So, during the first run, Group Family performs as follows:
During a subsequent run, Group Family performs as follows:
When creating a group to accommodate a given grouping, Group Family uses the group naming rules to generate a name for that group. The rules define a name based on the combination of values of the group-by properties that identifies the grouping. The group naming rules are stored as part of the Group Family configuration.
When capturing an existing group to accommodate a given grouping, Group Family uses a group-to-grouping link created manually and stored as part of the Group Family configuration. The link specifies the combination of values of the group-by properties to identify the grouping, and determines the group to be linked to that grouping.
When you configure a Group Family, you choose containers that hold the objects you want Group Family to assemble into groups (managed object containers) as well as the container to hold those groups (controlled group container). The Group Family policy has the option allowing you to select managed object containers from any domains registered with Active Roles. With this option, managed object containers may be from different domains and the domain of the controlled group container may be different from the domain of the managed object containers. Depending upon the location of the managed object containers, the groups controlled by Group Family can include objects from domains other than the domain that holds the controlled group container (external domains).
Active Directory has restrictions regarding the types of groups that can have members from external domains, and the types of groups that can have membership in other groups. All these restrictions apply to the groups controlled by Group Family. Thus, Active Roles does not allow Group Family to add objects from external domains to global groups, nor does it allow Group Family to add domain local groups to a global group. With these natural restrictions, you can configure Group Family so that its controlled groups include members from any domains registered with Active Roles.
As stated above, whether managed object containers can be selected from external domains depends upon the Group Family policy. If you want to use this capability, select the Enable cross-domain membership policy option (see Group Family policy options).
The Policy Settings tab includes the following options:
Select this option if you want Group Family to support the grouping of objects from external domains. When selected, this option allows each Group Family instance to have managed object containers from any domains that are registered with Active Roles. If this option is not selected, the managed object containers must be from the domain of the Group Family configuration storage group.
Selecting this option should be considered a long-term commitment to scenarios where objects managed by Group Family may reside in domains other than the domain of the Group Family configuration storage group—external domains. Once you have enabled cross-domain membership, you can configure Group Family instances to look for managed objects in any domains registered with Active Roles. However, if you later decide to un-select this policy options, the Group Family instances that were configured to look for managed objects in external domains will cease to function. You will have to inspect and, if needed, reconfigure your existing Group Family instances to limit scope of managed objects to the domain of the Group Family configuration storage group.
When selected, this option makes it possible for Group Family to perform grouping based on custom non-stored virtual attributes-the attributes that have their value calculated by a certain policy rather than stored in the Active Roles database. This option can have a negative effect on Group Family performance, so select it only if you have any of the Group Family group-by properties implemented as a custom non-stored virtual attribute.
This option is normally not selected for performance reasons, which causes Group Family not to create controlled groups that use a custom non-stored virtual attribute as a group-by property. You need to select this option if you want Group Family to create controlled groups by grouping objects based on custom non-stored virtual attributes.
The Active Roles console provides the New Group Family wizard for creating the Group Family configuration. The wizard creates a group, referred to as configuration storage group, and populates that group with the configuration data you specify.
Note that you can create any number of Group Families, with each Group Family intended to control a certain collection of groups. When linking a group to a grouping, the Group Family engine ensures the group is under the control of only the Group Family that created the link, thereby avoiding conflicts.
© 2020 One Identity LLC. ALL RIGHTS RESERVED. Feedback 이용 약관 개인정보 보호정책