8.2 Sample Deployment of REST Driver for Azure AD
This section explains the specific configuration details required for deploying the driver with Azure AD.
8.2.3 Creating REST Driver Object for Connecting to Azure AD in Designer
To begin with the configuration, you need to set up the REST driver object in the designer first, and then configure the REST driver with the specific parameters to connect to Azure AD application.
The procedure to set up the REST driver in Designer is similar for any connected application, as outlined in Steps 1 to 20. However, configuring the driver to an application depends on the configuration parameters required for that specific application as mentioned in step 21.
If you are familiar with the generic driver object set up, you can choose to skip to step 21 to see the configuration parameters specific to Azure AD application.
-
Open Designer.
-
In the toolbar, click > .
-
Click to update the packages
or
Click if the packages are up-to-date.
-
In the Outline view, right-click the .
-
Click .
-
Select any REST driver package
or
Click to import all of the packages displayed.
By default, only the base packages are displayed. Deselect to display all packages.
-
Click to import the selected packages, then click in the successfully imported packages message.
-
In view, open your project.
-
Right click the project > > , or drag and drop Identity Vault from the Palette to Modeler window.
-
In the Add Server Association screen, select values for the following fields and click .
-
Server DN
-
Identity Manager Version
-
Identity Manager Edition
The Identity Vault Credentials window appears.
-
-
In Identity Vault Credentials window, specify the following fields:
Field
Description
Host
The identity vault hosting machine's IP address
Username
The name of the user, for example, Admin, if the user is an administrator.
Password
The password of the user to login to the identity vault
-
Select , if you want to save your password for easy logins in the future.
-
Click .
The Identity Vault and the Driver Set appears in the Modeler window.
-
In the right pane, drag and drop the REST Server from the tab to the Modeler.
-
In the Driver Configuration Wizard, select (Contains the base functionality for a driver. You must install a driver base configuration package first).
NOTE:You can only select one base package.
-
Click .
-
Select from the following optional features to install for the REST driver:
-
REST Default Package
-
REST JSON Package: This package contains the default JSON configurations
-
REST Password Sync: This packages contains the policies that enable the REST driver to synchronize passwords. If you want to synchronize passwords, verify that this option is selected. For more information, see the NetIQ Identity Manager Password Management Guide.
-
-
Click .
The package dependencies window appears.
-
(Conditional) Click to install the package dependency listed.
NOTE:If there are any dependent packages associated with the selected package, you must install them to proceed.
-
On the Driver Information page, specify a name for the driver, then click . The Subscriber Options page appears.
-
Select in the Authentication Method field, as the REST Driver will be configured to connect to Azure AD with as the authentication method.
-
In the select the Certificate Based Authentication option:
: It uses digital certificates to get an access token for authentication.
To configure REST Driver using certificate based authentication, see Configuring the REST Driver with Certificate Based Authentication.
-
On the screen click .
-
Review the summary of tasks to be completed for creating the driver, then click . The configured driver appears in the designer screen.
-
After competing the above steps, refer to Configuring Resources to Synchronize, to configure the resources to synchronize with Azure AD.
Configuring the REST Driver with Certificate Based Authentication
Certificate Based Authentication uses digital certificates to get an access token for authentication. If you select , the following fields appear. Enter the values as shown in the following table:
|
Field |
Description |
|---|---|
|
|
https://login.microsoftonline.com/<DomainID>/oauth2/v2.0/token |
|
|
/<yourdirectorypath>/certcba.pfx NOTE:The keystore file should be in the .pfx file format. To generate the .pfx file, check Generating Certificate and Private Key for Certificate Based Authentication in REST Driver. |
|
|
<password used while creating certificate> |
|
|
<alias name given while creating certificate> |
|
|
|
|
|
|
Configuring Resources to Synchronize
Resources are configured to perform operations with the specified method of operation. These operations and methods are appended to the base URL specified to perform the required operation in Azure AD.
The steps to configure resources are as follows:
-
In Designer, double-click the connector.
-
In the Properties screen that appears, select from the left pane.
-
In the Driver Configuration screen, select tab.
-
Select . The Resources section appears.
-
Add instance, by clicking the
icon. -
Provide a schema name, for example <User>.
-
Set the Configure Handlers to , and click to add the schema name.
-
Add a instance by clicking the
icon, and specify the details as shown in the following table:Field
Description
Sample value
URL extension
Specify the customized URL extension to be appended to the base URL (the object entity on which the action is to be performed), in this case the object entity is User.
users
Operation
Specify the type of operation to be performed on the object entity.
The options are:
-
Add: to add the object entity
-
Modify: to modify a object entity
-
Query: to fetch details about the object entity
-
Delete: to delete the object entity
Method
Specify the method for the selected operation.
The options are:
-
GET: the method to perform a fetch operation
-
POST: the method to perform a create or add operation
-
DELETE: the method to delete
Example: For adding a user, enter user as the URL extension, set the Operation as , and Method as . This URL extension is appended to the base URL, so that the URL generated to perform the add user operation is https://login.microsoftonline.com/<DomainID>/oauth2/v2.0/users.
NOTE:Ensure to replace the variable values in the URL as required.
-
-
Click .
Sample Configuration of Handlers
|
REST Handler Details |
Sample URL Extension |
Operation |
Method |
REST end point URL |
|---|---|---|---|---|
|
Add user |
/User |
Add |
POST |
https://graph.microsoft.com/v1.0/users/ |
|
Fetch user |
/User/<association> |
Add |
GET |
https://graph.microsoft.com/v1.0/users/<association> |
|
Delete user |
/User/<association> |
Delete |
DELETE |
https://graph.microsoft.com/v1.0/users/<association> |
Customizing REST Driver Options for Azure AD
This section explains about the policies that can be customized for transforming generic JSON data to Azure AD specific JSON data. The policies that are based on certain rules, perform several actions which can also be customized as required. The REST driver performs multiple transformation operations for any REST based connected system. An example for Azure AD transformation policy is shown below.
