Maqsood Bhatti - iDENTITY

This code example shows how to remove unwanted group members from current operation based on some business logic. Optimization group members add to avoid  "ALREADY_EXIST_VALUE" kind of errors. when IDM engine fails to do so. Here I am doing look up in AD for members, and for each added member from IDM if user is already member of AD group, i am just striping out current member value from the current operaiton. < do-set-local-variable name = "group-dn" scope = "policy" > < arg-string > < token-src-dn /> </ arg-string > </ do-set-local-variable > < do-set-local-variable name = "group-members" scope = "policy" > < arg-node-set > < token-dest-attr class-name = "Group" name = "Member" /> </ arg-node-set > </ do-set-local-variable > < do-trace-message > < arg-string

Wanted to share very important peice of code shared by Microfocus employee " Dhaval" in the NetIQ support forums Ref: https://forums.novell.com/showthread.php/504380-Check-driver-entitlement-from-another-driver < actions > < do-set-local-variable name = "entitlementDN" scope = "policy" > < arg-string > < token-text xml:space = "preserve" > entitlement DN you want </ token-text > </ arg-string > </ do-set-local-variable > < do-set-local-variable name = "prevEntRef" scope = "policy" > < arg-node-set > < token-query class-name = "User" scope = "entry" > < arg-dn > < token-dest-dn /> </ arg-dn > < arg-string > < token-text xml:space = "preserve" > DirXML-EntitlementRef &l

Recently i had to execute EOL cmdlets using psexecute though new NetIQ azure ad driver, since this operation is fire and forget in nature, i would like to track whole request and response for my own generated commands from subscriber command transofrmaiton policy, so i solved it by following policy: < do-set-dest-attr-value direct = "true" name = "psexecute" > < arg-association > < token-resolve datastore = "src" > < arg-dn > < token-text xml:space = "preserve" > {userref} </ token-text > </ arg-dn > </ token-resolve > </ arg-association > < arg-value type = "string" > < token-local-variable name = "cmdlet" /> </ arg-value > </ do-set-dest-attr-value > < do-append-xml-element expression = "../modify[@direct]" na