User management with Code42 User Directory Sync

LDAP script triggers

A synchronization executes the active, org, and role scripts each time it runs. When the scripts run, they read users' LDAP attributes and group membership, and change your Code42 environment to match. 

User management scope

Code42 User Directory Sync creates new users or assumes management of existing users in Code42 only if the users exist in the LDAP search results. These users are then processed by the active, org, and role scripts and updated in Code42 accordingly. User Directory Sync can only manage users that are returned in the LDAP search results. If users are moved outside of the scope of the filtering criteria, they cease to be managed by Code42 User Directory Sync.

Example use of LDAP scripts

Consider the following situation. Company X's Org Name script depends on the location LDAP attribute. If the location attribute for user jsmith changes from San Francisco to New York, then the LDAP sync process moves jsmith from the San Francisco org to the New York org.

Default active script

The default active script code, which handles the default active script behavior, is:

function isActive(entry) {
    return true;
}

If the user is found in LDAP, the default JavaScript function returns the value TRUE. The user is treated as active.

Active script example

But what if your company policy requires that LDAP entries for users remain permanently in LDAP, and the user's employment status is maintained via an LDAP attribute? You can use an active script to deactivate a user account based on an LDAP user attribute. This script deactivates a user if they are disabled in active directory (AD). 

function isActive(entry) {
  if (entry.userAccountControl & 0x2) {
    return false;
  } else {
    return true;
  }
}

Org script example

The org script can place users into a Code42 environment organization based on the OU specified in each user's LDAP distinguished name. The script does the following:

1. Parse the user's distinguished name.
2. If the user is in the LDAP Staff OU, return the value “Staff” to place the user into the Code42 environment's Staff organization.
3. If the user is in the LDAP Students OU, return the value “Students” to place the user into the Code42 environment's Students organization.
4. If the user is in neither the Staff nor the Students OU, return the value “Default” to place the user in the Default organization.

function getOrgName(entry) {
   var ou = entry.dn;
   if (ou != null){
       if ((ou.indexOf("Staff") >= 0 )){  
           return 'Staff';
       }
       else if ((ou.indexOf("Students") >= 0 )){
           return 'Students';  
       }
       else {
           return 'Default';  
       }  
   }
   else {
       return 'Default';  
   }  
}

Role script example

This example analyzes an LDAP environment and grants user roles based on LDAP memberships.

1. Determine which LDAP groups the user is a member of.
2. Map the appropriate Code42 environment roles to the account:
   • If the user is a member of the Admins LDAP group, grant the Org Security Viewer role.
   • If the user is a member of the Support LDAP group, grant the Org Admin role.
   • If the user is a member of the Managers group, grant the Org Manager role.
   • If the user is a member of the WorkstationAdmins group, grant the Org Help Desk role.

The following example assigns roles for the backup agent.

function getRoles(entry) {
   var memberof = entry.memberOf;

   // Default user roles
   var myRoles=new Array("PROe User","Desktop User");

   // Loop over LDAP groups
   for (var x = 0; x < memberof.length; ++x) {
      if (memberof[x].indexOf("Admins") > -1) {
         myRoles.push("Org Security Viewer");
      }
      if (memberof[x].indexOf("Support") > -1) {
         myRoles.push("Org Admin");
      }
      if (memberof[x].indexOf("Managers") > -1) {
         myRoles.push("Org Manager");
      }
      if (memberof[x].indexOf("WorkstationAdmins") > -1) {
         myRoles.push("Org Help Desk");
      }
   }
   return myRoles;
}