Article

Problem

For the bidirectional AS400 driver (aka i5osdrv), there is a mapping of
Login Disabled (eDir) to STATUS (AS400). However, the syntax of the values is different.

In eDirectory that value is boolean, so either true and the user is
disabled - or, false (technically, a false eDirectory boolean is just the
absence of the attribute) and the user is enabled.

In the world of AS400, STATUS is either *ENABLED or *DISABLED.

The shipping default configuration has the Subscriver Output Transform convert eDirectory changes to Login Disabled to the format expected by
the AS400. But there does not appear to be an analogous rule on the Input
transform for the Publisher channel.

Solution

Here is a suggested rule to handle this mapping, so a disable action in AS400 can flow to eDirectory.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policy PUBLIC
"policy-builder-dtd"
"/data/programs/designer.201/designer/eclipse/plugins/
com.novell.designer.idm.policybuilder_2.0.0.200705161501/DTD/dirxmlscript.dtd"><policy>
<rule>
  <description>Transform STATUS from *DISABLED to True for Login Disabled</description>
  <comment xml:space="preserve">Login disabled and STATUS are linked, 
but the format is different.</comment>
  <comment name="lastchanged" xml:space="preserve">Jun 27, 2007</comment>
  <conditions>
    <and>
      <if-op-attr mode="nocase" name="STATUS" op="changing-to">*DISABLED</if-op-attr>
    </and>
  </conditions>
  <actions>
    <do-strip-op-attr name="STATUS"/>
    <do-set-dest-attr-value name="Login Disabled">
      <arg-value type="string">
        <token-text xml:space="preserve">true</token-text>
      </arg-value>
    </do-set-dest-attr-value>
  </actions>
</rule>

<rule>
  <description>Transform STATUS from *ENABLED to Login Disabled equals
false</description>
  <comment xml:space="preserve">Convert an AS400 account enable to an
eDirectory Login Disabled equals false.</comment>
  <comment name="lastchanged" xml:space="preserve">Jun 27, 2007</comment>
    <conditions>
      <or>
        <if-op-attr mode="nocase" name="STATUS" op="changing-to">*ENABLED</if-op-attr>
      </or>
    </conditions>
  <actions>
    <do-strip-op-attr name="STATUS"/>
    <do-set-dest-attr-value name="Login Disabled">
      <arg-value type="string">
        <token-text xml:space="preserve">false</token-text>
      </arg-value>
    </do-set-dest-attr-value>
  </actions>
</rule>
</policy>

Environment

This was done using the IDM 3.01 driver, version 2.0.