Hi Andrzej,

    I am in the same position. Did you find an answer to your question ?

    Thanks,



    ------------------------------
    amir anwar
    ------------------------------

    Original Message


  • 3.  RE: MAS LDAP user registry synchronization - custom attributes mapping

    Posted Mon January 27, 2025 01:17 AM

    Hi Amir,

    It's been quite some time ago when I was facing this challenge and at that time we decided to go for bespoke user synchronization tool as it turned out that we need to satisfy few more very specific requirements.

    I know though that meanwhile IBM has made significant progress in the development and there might be right tools already now. Perhaps someone watching this thread can fill in what options we do have these days. That would be appreciated.



    ------------------------------
    Andrzej Więcław
    Maximo Technical Consultant
    AFRY
    Wrocław, Poland
    ------------------------------

    Original Message


  • 4.  RE: MAS LDAP user registry synchronization - custom attributes mapping

    Posted Mon January 27, 2025 02:27 AM

    Hi,

    with MAS 9 there are now build in options to handle the custom attribute mapping on both LDAP --> MAS Core and MAS Core --> MAS Manage levels.

    How to setup custom mapping in MAS Core: https://www.ibm.com/docs/en/masv-and-l/continuous-delivery?topic=synchronization-ldap-user-registry
    TL,DR: in User Registry Synchronization You can provide mapping from LDAP field to MAS Core field.

    To customize MAS Core --> MAS Manage user synchronization You would use the same approach as for any other incoming integration using Enterprise Service (i.e. JSON map or Java user exit class). More details here: https://www.ibm.com/docs/en/masv-and-l/maximo-manage/continuous-delivery?topic=users-user-creation-authentication-synchronization

    Regards,
    WW



    ------------------------------
    Witold Wierzchowski
    Solution Architect
    Cohesive Poland
    ------------------------------

    Original Message


Related Content