Skip to Content
0
Former Member
Nov 16, 2010 at 05:24 PM

Autoresolving Dynamic Groups - Incorrect Documentation?

69 Views

Here is the documentation I have found for autoresolving dynamic groups:

MX_DG_ATTRIBUTE

MX_DG_ATTRIBUTE is a multi-value attribute reference. It is a list of attribute identifiers and

is used for resolving the dynamic group u2013 the list will be used to determine whether the dynamic

group must be resolved when an attribute changes for a user.

When an attribute is changed, LastChanged time is altered.

This will not be checked if MX_DG_CACHE_TIME is 0.

MX_DG_AUTORESOLVE_INTERVAL

This attribute indicates the interval for resolving the dynamic group. A positive number

indicates the number of seconds, while zero means that the dynamic group will never be

automatically resolved. The groups are also resolved automatically if the last_modified for this

attribute is <NULL>. The automatic resolve is done by the dispatcher.

Event based resolve of the dynamic group is done by setting the

MX_DG_AUTORESOLVE_INTERVAL.last_modified to <NULL> if any attribute referenced

by the dynamic group is changed. This will force a resolve by the dispatcher.

I found it here:

http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/f0d87115-36da-2b10-7b89-996efe422b2a?quicklink=index&overridelayout=true

This describes fairly accurately what I need to do. We have an attribute "INTERNET_LEVEL" on MX_PERSON that we will be changing when users request different access levels. We have a dynamic group for each level (1-9) that grants the appropriate LDAP privilege. When someone's INTERNET_LEVEL changes from 3 to 5, we need them to calculate out of the level 3 group and into the level 5 group.

It seems like to accomplish this, we want all of our dynamic groups for internet level privileges to autoresolve whenever INTERNET_LEVEL is changed for a person. According to the documentation, we should be able to add the attribute "INTERNET_LEVEL" to MX_DG_ATTRIBUTE for each of our dynamic groups, and they should recalculate.

Result: they do not recalculate on any change.

It could be that I am not storing the right thing in MX_DG_ATTRIBUTE on the dynamic group, as I can't find anything that specifies exactly what I should use. I tried a few different things, eventually it accepted an Attr_ID value (so like, MX_DG_ATTRIBUTE = 431, which is the Attr_ID for the attribute "INTERNET_LEVEL"). I will give up on this approach for now. Lack of this feature is not ideal, but I can work around it...

So, I should be able to create a job that will force a recalculation by changing the "last_modified" to NULL for the attribute MX_DG_AUTORESOLVE_INTERVAL. For starters, there is no "last_modified", I guess they mean "Modifytime"? I test setting this to NULL, and it does not automatically resolve. (The value of MX_DG_AUTORESOLVE_INTERVAL is 60.)

Also, there is no "MX_DG_CACHE_TIME" mentioned anywhere else in the documentation... I do not know if it is supposed to be another Attribute on the DYNAMIC_GROUP entry type, or a global variable/constant, or something else entirely. All I know is that it does not exist in our system nor can I find any mention of it anywhere.

Am I reading this documentation wrong, or is it completely inaccurate?

I'll post more later when I have time to collect more of my testing results...

Edited by: Adam Harwell on Nov 16, 2010 5:26 PM (Added more info)