IMPORTANT:The policies mentioned below are examples and must be used for reference purposes only. You must ensure not to use them directly in your production environment.
-
Select the REST Driver Object in designer.
-
Select the tab.
-
Select from the transformation diagram. This shows you all the input transformation policies.
-
Create a new policy by clicking
to add a new input transformation policy, and name it as . This policy will add the association to the new User, and must be imported into the Input Transformation on Publisher Channel. -
After the policy is added, navigate to the tab.
-
Copy the following content into the display area.
<?xml version="1.0" encoding="UTF-8"?><driver-configuration config-type="ScriptPolicyImpl" dn="cn=Rest Driver new test,cn=driverset1,o=system" driver-set-dn="cn=driverset1,o=system" name="NETIQRESTJSON-itp-FormattingJson"> <children> <rule name="NETIQRESTJSON-itp-FormattingJson"> <policy xmlns:jc="http://www.novell.com/nxsl/java/com.novell.nds.dirxml.driver.rest.common.JSONCreator" xmlns:jp="http://www.novell.com/nxsl/java/com.novell.nds.dirxml.driver.rest.common.JSONParser" xmlns:rs="http://www.novell.com/nxsl/java/com.novell.nds.dirxml.driver.rest.common.JSONConverter"> <rule> <description> Format the JSON that ID Vault Expects </description> <comment xml:space="preserve"> Extract and transform JSON fields from an HTTP response. </comment> <conditions> <and> <if-xpath op="true">./response/value</if-xpath> </and> </conditions> <actions> <do-if> <arg-conditions> <and> <if-xpath op="true">string-length(./response/value/text()) > 0</if-xpath> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="rawHttpResponse" scope="policy"> <arg-string> <token-xpath expression="string(./response/value)"/> </arg-string> </do-set-local-variable> </arg-actions> <arg-actions/> </do-if> <do-if> <arg-conditions> <and> <if-xpath op="true">self::driver-operation-data[@class-name='User']</if-xpath> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="HttpResponse" scope="policy"> <arg-string> <token-xpath expression='jp:getJsonValue($rawHttpResponse,"$.value")' notrace="true"/> </arg-string> </do-set-local-variable> <do-set-local-variable name="modificationRules" scope="policy"> <arg-string> <token-text> { "CN": "$.userPrincipalName", "Internet EMail Address": "$.email", "Full Name": "$.firstName", "Given Name": "$.firstName", "Surname": "$.lastName", "Telephone Number": "$.mobilePhone", "Title": "Developer", "workforceID":"$.id" } </token-text> </arg-string> </do-set-local-variable> </arg-actions> <arg-actions> <do-set-local-variable name="modificationRules" scope="policy"> <arg-string> <token-text> { "CN": "$.userPrincipalName", "Description":"$.description", "GID":"$.id" } </token-text> </arg-string> </do-set-local-variable> </arg-actions> </do-if> <do-set-local-variable name="modifiedArray" scope="policy"> <arg-string> <token-xpath expression="jp:modifyJsonArray($HttpResponse, $modificationRules)"/> </arg-string> </do-set-local-variable> <!-- Step 5: Create final JSON structure --> <do-set-local-variable name="creationRules" scope="policy"> <arg-string> <token-text>{ "$.results": "$" }</token-text> </arg-string> </do-set-local-variable> <do-set-local-variable name="modifiedHttpResponse" scope="policy"> <arg-string> <token-xpath expression="jc:createJson($creationRules, $modifiedArray)"/> </arg-string> </do-set-local-variable> <do-strip-xpath expression="response/response-header"/> <do-strip-xpath expression="./response/value"/> <do-append-xml-element expression="response" name="value"/> <do-append-xml-text expression="./response/value"> <arg-string> <token-local-variable name="modifiedHttpResponse"/> </arg-string> </do-append-xml-text> </actions> </rule> <rule> <description> Format the JSON that ID Vault Expects </description> <comment xml:space="preserve"> Extract and transform JSON fields from an HTTP response. </comment> <conditions> <and> <if-xpath op="true">./driver-operation-data[@command='query']</if-xpath> <if-xpath op="true">./driver-operation-data/response/value</if-xpath> <if-xpath op="true">self::status[@level='success']</if-xpath> <if-xpath op="not-true">./driver-operation-data[@event-id='ENTITLEMENT:Group']</if-xpath> </and> </conditions> <actions> <do-if> <arg-conditions> <and> <if-xpath op="true">string-length(./driver-operation-data/response/value/text()) > 0</if-xpath> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="rawHttpResponse" scope="policy"> <arg-string> <token-xpath expression="string(./driver-operation-data/response/value)"/> </arg-string> </do-set-local-variable> <do-set-local-variable name="ResponseValue" scope="policy"> <arg-string> <token-xpath expression='jp:getJsonValue($rawHttpResponse,"$.value")'/> </arg-string> </do-set-local-variable> </arg-actions> <arg-actions/> </do-if> <do-if> <arg-conditions> <and> <if-local-variable mode="nocase" name="ResponseValue" op="not-equal">[]</if-local-variable> </and> </arg-conditions> <arg-actions> <do-if> <arg-conditions> <and> <if-xpath op="true">./driver-operation-data[@class-name='User']</if-xpath> <if-local-variable