Control types

Two categories of controls are available:

• Basic

• Advanced.

Basic controls are comparable to simple HTML inputs, such as checkboxes.

Advanced controls are more like mini-applications with specific goals. For example, they could display a list of Entra-ID users or groups as the first step in a Flow.

Both types are implemented on the front-end using react-jsonschema-form.

Structure of control configuration

All controls follow the same structure:

{
    "type": "<controlType>",
    "id": "<controlId>",
    "config": {
        "required": true,
        "read_only": false
    },
    "data": "<data>",
    "ui": {},
    "schema": {}
}

type: Defines what control to be used.

id: Unique identifier to the current flow. In subsequent pipe calls the id is sent to the pipe along with value(s) from the control and accessed in the piped using {{request.<id>}}

config: Block of control-specific configuration. Se each control for appropriate values.

data: Value to be injected in control.

ui: Any additional ui-related data sent to frontend, unfiltered. See https://rjsf-team.github.io/react-jsonschema-form/ UISchema for more information. Typically this is used for layout management.

schema: Any additional control-related data not available in current control implementation.

Binding data to a control

Data binding is typically done using "data" configuration for a control. Most likely date is set by using some template {{flow.givenName}}.

Below is a screenshot of the control. This is from a create step where an admin has added Clarke and Kent in two input controls. Email and Mobile number has no value yet.

Scenarions when the control can be used:

• Like above when an admin creates a new object and needs to add data about the object. You can add data controllers to an inout control to verify correct syntax, an @ for email adress, no characters for an mobile number.

• You like to display data about an object. You search an LDAP directory and display a user with data about the user. The input control can be in edit or read-only mode.

Add one or several labels and/or descriptions text elements to a step. Example below shows a markdowns example, one label and one description.

The example can be added as one markdown or two separate markdowns.

Configuration when one markdown

{
   "id": "top_text_label_description",
   "type": "Markdown",
   "data": "# Create an Active Directory user  \nEnter information about the user you want to create."
}

Configuration when one markdown

Note. When using several markdowns in one step, make sure the id is unique.

{
   "id": "top_text_label",
   "type": "Markdown",
   "data": "# Create an Active Directory user"
},
{
   "id": "top_text_description",
   "type": "Markdown",
   "data": "Enter information about the user you want to create."
}

Link to basic syntax supported using Markdown

Click following link for a number of examples on how to use markdown in a step. https://www.markdownguide.org/cheat-sheet/

The ValuePicker is often used as a drop-down list for admins to select predefined values from. See example below.

Special notes for config.type and schema.format properties

The 'config.type' determines how the control is displayed in the view.

For the type 'string' the field can be validated before it is sent to the pipe or next step. The 'strict' validation is recommended as it blocks several common special characters not suitable for Pipe/Valve data handling. Postal is post address.

Configuration

Link to basic syntax supported using Markdown

Click following link for a number of examples on how to use markdown in a step.

Configuration

Searching for object to show

To populate list of items in UI a pipe must be executed. List of items returned should at least contain properties defined in columns.

Data sent to pipe is:

• search - containing user input if config -> search is set to true

• columns - comma separated string of defined columns

Return data must be in a form of a list of items.

Data exposed to flow

When pressing Select, data exposed to flow is found using key if control id. Value is item id returned from pipe

Use this control to manage groups for a selected user. Note. To select the user, which often is done in a previous step, use the control Selector.

Configuration

{
  "id": "<enter_unique_id_for_this_control>",
  "type": "ActiveDirectorySingleSelect",
  "config": {
    "attributes": [
      "displayName",
      "sAMAccountName"
    ],
    "base_dn": "OU=Product_Testing,DC=company,DC=local",
    "scope": "SUB",
    "pre_filter": "(distinguishedName={{flow.manager}})",
    "filter": "(&(|(givenName={{search_query}})(sn={{search_query}}))(!(sAMAccountName={{flow.selectedUser}})))",
    "display_key": "cn",
    "value_key": "distinguishedName"
 }
}

Search filter

The search filter is a template that has access to all data that is available in the flow. Additionally, the template can use the parameter search_query, that contains the user input.

