RBACRole - syncUsers_4

RBACRole - syncUsers

Description :

This command synchronizes users belonging to an external directory group to the specified role. The command also recursively searches for users of the subgroups that belong to the specified group and sychronizes them as well.

Prerequisite: To run this command, the role you used to initiate this BLCLI session must have read and write access to the users in the role you want to sync. Specifically, the BLCLI role must have User.Read, User.Modify, User.ModifyProperties and User.Delete permission for any users already assigned to the role you specify using the roleName argument.

You can use this command as part of the setup for the Active Directory user synchronization feature. For information about this feature, see the RBAC section of the BMC BladeLogic User Guide (Managing Access).

For ldapConnection, specify a named LDAP connection that you already created by using the Ldap : createConnection command.

For automationPrincipalName, specify the name of an automation principal that you already created by using the Impersonation : createAutomationPrincipal command.

Return type : DBKey

Command Input :

Variable Name	Variable Type	Description
roleName	String	Name of the role on which you want to perform the synchronization operation.
ldapConnection	String	Name of an existing LDAP connection.
automationPrincipalName	String	Name of an existing automation principal.
groupDN	String	Distinguished name of the directory group from which to synchronize users.
userFilter	String	LDAP filter to query users with.
userAttribute	String	Name of the LDAP attribute where the username is stored.
groupFilter	String	LDAP filter to query subgroups with.
memberAttribute	String	Name of the LDAP attribute where the group members are stored.

Example

The following example synchronizes all users of AD group CN=Administrators,CN=Users,DC=us,DC=sso,DC=bmc,DC=com configured on ActiveDirectory server engw2k8x64sso8.sso.bmc.com with the RBAC role DemoUS. It also synchronizes users of any subgroups that belong to the specified AD group. This is simply an additive operation; existing users of the role are kept intact. The query parameters specify how to find the users belonging to the RBAC role DemoUS in the ActiveDirectory server. The synchronization operation never affects reserved users (BLAdmin and RBACAdmin) or any users for whom the isSynchronizable property is set to false.

This example assumes that you have already created an LDAP connection and an automation principal.

Script

RBACRole syncUsers DemoUS SSO DirAdmin CN=Administrators,CN=Users,DC=us,DC=sso,DC=bmc,DC=com (objectClass=user) userPrincipalName (objectClass=group) member