EmpowerID includes a number of CRUD (create, read, update, delete) workflows for manipulating directory objects via the EmpowerID Virtual Directory. These workflows include the following.
|Workflow||What it does in an EmpowerID connected directory|
|Creates a new user account object|
|LDAPCreateOU||Creates a new OU container|
|LDAPCreateGroup||Creates a new group object|
|LDAPUpdateAccount||Updates an account object|
|LDAPUpdateOU||Updates an OU container|
|LDAPUpdateGroup||Updates a group object|
|LDAPDeleteAccount||Deletes a user account object|
|LDAPDeleteOU||Deletes an OU container|
|LDAPDeleteGroup||Deletes a group|
In this topic, we demonstrate how to create new directory objects by creating a new AD user account from the EmpowerID Virtual Directory.
As with all EmpowerID workflows, the LDAP workflows associated with the EmpowerID LDAP Server are RBAC-trimmed. Users must have the Initiator Access Level for each workflow to initiate that workflow, as well as a Access Level with any necessary operations allowed to execute the workflow without requiring further approval.
If a user initiates one of the LDAP workflows but does not have the needed delegations to perform the task in that workflow (such as creating a new user account), the EmpowerID LDAP Server will display to that user a message indicating that the request failed and then route the request to a delegated approver via email.
The approver can then choose to approve or deny the request. If the approver approves it, the workflow resumes and the user account (in this case) is created. If the approver rejects it, the workflow terminates and the user account is not created. In either case, EmpowerID routes the results of the request to the request initiator via email.
Depending on the tool you use for managing directory objects, the steps depicted below may differ for you.