Article

(View Disclaimer)

Problem

For the bidirectional AS400 driver (aka i5osdrv), there is a mapping of
Login Disabled (eDir) to STATUS (AS400). However, the syntax of the values is different.

In eDirectory that value is boolean, so either true and the user is
disabled - or, false (technically, a false eDirectory boolean is just the
absence of the attribute) and the user is enabled.

In the world of AS400, STATUS is either *ENABLED or *DISABLED.

The shipping default configuration has the Subscriver Output Transform convert eDirectory changes to Login Disabled to the format expected by
the AS400. But there does not appear to be an analogous rule on the Input
transform for the Publisher channel.

Solution

Here is a suggested rule to handle this mapping, so a disable action in AS400 can flow to eDirectory.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policy PUBLIC
"policy-builder-dtd"
"/data/programs/designer.201/designer/eclipse/plugins/
com.novell.designer.idm.policybuilder_2.0.0.200705161501/DTD/dirxmlscript.dtd"><policy>
<rule>
  <description>Transform STATUS from *DISABLED to True for Login Disabled</description>
  <comment xml:space="preserve">Login disabled and STATUS are linked, 
but the format is different.</comment>
  <comment name="lastchanged" xml:space="preserve">Jun 27, 2007</comment>
  <conditions>
    <and>
      <if-op-attr mode="nocase" name="STATUS" op="changing-to">*DISABLED</if-op-attr>
    </and>
  </conditions>
  <actions>
    <do-strip-op-attr name="STATUS"/>
    <do-set-dest-attr-value name="Login Disabled">
      <arg-value type="string">
        <token-text xml:space="preserve">true</token-text>
      </arg-value>
    </do-set-dest-attr-value>
  </actions>
</rule>

<rule>
  <description>Transform STATUS from *ENABLED to Login Disabled equals
false</description>
  <comment xml:space="preserve">Convert an AS400 account enable to an
eDirectory Login Disabled equals false.</comment>
  <comment name="lastchanged" xml:space="preserve">Jun 27, 2007</comment>
    <conditions>
      <or>
        <if-op-attr mode="nocase" name="STATUS" op="changing-to">*ENABLED</if-op-attr>
      </or>
    </conditions>
  <actions>
    <do-strip-op-attr name="STATUS"/>
    <do-set-dest-attr-value name="Login Disabled">
      <arg-value type="string">
        <token-text xml:space="preserve">false</token-text>
      </arg-value>
    </do-set-dest-attr-value>
  </actions>
</rule>
</policy>

Environment

This was done using the IDM 3.01 driver, version 2.0.

Disclaimer: As with everything else at Cool Solutions, this content is definitely not supported by Novell (so don't even think of calling Support if you try something and it blows up).

It was contributed by a community member and is published "as is." It seems to have worked for at least one person, and might work for you. But please be sure to test, test, test before you do anything drastic with it.