Symantec IGA

  • 1.  Bulk Migrate users from One Prov Role to another Prov Role

    Posted Jan 02, 2018 05:21 AM

    Hi Team,

     

    Any idea on migrating users from one provisioning role to another provisioning role in bulk. For example users who are all assigned with Prov Role A should be assigned with new Prov Role B and removed with Prov role A

    Any ideas on this helps us.



  • 2.  Re: Bulk Migrate users from One Prov Role to another Prov Role
    Best Answer

    Broadcom Employee
    Posted Jan 08, 2018 03:34 AM

    Hi Rajesh,

    Out of the box, it's not possible to assign/remove provisioning roles to/from a user via bulk loader.
    However, if you configure some Identity Policy or Xpress Policy to take care of it, you will be able to accomplish that.
    For both, you will need a new attribute that will hold a list of provision roles (Either multi value or single delimited).

    For Identity policy, you can create an Identity policy that will be triggered upon the new provision roles attribute change and will assign the provision roles based on this attribute.

    For Policy Xpress, you can create a PX that will take the value from that attribute and will assign the provisioning roles to that user.

    I add that in this mass change perspective you can also act on the Provisioning Server using the following etautil syntax sample :

    %ETAHOME%\bin\etautil -u superadmin -p secret masschange

    'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im'
    eTGlobalUser eTGlobalUserName=* to +eTRoleDN='eTRoleName=ADSrole,eTRoleContainerName=Roles,eTNamespaceName=CommonObjects,dc=im'

     

    (this can be adapted with your admin user/password, domain name, role name and users target.
    To trigger the User Synchronization you can add "eTSyncUsers=1" to this command line.

    Regards,

    Philippe.