How-to: Automatically remove a user from specified groups, when being added to another specified group (4266364)

In some environments, it may be required that a user only be a member of one specific group at a time. When a user is added to Group A, they are automatically removed from Group B and Group C. Workflows can be utilized to accomplish this task.

Consider the following scenario:

• There are three groups granting Administrator permissions to different regions in your environment (Groups A, B, and C)
• An Administrator may only be a member of one of these groups at a time

The following example is provided as a proof of concept only. Advanced customization's are not covered by support.

Please follow the steps below to create and configure the sample workflow, in which when a user is added to Group A, they are automatically removed from Group B and Group C

Create a new Change Workflow

1. In the Active Roles MMC, navigate to Configuration > Policies > Workflow
2. Right Click and select New > Workflow
3. Give the Workflow a Name and Description and click Next
4. Select Upon a request to change data in the directory (change workflow)
5. Click Finish

​

Configure the Workflow Options and Start Conditions

This section defines what triggers the Workflow - In this scenario, adding a member to a group

1. Select the Workflow
2. In the Workflow Pane that opens, select Workflow Options and Start Conditions at the top
3. Click the Configure button
4. Click the Select Operation button
5. Set the Target Object Type to GROUP
6. Select the Change Membership button
7. Check the Add Member to Group check box
8. Click Finish

​

Configure the Filtering Conditions

This section defines the group we are moderating - In this scenario, Group A

1. Select the Workflow
2. In the Workflow Pane that opens, select the Workflow Options and Start Conditions at the top
3. Click the Configure button
4. Under the Filtering Conditions area at the bottom, click the green + icon
5. Click Configure condition to evaluate...
6. Select Property of Workflow Target...
7. In the Target Property selection, select More Choices
8. Search for and select the Distinguished Name attribute
9. Click OK
10. Click Define Value to Compare to...
11. Select Object Defined by DN-Value Rule Expression...
12. Click Add Entry > Text String
13. Insert the DN of the group to be moderated by this Workflow (Group A)

Configure the Workflow Steps

This section defines the groups the user is to be removed from - in this scenario, Groups B and C

1. Select the Workflow
2. In the Workflow Pane that opens, select the Remove From Group activity on the left, and drag it below the Operation Execution step
3. Double click the Remove From Group activity to configure it
4. Select the Activity Target tab on the left side
5. Click on Workflow Target and select Object Defined by DN-Value Rule Expression...
6. Click Add Entry > Property of Object from Workflow Data Context
7. Click Target Object > More Choices > Added Member > OK
8. Click Target Property > More Choices
9. Search for and select Distinguished Name
10. Click OK
11. Select the Groups tab on the left
12. Ensure that Remove the object from these groups is selected
13. Click Add Group > Fixed Group in the Directory
14. Select Group B and Group C
15. Click OK and Save Changes

​

Once the Workflow has been configured, when a user is placed into Group A, they will automatically be removed from Group B and Group C, if they are currently in the aforementioned groups. To make this process multi-directional, you can create additional workflows re-ordering the included groups.