sorengranfeldt / mre Goto Github PK

It would be nice, if there was an option to add a positive or negative number of days.

<ConditionBase xsi:type="ConditionBefore"> 
  <Description>only when employee start date is 90 days before today</Description> 
  <AddDays>-90</AddDays> 
  <MVAttribute>employeeEndDate</MVAttribute> 
</ConditionBase>

For example, you could then trigger deprovisioning based on employeeEndDate being 90 days in the past.

Hello,

I am trying to Provision UserProxy to an AD LDS intance, as you know, you need to set the objectSID.
You can’t simply add an atribute flow to the MA objectSid(MV)==> objectSid(CS) because it is a « read-only » attribute so you need to do this when you use provision code (see attached image)

So i tried to write in my « xxx.fil.mre.xml » config file this :

<AttributeFlowBase xsi:type="AttributeFlowAttribute"> <Source>objectSid</Source> <Target> objectSid </Target> </AttributeFlowBase>

When i export my object to the LDS instance i have the following error :
« constraint-violation » « multiple values were specified for an attribute that can have only one value »

Do you have any idea to work around this ?

Thank you very much for all your work

Hi.

Could we please get an example for action DeprovisionAll?

I am not certain whether this action is exactly the same as Deprovision, except for action name itself. Why does DeprovisionAll require TargetManagementAgentName?

Feature Request:

MRE-product should be able to load and execute code in external DLLs, typically an existing MVextension.dll.

MIM-2016 (and earlier versions) can only have one DLL defined for "Metaverse Rule Extension". If this DLL is already being used, it is a blocking situation with regards to bringing thedynamic flexibility of MRE into the configuration.

I wish MRE can have it's existing rule methods extended with the ability to execute another DLL for provisioning against one or more spcific MA's and still use its own rules for other MA's. This would significantly add to the flexibility and usability of the MRE product, in particular for old FIM/MIM installations with an exisiting MVextension.dll which can not be easily abandoned.

MRE with this funcionality could then maybe also completely replace the old "Metverse Router" solution that was introduced by Microsoft many years ago.

Add option to load and call extension methods for i.e. ShouldDeleteFromMV and maybe for Provision

Fix code to not be depend on objects in metaverse to have attribute displayName bound

Hi

Using MRE v1.2.3.0

Trying to use reprovisioning on a MA where rename is not possible.. on the change of displayNameShort we require a reprovision to happen..

MRE config

<Rule>
	<RuleId>1</RuleId>
	<Name>Provision feature ==> GoogleApps</Name>
	<Description>Provision a feature to Google Apps</Description>
	<TargetManagementAgentName>GoogleApps</TargetManagementAgentName>
	<Enabled>true</Enabled>
	<SourceObject>feature</SourceObject>
	<TargetObject>feature</TargetObject>
	<Action>Provision</Action>
	<Reprovision>
		<ProvisionRuleId>1</ProvisionRuleId>
			<Conditions>
				<ConditionBase xsi:type="ConditionAreNotEqual">
					<CSAttribute>id</CSAttribute>
					<MVAttribute>displayNameShort</MVAttribute>
				</ConditionBase>
			</Conditions>
	</Reprovision>
	<Conditions>
		<ConditionBase xsi:type="ConditionMatch">
			<Description>Only if feature has a provisionToGoogleApps flag set to true</Description>
			<MVAttribute>provisionToGoogleApps</MVAttribute>
			<Pattern>True</Pattern>
		</ConditionBase>
	</Conditions>
		<InitialFlows>
			<AttributeFlowBase xsi:type="AttributeFlowConstant">
				<Target>[DN]</Target>
				<Constant>#mv:displayNameShort#@feature.resource</Constant>
			</AttributeFlowBase>
		</InitialFlows>
</Rule>

Debug viewer shows the code running but doesn't do a reprovision

[3312] FIM.MRE Information: 0 :
[3312] start-rule 'Provision feature ==> GoogleApps' (MA GoogleApps)
[3312] FIM.MRE Information: 0 :
[3312] feature, displayname: n/a, mvguid: 3e5604fd-1348-e811-bcc0-005056b5201b
[3312] FIM.MRE Information: 0 :
[3312] end-rule Provision feature ==> GoogleApps
[3312] FIM.MRE Information: 0 :
[3312] exit-provision

Nothing happens on the MA itself..

Please lemme know if this is a bug or an error in my XML or logic

Hi Søren,

Is there a way to handle ObjectAlreadyExistsException during provisioning without writing your own code like auto-incrementing the CN on DN collision?

Thanks!

Update Tracer to optimized version

When using this feature, the path to the legacy extension-DLL is also changed to the same alternative path. According to the documentation, the path to the external DLL is [fim]\Extensions if no full path is given. This is not correct if RuleFilesAlternativePath is given.
This is easily solved by giving full path to the extension DLL in rules-file, but you should probably add a note in the docs.

Hello,

I configured a provisoning rule using MRE extension.

The distinguishedName attribute is imported from a first domain and looks like "CN=User, OU=OUdependingOnUser,DC=domain1,DC=local" and I would like to keep all the distinguishedName until DC values and to change them to DC=domain2,DC=local. Is that possible with your extension ?

Here is my xml rule file :

<?xml version="1.0" encoding="utf-8"?>
<RulesFile xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
	<Rules>
		<Rule>
			<Name>User provisionning</Name>
			<Description>Provision users to the Active Directory</Description>
			<TargetManagementAgentName xsi:type="xsd:string">MA</TargetManagementAgentName>
			<Enabled>true</Enabled>
			<SourceObject>person</SourceObject>
			<TargetObject>user</TargetObject>
			<Action>Provision</Action>
			<Conditions>
				<ConditionBase xsi:type="ConditionIsPresent">
					<Description></Description>
					<MVAttribute>accountName</MVAttribute>
				</ConditionBase>
	
			</Conditions>
			<InitialFlows>
                                <AttributeFlowBase xsi:type="AttributeFlowAttribute">
			                 <Source>DN</Source>
			                 <Target>[DN]</Target>
				</AttributeFlowBase>
				<AttributeFlowBase xsi:type="AttributeFlowAttribute">
					<Source>accountName</Source>
					<Target>sAMAccountName</Target>
				</AttributeFlowBase>
				<AttributeFlowBase xsi:type="AttributeFlowAttribute">
					<Source>displayName</Source>
					<Target>displayName</Target>
				</AttributeFlowBase>
				<AttributeFlowBase xsi:type="AttributeFlowAttribute">
					<Source>givenName</Source>
					<Target>givenName</Target>
				</AttributeFlowBase>
			</InitialFlows>
		</Rule>
	</Rules>
</RulesFile>

Add option to transform values and use these in InitialFlows, kinda like the Helpers

I noticed in the docs for ConditionAfter it says:

This condition can be used to check whether a date/time in a metaverse attribute is after the current date/time.

..but the code is actually the reverse:

bool returnValue = now > value;

Same kind of error with ConditionBefore I believe.

We need to be able to create a rule that allows to match an attribute with a bitwise map, so (say) sync only objects that had UserAccountControl with bit 2 not set (enabled accounts)

how do I install MRE? Where can I build the file 'FIM.MRE.dll'? Do I need to build this my self using visual studio? What settings are required?

Maybe a good idea to put a hyperlink in the readme to the documentation or build steps

Verify that DN can be escaped for rename rules or add that feature

Is there a way to use MRE in combination with another "MVextension" DLL?
We provision users to a number of systems - all custom built MA's and managed through one big MVextension.dll. I wish it was possible to continue to use it in combination with MRE. Can I do that?