mode="nocase" name="ResponseValue" op="not-equal">[]</if-local-variable> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="modificationRules" scope="policy"> <arg-string> <token-text> {"$.CN": "$.userPrincipalName", "$.Internet EMail Address": "$.email", "$.Full Name": "$.displayName", "$.Given Name": "$.givenName", "$.Surname": "$.surname", "$.Telephone Number": "$.mobilePhone", "$.Title": "Developer", "$.workforceID":"$.id"} </token-text> </arg-string> </do-set-local-variable> </arg-actions> <arg-actions/> </do-if> <do-if> <arg-conditions> <and> <if-xpath op="true">./driver-operation-data[@class-name='groups']</if-xpath> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="modificationRules" scope="policy"> <arg-string> <token-text> { "CN": "$.profile.name", "Description":"$.profile.description", "GID":"$.id" } </token-text> </arg-string> </do-set-local-variable> </arg-actions> </do-if> <do-set-local-variable name="modifiedArray" scope="policy"> <arg-string> <token-xpath expression="jc:createJson($modificationRules,$rawHttpResponse)"/> </arg-string> </do-set-local-variable> <!-- Step 5: Create final JSON structure --> <do-strip-xpath expression="./driver-operation-data/response/response-header"/> <do-strip-xpath expression="./driver-operation-data/response/value"/> <do-append-xml-element expression="./driver-operation-data/response" name="value"/> <do-append-xml-text expression="./driver-operation-data/response/value"> <arg-string> <token-text xml:space="preserve">{"results":[</token-text> </arg-string> </do-append-xml-text> <do-append-xml-text expression="./driver-operation-data/response/value"> <arg-string> <token-local-variable name="modifiedArray"/> </arg-string> </do-append-xml-text> <do-append-xml-text expression="./driver-operation-data/response/value"> <arg-string> <token-text xml:space="preserve">]}</token-text> </arg-string> </do-append-xml-text> </arg-actions> </do-if> </actions> </rule> <rule> <description> Policy to modify JSON response fields directly </description> <comment xml:space="preserve"> Transform JSON fields from an HTTP response at ./driver-operation-data/response/value. </comment> <conditions> <and> <if-xpath op="true">./driver-operation-data/response/value</if-xpath> <if-xpath op="true">./driver-operation-data[@command='query']</if-xpath> <if-xpath op="true">./driver-operation-data[@event-id='ENTITLEMENT:Group']</if-xpath> </and> </conditions> <actions> <!-- Extract the raw HTTP response --> <do-set-local-variable name="rawHttpResponse" scope="policy"> <arg-string> <token-xpath expression="string(./driver-operation-data/response/value)"/> </arg-string> </do-set-local-variable> <!-- Define and apply modification rules --> <do-set-local-variable name="modificationRules" scope="policy"> <arg-string> <token-text> { "CN": "$.profile.name", "Description": "$.profile.description", "ID":"$.id" } </token-text> </arg-string> </do-set-local-variable> <do-set-local-variable name="modifiedArray" scope="policy"> <arg-string> <token-xpath expression="jp:modifyJsonArray($rawHttpResponse, $modificationRules)"/> </arg-string> </do-set-local-variable> <!-- Create the final JSON structure --> <do-set-local-variable name="creationRules" scope="policy"> <arg-string> <token-text>{ "$.results": "$" }</token-text> </arg-string> </do-set-local-variable> <do-set-local-variable name="modifiedHttpResponse" scope="policy"> <arg-string> <token-xpath expression="jc:createJson($creationRules, $modifiedArray)"/> </arg-string> </do-set-local-variable> <!-- Replace the original HTTP response --> <do-strip-xpath expression="./driver-operation-data/response/response-header"/> <do-strip-xpath expression="./driver-operation-data/response/value"/> <do-append-xml-element expression="./driver-operation-data/response" name="value"/> <do-append-xml-text expression="./driver-operation-data/response/value"> <arg-string> <token-local-variable name="modifiedHttpResponse"/> </arg-string> </do-append-xml-text> </actions> </rule> </policy> </rule> </children> </driver-configuration> -
Click the tab. The new policy screen appears.
-
Save all your changes.
-
Double click the and add the following condition:
<do-if> <arg-conditions> <and> <if-op-property mode="nocase" name="association" op="equal"/> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="responseVal" scope="policy"> <arg-string> <token-xpath expression="."/> </arg-string> </do-set-local-variable> <do-set-local-variable name="associationVal" scope="policy"> <arg-string> <token-xpath expression='jp:getJsonValue($responseVal, "$.id")'/> </arg-string> </do-set-local-variable> <do-set-op-property name="association"> <arg-string> <token-local-variable name="associationVal"/> </arg-string> </do-set-op-property> </arg-actions> <arg-actions/> </do-if> -
Make sure to arrange the policies in the following order by using the move icons:
-
NETIQRESTJSON-itp-FormattingJson
-
NETIQRESTJSON-itp-CheckRetries
-
NETIQRESTJSON-itp-JSONtoXDS
-
NETQRESTDCFG-itp-AddAssociation
-
NOVLPWDSYNC-itp-EmailOnFailedPwdSub
-
NETQPWDSYNC-itp-TransformPassword
-
-
Similarly, customize the transformation policies by selecting in the transformation diagram.
