How we can provision user in different ou in AD endpoint?
search cancel

How we can provision user in different ou in AD endpoint?


Article ID: 110172


Updated On:


CA Identity Manager CA Identity Governance CA Identity Portal


We have an AD endpoint and at AD we have 7 to 8 container.
Can we defined 5 provisioning role corresponding to each container using one Endpoint and one account template ?


Identity Management 14.x


You have multiple options here:


Option 1:
Create separate provisioning roles and account templates. The account template will have the specific OU set.
You can then create a logic in CAIM that will assign the right provisioning role to the user.
The problem here is that this is not a scalable solution.
You might have 7-8 OU now but how many of those you will have in the future?


Option 2:
Provision the AD account to a default location and then use a PX logic to move the account to the right location.
This is a scalable solution as you can put create an external decision table and then use the PX to get the right location
and then just move the AD account to the right location.

It is very important to note that once you create an account using a birthright template,
if you assign another template to the account which have a different OU in it, the account will not move to the other OU.
Only PX type of "Move Account" or manual move operation in the console will work

Option 3:
You can achieve using 1 role and 1 template. All you need to do was add conditions in user name filed.
Example: Map the user store attribute which drives your business logic to one of provisioning store attribute.
In Account Template in container tab, in User Account Filter you can apply the conditions for each ou.
Ex: eTCustomField14=WorkDay;eTADSOrgUnitName=Employees;eTCustomField14=Beeline;eTADSOrgUnitName=Contractors-TIPP;