Identity Manager

How to Sync Group Members that have been transformed (Groups transformed as well)

Been working on a project where we will have multiple IDM environments all utilizing different container structures from a single development Active Directory domain. We decided to just emulate the top level and create the same users under each structure and transform things like the cn, samaccountname, UPN & mail so they will be unique and easy to spot (John Smith/jsmith would be John Smith-d/jsmith-d for the dev container instance)

We also want to duplicate/transform the target groups and ensure the member back links resolve to the correct objects and not the top level (or other parallel)groups.  Currently have the users and groups where we want them but the member attributes aren't getting populated in the target domain.

Does anyone have a way to script these transforms as we will have in our dev domain several instances of the same users/groups (John Smith will also be John Smith-d, John Smith-u & John Smith-i within the same target dev AD.

Note: We are using a stand alone instance of Quick Connect 5.4 to do this...

  • Here is what I came up with and appears to meet the requirement; hope it helps someone else in the same predicament:
    Add-PSSnapin Quest.ActiveRoles.admanagement
    #Get the sam from source
    $srcMember = $srcObj["Member"]
    #transform - or lookup

    $S = get-qaduser $srcmember -DontUseDefaultIncludedProperties
    $srcSam = $S.samaccountname

    $dstSam = $srcSam + "-t1"

    $T = get-qaduser $dstSam -Service '' -DontUseDefaultIncludedProperties | Select-Object DN