-
Replace the existing content with the following in policy xml:
<children> <rule name="NETQRESTJSON-otp-XDStoJSON"> <policy xmlns:es="http://www.novell.com/nxsl/ecmascript" xmlns:rs="http://www.novell.com/nxsl/java/com.novell.nds.dirxml.driver.rest.common.JSONConverter"> <rule> <description>Translate XDS to JSON</description> <conditions> <and> <if-operation mode="regex" op="not-equal">instance</if-operation> <if-operation mode="nocase" op="not-equal">driver-operation-data</if-operation> </and> </conditions> <actions> <do-if> <arg-conditions> <and> <if-operation mode="regex" op="equal">status</if-operation> <if-xpath op="true">count(//nds//instance)>0</if-xpath> <if-xpath op="not-true">//instance[@class-name="DirXML-Driver"]</if-xpath> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="status" scope="policy"> <arg-node-set> <token-xml-parse> <token-text xml:space="preserve"><status></status></token-text> </token-xml-parse> </arg-node-set> </do-set-local-variable> <do-clone-xpath dest-expression="$status/status" src-expression="/nds/*/instance"/> <do-set-local-variable name="xmlInput" scope="policy"> <arg-string> <token-base64-encode charset="UTF-8"> <token-replace-all regex="&lt;" replace-with="<"> <token-xml-serialize> <token-xpath expression="$status"/> </token-xml-serialize> </token-replace-all> </token-base64-encode> </arg-string> </do-set-local-variable> <do-set-local-variable name="applicationContent" notrace="false" scope="policy"> <arg-string> <token-xpath expression="rs:xdsToJSON($xmlInput)"/> </arg-string> </do-set-local-variable> <do-append-xml-element expression="$current-op" name="driver-operation-data"/> <do-append-xml-element expression="$current-op/driver-operation-data[last()]" name="header"/> <do-set-xml-attr expression="$current-op/driver-operation-data[last()]/header" name="Accept"> <arg-string> <token-text xml:space="preserve">application/json</token-text> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="$current-op/driver-operation-data[last()]" name="response"/> <do-append-xml-element expression="$current-op/driver-operation-data[last()]/response" name="value"/> <do-append-xml-text expression="$current-op/driver-operation-data[last()]/response/value" notrace="false"> <arg-string> <token-local-variable name="applicationContent"/> </arg-string> </do-append-xml-text> <do-strip-xpath expression="/nds/*/instance"/> </arg-actions> <arg-actions> <do-if> <arg-conditions> <and> <if-class-name op="available"/> <if-class-name mode="nocase" op="not-equal">DirXML-Driver</if-class-name> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="operations" scope="policy"> <arg-node-set> <token-xpath expression="."/> </arg-node-set> </do-set-local-variable> <do-for-each> <arg-node-set> <token-local-variable name="operations"/> </arg-node-set> <arg-actions> <do-set-local-variable name="xmlInput" notrace="false" scope="policy"> <arg-string> <token-base64-encode charset="UTF-8"> <token-replace-all regex="&lt;" replace-with="<"> <token-xml-serialize> <token-xpath expression="$current-op"/> </token-xml-serialize> </token-replace-all> </token-base64-encode> </arg-string> </do-set-local-variable> <do-set-local-variable name="applicationContent" notrace="false" scope="policy"> <arg-string> <token-xpath expression="rs:xdsToJSON($xmlInput)"/> </arg-string> </do-set-local-variable> <do-if notrace="false"> <arg-conditions> <and> <if-local-variable mode="nocase" name="applicationContent" op="not-equal"/> </and> </arg-conditions> <arg-actions> <do-if> <arg-conditions> <and> <if-operation mode="regex" op="not-equal">query</if-operation> </and> </arg-conditions> <arg-actions> <do-append-xml-element expression=".." name="driver-operation-data"/> <do-set-xml-attr expression="../driver-operation-data" name="src-dn"> <arg-string> <token-src-dn/> </arg-string> </do-set-xml-attr> <do-set-xml-attr expression="../driver-operation-data[last()]" name="is-sensitive"> <arg-string> <token-text xml:space="preserve">false</token-text> </arg-string> </do-set-xml-attr> <!-- <do-if> <arg-conditions> <and> <if-password op="available"/> </and> </arg-conditions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="is-sensitive"> <arg-string> <token-text xml:space="preserve">false</token-text> </arg-string> </do-set-xml-attr> </arg-actions> <arg-actions/> </do-if>--> <do-set-xml-attr expression="../driver-operation-data[last()]" name="class-name"> <arg-string> <token-class-name/> </arg-string> </do-set-xml-attr> <do-set-xml-attr expression="../driver-operation-data[last()]" name="event-id"> <arg-string> <token-xpath expression="$current-op/@event-id"/> </arg-string> </do-set-xml-attr> <do-if> <arg-conditions> <and> <if-operation mode="nocase" op="equal">modify-password</if-operation> </and> </arg-conditions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="command"> <arg-string> <token-text xml:space="preserve">modify</token-text> </arg-string> </do-set-xml-attr> </arg-actions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="command"> <arg-string> <token-operation/> </arg-string> </do-set-xml-attr> </arg-actions> </do-if> <do-append-xml-element expression="../driver-operation-data[last()]" name="request"/> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="url-token"/> <do-if> <arg-conditions> <and> <if-association op="available"/> </and> </arg-conditions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="association"> <arg-string> <token-association/> </arg-string> </do-set-xml-attr> </arg-actions> <arg-actions/> </do-if> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="header"/> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/header" name="content-type"> <arg-string> <token-text xml:space="preserve">application/json</token-text> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="value"/> <do-append-xml-text expression="../driver-operation-data[last()]/request[last()]/value"> <arg-string> <token-local-variable