cancel
Showing results for 
Search instead for 
Did you mean: 

Uninstalling AD connector from SAP IDM

Former Member
0 Kudos

Hi Team,

I am new to SAP IDM and the requirement is to stop the existing connector from provisioining the users to AD.

Can you pls share  some info on this?

Do we need to uninstalling the Connector or Without uninstalling we can stop the provisioning, Please let me know which approach to follow.

Thanks

Harry

Accepted Solutions (0)

Answers (2)

Answers (2)

terovirta
Active Contributor
0 Kudos

Hello,

take away the provision (mx_add_member_task), deprovision (mx_del_member_task) and modify (mx_modify_task) -tasks from the repository by selecting "none".

If you remove the hook tasks the Provisioning Framework will still execure the provision/deprovision/modify workflows and attempt calling the hook tasks.

regards, Tero

Former Member
0 Kudos

Thanks Tero, Does this stop only user provisioning? because we still need group provisioning to work.

awaiting your response

terovirta
Active Contributor
0 Kudos

In that case you need to leave the add/del_member_tasks in place and it's probably best to develop a dummy task that does nothing and refer that to the hook tasks (create/modify user, change password etc) that you don't want to execute.

regards, Tero

rondv
Advisor
Advisor
0 Kudos

Why not create another task, or tasks, at strategic points in the workflow and let those tasks check a repository constant, or multiple constants, that you control which drive the execution of sections of the workflow, or make it stop or skip sections.

This way you can keep the workflow, but you can selectively control how it executes.

You could then go the whole hog and add some UI constructs on top of that and allow the setting of the constants from the admin UI, or even from other scripted activities that could respond to things in the environment and set the right constants to affect the sequencing of the AD workflow.

I don't know if that is what you need, but the programmer in me thinks its a way to control things:-).

former_member198652
Active Participant
0 Kudos

Hi Harry,

Simplest way is disabling the Individual jobs, or unchecking the dispatchers to the jobs which are executing connecting job.

Regards,

Jay

Former Member
0 Kudos

So when you are saying disabling individual jobs?

As a begineer not having much experience, what my concept over job is to do any transaction like "read the users from source", "provision the users" etc.

In my case, how can i relate the jobs and dispatcher?

know its bit dumb what i am asking......

former_member2987
Active Contributor
0 Kudos

Hello Harkirat,

First off, please advise us of what version is being used, that will somewhat alter the answer.

Have you checked any of the documentation? In any case you are going to need some basic understanding of IDM to act on our advice.

Thanks,

Matt

Former Member
0 Kudos

Hi Matt,

The version is 7.2

Stopping the dispatcher will halt the all systems bcoz we are using same dispatcher for other target systems as well.

The concern is clients want the group provision to work but user provisioning to stop....

i.e " let idm provision groups to AD but should not provision users at all.

Thanks

Harry

former_member187331
Participant
0 Kudos

Depending on your usecase there are 2 possible ways (i know):

1. Delete hooktasks in the repository. This will prevent all writes on the remote system.

2. Uncheck Dispatcher Assignment like Jaya said. I am not sure if this will add entries to the provisioning queue...

In IdM 8 you have the option to deactivate repositories natively

Greetings, Aydin

Former Member
0 Kudos

Thanks Aydin,

As mention by tero, Is it going to call the hooktasks even if the tasks are removed?

let me know

former_member187331
Participant
0 Kudos

When the tasks are removed, there will be no function to be called by the dispatcher.
Depending how your provisioning looks like (ours is a little bit custom), you can prevent ALL provisioning (users, groups etc.)

Greetings, Aydin

former_member2987
Active Contributor
0 Kudos

Hmmm, don't know that I would delete, but I would disable the tasks.  You might need them someday.

Matt

former_member187331
Participant
0 Kudos

Hello Matt,

disabling the task is a good idea, but I think the more flexible way is this one:

Delete references to the provisioning tasks (called hooktasks) in the specific repository (repository constants).


Usecase: You have 3 AD repositories. If you deactivate the AD Connector tasks, provisioning to all 3 repositories will be disabled. Better: Delete the hooktask-references of a specific repository.

Greetings, Aydin

former_member2987
Active Contributor
0 Kudos

On a per repository basis, that's OK.  I just get scared when people say delete

In this scenario, it sounds like there's on AD.

Regards,

Matt