none
Criteria Based Group Members and a Multi-Valued Attribute RRS feed

  • Question

  • Currently, I"m managing group membership using a multi-valued database table.  That works well.  But, the logic for group membership resides on a DB server and requires a developer or a DBA to alter (along with a bunch of change control overhead).

    In this instance, we have cases where an employee has duties in more than one building.  Those building lists are stored in the metaverse in a newly created multi-valued attriubte "building".  The MAs I have in place maintain that properly.  

    I'm going through an effort to move that into the portal.  I have the groups and users created in the portal.  But, when I try to define the group as a criteria based group, the list of selectable attributes does not include "building".  

    At first I thought the portal didn't support multi-valued string attributes.  But, I found instances in the default drop down that are multi-valued, non-indexed attributes.

    Then, I thought the reason I wasn't seeing that attribute was because of some MPR.  So, I added the "building" attribute to these MPRs:
        Synchronization: Synchronization account controls group resources it synchronizes
        Group management: Group administrators can update group resources

    My question is, what do I need to do to get my "building" attribute to show up in the criteria attribute selection drop down?  Or, is that not supported?  Or, am I missing something?

    Thanks,

    Greg
    Sunday, May 22, 2016 9:39 PM

Answers

  • Hi,

    this is not possible due to limitation on FIM/MIMs XPath which are used to create dynamic groups/sets.Xpath does not work in unindexed strings or binaires. If you create "building" as an indexed string you should be able to use it.

    But indexed string are limited in size and can not be that large rather then unindexed.

    /Peter


    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Monday, May 23, 2016 8:10 AM

All replies

  • Hi,

    this is not possible due to limitation on FIM/MIMs XPath which are used to create dynamic groups/sets.Xpath does not work in unindexed strings or binaires. If you create "building" as an indexed string you should be able to use it.

    But indexed string are limited in size and can not be that large rather then unindexed.

    /Peter


    Peter Stapf - ExpertCircle GmbH - My blog: JustIDM.wordpress.com

    Monday, May 23, 2016 8:10 AM
  • Thank Peter.  That worked.  I had a two day exercise trying to delete and redefine that attribute (the Microsoft guys need to make it easier to locate attribute references). 

    I can define a criteria based membership based on a multi-valued attribute.  Click on "View Members" shows the appropriate list of members for that group.

    But, now I have a different problem.  When try to save the group definition, I get an error:  "The operation was rejected because of access control policies". And, an additional message "The server workflow rejected the operation".  I have the building attribute listed in the following MPRs:

    • Distribution list management: Owners can update and delete groups they own
    • Group management: Group administrators can update group resources
    • Synchronization: Synchronization account controls group resources it synchronizes
    • Synchronization: Synchronization account controls users it synchronizes

    FYI, all this is being run under the administrator account, and the administrator has been made the owner of the group.

    I spent quite a bit of time looking at MPRs, and I haven't defined any workflows at all.  Any ideas where to look?  I'm going to continue to dig around in this.

    And, thanks again for your answer.  I had discounted the indexed requirement because the current drop down list has one unindexed, multi-valued attribute listed.  I can't recall the name, though.  I looked like a system attribute, though.

    Greg

    Tuesday, May 24, 2016 6:45 PM
  • I found the answer to my latest issue.  I had to add the building attribute to the FilterPermissions FilterScope under All Resources.

    Cool!

    Tuesday, May 24, 2016 7:18 PM