name="applicationContent"/> </arg-string> </do-append-xml-text> </arg-actions> <arg-actions> <do-if> <arg-conditions> <and> <if-xpath op="true">$current-op/@scope="entry"</if-xpath> </and> </arg-conditions> <arg-actions> <do-append-xml-element expression=".." name="driver-operation-data"/> <do-if disabled="true"> <arg-conditions> <and> <if-global-variable mode="case" name="drv.allowtracing" op="equal">false</if-global-variable> </and> </arg-conditions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="is-sensitive"> <arg-string> <token-text xml:space="preserve">false</token-text> </arg-string> </do-set-xml-attr> </arg-actions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="is-sensitive"> <arg-string> <token-text xml:space="preserve">false</token-text> </arg-string> </do-set-xml-attr> </arg-actions> </do-if> <do-set-xml-attr expression="../driver-operation-data[last()]" name="class-name"> <arg-string> <token-class-name/> </arg-string> </do-set-xml-attr> <do-set-xml-attr expression="../driver-operation-data[last()]" name="command"> <arg-string> <token-operation/> </arg-string> </do-set-xml-attr> <do-set-xml-attr expression="../driver-operation-data[last()]" name="event-id"> <arg-string> <token-xpath expression="$current-op/@event-id"/> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="../driver-operation-data[last()]" name="request"/> <do-if> <arg-conditions> <and> <if-association op="available"/> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="associationHolder" scope="policy"> <arg-string> <token-association/> </arg-string> </do-set-local-variable> </arg-actions> <arg-actions> <do-set-local-variable name="associationHolder" scope="policy"> <arg-string> <token-text xml:space="preserve">/</token-text> <token-dest-dn/> </arg-string> </do-set-local-variable> </arg-actions> </do-if> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="url-token"/> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="association"> <arg-string> <token-local-variable name="associationHolder"/> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="header"/> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/header" name="content-type"> <arg-string> <token-text xml:space="preserve">application/json</token-text> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="value"/> <do-append-xml-text expression="../driver-operation-data[last()]/request[last()]/value"> <arg-string> <token-local-variable name="applicationContent"/> </arg-string> </do-append-xml-text> </arg-actions> <arg-actions> <do-set-local-variable name="searchClasses" scope="policy"> <arg-node-set> <token-xpath expression="$current-op/search-class"/> </arg-node-set> </do-set-local-variable> <do-for-each> <arg-node-set> <token-local-variable name="searchClasses"/> </arg-node-set> <arg-actions> <do-append-xml-element expression=".." name="driver-operation-data"/> <do-set-xml-attr expression="../driver-operation-data[last()]" name="class-name"> <arg-string> <token-class-name/> </arg-string> </do-set-xml-attr> <do-set-xml-attr expression="../driver-operation-data[last()]" name="command"> <arg-string> <token-operation/> </arg-string> </do-set-xml-attr> <do-set-xml-attr expression="../driver-operation-data[last()]" name="event-id"> <arg-string> <token-xpath expression="$current-op/@event-id"/> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="../driver-operation-data[last()]" name="request"/> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="url-token"/> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="header"/> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/header" name="content-type"> <arg-string> <token-text xml:space="preserve">application/json</token-text> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="value"/> <do-append-xml-text expression="../driver-operation-data[last()]/request[last()]/value"> <arg-string> <token-local-variable name="applicationContent"/> </arg-string> </do-append-xml-text> <do-set-local-variable name="searchAttrs" scope="policy"> <arg-node-set> <token-xpath expression="$current-op/search-attr"/> </arg-node-set> </do-set-local-variable> <do-for-each> <arg-node-set> <token-local-variable name="searchAttrs"/> </arg-node-set> <arg-actions> <do-if> <arg-conditions> <and> <if-local-variable name="filterText" op="available"/> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="filterText" scope="policy"> <arg-string> <token-xpath expression="$current-node/@attr-name"/> <token-text xml:space="preserve"> eq '</token-text> <token-xpath expression="$current-node/value/text()"/> <token-text xml:space="preserve">'</token-text> <token-text xml:space="preserve"> and </token-text> <token-local-variable name="filterText"/> </arg-string> </do-set-local-variable> </arg-actions> <arg-actions> <do-set-local-variable name="filterText" scope="policy"> <arg-string> <token-xpath expression="$current-node/@attr-name"/> <token-text xml:space="preserve"> eq '</token-text> <token-xpath expression="$current-node/value/text()"/> <token-text xml:space="preserve">'</token-text> </arg-string> </do-set-local-variable> </arg-actions> </do-if> </arg-actions> </do-for-each> <do-set-local-variable name="filterText" scope="policy"> <arg-string> <token-xpath expression='rs:urlEncode($filterText,"UTF-8")'/> </arg-string> </do-set-local-variable> </arg-actions> </do-for-each> </arg-actions> </do-if> <do-set-local-variable name="readAttrs" scope="policy"> <arg-node-set> <token-xpath expression="$current-op/read-attr"/> </arg-node-set> </do-set-local-variable> <do-if> <arg-conditions> <and> <if-xpath op="true">count($readAttrs)>0</if-xpath> </and> </arg-conditions> <arg-actions> <do-for-each> <arg-node-set> <token-local-variable name="readAttrs"/> </arg-node-set> <arg-actions> <do-if> <arg-conditions> <and> <if-local-variable name="readAttrText" op="not-available"/> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="readAttrText" scope="policy"> <arg-string> <token-text xml:space="preserve">'</token-text> <token-xpath