How we can provision user in different ou in AD endpoint?

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

We have an AD endpoint and at AD we have 7 to 8 container.
Can we defined 5 provisioning role corresponding to each container using one Endpoint and one account template ?
 

Environment

Identity Management 14.x

Resolution

You have multiple options here:

 

Option 1:
Create separate provisioning roles and account templates. The account template will have the specific OU set.
You can then create a logic in CAIM that will assign the right provisioning role to the user.
The problem here is that this is not a scalable solution.
You might have 7-8 OU now but how many of those you will have in the future?

 

Option 2:
Provision the AD account to a default location and then use a PX logic to move the account to the right location.
This is a scalable solution as you can put create an external decision table and then use the PX to get the right location
and then just move the AD account to the right location.

It is very important to note that once you create an account using a birthright template,
if you assign another template to the account which have a different OU in it, the account will not move to the other OU.
Only PX type of "Move Account" or manual move operation in the console will work


Option 3:
You can achieve using 1 role and 1 template. All you need to do was add conditions in user name filed.
Example: Map the user store attribute which drives your business logic to one of provisioning store attribute.
In Account Template in container tab, in User Account Filter you can apply the conditions for each ou.
Ex: eTCustomField14=WorkDay;eTADSOrgUnitName=Employees;eTCustomField14=Beeline;eTADSOrgUnitName=Contractors-TIPP;