It Role to add a AD group and remove another

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

8.2

Hello everybody,

In my Sailpoint I have an IT Role that is automatically assigned to a set of users.
This role is linked to a rule that will validate who the user is and based on their department, it returns a Dn from an AD group and assigned this group to the user.
The issue is that the user may for some reason already have the group.
How can I validate if the user already has the group and if they have, how to remove it before assign the new one?

Thanks everyone

2

These groups are multuivalued attribute , Users can have multiple group at the same time .
Now if the users has group which IT role want to assign again , then sailpoint will ot fail despite it will say the group as filtered ,

3

Hey, yes but in this case this will assign a group based on department.
If the user change department The goal is to remove the old group and give the new one

4

@RIsidoro
Is your IT role not associated with AD groups directly and you have an additional adhoc rule that will provision the new group?
Can you provide more details because by default if your IT role has the group configuration , you removed the old group and added new group for the same or if the user is removed from the IT role the old group is configured, old group membership removal will taken care by refresh task and propagate role changes

5

My IT role is connected to a rule.
And my role is assigned to all users

I will give an example

A user is created in Sailpoint
This rule will determine that a user is from the IT department, so do “return CN=IT”

And the user starts to have an AD group called IT

But if the user switches to sales
I want a rule to removes the group IT and assignes the group sales .

Right now I can add the sales one, but I’m not able to remove the IT one

i need like a code to remove the group X from AD

6

I though doing something like acct.add(new AttributeRequest(“memberOf”,ProvisioningPlan.Operation.Remove,“CN=xyz”));

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.