expression="$current-node/@attr-name"/> <token-text xml:space="preserve">'</token-text> </arg-string> </do-set-local-variable> </arg-actions> <arg-actions> <do-set-local-variable name="readAttrText" scope="policy"> <arg-string> <token-text xml:space="preserve">'</token-text> <token-xpath expression="$current-node/@attr-name"/> <token-text xml:space="preserve">'</token-text> <token-text xml:space="preserve">and</token-text> <token-local-variable name="readAttrText"/> </arg-string> </do-set-local-variable> </arg-actions> </do-if> </arg-actions> </do-for-each> <do-if> <arg-conditions> <and> <if-local-variable mode="case" name="readAttrText" op="not-equal">''</if-local-variable> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="readAttrText" scope="policy"> <arg-string> <token-xpath expression='rs:urlEncode($readAttrText,"UTF-8")'/> </arg-string> </do-set-local-variable> <do-if> <arg-conditions> <and> <if-xpath op="true">$current-op/@scope="entry"</if-xpath> </and> </arg-conditions> <arg-actions> <!-- <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="filter"> <arg-string> <token-text xml:space="preserve">?read-attr=</token-text> <token-local-variable name="readAttrText"/> </arg-string> </do-set-xml-attr> --> </arg-actions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="filter"> <arg-string> <token-text xml:space="preserve">?$filter=</token-text> <token-local-variable name="filterText"/> <!-- <token-text xml:space="preserve">&read-attr=</token-text> <token-local-variable name="readAttrText"/> --> </arg-string> </do-set-xml-attr> </arg-actions> </do-if> </arg-actions> <arg-actions> <do-set-local-variable name="readAttrText" scope="policy"> <arg-string> <token-xpath expression='rs:urlEncode("","UTF-8")'/> </arg-string> </do-set-local-variable> <do-if> <arg-conditions> <and> <if-xpath op="true">$current-op/@scope="entry"</if-xpath> </and> </arg-conditions> <arg-actions> <!-- <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="filter"> <arg-string> <token-text xml:space="preserve">?read-attr=</token-text> <token-local-variable name="readAttrText"/> </arg-string> </do-set-xml-attr> --> </arg-actions> <arg-actions> <do-set-local-variable name="FilterName" scope="policy"> <arg-string> <token-text xml:space="preserve">?</token-text> <token-xpath expression='rs:urlEncode("$filter","UTF-8")'/> <token-text xml:space="preserve">=</token-text> <token-local-variable name="filterText"/> </arg-string> </do-set-local-variable> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="filter"> <arg-string> <token-local-variable name="FilterName"/> </arg-string> </do-set-xml-attr> </arg-actions> </do-if> </arg-actions> </do-if> </arg-actions> <arg-actions> <do-set-local-variable name="readAttrText" scope="policy"> <arg-string> <token-xpath expression='rs:urlEncode("*","UTF-8")'/> </arg-string> </do-set-local-variable> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="filter"> <arg-string> <token-text xml:space="preserve">?search-attr=</token-text> <token-local-variable name="filterText"/> <!-- <token-text xml:space="preserve">&read-attr=</token-text> <token-local-variable name="readAttrText"/> --> </arg-string> </do-set-xml-attr> </arg-actions> </do-if> </arg-actions> </do-if> </arg-actions> <arg-actions> <do-if> <arg-conditions> <and> <if-operation mode="regex" op="equal">delete|modify-password</if-operation> </and> </arg-conditions> <arg-actions> <do-append-xml-element expression=".." name="driver-operation-data"/> <do-if> <arg-conditions> <and> <if-password op="available"/> </and> </arg-conditions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="is-sensitive"> <arg-string> <token-text xml:space="preserve">false</token-text> </arg-string> </do-set-xml-attr> </arg-actions> <arg-actions/> </do-if> <do-set-xml-attr expression="../driver-operation-data[last()]" name="class-name"> <arg-string> <token-class-name/> </arg-string> </do-set-xml-attr> <do-if> <arg-conditions> <and> <if-operation mode="nocase" op="equal">modify-password</if-operation> </and> </arg-conditions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="command"> <arg-string> <token-text xml:space="preserve">modify</token-text> </arg-string> </do-set-xml-attr> </arg-actions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]" name="command"> <arg-string> <token-operation/> </arg-string> </do-set-xml-attr> </arg-actions> </do-if> <do-append-xml-element expression="../driver-operation-data[last()]" name="request"/> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="url-token"/> <do-if> <arg-conditions> <and> <if-association op="available"/> </and> </arg-conditions> <arg-actions> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/url-token" name="association"> <arg-string> <token-association/> </arg-string> </do-set-xml-attr> </arg-actions> <arg-actions/> </do-if> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="header"/> <do-set-xml-attr expression="../driver-operation-data[last()]/request[last()]/header" name="content-type"> <arg-string> <token-text xml:space="preserve">application/json</token-text> </arg-string> </do-set-xml-attr> <do-append-xml-element expression="../driver-operation-data[last()]/request[last()]" name="value"/> <do-append-xml-text expression="../driver-operation-data[last()]/request[last()]/value"> <arg-string> <token-local-variable name="applicationContent"/> </arg-string> </do-append-xml-text> </arg-actions> <arg-actions/> </do-if> </arg-actions> </do-if> <do-clone-xpath dest-expression="../driver-operation-data[last()]" notrace="false" src-expression="$current-op/operation-data"/> <do-strip-xpath expression="$current-op" notrace="false"/> </arg-actions> </do-for-each> </arg-actions> <arg-actions/> </do-if> </arg-actions> </do-if> </actions> </rule> </policy> </rule> </children> </driver-configuration> -
Create a new polices by clicking
in the window, and name it , and . -
Double click the newly created policy, and navigate to tab in the right pane.
