Answers to: How to map AD group to Ivy role?

Comment by Adrian Imfeld on Christian Strebel's answer

Adrian Imfeld — Mon, 27 Jul 2015 08:40:52 -0400

Because of that, I asked the second question. Is it possible to listen to the user synchronisation job in Axon.ivy Engine? After the job is running i could map all the requestet (and additional) IRoles to the users.

Comment by Christian Strebel on Christian Strebel's answer

Christian Strebel — Fri, 24 Jul 2015 08:22:16 -0400

A solution could be designed as follows with the ivy roles:

Everybody
|-IT+Management
 |-Management (Mapped to: OU=Management,OU=Swiss,DC=company)
 |-IT (Mapped to: OU=IT,OU=Swiss,DC=company)

So if you have the OU "Management" or "IT" you get the corresponding ivy role and also the ivy role IT+Management (inherited).

Because I think you don't want to change/add the sub roles in RAP project you could add the roles per API (See Q&A) on the server of your client.

Comment by Adrian Imfeld on Christian Strebel's answer

Adrian Imfeld — Thu, 23 Jul 2015 17:37:33 -0400

I mean two different OU's of the same hierarchical level. For example we have units "backoffice", "sales" and "it". All units ar hirarchical under the enterprise unit. Backoffice- and IT-users need the right for a time tracking tool (Axon.ivy role "RAP"). Sales-Users should not have this rights or rather Axon.ivy role.

Comment by Christian Strebel on Christian Strebel's answer

Christian Strebel — Thu, 23 Jul 2015 17:20:45 -0400

Organisation Units are hierarchical:

DC=company
|-OU=Swiss (FQN: OU=Swiss,DC=company)
 |-OU=Management (FQN: OU=Management,OU=Swiss,DC=company)
 |-OU=IT (FQN: OU=IT,OU=Swiss,DC=company)

So if you have the OU "Management" or "IT" you have always also "Swiss".

Comment by Adrian Imfeld on Christian Strebel's answer

Adrian Imfeld — Thu, 23 Jul 2015 17:04:57 -0400

Thank you. Is it also possible to define more than one structural node for one Axon.ivy role? If not, I have still the need to listen for the user synchronisation job of the Axon.ivy Engine.

Answer by Christian Strebel

Christian Strebel — Thu, 23 Jul 2015 16:26:57 -0400

If you read the User.getExternalSecurityName() you get the fully qualified LDAP Name like: CN=User Name,CN=Users,OU=Management,OU=Swiss,DC=company,DC=com

This means the user is "under" the Organisation Units "Management" and "Swiss".

Answer by Christian Strebel

Christian Strebel — Thu, 23 Jul 2015 16:18:25 -0400

You can map either an group or an Organisation Unit (OU) to an ivy role.

See dokumentation about External Security Name:

If you are using an external security system (e.g. Microsoft Active Directory) then you can link an Axon.ivy role to a group or another structural node (e.g. Organisation Unit) on the directory server. If a group is selected then all users that are members of this group will automatically receive the associated Axon.ivy role. If a structural node is selected then all users located below the structural node will automatically receive the associated Axon.ivy role.

Press External security name to edit or browse the name of the group or structural node whose users should receive the selected Axon.ivy role.