IDM_ex13 - しうえいの脳空間

Setup Authorization and TerminatedAccounts Organization

1. カスタムタスク定義の第１ステップとして、AuthType を定義する

• a. 新しいAuthType は、TaskDefinition, TaskInstance, TaskTemplate を継承する
• b. Configuration:AuthorizationTypes オブジェクトに対して、次のようなノードを追加する。

• (

  AuthType name='Terminate User' extends='TaskDefinition,TaskInstance,TaskTemplate'/>

  • )

2. phase2/AdminGroup_Training-TerminateUser.xml をインポートする。 これにより新しい AdminGroupが定義される。

• a. Admin GroupのXML表現は以下の通りである。

• (

  ?xml version='1.0' encoding='UTF-8'?>

  !DOCTYPE Waveset PUBLIC 'waveset.dtd' 'waveset.dtd'>

  Waveset>

  AdminGroup name='Training - Terminate User'

             protected='true'
             displayName='Terminate User'
             description='Allowed to terminate users'>
   <Permissions>
     <Permission type='Terminate User' rights='View'/>
   </Permissions>
   <MemberObjectGroups>
     <ObjectRef type='ObjectGroup' id='#ID#All' name='All'/>
   </MemberObjectGroups>
  

  /AdminGroup>

  /Waveset>

  • ) 3. Training - Terminate User capabilityを管理アカウントに付加する
    4. Training - Terminate Users というTaskDefinition をimportする~ 5. Training - Terminate Single User というConfiguration をimportする
    

Add New User Action

1. Configuration:User Actions Configuration　を次のように編集する。

• a. Configuration タグの id='#ID#Configuration:UserActionsConfiguration'　属性を削除する。
• b. name 属性を"User Actions Configuration" から "Training - User Actions Configuration"へ変更する。
• c. ファイルにセーブする。
• d. 検索画面及び、アカウントリスト両方にカスタムの Terminate Users タスクを紐付ける。
  • Add the “Terminate” command after the Delete User command as a new <Object> in the findUsersButton <List>.
    • Specify the following attributes:

Attribute	Value
textKey	Terminate …
commandName	Training - Terminate Users

• (

  Object> <Attribute name="textKey" value="Terminate ..."/> <Attribute name="commandName" value="Training - Terminate Users"/>

  /Object>

  • )

• Add the “Terminate” command after the Delete User commands as a new <Object> in the userApplet.userMenu <List>. Add a line separator after the <Object> element.

Attribute	Value
textKey	UI_ACCT_JAVA_MENU_TERM_USER
commandName	Training – Terminate Users

• (

  Object> <Attribute name="textKey" value=" UI_ACCT_JAVA_MENU_TERM_USER"/> <Attribute name="commandName" value="Training - Terminate Users"/>

  /Object>

  Object> <Attribute name="separator" value="separator"/>

  /Object>

  • )

2. Add a custom catalog and an entry for the Terminate Users command.

• a. Import the Configuration object named Training &#8211; Custom Catalog into Identity Manager.
• b. Note the Configuration name can be changed, but the id value in the <CustomCatalog> tag must be defaultCustomCatalog.
• c. Modify the Configuration object System Configuration to reference the customized user actions configuration and custom catalog.
  • Export the Configuration:System Configuration object to Configuration_Training-SystemConfiguration.xml.
  • Change the value of userActionsConfigMapping from User Actions Configuration to Training &#8211; User Actions Configuration.
  • Add the following line right after the user actions mapping:

• (

  Attribute name='customMessageCatalog' value= 'Training - Custom Catalog'/>

  • )

• Save the modified System Configuration to the file and back into the repository.
• Bounce the application server.

3. Verify your configuration.

• a. Create two test accounts to verify that the new Terminate User’s custom action has been configured correctly.
  • Organization = something other than TerminateAccounts
  • Add at least one resource account to each user
  • Login to the administrator pages as your admin account with the “Terminate User” capability.
• b. Go to the find users page and search for the two users created in step 10.
  • Check the box next to their account and click onto the Terminate … button.
  • You should see a screen that confirms which users you have selected for termination. If this is correct, hit the Launch button to proceed with termination.
• c. In the task results verify that the Terminated user is moved to the TerminatedAccounts directory and is disabled.
• d. Check to verify that customization is visible on the accounts applet.
  • Right click on a user and select Terminate from the menu options.
• e. (Optional) Create a new administrator, give them the Account Administrator capability only, then login as that administrator and verify that you don’t see the Terminate button or menu option anymore.
  • (Optional) Import the Configuration object named Training - Terminate Single User - Optimized into Identity Manager.
  • (Optional) Edit the TaskDefintion object named Training - Terminate Users and change the “process=” reference from Training - Terminate Single User to Training - Terminate Single User - Optimized.

Use Out-of-the-Box Authorization

1. Edit the Training - User Actions Configuration, and specify that any administrator who has the ability to delete users should be able to launch the Terminate process.

• a. Find the applet menu option that was defined previously, and add the following lines:

• (

  Object> <Attribute name="textKey" value="Terminate ..."/> <Attribute name="commandName" value="Training - Terminate Users"/> <Attribute name='requiredPermission'> <Object> <Attribute name='objectType' value='User'/> <Attribute name='rights' value='Delete'/> </Object> </Attribute>

  /Object>

  • )

• b. Find the find user menu option that was defined previously, and add the following lines:

• (

  Object> <Attribute name="textKey" value=" UI_ACCT_JAVA_MENU_TERM_USER"/> <Attribute name="commandName" value="Training - Terminate Users"/> <Attribute name='requiredPermission'> <Object> <Attribute name='objectType' value='User'/> <Attribute name='rights' value='Delete'/> </Object> </Attribute>

  /Object>

  Object> <Attribute name="separator" value="separator"/>

  /Object>

  • )

2. Edit Training - Terminate Users task that was provided before and change the authType to UserAdminTask.
3. Save your changes.
4. To test, log in as any account administrator who controls Top:XYZCompany and TerminatedAccounts.

• a. Verify that the popup menu and find user page reflect the custom user action.
• b. Select a user and execute the custom user action.