Grouper Adobe provisioner
Initial release was in v4.16.0. However you are always encouraged to use the most recent "LATEST STABLE" release.
Adobe has strict rate limiting so you should set thread count to be 1
In the external system set sleep seconds to 6000 (since max 10 calls per minute per client)
Advice
User userName as an entity attribute
Case insensitive compare on username and email
Do not provision if null (username and email)
Do not update (in CRUD) (username)
Username is EPPN in FederatedID log in
Search attribute is email
Match attributes are: userName, ID, email
Links
(Log in) https://adminconsole.adobe.com/
(Docs) https://adobe-apiplatform.github.io/umapi-documentation/en/
External system
Use an Oauth Web service external system for Adobe
Config | Example | Description |
|---|---|---|
Config id | adobe would be in config key: grouper.wsBearerToken.adobe.scopes | Used in configuration file grouper-loader.properties |
Authentication type | oauthClientCredentials | Bearer token: just an Authentication header with a value (token can have a prefix, e.g. Bearer: ) Basic auth: Authentication header with basic auth standard |
Token URL | URL for authorization to get a token | |
Service URL | URL for the services | |
Client id | sdf6786sdaf876 | Oauth client id for token URL |
Client secret | sdf79asdf897as | Oauth client secret for token URL |
Grant type | client_credentials | Oauth strategy |
Scopes | openid,AdobeID,user_management_sdk | Oauth scopes |
API key header name | x-api-key | Adobe key |
API key password | fd76asdf876 | Adobe key |
Proxy URL | If you are using a proxy server (not reverse proxy), enter that URL | |
Proxy type | PROXY_HTTP, PROXY_SOCKS5 | Proxy protocol |
Enabled | true | false | If this is enabled and can be used |
Test URL suffix | /groups/5DE01@AdobeOrg/0 | Gets the first page of groups, put your org ID in there |
Test HTTP method | GET | HTTP method for test call |
Test HTTP response code | 200 | Response code expected |
Test response body regex | .*adminGroupName.* | Run this regex on the response to see if it is valid |
Provisioning general
Input the Org ID and optionally the user type on create.
Provisioning type is membershipObjects
Provisioning groups
User groups vs product profiles (licenses): In Adobe, a license is granted by membership in a product profile (also called a product configuration), not by a plain user group. This provisioner can target either one -- the "Group name in Adobe" group metadata (the group name attribute) can be a user group or a product profile. To have Grouper drive license assignment directly, point the group at the product profile name. That keeps Grouper authoritative for licensing, so assignments are not made by hand in the Adobe Admin Console. Support admins can also be provisioned (as a role); the high-level system and org admins cannot be externalized in Adobe, so those are the only thing this provisioner does not manage.
You can search by name or id. You should cache the name and id.
API documentation
Grouper name | Type | Required? | Adobe API | Description |
|---|---|---|---|---|
id | String | required | groupId | This is the id read from Adobe. Select only. This should not be translated from Grouper, and the target attribute should be cached. Note: this is a number in JSON but it is a String type in the provisioner |
name | String | required | name | This is the name of the group on the Adobe side. |
Provisioning users
You can search by email only. You should cache the email and id.
API documentation
Grouper name | Type | Required? | Adobe API | Description |
|---|---|---|---|---|
id | String | required | groupId | This is the id read from Adobe. Select only. This should not be translated from Grouper, and the target attribute should be cached. |
String | required | name | Email which will be the username too | |
firstname | String | required usually | firstname | |
lastname | String | required usually | lastname | |
country | String | required usually | country | e.g. US. You can hard code if you want in the provisioner translation |
emailsForLookup | String | no | N/A | If email does not match userName, this can be multi-valued, or single-valued comma separated, and will look up the user based on those emails (and will use the email attribute too) |
Deprovisioning
When Grouper deletes a user in the target, the provisioner always calls Adobe's removeFromOrg action. The optional deleteAccountWhenDeleteUser config (boolean, default false) sets the deleteAccount flag on that call. When false, the user is only removed from the Adobe org and the underlying Adobe account is left intact; when true, the account itself is also deleted (only meaningful for org-owned identity types such as Enterprise ID / Federated ID). It is a single global flag, so it applies to every deleted user regardless of identity type. It appears in the config UI only when "Delete entities" is enabled.
Loading
You can load groups, users and memberships from the target.
You need to Select all groups and users from target on full sync. And load entities
You will see users, groups, and memberships in the database. You can report on them, load then into groups (once or ongoing), etc
Sample config
Carefully review these settings if you are making a similar provisioner