Symantec IGA

 View Only
  • 1.  Invoke ADS program exit (vAPP)

    Posted Nov 28, 2019 04:12 AM
    Hello all,

    I need to invoke a PowerShell script when a user is disabled.
    Now, PowerShell runs on Windows obviously, and my customer is running under vApp (Linux)

    So i cannot use a shell command (through PX  or Kettle) as IDM runs in the vApp.

    I cannot run program exit (DLL or batch) as again, those need to be deployed in the provisioning server\bin  (again, vApp Linux).

    What are my options (if any)?

    Thanks!

    Charly

    ------------------------------
    Senior Consultant/Architect- CA Identity Suite SME
    Topspin Technologies (Partner)
    ------------------------------


  • 2.  RE: Invoke ADS program exit (vAPP)

    Broadcom Employee
    Posted Nov 28, 2019 08:39 AM
    Maybe you could use an SSH server on Windows like Cygwin, and invoke the PowerShell script through an ssh tunnel. 



  • 3.  RE: Invoke ADS program exit (vAPP)

    Posted Nov 28, 2019 10:23 AM

    Hi Charly,

     

    You can deploy custom java code which can then call Powershell on windows machine.

    Java custom code should be called from PX

     






  • 4.  RE: Invoke ADS program exit (vAPP)

    Posted Nov 28, 2019 05:26 PM
    Rajesh-
    As I mentioned, PX will run a java code in the vAPP (Linux), not on a windows box.

    ------------------------------
    Senior Consultant/Architect- CA Identity Suite SME
    Topspin Technologies (Partner)
    ------------------------------



  • 5.  RE: Invoke ADS program exit (vAPP)

    Posted Nov 29, 2019 08:13 AM

    Hi Charly,

     

    Yes. PX will run/call java code in Linux. We can use java code to run powershell on windows machine if that is acceptable

     






  • 6.  RE: Invoke ADS program exit (vAPP)

    Posted Nov 28, 2019 05:25 PM
    Hi Iyes-
    Customer prefers not doing that...

    ------------------------------
    Senior Consultant/Architect- CA Identity Suite SME
    Topspin Technologies (Partner)
    ------------------------------



  • 7.  RE: Invoke ADS program exit (vAPP)
    Best Answer

    Posted Nov 29, 2019 07:06 AM
    Does the PowerShell script have to be executed immediately?
    If not, IM PX could write to a DB table when the user is disabled. Then have a scheduled task on Windows that runs every, say, 15 minutes. It could call PDI or PowerShell script to read the user id out of the DB table, do whatever the PS script needs to do and then delete the user from the DB (or mark the user status as updated in the DB).


  • 8.  RE: Invoke ADS program exit (vAPP)

    Posted Nov 30, 2019 11:14 AM
    Hi Pearse-
    This is an option I will explore.
    Thanks.

    ------------------------------
    Senior Consultant/Architect- CA Identity Suite SME
    Topspin Technologies (Partner)
    ------------------------------