Join Log in
Score:0
avatar Server

Is it possible to run automated tasks when users are added to Active Directory?

cn flag
twoLeftFeet

we are looking to perform some automatic tasks when users are added and removed to active directory.

When users are added, we would like to run a python file that would add that user to another service, and email them with their account info (randomly generated password).

When users are removed, we would like to run a different python file and remove them from the 3rd party system.

Are there any ootb solutions for this built into ActiveDirectory? Some sort of trigger when users get added/removed?

26
0 + 0
Swisstone avatar
cn flag
Swisstone
Built into AD? No
0
Reply
cn flag
twoLeftFeet
Okay. that's what I figured. Are there alternatives? I suppose the only alternative I could think of would be some sort of poll process that queries for newly added users and then runs the triggers.
0
Reply
Score:0
avatar Server
cn flag
Greg Askew

Not natively. Assembly line products for account provisioning use hooks into LDAP for firing events based on some criteria. You may not need that, but you could have a scheduled task that queries for user accounts created in the previous nn hours/does not meet criteria and perform an action.

0 + 0
Score:0
avatar Server
us flag
Rob

AFAIK I know Active Directory has no native support for adding hooks to specific events.

Azure AD on the other hand supports "app(lication) provisioning"" using SCIM.

When your application supports SCIM, or you've built a SCIM gateway to connect to your legacy application, you can use the Azure AD Provisioning agent to directly connect with your application and automate provisioning and deprovisioning. If you have legacy applications that don't support SCIM and rely on an LDAP user store or a SQL database, Azure AD can support those as well.

Most organisations seem to introduce "Identity Management" (IdM) aka "Identity & Access Managent" (IAM) solutions to solve the problem of creating and managing identities, accounts (and often roles and passwords) in a large ecosystem of applications and services that are not AD integrated.

There you would integrate workflows for joining, leaving, transfers, but also the requesting, approving and assigning of roles (and frequently password recovery and password changing) with the provisioning and de-provisioning of those in a myriad of different systems.

In other words: you don't create an account in AD and use that to trigger the creation of an account with the same login in a different system. You add a joiner in the IdM/AIM system and that system has a plugin for AD to create an account there and a second plugin will create an account in another related system.

0 + 0
cn flag
twoLeftFeet
Thanks @Rob - that helps a lot.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.