LDAP Group Assignment from GRC10

[Former Member]

Hi Experts,

We are planning to implement the LDAP group assignment from GRC10

For this we have performed end to end configuration

Created the connector and performed LDAP server configuration ( for LDAP system user we have given pseudo access)

Done mapping for connector etc

Performed the all the synchronizations and everything is working fine

I have imported the groups as single roles using role import and scheduled synchronization job (full sync), but the role exits says No'.

Even the roles are present in the tables GRACRLCONN & GRACROLE.

Current SP level is 13

Kindly suggest.

Thanks,

Sriram

[Former Member · Accepted solution]

Hi All,

I have implemented the note 1867742 and now it is working fine.

Thanks all for your support.

Regards,

Sriram

[alessandr0]

Hi Sriram,

did you try to run the GRAC_REP_OBJ_SYNC (Full sync mode) to a specific connector? Actually this changes the status "Role exists" when the role exists in the back-end.

Regards,

Alessandro

[Former Member]

Hi Alessandro,

Yes... I have schedule the full sync job many times .. but still it is showing that the Role Exists 'NO'.

even in the result of the full sych it is giving the exact number of roles and users that have sync in to GRC.

Thanks,

Sriram

[alessandr0]

Strange - can you check SLG1 in both systems (grc and plug-in) after running the sync job? Any error message showing up?

[Former Member]

HI Alessandro,

Again i have scheduled the full sync job in grc for LDAP connector to capture SLG1 logs

Job is successful and there were no errors and we have 2 users & 2 groups in the current base entry.

Here plugin system in LDAP so i cannot get Log there.

Below is the SLG1 log in GRC10

Thanks,

Sriram

[Former Member]

HI Alessandro,

in addition to that i have added the LDAP connector to AUTH/PROV/ROLMG scenario

Also assigned the actions Role Generation, Role Risk Analysis, Authorization Maintenance, Provisioning

Maintained the Group path and user path

Below is the mapping details that i have done for provisioning groups

Kindly analyse and suggest

Thanks,

Sriram

[former_member193066]

Thats group parameter mapping.

This activity is for provisioning into systems that are SPML1.0 compliant, like IDMs and SAP EP. These entries are based on the schema exposed by IDMs.

Let me know incase you have any query.

Regards,

Prasant.

[Former Member]

HI Prasant,

Thanks for your reply.

Here i am trying to provision LDAP groups from GRC 10.

So is there any separate mapping i need to do.

If i change these mapping then schedule the sync job and import the LDAP groups then Role Exist will then convert to 'YES'.

Awaiting fro your response

Thanks,

Sriram

[Former Member]

Hi Alessandro/Prasant,

I have deleted group parameter mapping (please check the above screen shot)  in 'maintain mapping for actions and connector groups'.

Now i have again run the sync job, but i can see there are total 5 values sitting in GRACRLCONN table.

Here both the users & groups came for the ROLE_ID value.

Even now the Role Exist show NO.

Kindly please suggest.

Thanks,

Sriram

[former_member193066]

CL_GRAC_AD_AUTH_MGMT_LDAP IF_GRAC_AD_AUTH_MGMT~GET_ROLE_LIST is for

CL_GRAC_AD_AUTH_MGMT_LDAP check if you have maintained in integration scenario

Regards,

Prasant

[Former Member]

Hi Prasanth,

Yes CL_GRAC_AD_AUTH_MGMT_LDAP is maintained in AUTH scenario for LDAP connector

CL_GRAC_AD_ACCESS_MGMT_LDAP maintained for ROLMG & PROV scenario

And i have added LDAP connector to all the 3 scenarios

Thanks,

Sriram

[Former Member]

In Addition to that in ROLMG scenario i have added CL_GRAC_AD_ACCESS_MGMT_LDAP