Provisioning resources

In standard input/output (stdio) mode, filter plugins work in the following way:

Input

Input is similar for all resource filter plugins. The plugin first receives standard data in the format:

"" "" = {
  "sessionid" = "<session ID>" # The session ID of the request.
  "module" = "<idr|ids|idp|idwfm>"
                     
  "accountID" = "<account ID>" # The account ID of the recipient.
                     
  "template = "<template ID>" # The selected template ID.
  "targetid" = "<target ID>" # The target ID for the recipient.
  "navigation" "" = { ... } # User navigation data
  "recipient" "<user|empty>" = {
     # The "recipient" group contains standard information about the
                     
     # subject of the request.
   }
  "viewer" "user" = {
     # The "viewer" group contains standard information about the
     # person using the CGI.
   }
  "request" "" = {
     # The "request" group contains standard information about the
     # the request.
   }
 } 

Some of the values above may be empty, due to the stage and type of the request.

The plugin then receives a series of KVGroups; one for each item. An account filter plugin receives, for example:

"account" "" = {
  "account" "" = {
    "userid" = "ACOS0000"
    "hostid" = "NORSE"
    "longid" = "ACOS0000"
    "shortid" = "ACOS0000"
    "helpdesk" = "FALSE"
    "list" = "TRUE"
    "user" = "FALSE"
    "associated" = "TRUE"
    "invalid" = "FALSE"
  }

  "target" "" = {
    "targetid" = "NORSE"
    "platform" = "WIN2K"
    "address" = "\\\\10.0.12.21/basedn=ou=staff"
    "standardid" = "true"
    "targetgroupid" = "DEFAULT"
  }
} 

A template filter plugin receives:

"template" "" = {
  "description" = "Corporate Active Directory"
  "hostid" = "AD"
  "id" = "AD_TEMPLATE"
  "location" = ""
  "longid" = "template_user"
  "type" = ""
} 

A group filter plugin receives:

"nosgroup" "" = {
  "addtype" = "MODR"
  "deltype" = "MODR"
  "groupid" = "CN=arch_frv_owners,OU=groups,OU=staff,DC=norse,DC=bravurasecurity,DC=com"
  "hostid" = "AD"
  "location" = ""
  "mgrpid" = "e371a413-a417-4d67-9085-538ab963d886"
  "subgrpid" = "00000000-0000-0000-0000-000000000000"
  "type" = ""
} 

A role filter plugin receives:

 "role" "" = {
  "desc" = "Corporate employee"
  "roleid" = "CORP_AD_ROLE"
} 

Output

For each item, one output KVGroup is expected on stdout, with an optional "filter" = "true" pair to indicate that the item should not be displayed:

"" "" = {
"filter" = "true|false"
       # If false, the user is displayed
       # If true, the user is not displayed
"retval" = "<#>"
       # Optional, if non-zero returned, abort the plugin
} 

A plugin that encounters errors in its processing can add standard output pairs for individual items, which should cause the plugin execution to be aborted.

In callback mode the resource filter plugin uses two functions:

Example

A simple example is as follows:

 function OnFilterInit( const $inkvg, output $detail )
 {
     log ( kvgToString( $inkvg ))
     $detail = 0;
     return 0;
 }
  function OnItemFilter(const $inkvg, output $msg, output $allow )
 {
     log ( "OnItemFilter:" );
     log ( kvgToString( $inkvg ))
      $msg = ""; # Error message
     $allow = 0; # not allowed
     # $allow = 1; # allowed
     return 0;
 } 

In standard input/output (stdio) mode, a synchronous list generation plugin works in the following way:

Input

Input sent to the plugin is as follows:

"" "" = {
  "module" = "<idr|ida>"
                     
  "recipient" "<user|empty>" = {
                     
     # The "recipient" group contains standard information about the
                     
     # subject of the request.
   }
  "viewer" "<user|admin>" = {
     # The "viewer" group contains standard information about the
     # person using the CGI.
   }
 }  

Output

The list of managed groups is passed from the plugin on stdout. A KVGroup is sent for each user.

The output KVGroup sent from the plugin must be as follows:

"" "" = {
  "groupiD" = "<group ID>"
      # Optional; This indicates the next managed group to add to the list of managed groups.
      # If omitted, this indicates there are no more managed groups to add.
  "grouptarget" = "Target ID>"
      # The target system on which the group membership is managed
  "abort"  = "<true|false>" #If true, bypass the list generation plugin
  "errmsg" = "<text message>" # A message sent on an error
  "retval" = "0" # Mandatory; non-zero indicates failure
} 

In callback mode the managed group list generation plugin uses two functions:

Example

A simple example is as follows:

  function OnGeneratorInit( input $inkvg )
  {
      log( "inkvg: " + kvgToString($inkvg ));
  }
  function GetGenList( output $list )
  {
      var $include_group[]
      $include_group[ size( $include_group ) ] = "GROUP7";
      $include_group[ size( $include_group ) ] = "GROUP1";
      $list = $include_group;
  } 

In standard input/output (stdio) mode, a synchronous list generation plugin works in the following way:

Input

Input sent to the plugin is as follows:

"" "" = {
  "module" = "<idr|ida>"
                     
  "recipient" "<user|empty>" = {
                     
     # The "recipient" group contains standard information about the
                     
     # subject of the request.
   }
  "viewer" "<user|admin>" = {
     # The "viewer" group contains standard information about the
     # person using the CGI.
   }
 } 

Output

The list of roles is passed from the plugin on stdout. A KVGroup is sent for each user.

The output KVGroup sent from the plugin must be as follows:

"" "" = {
  "roleid" = "<role ID>"
                     
      # Optional; This indicates the next role to add to the list of roles.
      # If omitted, this indicates there are no more roles to add.
  "abort"  = "<true|false>" #If true, bypass the list generation plugin
  "errmsg" = "<text message>" # A message sent on an error
  "retval" = "0" # Mandatory; non-zero indicates failure
} 

In callback mode the role list generation plugin uses two functions:

Example

A simple example is as follows:

  function OnGeneratorInit( input $inkvg )
  {
      log( "inkvg: " + kvgToString($inkvg ));
  }
  function GetGenList( output $list )
  {
      var $include_role[]
      $include_role[ size( $include_role ) ] = "ROLE7";
      $include_role[ size( $include_role ) ] = "ROLE1";
      $list = $include_role;
  }