This rule places objects from one container in the Identity Vault into multiple containers in the data store based on the OU attribute. Implement the rule on the Placement policy in the driver. You can implement the rule only on the Subscriber channel.
There are two steps involved in using the predefined rules: creating a policy in the Placement policy set and importing the predefined rule. If you already have a Placement policy that you want to add this rule to, skip to Importing the Predefined Rule.
From the Outline view or the Policy Flow view, select the Subscriber channel.
Select the Placement policy set in the Policy Set view, then click
icon to create a new policy.Click
, then click .Name the policy.
Use the default location or browse and select another location to place the policy in the driver.
Select
, then click .Select
for the type of policy, then click .A file conflict window appears with the message “ Before editing this item you need to save. Do you wish to save the editor’s changes and continue?” Click . The Policy Builder is launched and the new Placement policy is saved.
Continue with Section 8.19.2, Importing the Predefined Rule.
Right-click in the Policy Builder, then click
> or .Select
, then click .Edit the action by double-clicking the
tab.Delete
from the field.Click the
icon to launch the Argument Builder.Select
in the list.Double-click
to add it to the argument.In the Editor, add the parent container in the data store. The parent container must be specified in LDAP format. Make sure all of the department containers are child containers of this DN, then click
.Click
.Save the rule by clicking
> .This rule places User objects in proper department containers depending upon the value that is stored in the OU attribute. If a User object needs to be placed and has the OU attribute available, then the User object is placed in the uid=unique name,ou=value of OU attribute,dest-base.
The dest-base is a local variable. The DN must be the relative root path of the department containers. It can be an organization or an organizational unit. The value stored in the OU attribute must be the name of a child container of the dest-base local variable.
The child containers must be associated for the User objects to be placed. The value of the OU attribute must be the name of the child container. If the OU attribute is not present, then this rule is not executed.
The uid attribute of the User object is the first two letters of the Given Name attribute plus the Surname attribute as lowercase. The rule uses LDAP format.