Business Rule - 'After user updated' not triggered when the user is added to a group.

Question

I need a way of triggering a business rule based on the user (and not the group) being added or removed from a group. The reason I would like this triggered on the user is so the business rule can be tied to a specific OU that the users are in. These users need a force sync to a domain controller that is on the other side of the globe and will take several hours to replicate if I don't force it. I can setup the business rule to trigger on all groups in the domain and then check the OU of the member but that would then have to trigger on all group adds. I think this could be a performance issue so I would prefer not to do that. I am checking to see if there is another way to do this.

Answer 1

Hello Mark,

Unfortunately, there is no possibility to use a business rule triggering After updating a user in this case. The thing is that when a member is added to a group, it is the group being updated, not the member. The behaviour is by design and comes from AD itself, not Adaxes. To achieve the desired, you can use a business rule triggering After adding a member to a group. The rule will look like the following: In the script condition, use the below script. In the script, the $ouDN variable specifies the distinguished name (DN) of the OU where users requiring synchronization force are located. For details on how to get an object DN, see https://www.adaxes.com/sdk/HowDoI.GetDnOfObject.

$ouDN = "OU=Users,DC=company,DC=com" # TODO: modify me

# Get member DN
$member = $Context.BindToObject("Adaxes://%member%")
$memberDN = $member.Get("distinguishedName")
$memberDNobject = New-Object "Softerra.Adaxes.Ldap.DN" $memberDN

# Check user location
$ouDNobject = New-Object "Softerra.Adaxes.Ldap.DN" $ouDN
$Context.ConditionIsMet = $memberDNobject.IsDescendantOf($ouDNobject)

Comments

thank you for the detailed answer!