Skip to main content

NetIQ IDM - Trigger idm job from driver policy on driver startup with dynamic argument values


Looking at this article:
https://www.netiq.com/communities/cool-solutions/how-start-idm-job-policy/

it shows you the complete recipe, except it does not show how to deal with dynamic argument values for the method itself; here is my version;

I wanted to run this on the driver startup and wanted to let driver die if job execution did not succeed.

1. username must be "dotted" format; one can use parseDN; example:

<token-parse-dn dest-dn-format="dot" src-dn-format="ldap">
                        <token-local-variable name="local.sub.etp.resource.UserId"/>
                    </token-parse-dn>

2. Jobname must be in "dotted" format too.


3. For more java lovers, one can dig into this: https://www.novell.com/documentation/developer/dirxml/dirxmlbk/api/com/novell/nds/dirxml/util/DxCommand.html




<rule> <description>Schedule job on the startup</description> <conditions> <and> <if-operation mode="nocase" op="equal">status</if-operation> <if-xpath op="true">@type="startup"</if-xpath> </and> </conditions> <actions> <do-set-local-variable name="local.sub.etp.ScheduleArguments" scope="policy"> <arg-string> <token-text xml:space="preserve">-user </token-text> <token-local-variable name="local.sub.etp.resource.UserId" /> <token-text xml:space="preserve"> </token-text> <token-text xml:space="preserve"> -password </token-text> <token-local-variable name="local.sub.etp.resource.Password" /> <token-text xml:space="preserve"> -startjob </token-text> <token-local-variable name="local.sub.ctp.JobName" /> </arg-string> </do-set-local-variable> <do-trace-message> <arg-string> <token-text xml:space="preserve">Prepare cmdline =&gt; </token-text> <token-local-variable name="local.sub.etp.ScheduleArguments" /> </arg-string> </do-trace-message> <do-set-local-variable name="local.sub.etp.Scheduleob" scope="policy"> <arg-object> <token-xpath expression="jcmd:commandLine(string($local.sub.etp.ScheduleArguments))" /> </arg-object> </do-set-local-variable> <do-trace-message> <arg-string> <token-text xml:space="preserve">Initiate startup token job =&gt; </token-text> <token-local-variable name="local.sub.etp.Scheduleob" /> </arg-string> </do-trace-message> <do-if> <arg-conditions> <and> <if-local-variable mode="nocase" name="local.sub.etp.Scheduleob" op="not-equal">0</if-local-variable> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="local.sub.startup.Message" scope="policy"> <arg-string> <token-text xml:space="preserve">Driver could not run token refresh job with arguments </token-text> <token-local-variable name="local.sub.etp.ScheduleArguments" /> <token-text xml:space="preserve"> Please fix the error, clean driver event cache before starting the driver again.</token-text> </arg-string> </do-set-local-variable> <do-status level="error"> <arg-string> <token-local-variable name="local.sub.startup.Message" /> </arg-string> </do-status> <do-status level="fatal"> <arg-string> <token-local-variable name="local.sub.startup.Message" /> </arg-string> </do-status> </arg-actions> <arg-actions /> </do-if> </actions> </rule>

Comments

Post a Comment

Popular posts from this blog

My own developed - Active Directory Cache Inspector for AD Driver Novell Identity manager

Sometimes there is a need for us (Consultants) to see a snapshot of all the changes that happened on the Active directory side while the Novell AD IDM driver was stopped or was not running, before we decide to start the AD driver. Since Novell Identity Manager currently allows us to see all the events which happened in the Identity vault only, but not on the AD side, I decided to write such a tool myself, and of course wanted to share this tool with the consultants/community out there. It's a .NET 2.0 WinForm application, written in C# programming language. To run this tool you should have at minimum: .NET 2.0 framework installed, ( Not supported on the Linux platforms yet) This application must be run under the same user which is configured on the AD driver. Short Tutorial (How To): When you run the application (ADCView.exe), the application automatically discovers the current domain, a domain controller, and default domain naming context in the user logged in domain automatically
Post a Comment
Read more

NetIQ IDM - How to read Component type data from Query nodeset done from command transformation

Suppose query: <do-set-local-variable name="local.sub.ctp.QueryContacts" scope="policy"> <arg-node-set> <token-query class-name="User" scope="entry"> <arg-match-attr name="UPN"> <arg-value type="string"> <token-src-attr class-name="User" name="UPN"/> </arg-value> </arg-match-attr> <arg-match-attr name="contacts"> <arg-value type="string"> <token-text xml:space="preserve">get-contacts</token-text> </arg-value> </arg-match-attr> <arg-match-attr name="userid"> <arg-value type="string"> <token-association/> </arg-value> </arg-match-attr> </token-query> </arg-node-set> </do-set-local-variable> Outpu
Post a Comment
Read more