13.5 Extending functionality with plug-ins

ID-Synch's plug-in architecture lets you add functionality to modules or HTML on certain pages.

For example, you can add HTML or interactive modules to front-end pages.

You can write your own plug-in programs, use a ready-made plug-in program from M-Tech, or have M-Tech write the program for you.

This section shows you how to enable plug-in points configured through the Web Modules menu. For more detailed information about plug-in points and programs, including

customizing programs, see the full manual shipped with the ID-Synch software. For information about configuring workflow plug-ins, see Workflow plug-ins and mail.

The following table lists the plug-in points and the types of programs that can be used with ID-Synch modules:

Table: ID-Synch plug-in points and programs

Module	Plug-in point	Purpose	Shipped
Front-end	PSF PLUGIN	Display additional HTML or interactive modules to login, authentication, or options pages.	None
Account console	IDA ACCOUNT FILTER PLUGIN	Filter out users, accounts, and templates that administrators are not allowed to manage.	plugin-filter-account-location.exe
	IDA ACCTGROUP FILTER PLUGIN	Filter out account groups that administrators are not allowed to manage.	plugin-filter-nosgroup-location.exe
	IDA TEMPLATE PRESELECT PLUGIN	Automatically select templates for new requests.	None
New request	IDR ACCTGROUP FILTER PLUGIN	Filter out account groups that requesters are not allowed to manage.	plugin-filter-nosgroup-location.exe
	IDR OPERATION FILTER PLUGIN	Restricts operations available to requesters, for security purposes.	idrOperationFilter.psl

To enable a plug-in point:

1. From the Web Modules menu page, click:
   • Front-end to enable the PSF PLUGIN variable.
   • Account console to enable the IDA ACCOUNT FILTER PLUGIN, IDA ACCTGROUP FILTER PLUGIN, or IDA TEMPLATE PRESELECT PLUGIN variable.
   • New request to enable the IDR ACCTGROUP FILTER PLUGIN or IDR OPERATION FILTER PLUGIN variable.

2. In the appropriate section, enable the variable and type the name of the plug-in (for example, plugin-filter-nosgroup-location.exe) in the adjacent field.

   All plug-ins are located in the \<instance name>\cgi-bin\. The file path is not required.

3. Click Update at the bottom of the page.

13.5.1 Filtering accounts or groups available to users

ID-Synch includes plug-in points that allows you to filter:

• Account groups that requesters or console users can view and manage.
• Users, accounts, and templates that console users can view and manage.

The default plug-ins filter by location. You can write customized plug-ins to filter by other criteria. The account plug-in works in this way:

1. A console user logs into the Account management console (nph-ida.exe) using an account created by a template that includes location information.
2. The console user selects Existing user -$>$ Search.
3. The filter plug-in returns only those users, accounts, and templates that include location information that matches that of the console user.

   The filter is bypassed when a console user is assigned all rights (e.g. the ID-Synch administrator).

The account group filter works in a similar way for a requester using the New account request module (nph-idr.exe) to make a request, or a console user using the Account management console (nph-ida.exe).

Note:

The requesters or console users must be created from templates that are matched to actual accounts and include a defined location. Account groups must also have a defined location.

To filter users, accounts, and templates available to console users:

1. Create templates with the location definitions.

2. Use templates to set up users as console users.

3. Enable the IDA ACCOUNT FILTER PLUGIN point for the New account request module (nph-idr.exe) or Account management console (nph-ida.exe), and type the name of the plug-in.

   The default plug-in to filter by location is PLUGIN-FILTER-ACCOUNT-LOCATION.EXE

To filter groups available to users:

1. Set up managed groups with defined location variables.

2. Create templates with the same location definitions.

3. If you are using the Account management console (nph-ida.exe), set up users as console users, with permission to manage groups.

4. If you are using the New account request module (nph-idr.exe), set up users with the templates containing location information.

5. Enable the ACCTGROUP FILTER PLUGIN point for the New account request module (nph-idr.exe) or Account management console (nph-ida.exe), and type the name of the plug-in.

13.5.2 Pre-selecting templates for users

You can simplify new account requests by using a plug-in program to pre-select templates when console users set up a new user. This means that users skip the template selection step when using the Account management console (nph-ida.exe), and do not need to know about templates.

This is useful where there is never a need to choose templates. For example, a staff administrator may need to provision access for new users, where the provisioning request always involves the same set of accounts and targets.

To use this plug-in enable the IDA TEMPLATE PRESELECT PLUGIN point for the Account management console (nph-ida.exe), and type the name of the plug-in.

The plug-in is bypassed if the console user is assigned all rights (superuser).

Contact M-Tech Support for more information about using this plug-in.

13.5.3 Restricting operations allowed for requesters

ID-Synch includes a plug-in point and default plug-in program, IDROPERATIONFILTER.PSL, to control the operations that requesters can perform when using the New account request module (nph-idr.exe).

By default, this plug-in point is enabled, and requesters can perform:

• All operations except enable when they are also the recipient
• Only create operations when another user is the recipient.

The default plug-in script, stored in the \<instance name>\cgi-bin\, is written in the PSLANG scripting language.

You can customize the script to grant requesters additional control, or write a customized script.

Caution:

Granting requesters additional control can weaken security. For example, if users are allowed to perform delete operations, they may be able to delete accounts belonging to other users.