Specifying Additional Active Directory Group Attributes in SOAP/TEWS Requests

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article explains how to modify the "Create Active Directory Group" task to include additional attributes (such as dlMemSubmitPerms) when creating an Active Directory group via a SOAP/TEWS request.

Environment

Identity Manager

Resolution

To specify additional attributes in your TEWS call, use the JSON format for the attribute payload.

Example Syntax

{  "name": "ADSGroup=Group2,ADSOrgUnit=IDM,EndPoint=AD1,Namespace=ActiveDirectory,Domain=im,Server=Server",  "dlMemSubmitPerms": "CN=DistributionList,OU=Groups,DC=domain,DC=com"}

Instructions

1. Ensure your SOAP request is correctly formatted for the Identity Manager TEWS endpoint.
2. Include the attribute key (e.g., dlMemSubmitPerms) followed by the required value (e.g., the Distinguished Name of the distribution list).
3. Ensure the attribute name matches the schema defined in your Identity Manager environment.

Note: For the "Accept Message from Distribution List" attribute, ensure you are providing the full Distinguished Name (DN) of the target distribution list.

 

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsdl="http://tews6/wsdl">
<soapenv:Header/>
<soapenv:Body>
<wsdl:TaskContext>
<wsdl:admin_id>imuser</wsdl:admin_id>
<wsdl:admin_password>IMpassword</wsdl:admin_password>
</wsdl:TaskContext>
<wsdl:CreateActiveDirectoryGroup>
<wsdl:CreateActiveDirectoryGroupSearch>
<wsdl:CreateNew>TRUE</wsdl:CreateNew>
<wsdl:EndpointGroupSearch>
<wsdl:ContainerHandle>ADSOrgUnit=IDM,EndPoint=AD1,Namespace=ActiveDirectory,Domain=im,Server=Server</wsdl:ContainerHandle>
</wsdl:EndpointGroupSearch>
</wsdl:CreateActiveDirectoryGroupSearch>
<wsdl:CreateActiveDirectoryGroupActiveDirectoryGroupGroupTab>
<wsdl:_PCT_ENDPOINT_CAPABILITY_NAME_PCT_>Group1</wsdl:_PCT_ENDPOINT_CAPABILITY_NAME_PCT_>
<wsdl:ntAccountId>Group1</wsdl:ntAccountId>
<wsdl:displayName>Any Name</wsdl:displayName>
<wsdl:ADSdescription>Distribution List</wsdl:ADSdescription>
<wsdl:groupScopeInternal>Global</wsdl:groupScopeInternal>
<wsdl:groupTypeInternal>Distribution</wsdl:groupTypeInternal>
<wsdl:DLMemSubmitPerms>{"name":"ADSGroup=Group2,ADSOrgUnit=IDM,EndPoint=AD1,Namespace=ActiveDirectory,Domain=im,Server=Server"}</wsdl:DLMemSubmitPerms>
</wsdl:CreateActiveDirectoryGroupActiveDirectoryGroupGroupTab>
</wsdl:CreateActiveDirectoryGroup>
</soapenv:Body>
</soapenv:Envelope>