-
Paste the following xml content for this policy in the display area:
<?xml version="1.0" encoding="UTF-8"?><driver-configuration config-type="ScriptPolicyImpl" dn="cn=Rest Driver new test,cn=driverset1,o=system" driver-set-dn="cn=driverset1,o=system" name="NETQRESTJSON-otp-ModifyUserprincpalName"> <children> <rule name="NETQRESTJSON-otp-ModifyUserprincpalName"> <policy> <rule> <description>modify upn</description> <conditions> <and> <if-class-name mode="nocase" op="equal">User</if-class-name> <if-op-attr name="userPrincipalName" op="available"/> </and> </conditions> <actions> <do-reformat-op-attr name="userPrincipalName"> <arg-value type="string"> <token-op-attr name="userPrincipalName" notrace="true"/> <token-text xml:space="preserve"><tenant-id></token-text> </arg-value> </do-reformat-op-attr> </actions> </rule> </policy> </rule> </children> </driver-configuration> -
Double click the newly created policy, and navigate to tab in the right pane.
-
Paste the following xml content for this policy in the display area:
<?xml version="1.0" encoding="UTF-8"?><driver-configuration config-type="ScriptPolicyImpl" dn="cn=Rest Driver new test,cn=driverset1,o=system" driver-set-dn="cn=driverset1,o=system" name="NETIQRESTJSON-otp-FormatJSON"> <children> <rule name="NETIQRESTJSON-otp-FormatJSON"> <policy xmlns:jc="http://www.novell.com/nxsl/java/com.novell.nds.dirxml.driver.rest.common.JSONCreator" xmlns:jp="http://www.novell.com/nxsl/java/com.novell.nds.dirxml.driver.rest.common.JSONParser"> <description>Format JSON inside the value tag to wrap with profile.</description> <rule> <description>Wrap Existing JSON into Profile JSON Object</description> <!-- This rule is for both User and Groups, used to modify the JSON Format --> <conditions> <and> <if-xpath op="true">../driver-operation-data/request/value</if-xpath> </and> </conditions> <actions> <do-if> <arg-conditions> <and> <if-xpath op="true">string-length(./request/value/text()) > 0</if-xpath> <if-class-name mode="nocase" op="equal">User</if-class-name> <if-xpath op="true">self::driver-operation-data[@command='add']</if-xpath> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="jsonPayload" scope="policy"> <arg-string> <token-xpath expression="request/value"/> </arg-string> </do-set-local-variable> <do-set-local-variable name="creationRules" scope="policy"> <arg-string> <token-text> { "$.accountEnabled": true, "$.displayName": "$.displayName", "$.userPrincipalName": "$.userPrincipalName", "$.passwordProfile.forceChangePasswordNextSignIn": true, "$.passwordProfile.password": "$.password" , "$.mailNickname": "$.displayName" } </token-text> </arg-string> </do-set-local-variable> <do-set-local-variable name="finalJson" scope="policy"> <arg-string> <token-xpath expression="jc:createJson($creationRules, $jsonPayload)"/> </arg-string> </do-set-local-variable> <!-- it will create the final JSON Object --> <do-strip-xpath expression="request/value"/> <do-append-xml-element expression="request" name="value"/> <do-append-xml-text expression="request/value"> <arg-string> <token-local-variable name="finalJson"/> </arg-string> </do-append-xml-text> </arg-actions> <arg-actions> <do-if> <arg-conditions> <and> <if-class-name mode="nocase" op="equal">groups</if-class-name> <if-xpath op="true">self::driver-operation-data[@command='add']</if-xpath> </and> <and> <if-class-name mode="nocase" op="equal">groups</if-class-name> <if-xpath op="true">self::driver-operation-data[@command='modify']</if-xpath> </and> <and> <if-class-name mode="nocase" op="equal">User</if-class-name> <if-xpath op="true">self::driver-operation-data[@command='modify']</if-xpath> </and> </arg-conditions> <arg-actions> <do-set-local-variable name="valueattribute" scope="policy"> <arg-string> <token-xpath expression="request/value"/> </arg-string> </do-set-local-variable> <do-strip-xpath expression="request/value"/> <do-append-xml-element expression="request" name="value"/> <do-set-local-variable name="profileJson" scope="policy"> <arg-string> <token-json-object> <arg-string name="profile"> <token-local-variable name="valueattribute"/> </arg-string> </token-json-object> </arg-string> </do-set-local-variable> <do-append-xml-text expression="request/value"> <arg-string> <token-local-variable name="profileJson"/> </arg-string> </do-append-xml-text> </arg-actions> <arg-actions/> </do-if> </arg-actions> </do-if> </actions> </rule> </policy> </rule> </children> </driver-configuration> -
Double click the newly created policy, and navigate to tab in the right pane.
