Page Comparison

...

PFA will allow department administrators to use Active Directory attributes to apply permissions to objects. Initial implementation is focused on 

Parameters

1. Define <report-attribute> for results
   • utexasEduAustinMultiX
   Define <action-attribute> for query
   • utexasEduAustinBool1
2. Define <permission-attribute> for query
   • utexasEduAustinSingle1utexasEduAustinSingle11
   • Value must be one of the existing Delegation values
3. Define <target<targets-attribute> for query
   
   • managedBy
   • Target of delegationutexasEduAustinMulti11
   • Values must be DN of a group object
4. Define <reports-attribute> for results
   • utexasEduAustinMulti12
5. Define <object-class> for query
   • organizationalUnit
6. Define <container> as search base for query
   • OU=Departments,<domainDnsRoot>

...

1. Query for <object-class> in <container> where:
   1. <action-attribute> is true
   2. <permission-attribute> has a value
   3. <target<targets-attribute> has a value
2. For each object found in previous step...
   
   1. Grant <permission-attribute> delegation to <targeton object to each principal in <targets-attribute> principal
   2. Write <reportUpdate <reports-attribute> with "<timestamp>;<add/remove>;<delegation>;<managedBy>"
   3. Clear <action-attribute> and , <permission-attribute>, <targets-attribute>
3. Create scheduled task on ADFS servers to perform query every hour
   1. Run as dedicated GMSA
      1. All permissions actions taken by known account
      2. Password of account managed by domain
   2. Leverage HostCheck
      1. Avoid duplication of work

...