How to filter group objects residing in sub containers during AD group import

[jbirkmeier]

I have a requirement to filter out all group objects in sub container when the AD import job is run.

Example:

The AD connector groupSearchBaseDN is set to "OU=groups,DC=dev,DC=xyz,DC=com".  This is needed in order to import all of the required groups within OU=groups.

The AD directory structure under "OU=groups,DC=dev,DC=xyz,DC=com" also has multiple sub containers like OU=service,OU=groups....

My requirement is to not import any of the the AD group objects in the sub containers under OU=groups...   like CN=application,OU=service,OU=groups.

How can I filter out the the sub containers?  Thanks!

[Belwyn]

Hi @jbirkmeier 

Thank you for reaching out to us, 

Is your use case is something like, you have a group like OU=groups,DC=dev,DC=xyz,DC=com and this group has nested groups in them and you do not wish to bring them in, is this correct understanding? 

Thanks & Regards, 

Belwyn.

[jbirkmeier]

Thanks for the reply Belwyn.  My scenario does not involve "nested" groups.  My goal is to not import groups that reside in sub containers under the the OU=groups parent container. 

[rushikeshvartak]

Use can use filter condition based on attribute of group and achieve your requirement. which ever group you want to pull add into object filter or use groups unique attribute

[jbirkmeier]

Thank you for the reply Rushikesh.  Your suggestion sounds like it would work, but adds an extra layer of complexity and management that I was hoping to avoid. 

[rushikeshvartak]

IGA tools bring standardization hence this will be one time activity and for new group same can be followed either by ad admin or via saviynt ( if group management is used) while creating user group