When creating a group in the RACF database, the following LDAP attributes must be defined:
vrtEntryCanonicalName is a virtual property, set to the canonical name of the object in the connector.
On the RACF system, racfid is the group ID.
vrtEntryDN is a virtual property, set to the DN of the object in the connector. Activate the check box Force mapping against direction of synchronization.
The objectClass attribute (multi-valued) on the RACF system. Activate the check box Ignore case sensitivity.
vrtStructuralObjectClass on the RACF system defines the single object class for the object type.
Create a fixed value property variable on the RACF side called vrtIdentDomain that is set to the value $IdentDomain$. Map this to UID_LDPDomain. This will cause a conflict and the Property Mapping Rule Conflict Wizard opens automatically.
To solve the conflict
Create a fixed value property variable on the One Identity Manager side called vrtParentDN equal to a fixed string with value $GroupLocation$. Map this to vrtEntryParentDN on the RACF side. Activate the check box Ignore case sensitivity.
Create a new variable on the One Identity Manager side of type "Script Property" with name vrtRDN and a data type of "string". In the Scripts section, enter one of the he following scripts in the Read script section, depending on whether your project is configured for C# or Visual Basic.
return (VI.TargetSystem.Base.Utils.LDAP.RDN.Create("cn", useOldValues ? $cn[o]$ : $cn$).ToString()).Replace("cn=","racfid=");
Dim name as String = ""
If useOldValues Then
name = $cn[o]$
name = $cn$
Then map this to vrtEntryRDN on the RACF side.
This is a workaround needed to support group mappings. Create a new fixed value variable on the RACF side of type "String" with no value called vrtLDAPContainerDN with the value set to $GroupLocation$. This generates a property mapping rule conflict.
To solve the conflict
This mapping is used to synchronize group membership information.
vrtEntryDN is a virtual property, set to the DN of the object in the connector. This forms a unique ID to distinguish individual group objects on the RACF system.
To convert this mapping into an object matching rule
A message appears.
Edit the object mapping rule and activate the Case sensitive check box.
The following figure shows the above group mapping in operation.