How to configure a single service to add users to a user group in their own domain
Summary
This approach allows a single Activate service to work across two or more domains, while ensuring the requested user is added to the correct Active Directory group in their own domain.
It is useful when:
- users from multiple domains can access Activate
- a service can be ordered for the requester or another user
- the target user may exist in the same domain or a different domain
- each domain requires membership in a different AD group
Scenario
Users in two or more domains can order user group-based services through Activate.
When the service request is approved, Activate should add the target user to an AD group in that user’s domain.
A user in either domain can order the service for:
- themselves
- another user in the same domain
- a user in a different domain
High-level approach
To support this configuration:
- create a separate delivery method for each target domain
- secure each delivery method so only the relevant users can access it
- configure the service to use all relevant delivery methods
- add service parameters that define the correct group for each domain
How it works
When Activate provisions the service instance, it will:
- Read the AvailableDeliveryMethods parameter on the service
- Identify which delivery method resources the target user can access
- Read the UserGroupName parameter from the applicable delivery method
- Look for a service parameter with that name
- Add the user to the group defined in that parameter
If no matching group parameter exists for the target user’s domain, Activate will not add the user to a group. The job will not error.
Configuration steps
1. Create a delivery method for each domain
Under //Resources/Services/Delivery Methods, create a new Delivery Method resource for each domain the target users belong to.
2. Secure each delivery method
Apply security so that only:
- Administrators
- users from the applicable domain
can access that delivery method resource.
This ensures the correct delivery method is available based on the target user’s domain.
3. Configure the UserGroupName parameter on each delivery method
On each delivery method, set a string parameter named UserGroupName.
This parameter should contain the name of the service parameter that Activate will look for when determining which group to use.
4. Update the service delivery methods
On the service, configure AvailableDeliveryMethods to include:
- both of the new domain-specific delivery methods
- the existing user-based delivery method
For example, if the service is also used for Azure users, keep the existing user-based delivery method enabled unless you are certain it is no longer required.
5. Add group reference parameters to the service
On the service, create a GroupReference parameter for each domain that requires its own group.
The parameter names must match the values defined in the UserGroupName parameter on the relevant delivery methods.
Example logic
A service might include:
- one delivery method for Domain A
- one delivery method for Domain B
- one existing standard user delivery method
Each domain-specific delivery method would define a different UserGroupName value, such as:
DomainAGroup DomainBGroup
The service would then contain matching parameters such as:
DomainAGroup = CN=Service_Group_A,OU=Groups,DC=domaina,DC=local DomainBGroup = CN=Service_Group_B,OU=Groups,DC=domainb,DC=local
When the service is provisioned, Activate uses the target user’s accessible delivery method to determine which parameter to read, then adds the user to the corresponding group.
Important behaviour
- The target user’s domain determines which delivery method is used
- The delivery method determines which service parameter Activate reads
- The service parameter determines which group the user is added to
- If the expected group parameter does not exist, the job does not fail
Because of this, service security should be configured carefully to avoid unexpected outcomes where a user can order a service but no group assignment occurs.
Configuration guidance
Use security on both:
- the delivery method resources
- the service itself
to ensure only valid combinations of users, services, and target domains are available.