[Hi @vguleria thank you so much for your input.
Please refer to the below AD before provisioning rule which we are using for user leaver and dormant process.
<?xml version='1.0' encoding='UTF-8'?> AD Before Provisioning Rule which removes all the group memberships except ACC_LegalHold from AD. <![CDATA[ import java.text.SimpleDateFormat; import java.util.ArrayList; import java.util.Date; import java.util.List; import java.util.Random; import sailpoint.object.Identity; import sailpoint.object.ProvisioningPlan.AccountRequest; import sailpoint.object.ProvisioningPlan.AttributeRequest; import sailpoint.object.ProvisioningPlan; import sailpoint.tools.Util; import java.util.TimeZone;
log.info("Inside Rule - BeforeProvisioning - ADBeforeProvisoning");
Identity identity = plan.getIdentity();
List accountRequests = plan.getAccountRequests();
List memeberOfList = new ArrayList();
String currentLCS =identity.getAttribute("cloudLifecycleState");
String disabledOU= "OU=Departed,OU=User Accounts,DC=Sample,DC=TestNet,DC=com";
log.info("currentLCS:: "+currentLCS);
if (accountRequests != null) {
for (AccountRequest accountRequest : accountRequests) {
if (AccountRequest.Operation.Disable.equals(accountRequest.getOperation()) && "terminated".equals(currentLCS)) {
log.info("operation disable loop:: ");
String nativeIdentity = accountRequest.getNativeIdentity();
log.info("ApplicationName"+application.getName());
log.info("nativeIdentity"+nativeIdentity);
Object memberOfObject = idn.getRawAccountAttribute(application.getName(), nativeIdentity, "memberOf");
log.info("memberOfObject"+memberOfObject);
if (memberOfObject != null) {
if (memberOfObject instanceof String) {
String strGroup = (String) memberOfObject;
memeberOfList.add(strGroup);
}
else if (memberOfObject instanceof List) {
memeberOfList = (List) memberOfObject;
}
}
log.info("memeberOfList"+memeberOfList);
for (Iterator iterator = memeberOfList.iterator(); iterator.hasNext();)
{
String memberOf= (String) iterator.next();
if (memberOf.equals("CN=Domain Users,CN=Users,DC=Sample,DC=TestNet,DC=com") ||
memberOf.equals("CN=ACC_LegalHold-3Months,CN=Users,DC=Sample,DC=TestNet,DC=com") || memberOf.equals("CN=ACC_LegalHold,CN=Users,DC=Sample,DC=TestNet,DC=com")) {
iterator.remove();
}
}
log.info("memeberOfList after Removal:: " +memeberOfList);
String charset = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz1234567890!@#$%^&*()_+-={}[]:;<>?,./";
int len = charset.length();
Random rnd = new Random();
StringBuilder newPassword = new StringBuilder();
// Generate one capital letter
char capitalLetter = charset.charAt(rnd.nextInt(26));
newPassword.append(capitalLetter);
// Generate one small letter
char smallLetter = charset.charAt(26 + rnd.nextInt(26));
newPassword.append(smallLetter);
// Generate one symbol
char symbol = charset.charAt(52 + rnd.nextInt(14));
newPassword.append(symbol);
// Generate one number
char number = charset.charAt(66 + rnd.nextInt(10));
newPassword.append(number);
// Generate the remaining characters
for (int count = 0; count < 8; count++) {
char randomChar = charset.charAt(rnd.nextInt(len));
newPassword.append(randomChar);
}
Date today = new Date();
SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ssX");
TimeZone timeZone = TimeZone.getTimeZone("UTC");
sdf.setTimeZone(timeZone);
String formattedDate = sdf.format(today);
accountRequest.add(new AttributeRequest("title", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("department", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("manager", ProvisioningPlan.Operation.Set,""));
accountRequest.add(new AttributeRequest("company", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("description",ProvisioningPlan.Operation.Set, "Disabled on " +formattedDate+ " (" + timeZone.getID() + ")"));
accountRequest.add(new AttributeRequest("telephoneNumber", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("facsimileTelephoneNumber", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("homePhone", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("ipPhone", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("otherHomePhone", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("mobile", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("pager", ProvisioningPlan.Operation.Set, ""));
accountRequest.add(new AttributeRequest("msExchHideFromAddressLists", ProvisioningPlan.Operation.Set, true));
accountRequest.add(new AttributeRequest("password", ProvisioningPlan.Operation.Set, newPassword));
accountRequest.add(new AttributeRequest("memberOf", ProvisioningPlan.Operation.Remove, memeberOfList));
if(disabledOU!=null)
accountRequest.add(new AttributeRequest("AC_NewParent", ProvisioningPlan.Operation.Set,disabledOU));
}
if(Util.nullSafeCaseInsensitiveEq("dormant",currentLCS))
{
String nativeIden = accountRequest.getNativeIdentity();
if (nativeIden != null && nativeIden.replaceAll("\\s", "").toLowerCase().contains("-admin")) {
plan.remove(accountRequest);
}
}
}
}
]]>
</Source>
- The account movement is happening in AD and removing all the group membership except Domain Users and ACC_LegalHold while user getting terminated.
- It is optimised aggregation for AD source.
Thanks
Kalyan
.