Project

General

Profile

Actions
Copy link

Task #423

closed

IDs for provisioning

Added by Filip Měšťánek almost 7 years ago. Updated almost 7 years ago.

Status:
Closed
Priority:
Urgent
Assignee:
Vít Švanda
Category:
Provisioning
Target version:
Citrine (7.3.0)
Start date:
05/12/2017
Due date:
% Done:

100%

Estimated time:
Owner:

Description

The IdM must allow 2 scenarios for IDs for provisioning:

  1. For example when connecting LDAP, the identifier tends to be attribute like distinguishedName. It uniquely identifies the object but it can change. Usually, the DN is build from identity's name and organization. When its name or organization changes, the distinguishedName also needs to change. Now Idm doesn't allow for change of identifier.
  2. The identifier is generated by the resource. Example can be Active Directory, which generates a GUID when creating a record - global identifier, which is immutable. It is then returned from the connector. Now, IdM requires the identifier to be generated in IdM.

Both of these scenarios are very common and is critical to support them.

Actions
Copy link
 #1

Updated by Vít Švanda almost 7 years ago

  • Status changed from New to In Progress
Actions
Copy link
 #2

Updated by Vít Švanda almost 7 years ago

  • Category set to Provisioning
  • Target version set to Citrine (7.3.0)
Actions
Copy link
 #3

Updated by Vít Švanda almost 7 years ago

  • % Done changed from 0 to 80
  • Allowed change account identifier (UID )
  • Added "uid" parameter to script "transformToResource".
  • Added test for change account UID.
Actions
Copy link
 #4

Updated by Vít Švanda almost 7 years ago

  • % Done changed from 80 to 90

1) - Primary accaunt (AccAccount.uid) can be changed now. More informations are in wiki https://proj.bcvsolutions.eu/ngidm/doku.php?id=en:navrh:account-management#example_of_account_life_cycle.
2) - This case has been implemented in the past. GUID id ,returned by system, should be saved to SysSystemEntity.uid.

  • I added variable "uid" to script "transformToSystem" - Interfaces had to be changed for this.
  • I created test for change account uid situation.
Actions
Copy link
 #5

Updated by Vít Švanda almost 7 years ago

  • Status changed from In Progress to Needs feedback
  • Assignee changed from Vít Švanda to Filip Měšťánek

Can you try it now?

Actions
Copy link
 #6

Updated by Filip Měšťánek almost 7 years ago

  • Assignee changed from Filip Měšťánek to Vít Švanda

It still behaves strangely. I tried it on LDAP with DN being marked as identifier:

  1. Created account with DN 'cn=Ondrej Kopr,ou=AAA,O=XXXC=CZ'. This was saved to AccAccount and SysAccount.
  2. I changed the DN to 'cn=Ondrej Kopr,O=XXXC=CZ'. It changed the DN on the LDAP and it was saved to the SysAccount. But the AccAccount remained the same.
  3. When I tried to provision the user again, it tried to create a new account!
Actions
Copy link
 #7

Updated by Vít Švanda almost 7 years ago

This behavior makes sense (only SysSystemEntity.uid does not change).
The problem is that if SystemEntity.uid updated automatically, it lost this information for systems that generate its own ID.

Actions
Copy link
 #8

Updated by Vít Švanda almost 7 years ago

  • Assignee changed from Vít Švanda to Ondřej Kopr

I have extended the behavior (AbstractProvisioningProcessor) for modifying SystemEntity.uid if a different UID is returned from the system.
This works for creating and editing account.

Actions
Copy link
 #9

Updated by Ondřej Kopr almost 7 years ago

  • Status changed from Needs feedback to Resolved
  • Assignee changed from Ondřej Kopr to Vít Švanda
  • % Done changed from 90 to 100

Feedback (i tested this bugfix/feature on temporary local ldap, very simple for setup: https://github.com/intelie/dummyldap):

test with identities. OK, you may close this ticket.

Actions
Copy link
 #10

Updated by Vít Švanda almost 7 years ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF