{"id":347,"date":"2009-02-24T09:14:54","date_gmt":"2009-02-24T09:14:54","guid":{"rendered":"https:\/\/www.wapshere.com\/missmiis\/?p=347"},"modified":"2009-11-18T08:34:49","modified_gmt":"2009-11-18T08:34:49","slug":"ilm2-rc0-codeless-provisioning-step-by-step","status":"publish","type":"post","link":"https:\/\/www.wapshere.com\/missmiis\/ilm2-rc0-codeless-provisioning-step-by-step","title":{"rendered":"ILM2 RC0 – Codeless Provisioning Step by Step"},"content":{"rendered":"

This post did start with a rant about how much trouble I had getting the codeless provisioning to work – but I’ve been working with it a bit more now, and have sufficiently got the hang of it, so I have rewritten the introduction to this post. This is not an attenpt to change history – I expect most readers come at my blog through google searches, and really, they don’t need my soap-boxing.<\/p>\n

This post goes through the steps I took to provision user accounts into AD. For the extra configuration need to add Exchange 2007 mailboxes to those users accounts see this post<\/a>.<\/p>\n

All the objects you have to create<\/h2>\n

Synchronization Rule<\/strong><\/p>\n

I will say that I do like the codeless flow rules<\/a>. All you have to do to get those working is create a Synchronization Rule<\/em> in the portal, import it into MIIS and you’re away.<\/p>\n

To get the Synchronization Rule to also do\u00c2\u00a0provisioning you need a few more bits and pieces.<\/p>\n

Set<\/strong><\/p>\n

You\u00c2\u00a0must create a Set<\/em> which will contain only those users which will exist in your target directory. (A tip on naming: start it with an underscore “_” so that it appears at the top of the list.)<\/p>\n

Don’t do what I did and use “All People” because then it tries to create the Administrator and Built-In Synchronization accounts in your target directory.<\/p>\n

Workflow<\/strong><\/p>\n

Next you create a Workflow<\/em> of type “Action” which has, as its action, the Synchronisation Rule you created above.<\/p>\n

Management Policy<\/strong><\/p>\n

Finally you create a Management Policy<\/em>. I am still a little vague on all the things these objects can do, but in terms of provisioning, this is where you tie your Set and your Workflow together.<\/p>\n

ILM MA<\/strong><\/p>\n

You also have to make sure you are flowing your data into the metaverse through the ILM MA, so that it will be there ready to be used by your synchronization rule. For unfathomable reasons the ILM MA still relies wholy on “classic” flow rules.<\/p>\n

\u00c2\u00a0<\/p>\n

And now with pictures<\/h2>\n

Create the Synchronization Rule<\/h3>\n

In the portal, click on Administration -><\/strong>\u00c2\u00a0Synchronization Rules<\/strong> -> New<\/strong>. The following pictures show how I configured my rule.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

When creating your attribute flows make sure you include an “Inital Only” that sets the DN.<\/p>\n

\"\"<\/p>\n

\u00c2\u00a0<\/p>\n

Create the Set<\/h3>\n

Click on All Sets<\/strong> -> New<\/strong>.<\/p>\n

I created a set called “_All Users” with the following dynamic rule. Note the cheat on the employee ID – at the moment there is no “Is Present” test, again an inexplicable oversight. As I’m in a test environment at the moment I’m just ensuring all my employeeID values have a “1” in them. (Note that “employeeID is *” does not work.)<\/p>\n

\"\"<\/p>\n

\u00c2\u00a0<\/p>\n

Create the Workflow<\/h3>\n

Click on Workflows<\/strong> -> New<\/strong>.<\/p>\n

The following pictures show how I created the Workflow “_AD Create Users”.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

Later note: I think maybe “Add” was not the right choice here because I had some trouble with not being able to remove ERLs later on. Perhaps I should have chosen “Based on Attribute Value” -\u00c2\u00a0more testing obviously needed.<\/p><\/blockquote>\n

Create the Management Policy<\/h3>\n

Click on Management Policies<\/strong> -> New<\/strong>.<\/p>\n

The following pictures show how I created the Management Policy “_AD Create Users”. As I said above, I’m still learning about these objects, so I do not claim this is the right way to configure it – this just shows what I did to get provisioning working, after a fashion.<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

\"\"<\/p>\n

\u00c2\u00a0<\/p>\n

Configure the ILM MA<\/h3>\n

You now need to create Import flow rules on the ILM MA to flow all the attributes required by your Synchronization Rule into the metaverse.<\/p>\n

Also you must add a flow rule for expected rules list<\/strong>. I never would have figured this out without help from people on the Connect news group.<\/p>\n

\"\"<\/p>\n

\u00c2\u00a0<\/p>\n

Testing<\/h2>\n

Start by creating a user directly in the Portal. Make sure you populate whatever you need to so they are eligible for the Set you created above. You also need to populate the Start Date<\/strong>, so that it is either today, or a day in the past.<\/p>\n

After creating the user, check their Provisioning tab – and if you’re really luck you should see that they have an expected rules list with a status of “Pending”.<\/p>\n

\"\"<\/p>\n

You can also check the Search Requests<\/strong> page for information about what has (or has not) been going on in the background.<\/p>\n

\"\"<\/p>\n

\u00c2\u00a0<\/p>\n

Once you’ve got that pending ERL in place, you should no be ready to run a Full Import and Full Sync of you ILM MA.<\/p>\n

Was a new object created in your target MA?<\/p>\n","protected":false},"excerpt":{"rendered":"

This post did start with a rant about how much trouble I had getting the codeless provisioning to work – but I’ve been working with it a bit more now, and have sufficiently got the hang of it, so I have rewritten the introduction to this post. This is not an attenpt to change history…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"footnotes":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false,"jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":[]},"categories":[25],"tags":[],"class_list":["post-347","post","type-post","status-publish","format-standard","hentry","category-ilm-2"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pkp1o-5B","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/347","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/comments?post=347"}],"version-history":[{"count":10,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/347\/revisions"}],"predecessor-version":[{"id":353,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/posts\/347\/revisions\/353"}],"wp:attachment":[{"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/media?parent=347"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/categories?post=347"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wapshere.com\/missmiis\/wp-json\/wp\/v2\/tags?post=347"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}