Which IIQ version are you inquiring about? 8.3p3 Share all details about your problem, including any error messages you may have received. Hello everyone. Could someone please help me with the following problem. We have a need to add a Joiner user to a group based on one-time access only. We have…

Hi @d_pustovoitov - Coming at it from a different angle; I believe AD LDAP honours the memberOf attribute (I say honours because it’s not a real attribute). I haven’t tried it but maybe you could try attribute mapping the (fixed) group DN to memberOf as part of account creation?

Hi @d_pustovoitov Possible that where you have the group search filter: [image] Danylo Pustovoitov: { Name -eq $GroupName } You should have

Hi @j_place , Thanks, I’ll check it now.

Hi @j_place , Thanks, but it didn’t help.

Hi @d_pustovoitov - You will probably need @IAMpdu suggestion to target the same DC as the account creation as well

Hi @IAMpdu , Thanks for your reply. I’ve tried it and added the next lines to the code. This is for the rule: String createServer = " "; ProvisioningResult result = plan.getResult(); if (result != null) { ResourceObject resObj = result.getObject(); if (resObj != n…

You could potentially achieve this by an assignment rule on a bundle that is tied to the AD group as long as you have a flag or some condition you can check if the user has completed the IT security test. This way all logic for group assignment is within IIQ and not an external source.

Hi @nbhansali , Unfortunately, that’s not possible for us because this external source has a closed internal logic and does not add or update any flags on the AD account.

Ahh gotcha! I would possibly look to the options within your Identity Refresh task then. I think the problem is that the entitlement remains on your cube so regardless of what’s happening in your target system IIQ will over-write it and enforce the entitlement. Perhaps a hook somewhere to remove the…

@d_pustovoitov when user completes the IT security test, is there any flag somewhere sets in identity ? Or in any target app ?

Using the PowerShell script to add user to a group in AD

IdentityIQ (IIQ) IIQ Discussion and Questions

IAMpdu (Prasad Uplenchwar) November 12, 2024, 1:58pm 4

If there are multiple DC then you need to pass on which DC the user has been created.

Extract createdOnServer attribute from resultObject and server as parameter to below command -

Add-ADGroupMember -Identity $GroupName -Members $Username -Server <Value of created on server Name>

Topic		Replies	Views
Add AD group to user when request for a specific application entitlements IIQ Discussion and Questions identityiq , access-requests	6	377	July 23, 2024
How to Add Group Members While Creating Active Directory Group Using Plan IIQ Discussion and Questions aggregation , identityiq , provisioning , governance-groups	4	1012	June 9, 2024
How to add two groups to the same user using provisioning rule IIQ Discussion and Questions identityiq , provisioning	7	129	July 6, 2025
Add joiners to AD group in IIQ IIQ Discussion and Questions identityiq , provisioning	4	376	March 25, 2024
Adding/ Removing into a group in AD IIQ Discussion and Questions rules , identityiq	4	148	April 7, 2025

Using the PowerShell script to add user to a group in AD

Related topics