Need a way to find all provisioning users that have no assigned provisioning role
How can I get a list of provisioning users that have no provisioning role assigned?
All Identity Manager
Below is a LDAP query that you can run in order to get that information.
For IMPS_HOST, enter the hostname of the Provisioning Server For PWD, enter the password for the 'etaadmin' user.
ldapsearch.exe -LLL -h IMPS_HOST -p 20389 -D "eTGlobalUserName=etaadmin,eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta" -w PWD -b "eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta" -s one "(!(eTRoleDN=*))" eTGlobalUserName
If instead you were trying to run an ldapsearch to find which users have a specific role then the search would instead look like this:
ldapsearch.exe -LLL -h IMPS_HOST -p 20389 -D "eTGlobalUserName=etaadmin,eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta" -w PWD -b "eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects,dc=im,dc=eta" -s one "(eTRoleDN=eTRoleName=MY_PROV_ROLE,eTRoleContainerName=Roles,eTNamespaceName=CommonObjects,dc=im)" eTGlobalUserName
Assuming you get the list of users from the previous command you can build an input file to feed into an etautil command such as:
etautil.exe -u USER -p PWD -f input.txt
where input.txt contains one command per line such as:
update 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects' eTGlobalUser eTGlobalUserName='user1' to +eTRoleDN='eTRoleName=myrole,eTRoleContainerName=Roles,eTNamespaceName=CommonObjects,dc=im' eTSyncUsers='1';
update 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects' eTGlobalUser eTGlobalUserName='user2' to +eTRoleDN='eTRoleName=myrole,eTRoleContainerName=Roles,eTNamespaceName=CommonObjects,dc=im' eTSyncUsers='1';
If you want to remove the role from the user instead then the commands would look like the following:
update 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects' eTGlobalUser eTGlobalUserName='user1' to -eTRoleDN='eTRoleName=myrole,eTRoleContainerName=Roles,eTNamespaceName=CommonObjects,dc=im' eTSyncDelete='1';
update 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects' eTGlobalUser eTGlobalUserName='user2' to -eTRoleDN='eTRoleName=myrole,eTRoleContainerName=Roles,eTNamespaceName=CommonObjects,dc=im' eTSyncDelete='1';