In reshaping my deployment of ARS 7 I’ve made extensive use of the dynamic objects ARS provides, i.e. Managed Units and Dynamic groups. Both of these are defined by a set of membership rules. In doing so I came across one limitation ( or bug ) and one annoyance. I’d like these to be ‘Feature Requests’ for the next version of ARS.
- The bug – objects in a Managed Unit are not sorted
- The annoyance – You cannot rename the membership rules in a dynamic object
The bug ( although I suspect Quest / Dell / Quest / One Identity, never thought about this ) is that if I use a Custom Include Query that displays the OUs below a target ‘searchRoot’ the OUs are not displaed in any order and there is no control over this, e.g. If I target a users OU and under this OU there is an OU for each country the MU displays the countries in a random order. If you want to try this out use this query as a membership rule ‘(&(objectCategory=organizationalUnit)(street=DisplayOUInMU))’ where I tag the OUs street attribute with either ‘DisplayOUInMU’ or ‘Don’tDisplayInMU’ I also have a 3rd setting ‘DisplayObjectsinMU’ which allows me to also display the objects in the OU in the MU.
I think that the MU should by default always sort the objects it displays in alphabetical order. In case you were wondering why I don’t just add the OUs implicitly there are two reasons, one, there are a lot of them and two, what if we add another country OU, I wanted to make the MU automatically pick it up. I have a fix for this by the way, add the dynamic rule but also add the explicit OU objects that already exist in the OU that you want to display. Any new OUs will get the correct ‘street’ attribute value as I use an ARS policy to update the street attributed based on the parent OU. The new OUs won’t be sorted so you will need to go and update the MU membership rules although now I am writing this I could write an ARS Policy script to automate this but I’ll wait a little in case One Identiry decide to add this feature / bug fix to the next ARS version.
The annoyance – You cannot rename the membership rules in a dynamic object. This should be an easy thing to allow in the same way as you can rename the PVG rules in an ARS Policy. I have dynmaic objects with 3 of even 4 ‘custom searches’ wouldn’t it be nice to be able to give these a meaningful name so you don’t have to open each one when you need to modify it?