I’m now at the point, in this series of posts for ILM-newbies, where I can start to look at provisioning code.<\/p>\n
<\/p>\n
I introduced the Metaverse Extension in this post<\/a>, but to recap briefly: as far as ILM is concerned there is only one<\/em> metaverse extension dll, which is run, in its entirity, against all types of metaverse object. For a project with more than, let’s say, four MAs you will find it easier to keep track of your code if you go for the MVRouter<\/a> approach where you can split your project down into a seperate dll for each MA (remebering that this split is notional only – ILM still runs all<\/em> the code against all<\/em> objects).<\/p>\n If you haven’t already done so, create your extension project as covered in this post<\/a>.<\/p>\n You can get started right away by adding some code to the Sub Provision<\/strong>. All you need, in this subroutine, is some code bracketed with the StartNewConnector and CommitNewConnector statements: This will create an object of type objecttype<\/em> in the MA called MA_Name<\/em>.<\/p>\n If you’re provisioning to something like a database table, or a text file, or other system where the objects have a simple name, then all you need, to name the object, is to set the appropriate attribute:<\/p>\n Relative (ie LDAP style) directories are a little more complicated, because the object name is the Distinguished Name, constructed from it’s relationship with a parent container. We have a little more coding to do in that case:<\/p>\n Note that the OU_Name<\/em> you use here must be the fully distinguished name, eg: “CN=Users,DC=fabrikam,DC=com”.<\/p>\n Attribute values can either be set on the new object in the MVExtension, or by using flow rules<\/a>. It doesn’t much matter which way you do it, as long as the attributes reach the connector space object before it’s exported.<\/p>\n Often you will want to set a few key attributes while creating the object and, this being the case, you must<\/em> do it between the StartNewConnector <\/strong>and CommitNewConnector statements.<\/p>\n So, to put that another way, once a CS object exists you cannot modify its attributes in the MVExtension<\/em>. The only way you can modify attributes, from that point on, is using flow rules.<\/p>\n To set an attribute value just use<\/p>\n In Active Directory the account will be created disabled unless a password is set. The following snippet sets the unicodePwd to some constant value, and then specifes that the account should be enabled (though the userAccountControl setting will be overridden by AD if your password is not strong enough to satisfiy its security settings).<\/p>\n For a list of the other userAccountControl settings see Example: Enabling or Disabling a User Account in Active Directory<\/a> in the Developer’s Reference.<\/p>\n See this post<\/a> for a simple, flexible outline for a Provisioning sub.<\/p>\n And also check out the Developer’s Reference for these examples:<\/p>\n Simple AD provisioning code: Example: Setting an Initial Password in Active Directory<\/a><\/p>\n Simple LDAP provisioning code: Example: Setting an Initial Password in Sun and Netscape Directory Servers<\/a><\/p>\nThe simplest provisioning code<\/h4>\n
\n
\nDim csentry As CSEntry
\nDim MA As ConnectedMA
\nMA = mventry.ConnectedMAs(MA_Name<\/em>)
\ncsentry = MA.Connectors.StartNewConnector(\"objecttype<\/em>\")
\n<..set name and attribute values of the new object><\/em>
\ncsentry.CommitNewConnector()<\/code><\/p>\nSetting the object name in a flat directory<\/h4>\n
csentry = MA.Connectors.StartNewConnector(\"record\")
\ncsentry(\"id\").Value = mventry(\"StaffID\").Value
\n<..set other attribute values><\/em>
\ncsentry.CommitNewConnector()<\/code><\/p>\nSetting the object name in a relative directory<\/h4>\n
Dim dn as ReferenceValue
\nDim rdn as String
\n'..Construct the dn from the cn and the OU
\nrdn = \"CN=\" & mventry(\"cn\").Value
\nMA = mventry.ConnectedMAs(MA_Name<\/em>)
\ndn = MA.EscapeDNComponent(rdn).Concat(OU_Name<\/em>)
\n'..Create the cs object
\ncsentry = MA.Connectors.StartNewConnector(\"user\")
\ncsentry.DN = dn
\n<..set other attribute values><\/em>
\ncsentry.CommitNewConnector()<\/code><\/p>\nSetting attribute values<\/h4>\n
csentry(\"attributeName<\/em>\").Value = ...<\/code><\/p>\nDisabled AD Account<\/h4>\n
Const ADS_UF_NORMAL_ACCOUNT As Integer = &H200
\ncsentry(\"UnicodePwd\").Values.Add(INITIAL_PASSWORD)
\ncsentry(\"userAccountControl\").IntegerValue = ADS_UF_NORMAL_ACCOUNT<\/code><\/p>\nCode Examples<\/h4>\n
That should be enough to get you started…<\/h4>\n