Identity Manager 4.0.1 Driver for Scripting Implementation ... - NetIQ

command=‘IDMGETVAR "COMMAND"‘
# check for an add event
if [ "$command" = "add" ]; then
# call the add script
add.sh
fi
Example 2:
# obtain the event’s association and CN attribute
ASSOCIATION=‘IDMGETVAR "ASSOCIATION"‘
CN=‘IDMGETVAR "ADD_CN"‘
if [ "$CN" = "bob" ]; then
# for "bob", check to see if he’s been enabled
ENABLE=‘IDMGETVAR "REMOVE_Login Disabled"‘
if [ "$ENABLE" = "true" ]; then
# bob is enabled again
cmd="appenable -association $ASSOCIATION"
EXEC "$cmd"
fi
fi
Handling Associations
The association value indicates which identity has been changed. If the identity has no association,
an association must be generated for it using an implementation-specific rule that you have adopted.
When Identity Manager processes an event for an identity with no association, it executes the
driver’s Matching policy. This policy attempts to match the event’s identity to an identity on the
external application’s system. Usually doing this involves executing a query. The default Matching
policy included with the Scripting driver queries for matching Users and Groups based on the CN
attribute. If the event’s identity matches an identity on the external application, both identities must
be assigned the new association. Assigning this association can be done as part of the queryhandling
script. (Handling queries is discussed in more detail in “Handling Query Events” on
page 51.) If no identity matches, an Add event is issued, and the new association can be assigned as
part of the Add event-handling script:
# Adding an association
IDMSETVAR "COMMAND" "ADD_ASSOCIATION"
IDMSETVAR "ASSOCIATION" "$MyAssociation"
IDMSETVAR "EVENT_ID" "$EVENT_ID"
IDMSETVAR "DEST_DN" "$SRC_DN"
IDMSETVAR "DEST_ENTRY_ID" "$SRC_ENTRY_ID"
The above example demonstrates each name/value pair that must be set for an association to be
assigned by the Identity Manager engine. The values of EVENT_ID, SRC_DN and SRC_ENTRY_ID are
always sent by the engine during an add event, and therefore, are available for your add script to
obtain using IDMGETVAR. The example above also illustrates the IDMSETVAR function. For
detailed information on how to use IDMSETVAR, see Section C.1, “UNIX Shell (idmlib.sh)
Reference,” on page 143. This function sets a name and value which indicates what action Identity
Manager should perform. For example, the pair COMMAND and ADD_ASSOCIATION instructs the shim
to create an add-association document to assign an association to an identity, as discussed above.
The pair EVENT_ID and $EVENT_ID instruct the shim to assign add-association document an eventid
described by the variable $EVENT_ID. This is important for the engine to match documents sent
and returned on the subscriber channel.
The Subscriber can also issue MODIFY_ASSOCIATION and REMOVE_ASSOCIATION commands:
Customizing the Scripting Driver 49