Enable only custom commands execution

Question

Hello,

Problem:
i have an OU = 'X' that keeps all account that has been deprovision. I need to disable creation/updating in that OU = 'X' and allow only a specific custom command to be executed that restores the account. The custom command moves the object to the previous OU and thus can update/active the account.

Part of the solution was to create 2 business rule (before updating/create), that will cancel operation if creation/update is made within the business rule scope (the OU = 'X').

Note: moving object is still possible in the OU

Question:
Now i need to allow only 1 custom command to be executed in that OU. Is there a way for a business rule to know which Custom command i am executing? Or any other solution?

Thx

Answer 1

Hello,

Is there a way for a business rule to know which Custom command i am executing?

Unfortunately, there is no such possibility.

Or any other solution?

We recommend you to use Security Roles to deny the permissions to create/update objects in the OU and only allow to move objects from the OU and execute the Custom Command on objects located in it. The Security role will look like the following:

For details, have a look at the following tutorials: https://www.adaxes.com/tutorials_Delega ... ssions.htm.

Still the Security Role will not deny the permissions for service administrators. If you want to prevent the administrators from creating/updating users in the OU, you will need to create Business Rules triggering Before Creating a User and Before Updating a User that will cancel the operations with corresponding messages. For example: