When creating a group in the RACF database, the following LDAP attributes must be defined:
vrtEntryCanonicalName is a virtual property, set to the canonical name of the object in the connector.
Sample value:
COM/MYCOMPANY/MAINFRAME1/GROUP/USERGRP
On the RACF system, racfid is the group ID.
Sample value:
USERGRP
vrtEntryDN is a virtual property, set to the DN of the object in the connector. Activate the check box Force mapping against direction of synchronization.
Sample value:
racfid=USERGRP,profiletype=group,cn=mainframe1,o=mycompany,c=com
The objectClass attribute (multi-valued) on the RACF system. Activate the check box Ignore case sensitivity.
Sample value:
TOP;RACFBASECOMMON;RACFGROUP
vrtStructuralObjectClass on the RACF system defines the single object class for the object type.
Sample value:
RACFGROUP
Create a fixed value property variable on the RACF side called vrtIdentDomain that is set to the value $IdentDomain$. Map this to UID_LDPDomain. This will cause a conflict and the Property Mapping Rule Conflict Wizard opens automatically.
To solve the conflict
Sample value:
RACF_DOMAIN
Create a fixed value property variable on the One Identity Manager side called vrtParentDN equal to a fixed string with value $GroupLocation$. Map this to vrtEntryParentDN on the RACF side. Activate the check box Ignore case sensitivity.
Sample value:
profiletype=group,cn=mainframe1,o=mycompany,c=com
Create a new variable on the One Identity Manager side of type "Script Property" with name vrtRDN and a data type of "string". In the Scripts section, enter one of the he following scripts in the Read script section, depending on whether your project is configured for C# or Visual Basic.
C# Script
references VI.TSUtils.dll;
return (VI.TargetSystem.Base.Utils.LDAP.RDN.Create("cn", useOldValues ? $cn[o]$ : $cn$).ToString()).Replace("cn=","racfid=");
VB Script
References VI.TSUtils.dll
Imports VI.TargetSystem.Base.Utils.LDAP
Dim name as String = ""
If useOldValues Then
name = $cn[o]$
Else
name = $cn$
End If
return RDN.Create("cn",name).ToString().Replace("cn=","racfid=")
Then map this to vrtEntryRDN on the RACF side.
Sample value:
USERGRP
This is a workaround needed to support group mappings. Create a new fixed value variable on the RACF side of type "String" with no value called vrtLDAPContainerDN with the value set to $GroupLocation$. This generates a property mapping rule conflict.
To solve the conflict
This mapping is used to synchronize group membership information.
vrtEntryDN is a virtual property, set to the DN of the object in the connector. This forms a unique ID to distinguish individual group objects on the RACF system.
To convert this mapping into an object matching rule
A message appears.
Edit the object mapping rule and activate the Case sensitive check box.
Sample value:
racfid=USERGRP,profiletype=group,cn=mainframe1,o=mycompany,c=com
The following figure shows the above group mapping in operation.
© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy