Provision Active Directory Groups

Role Model tutorial · Step 1 of 2

Create the AD groups that will be managed through the role model.

Create the AD groups before assigning membership through a NIM role model. This example maps each HR department to one AD group, so every employee belongs to the group for their department.

Create the group filter

First, we'll create a filter that outputs a column with all departments in our CSV source system.

1. Go to Processing > Filters.
2. Click Add.
3. For the Filter Name, enter HR500_AD_Group_Create.
4. Click Create.

Configure group selection

1. Select HR500.departments as the Start Table.

2. Click Filter to run the filter. The results are populated into the Result pane.

3. If AD group names should differ from HR department names, add a transformation. This example prefixes names with DEPGRP_, converting EN_DOC to DEPGRP_EN_DOC.

4. Go to the Columns Specification tab.

5. Click Add Script Column.

6. Enter a Column Name. For this example, we'll name the column dep_grp_name.

7. Enter your JavaScript in the Code pane. For this example, we'll use the following JavaScript: return 'DEPGRP_'+departments['organizational_unit'].

8. Click Test Script to execute your JavaScript code.

9. The result appears in the Script Result Value field.

10. Click Save and Exit.

11. Click Filter to refresh the data.

12. The HR500_AD_Group_Create filter now contains the dep_grp_name column.

13. In the Lookup tab, create these two lookups. The exclude lookup finds groups to create; the include lookup is used by the role generator.

    Lookup name	Filter column	System	Table	Field	Operation
    group_include	dep_grp_name	AD	Groups	sAMAccountName	include
    group_exclude	dep_grp_name	AD	Groups	sAMAccountName	exclude

14. Click Save.

15. Go back to the Data tab.

16. Click Filter [group_exclude] to test the exclude lookup. It should return all 39 groups, since they don't yet exist in AD:

17. Click Filter [group_include] to test the include lookup. It should return 0 groups, since they (likewise) don't yet exist in AD:

Create the group mapping

1. Go to Output > Mappings.
2. Click Add.
3. Enter these values: System: AD; Target: Groups; Function: GroupCreate; Name: HR500_AD_GroupCreate.
4. Click Save.

Configure and test the mapping

1. Select HR500_AD_Group_Create[group_exclude] as the mapping filter. Its columns appear in Items.

tip

Use the exclude lookup for the create mapping because it returns only groups that do not yet exist in AD.

2. In the Items pane, click the > button to preview the first record.

3. Map the group values as follows:

   Attribute	Item or value	Note
   cn	dep_grp_name
   path	OU=groups,OU=docs,DC=t4edemo,DC=com	Enter the path for your environment.
   sAMAccountName	dep_grp_name

4. Click Save.

5. Now, we'll manually test a single group create operation. Go to the Run tab. Select one of the rows in the Operation pane and click Run Selected Item.

6. The group should be successfully created in the target AD system.

Add group creation to the job

1. Go to Output > Jobs.
2. For the HR500_AD job, click Edit Job.
3. Go to the Configuration tab.
4. Click Add.
5. For this job item, select crud for Type, then select the HR500_AD_GroupCreate mapping for Name. Set the Threshold to 1000. This crud threshold counts pending group-create mapping operations; it does not use the membership-change count used by groupmembership items.
6. Click Save.

Evaluate and run the job

1. Go to the Execution tab.

2. Click Evaluate.

3. After a few moments, the Status changes to Initialized. This job will perform 39 group create operations.

4. Return to Scheduler > Overview and manually run the HR500_AD schedule.

5. Confirm that the schedule completes successfully and creates the remaining groups (38 in this example, after the single test group).