To configure a Script Execution policy
The list contains the names of all script functions found in the selected Script Module. The policy has the parameters that are defined by the function specified in the Function to declare parameters box. Normally, this is a function named onInit.
Clicking Edit displays a page where you can add, remove or select a value or values for the selected parameter. For each parameter, the function that is used to declare parameters defines the name of the parameter and other characteristics, such as a description, a list of possible values, the default value, and whether a value is required. If a list of possible values is defined, then you can only select values from that list.
To create a script module
You can create a new folder as follows: Right-click Script Modules and select New | Scripts Container. Similarly, you can create a sub-folder in a folder: Right-click the folder and select New | Scripts Container.
To edit a script module
To import a script module
You can create a new folder as follows: Right-click Script Modules and select New | Scripts Container. Similarly, you can create a sub-folder in a folder: Right-click the folder and select New | Scripts Container.
To export a script module
This scenario describes how to configure a policy that prevents creation of universal groups. With this policy, the Active Roles console or Web Interface does not allow an administrator to create a new universal group or convert an existing group to a universal group.
To implement this scenario, you must perform the following actions:
As a result, the Active Roles console or Web Interface cannot be used to set the universal group scope option when creating a new group or changing an existing group in the container you selected in Step 3. For example, if you choose the Universal option under Group scope and then click Next in the New Object - Group wizard, the Active Roles console presents you with an error message stating that creation of universal groups is not allowed.
The following sections elaborate on the steps to implement this scenario.
The script used in this scenario is installed with the Active Roles SDK. By default, the path and name of the script file is as follows:
%ProgramFiles%\One Identity\Active Roles\Active Roles\SDK\Samples\RestrictGroupScope\RestrictGroupScope.ps1
The script receives control upon a request to check the property values submitted to the Administration Service, and analyzes the value of the groupType attribute to determine if the universal group scope option is attempted. If the script detects that the assumed groupType value would cause a group to be configured as a universal group, it raises a policy violation event in the Administration Service. As a result, the application that initiated the request (such as the Active Roles console or Web Interface) displays an error message provided by the script. For more information, see the “Restricting the Scope of Groups” topic in the Active Roles SDK documentation.
To import the script, right-click the Script Modules container in the Active Roles console, and click Import. Then, select and open the RestrictGroupScope.ps1 file.
You can create and configure the Policy Object you need by using the New Provisioning Policy Object wizard. For information about the wizard, see Creating a Policy Object in the Policy Object management tasks section earlier in this chapter.
To configure the policy, click Script Execution on the Policy to Configure page of the wizard. Then, click Next.
On the Script Module page, click Select a script module, and select RestrictGroupScope from the list of script modules, as shown in the following figure.
Figure 66: Script Module: Creating/configuring policy object
Click Next and follow the instructions in the wizard to create the Policy Object.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy