Beanshell code to remove a user from an active directory group?

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

I’ve been doing a lot of searching today but haven’t found a basic example of programmatically removing a member from an active directory group. I’ve been reading about provisioning plans, leaver workflows, and entitlements but I’m new to SailPoint and am trying to keep things simple for now. I’m ok using a provisioning plan but how should it be configured to remove one identity from a ManagedAttribute (ie. AD group)? Thanks

2

If you have a provisioning plan you can run it using:

Provisioner provisioner = new Provisioner(context);
provisioner.execute(plan);

However I advice to use a WorkFlow to provision the removal of the AD group membership, as the ‘LCM Provisioning’ workflow also performs retrying if needed and is more resilient compared to directly provisioning a plan using the Provisioner.

– Remold

3

Hello,

you can try something like this. Account request execution through Provisioing plan will help. Let me know if the solution works or you need more info on this

AccountRequest ar=new AccountRequest();
        ar.setNativeIdentity(link.getNativeIdentity());
        ar.setApplication(link.getApplicationName());
        ar.setOperation(ProvisioningPlan.AccountRequest.Operation.Modify);

        AttributeRequest attReq = new AttributeRequest();

        attReq.setName("memberOf");

        attReq.setOperation(ProvisioningPlan.Operation.Add); // chnage op to remove 

        attReq.setValue("CN for the entitlment goes here");
        ar.add(attReq);
        accReqs.add(ar);
        plan2.setAccountRequests(accReqs);
        plan2.add(ar);
2 Likes
4

Seems that previous replies missed your main misunderstanding. To remove user from AD group you really do not touch ManagedAttribute at all. Do not try to draw parallel between real AD group and ManagedAttribute.
Removing user from AD group is similar like removing any other entitlement from the Identity.

  1. You pick the identity
  2. You find the entitlement on the Identity you want to remove
  3. You create a provisioning plan where you provision a Remove operation to that account.

NB! This is NOT production ready code! No verifications, try catches etc. And modifying identity this way is also not correct in certain places like LCM Lifecycle Event workflows where it may affect identity locking etc.

For example:

import sailpoint.api.IdentityService;
import sailpoint.object.Application;
import sailpoint.object.AccountRequest;
import sailpoint.object.AttributeRequest;
import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import sailpoint.object.ProvisioningPlan.Operation;
import sailpoint.api.Provisioner;

Identity identity = context.getObjectByName(Identity.class, "YOUR IDENTITY");
Application ad = context.getObjectByName(Application.class,"THE NAME OF YOUR AD APP");
IdentityService is = new IdentityService(context);	
List listOfLinks = is.getLinks(identity, ad);
for(Link eachLink : listOfLinks) {
// you have to define some logic, how you check that this is the correct account 
String nativeIdentity = eachLink.getNativeIdentity();
// if you have found one
AccountRequest accReq = new AccountRequest();	
accReq.setNativeIdentity(eachLink.getNativeIdentity());
accReq.setApplication(eachLink.getApplicationName());
accReq.setOperation(ProvisioningPlan.AccountRequest.Operation.Modify);
accReq.add(new AttributeRequest("memberOf", ProvisioningPlan.Operation.Remove, "THE CN OF THE GROUP"));
ProvisioningPlan plan = new ProvisioningPlan();
plan.setIdentity(identity);
plan.add(accReq);
Provisioner provisioner = new Provisioner(context);
provisioner.execute(plan);
}
2 Likes
5

Thanks for the help from everyone, this response best answers my question. It is very helpful.

6

In any case, the disclaimer. Do not use this code as-is. It just demonstrates the main moving parts. The main reason you cant use it directly is that it currently will run the provisioning in the loop. In reality you of course find the correct account (Link - user may have multiple accounts on the same application) and then you should fire the provisioning on correct account only.

7

Also remember that if your group was originally assigned through LCM, you’ll need to clean up the attributeAssignment to avoid triggering re-provisioning.
See e.g. https://community.sailpoint.com/t5/IdentityIQ-Forum/How-to-remove-attributeAssignments-by-leaver-workflow/m-p/54822

8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.