Symantec IGA

Hi, 

Is there any way to get added/ removed groups from user. Tried BLTH, Policy Xpress options both are not working as per product documentation. I am adding new groups to user through  Groups Relationships tab form. Anybody has idea how can i get this info?

Doc reference:

Using the CA Identity ManagerBLTHContext get... methods to access a run-time instance of a managed object in the task session.
The information you can access in a task session includes the subject of the task (such as a User object in a Create User task) and the subject’s relationships (such as the roles and groups that a user is assigned to). You can also access any objects that were modified during the task (such as user objects that were disabled or deleted).
Any changes made to a managed object through BLTHContext get... methods are made to the run-time instance of the managed object in the task session. CA Identity Manager generates events for the task, and workflow approvals, auditing, and security checks can be performed.

Hi MK_1,

I'm not sure what you are trying to achieve, so i hope what i'm telling you is of any help. I have written this from a user create/modify perspective. 

If you want to use BLTH the BlthContext indeed contains states but you need to access the proper attribute/method. 

as you probably know a BTLH in this case starts with the handleValidation method

function handleValidation(BlthContext, errorMessage) {...}

to get the groups of the user you need to use the BLTHContext.getUsersGroups() method 

// get the user groups
var usergroups = BlthContext.getUsersGroups();
var added_user_groups = usergroups.getAdditions();
var deleted_user_groups = usergroups.getDeletions();
var current_user_groups = usergroups.getCurrentValues();
var new_current_user_groups = usergroups.getNewCurrentValues();

You can iterate through these lists, which are Vector, and do with it as you wish.

// example: iterate through the current group list (vector)
for(var i = 0; i < current_user_groups.size(); i++ ){
   var group = current_user_groups.get(i);
   // do something with it
}

Hopefully this helps. 

Wietse Beerens

Hi Wieste,

Tq for your reply. BlthContext.getUsersGroups(); alsways retuning null value. I am using Group Relationship tab form to add/ remove values. Even PX option not returinging the changed values.

Hi MK_1,

Probably its empty because the usergroup tab is not included in the admin task, may be you could try that tab in stead of a group relations tab?  

kr,

Wietse

Tq Wietse, For scalability/ Performace of groups CA recommended to use Group Relationship tabs.  We can't able touse user Group tab.

Hello,

This may not be exactly what you are looking for but if all other things fail you could also do the following:

1. Write the first policy xpress that gets the list of groups for a user (Group Membership under Category in the Data tab) BEFORE this user is added to a group or removed from a group. Depending on from where you are adding/removing users to/from groups you may need to execute this policy xpress BEFORE any of the following events: ModifyGroupEvent, AddToGroupEvent, RemoveFromGroupEvent.  As an action of this "BEFORE" policy xpress SET the values returned by Group Membership in the Data tab to a multi-valued attribute of the user object (let's call it ATTR1)

2. write the second policy xpress that gets the list of groups for the user (Group Membership under Category in the Data tab) AFTER the user is added to a group or removed from a group.  Once again, depending on from where you are adding/removing users to/from groups you may need to execute this policy xpress AFTER any of the following events: ModifyGroupEvent, AddToGroupEvent, RemoveFromGroupEvent. This policy xpress will have 2 actions. The first action will SET the values returned by group memberships AFTER the group change to the same multi-valued attribute of the user object (ATTR1) where you wrote group memberships BEFORE the event took place.

The second action will use the Values Added or Values Removed from ATTR1 (you need to get added values and removed values for ATTR1 - has user attribute changed - in the PX data tab) in whatever form you desire.

KR
Russi

Hi Leela Kumar

Thanks for sharing this very useful code which will be helpful to the original requester. I justed wanted to let you know that policy xpress DOES return the list of groups (Group Member under Group category of the Policy Xpress Data types). I just added and removed groups from a user with Relationship tab (configured for groups) and I DO get the list of groups returned before and after events for the user through policy xpress.

KR
Russi

Thanks Leela, Russi for your suggestions.  Taken Leela approach and able to achieve.

Policy Express should enhance its cabability to get changed values during runtime in all aspects. Currently its not and long way to achieve desired functionality.

LEELA: useful.

HOWEVER there is a problem: Items can be in the "added" list, even though the "Members" checkbox is off. 

The methods return as follows:

- getAdded = all Groups added to the list (whether the "Members" checkbox is on or off)

- getRemoved = Groups on list where "Members" checkbox is off 

      BUT this does NOT include newly-added Groups, only "currently-assigned" removed items

Somehow we need to ALSO see if the "Members" checkbox is on or off.

There is a method in TaskTabHandler.getRelationship()  - isObjectRelated() - but this seems to always return true; 

TaskTabHandler (and related classes) are not in the JavaDoc, so decompile would be needed to see if there is a useful method for this. 

Review of Methods

DECISION: Use the approach below:

• ADDs: where Group is in BOTH Relationship.getAdded and RelationshipTabHandler.getAssignedResources
  • This is completely reliable
• REMOVEs: where Group is in RelationshipTabHandler.getRevokedResources
  • This is not completely reliable
  • It will not notice a Group that was previously assigned, then “Added” to the list by the user, and still removed (checkbox turned off)
  • This will not be validated: but will be removed from the user by the IM