Can I get Crowd to create a group from a specified group in Active Directory?

[Nancy Bonanno]

Is there a way to say, "Hey Crowd, create a group called 'All_Managers' from our Active Directory.  Look for all users in the AD who have Employee Type set to 'M' and only pull them into the new Crowd group."

Okay - I probably can't do that with voice commands, but is there some way to accomplish this task?

Thanks for any direction. 

[Marcin Kempa]

Hi @Nancy Bonanno 

Thanks for asking this question here. Just to make sure I understand you well let me rephrase your question:

You would like to create a group 'All_Managers' just locally in Crowd (I assume not in your Active Directory). Later on you would like to synchronize users from that Active Directory and those who has Employee Type set to 'M' (I assume this is a user property) add to that 'All_Managers' group? Is that fair summary?

If the situation you are looking at is as I described above, here is configuration you could give a try in order to achieve that:

(I assume that you already have a directory for all your users which is mapped to applications in Crowd, I will call this 'All Users Directory'

1. Create a new directory in Crowd to synchronize from Active Directory and set user LDAP filter to only filter user who has Employee Type set to 'M'. I will call this 'Managers Directory'. Make sure that you set 'manage groups locally' option in this directory.
2. Create 'All_Managers' local group in 'Managers Directory'
3. Configure 'Managers Directory' to automatically assign 'All_Managers' to users who login to Crowd or applications using this directory. In order to do so, please see the section 'Automatically assigning groups per directory' in Crowd's documentation.
4. Map this directory to application that should use it as described here. I assume that you have also other directory for other users that will be logging in to applications - 'All Users Directory' (you may set LDAP filter in that directory to filter out users who has Employee Type set to 'M').
   1. Make sure that 'Managers Directory' is the first directory in the list for applications. This is important especially if you do not filter out those users who has Employee Type set to 'M' in 'All Users Directory' as feature of automatically assigning groups per directory works only if user logs in to application using that directory
5. Select membership aggregation as described here.

Let me know if the proposed solution works for you.

Best Regards,

Marcin Kempa

[Nancy Bonanno]

OOoooOH.  This sounds promising.  When I create the directory in step 1, do I use the "delegated authentication" type?

[Marcin Kempa]

Hi @Nancy Bonanno 

In general I would recommend connector directory which would periodically synchronize your users and their memberships from Active Directory. But delegated authentication directory should work as well, although you may be running into problems with user accounts that are no longer active as delegated authentication directory does not clean up by default such users. There is a plugin for that on our marketplace though.

Best Regards,

Marcin Kempa

[Nancy Bonanno]

In the end, my admins wouldn't do this.  So we just make an AD group and I'm going to have them regularly update the AD group.  But thanks and I may get them to try this in the future.