SetFlags Function

A common AD user account provisioning requirement is to set the user account enabled/disabled state based on a corresponding value in an authoritative source, such as the employee status in HR (typically active/inactive).  This is achieved by setting a value in the AD userAccountControl property, otherwise known as simply the UAC.

While the underlying data type of this property is an integer, each of the bit values of which it comprises serves as a flag for one of the various settings described in the linked Microsoft article above.  Being able to correctly set the account status therefore requires understanding of the various integer values that correspond to the set of desired flag values.

Correctly navigating the various combinations of values to be inferred from this value traditionally requires understanding how to use functions (also available in Identity Panel) such as BitAnd() and BitOr() correctly in to not only set a targeted set of flags (in this case the ACCOUNTDISABLE property flag), but also leave the existing flag settings intact.

The SetFlags function provides a convenient and consistent means of not only doing just this, but also doing it in a way that removes a lot of the ambiguity of the intent when subsequently inspecting the configuration, such as in the generated As-Built Document.  This is also enhanced by utilizing the set of built-in AD constants within the Identity Panel Rule Engine

Example Scenarios

• Setting the UAC value to enabled or disabled, based on the user’s employee status.
• Setting the password to not required for a gMSA
• Ensuring that the password cannot be changed by the user themselves

Where can it be used?

As with any function this can be used extensively throughout Identity Panel wherever the Rule Engine is invoked.  A good indicator of this is to look for the presence of a (?) button in the top right corner of a text box.

Examples include (but are not limited to) the following:

• HyperSync - Attribute Flow, Stateful Sync and various Filter rules
• Test Panel – Fixtures
• Environment Settings - Custom Rule Functions
• Reports

How the function works

The following list describes how the function works, and the steps it goes through.

1. Function is invoked.
2. Function initializes the returned value as the current (base) integer value representing all current flag values.
3. For each rule in rules[]
   1. Calculate the boolean condition value from the rule expression in the iteration
   2. set the specified bit value ON/OFF according to the boolean condition of true/false respectively
4. Function returns the integer value representing the original flag values with only the specified flags changed (if not already set) for each of the supplied rules[].

Q&A

None

Pre-Requisites

None

Using the Function

Built In Documentation

SetFlags(value, rules[])
Sets/clears flags in a number. First parameter is current/base value, followed by pairs of parameters in format: bool, flag eg.

SetFlags(AD.userAccountControl, Not(IsActive(...)), special.AD.ACCOUNTDISABLE)

Deploying

Parameters

value

The existing integer value, e.g. AD.userAccountControl property from an Active Directory silo (with the alias "AD") referenced in a HyperSync Panel synchronization rule.  While you could also use HV.userAccountControl instead (if defined in the Hyperverse), ensuring that you pass the current value of the attribute to which you are writing is often the most reliable way to implement this function.

rules[]

A list of rule expression "pairs", each comprising both

• a boolean condition (e.g. evaluates to true for an account which must be enabled)
• a corresponding flag value to apply when the condition evaluates to true (e.g. special.AD.ACCOUNTDISABLE)

Special Variables

None

Returned Value

An integer value which corresponds to the aggregate of

• the existing "untouched" flag values
• the derived flag values each represented by exactly one of the specified rules[] pairs