Novell Home

Solving Account Disabled Issues with the AS400 Bidirectional Driver

Novell Cool Solutions: Tip
By Geoffrey Carman

Digg This - Slashdot This

Posted: 11 Jul 2007 		 

Problem

For the bidirectional AS400 driver (aka i5osdrv), there is a mapping of Login Disabled (eDir) to STATUS (AS400). However, the syntax of the values is different.

In eDirectory that value is boolean, so either true and the user is disabled - or, false (technically, a false eDirectory boolean is just the absence of the attribute) and the user is enabled.

In the world of AS400, STATUS is either *ENABLED or *DISABLED.

The shipping default configuration has the Subscriver Output Transform convert eDirectory changes to Login Disabled to the format expected by the AS400. But there does not appear to be an analogous rule on the Input transform for the Publisher channel.

Solution

Here is a suggested rule to handle this mapping, so a disable action in AS400 can flow to eDirectory.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE policy PUBLIC
"policy-builder-dtd"
"/data/programs/designer.201/designer/eclipse/plugins/
com.novell.designer.idm.policybuilder_2.0.0.200705161501/DTD/dirxmlscript.dtd"><policy>
<rule>
  <description>Transform STATUS from *DISABLED to True for Login Disabled</description>
  <comment xml:space="preserve">Login disabled and STATUS are linked, 
but the format is different.</comment>
  <comment name="lastchanged" xml:space="preserve">Jun 27, 2007</comment>
  <conditions>
    <and>
      <if-op-attr mode="nocase" name="STATUS" op="changing-to">*DISABLED</if-op-attr>
    </and>
  </conditions>
  <actions>
    <do-strip-op-attr name="STATUS"/>
    <do-set-dest-attr-value name="Login Disabled">
      <arg-value type="string">
        <token-text xml:space="preserve">true</token-text>
      </arg-value>
    </do-set-dest-attr-value>
  </actions>
</rule>

<rule>
  <description>Transform STATUS from *ENABLED to Login Disabled equals
false</description>
  <comment xml:space="preserve">Convert an AS400 account enable to an
eDirectory Login Disabled equals false.</comment>
  <comment name="lastchanged" xml:space="preserve">Jun 27, 2007</comment>
    <conditions>
      <or>
        <if-op-attr mode="nocase" name="STATUS" op="changing-to">*ENABLED</if-op-attr>
      </or>
    </conditions>
  <actions>
    <do-strip-op-attr name="STATUS"/>
    <do-set-dest-attr-value name="Login Disabled">
      <arg-value type="string">
        <token-text xml:space="preserve">false</token-text>
      </arg-value>
    </do-set-dest-attr-value>
  </actions>
</rule>
</policy>

Environment

This was done using the IDM 3.01 driver, version 2.0.


Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions. www.webwiseone.com

© 2013 Novell