Handling non existing external groups

[AmuthesanS]

I have a use case where I have external group as members for groups managed in the AC group_config. These external groups are optional and it may not be available in the environments. When AC group_config configuration is applied with members value pointing to external user that is non-existing then the tool stops processing AC with exception. Is there an option to suppress the exception and continue applying rest of the AC schema or have a condition that could check the availability of group in system?

[kwin]

This is already possible with https://github.com/Netcentric/accesscontroltool/blob/develop/docs/AdvancedFeatures.md#configure-memberships-oftowards-externally-managed-groups

[blair-robertson]

Hi

I was trying this using the defaultUnmanagedExternalMembersRegex and defaultUnmanagedExternalIsMemberOfRegex and I was still getting the exceptions.

My use case is to add IMS groups as members of AEM groups created by ACTool. There are 2 cases when the IMS groups will not exist in AEM:

• Local AEM - groups just don't exist
• AEMaaCS - no user assigned to these groups has logged into AEM yet.

We cannot have ACTool create these IMS groups in AEM because they will then be missing the rep:externalId with its link to the ims auth handler.

With this configuration:

- group_config:
  - Websites-admin:
    - members: IMS-AEM-Websites-admin

And with defaultUnmanagedExternalMembersRegex: IMS-AEM-.* I get the error

Group 'Websites-admin' references external group group or user 'IMS-AEM-Websites-admin' via members but relationships to this external group is explicitly unmanged by regex IMS-AEM-.*

With defaultUnmanagedExternalIsMemberOfRegex: IMS-AEM-.* I get the error

Member IMS-AEM-Websites-admin does not exist and cannot be added as external member to group Websites-admin

For the moment we will manually add the IMS groups as members of groups created by ACTool in each AEMaaCS environment (using defaultUnmanagedExternalMembersRegex: IMS-AEM-.* so they are not removed by ACTool), but it would be nice to be able to automate this.

Thanks in advance