-
Paste the following xml content for this policy in the display area:
<?xml version="1.0" encoding="UTF-8"?><driver-configuration config-type="ScriptPolicyImpl" dn="cn=Rest Driver new test,cn=driverset1,o=system" driver-set-dn="cn=driverset1,o=system" name="NETQRESTJSON-otp-RemoveArray"> <children> <rule name="NETQRESTJSON-otp-RemoveArray"> <policy> <description>This policy is used to remove array identifiers associated with JSON values.</description> <rule> <description>remove array identifiers</description> <comment xml:space="preserve">remove array identifiers</comment> <conditions> <and> <if-xpath op="true">../driver-operation-data/request/value</if-xpath> </and> </conditions> <actions> <do-set-local-variable name="valueattribute" scope="policy"> <arg-string> <token-xpath expression="request/value"/> </arg-string> </do-set-local-variable> <do-strip-xpath expression="request/value"/> <do-append-xml-element expression="request" name="value"/> <do-append-xml-text expression="request/value"> <arg-string> <token-replace-all regex='\"\}\,' replace-with='",'> <token-replace-all regex="\}\}" replace-with="}"> <token-replace-all regex='\{\"add\"\:' replace-with=""> <token-replace-all regex="\[" replace-with=""> <token-replace-all regex="\]" replace-with=""> <token-local-variable name="valueattribute"/> </token-replace-all> </token-replace-all> </token-replace-all> </token-replace-all> </token-replace-all> </arg-string> </do-append-xml-text> </actions> </rule> </policy> </rule> </children> </driver-configuration> -
Make sure to arrange the policies in the following order by using the move icons:
-
NETQRESTJSON-otp-ModifyUserprincpalName
-
NETQRESTDCFG-otp-AddAssociation
-
NOVLPWDSYNC-otp-EmailOnFailedPwdSub
-
NETQRESTDCFG-otp-ConvertQueryExToQuery
-
NETQRESTJSON-otp-XDStoJSON
-
NETQRESTDCFG-otp-AddFromCprsFlag
-
NETIQRESTJSON-otp-FormatJSON
-
NETQRESTJSON-otp-RemoveArray
-
-
Select from the transformation diagram, create a new policy by clicking
to add a new transformation policy, and name it as . -
Go to the tab in the right pane and copy the following content into the display area:
<rule name="NETQRESTDCFG-SchemaMapping"> <attr-name-map> <class-name> <nds-name>Group</nds-name> <app-name>Group</app-name> </class-name> <attr-name class-name="Group"> <nds-name>CN</nds-name> <app-name>displayName</app-name> </attr-name> <attr-name class-name="Group"> <nds-name>Description</nds-name> <app-name>description</app-name> </attr-name> <attr-name class-name="Group"> <nds-name>DirXML-AADObjectType</nds-name> <app-name>Type</app-name> </attr-name> <attr-name class-name="Group"> <nds-name>Member</nds-name> <app-name>members</app-name> </attr-name> <attr-name class-name="Group"> <nds-name>Owner</nds-name> <app-name>owners</app-name> </attr-name> <attr-name class-name="Group"> <nds-name>preferredName</nds-name> <app-name>mailNickname</app-name> </attr-name> <class-name> <nds-name>User</nds-name> <app-name>User</app-name> </class-name> <attr-name class-name="User"> <nds-name>C</nds-name> <app-name>usageLocation</app-name> </attr-name> <attr-name class-name="User"> <nds-name>city</nds-name> <app-name>city</app-name> </attr-name> <attr-name class-name="User"> <nds-name>CN</nds-name> <app-name>userPrincipalName</app-name> </attr-name> <attr-name class-name="User"> <nds-name>co</nds-name> <app-name>country</app-name> </attr-name> <attr-name class-name="User"> <nds-name>company</nds-name> <app-name>companyName</app-name> </attr-name> <attr-name class-name="User"> <nds-name>directReports</nds-name> <app-name>directReports</app-name> </attr-name> <attr-name class-name="User"> <nds-name>DirXML-AADArchiveStatus</nds-name> <app-name>ArchiveStatus</app-name> </attr-name> <attr-name class-name="User"> <nds-name>DirXML-AADLegacyExchangeDN</nds-name> <app-name>ServerLegacyDN</app-name> </attr-name> <attr-name class-name="User"> <nds-name>DirXML-AADLitigationHoldEnabled</nds-name> <app-name>LitigationHoldEnabled</app-name> </attr-name> <attr-name class-name="User"> <nds-name>DirXML-AADObjectType</nds-name> <app-name>Type</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Facsimile Telephone Number</nds-name> <app-name>faxNumber</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Full Name</nds-name> <app-name>displayName</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Given Name</nds-name> <app-name>givenName</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Internet EMail Address</nds-name> <app-name>otherMails</app-name> </attr-name> <attr-name class-name="User"> <nds-name>jpegPhoto</nds-name> <app-name>photo</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Locked By Intruder</nds-name> <app-name>isCompromised</app-name> </attr-name> <attr-name class-name="User"> <nds-name>manager</nds-name> <app-name>manager</app-name> </attr-name> <attr-name class-name="User"> <nds-name>mobile</nds-name> <app-name>mobilePhone</app-name> </attr-name> <attr-name class-name="User"> <nds-name>OU</nds-name> <app-name>department</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Physical Delivery Office Name</nds-name> <app-name>physicalDeliveryOfficeName</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Postal Code</nds-name> <app-name>postalCode</app-name> </attr-name> <attr-name class-name="User"> <nds-name>preferredLanguage</nds-name> <app-name>preferredLanguage</app-name> </attr-name> <attr-name class-name="User"> <nds-name>preferredName</nds-name> <app-name>mailNickname</app-name> </attr-name> <attr-name class-name="User"> <nds-name>S</nds-name> <app-name>state</app-name> </attr-name> <attr-name class-name="User"> <nds-name>SA</nds-name> <app-name>streetAddress</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Surname</nds-name> <app-name>surname</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Telephone Number</nds-name> <app-name>businessPhones</app-name> </attr-name> <attr-name class-name="User"> <nds-name>Title</nds-name> <app-name>jobTitle</app-name> </attr-name> </attr-name-map> </rule> -
Save all your changes and deploy these policies to Identity Manager. This customized REST driver will manage Azure AD system for creating user as mentioned above.