The attributes defined by display_key and value_key are always queried.

Requirements

An LdapClient module deployed with matching name as defined in "namespace".

Configuration

  {
    "id": "<enter_unique_id_for_this_control>",
    "type": "ActiveDirectoryGroupEditGroupMember",
    "config": {
        "namespace": "ldap_client_1",
        "base_dn": "DC=company,DC=local",
        "scope": "SUB",
        "current_filter": "memberOf={{{flow.findMyActiveDirectoryGroups}}}",
        "available_filter": "(&(|(objectClass=user)(objectClass=group))(!(memberOf={{{flow.findMyActiveDirectoryGroups}}})))",
        "columns": [
            "displayName",
            "mail",
            "sAMAccountName",
            "mobile"
        ]
    }
}

Exposed data to flow

Object array, "ad_pending_remove" - contains data on what members to remove from group.

Object array, "ad_pending_add" - contains data on what members to add to group.

Example data in finalize pipe:

...
"ad_pending_add" : [ 
    { 
        "id" : "CN=Felix Andreasson,OU=Demo,DC=company,DC=local", 
        "displayName" : "Felix Andreasson" 
    }, 
    { 
        "id" : "CN=Eva Ek,OU=Demo,DC=company,DC=local", 
        "displayName" : "Eva Ek" 
    } 
],
"ad_pending_remove" : [ 
    { 
        "id" : "CN=Lance Armsson,OU=Demo,DC=company,DC=local", 
        "displayName" : "Lance Armsson" 
    }, 
    { 
        "id" : "CN=Britt Thomasson,OU=Demo,DC=company,DC=local", 
        "displayName" : "Britt Thomasson" 
    } 
]
...

Valves used in finalize pipe

ActiveDirectoryAddGroupToMembers

Used to add group members to a specified group

ActiveDirectoryRemoveGroupFromMembers

Used to remove group members from a specified group

Below is a screenshot of the control. This is from a create step where an admin like to choose a manager for a user to be created.

Use this control to manage group members for a selected groups. Note. To select the group, which often is done in a previous step, use the control Selector.

Configuration

Use this control to manage users for a selected group. Note. To select the user, which often is done in a previous step, use the control EntraGroupSelect.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

An Entra ID identifier, "selected_entra_id", located in either session or flow. Data is taken from session first and flow second. selected_entra_id must reference a Entra ID group.

Use this control to find and selected a Microsoft Entra ID group. Note. When group is selected you might like to mange members for the group. Use the control EntraGroupEditGroupMember.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

User mapping

For an order to be displayed in the list selection is made base on user login subject. Most likely the SAML NameID attribute from SP login.

The configuration is divided in two blocks, config & ui where config parameters are marked as config.<parameter name> and ui parameters are marked as ui.<parameter name>.

See the Example tab for a full example.

Only showing groups by end user

Set owned_groups_only_attribute will cause control match the data from owned_groups_only_attribute. Matching is done using data from owned_groups_only_attribute and entra_identifier.

entra_identifier is read from session or flow. Session read first then flow.

Settings "owned_groups_only_attribute":"owner", will match value from entra_identifier with id in "owner". Only showing groups where user is set to owner.

Exposed data to flow

"selected_entra_id" - id of selected group

"selected_entra_displayName" - display name of selected group.

Exposed data to flow

Object array, "entra_pending_remove" - contains data on what groups to remove from user.

Object array, "entra_pending_add" - contains data on what groups add to user.

Array data will ha the syntax:

[{"id":"1234567","displayName":"Group 1"}]

Use this control to manage groups for a selected user. Note. To select the user, which often is done in a previous step, use the control EntraUserSelect.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

An Entra ID identifier, "selected_entra_id", located in either session or flow. Data is taken from session first and flow second. selected_entra_id must reference a Entra ID user.

The configuration is divided in two blocks, config & ui where config parameters are marked as config.<parameter name> and ui parameters are marked as ui.<parameter name>.

See the Example tab for a full example.

Exposed data to flow

Object array, "entra_pending_remove" - contains data on what groups to remove from user.

Object array, "entra_pending_add" - contains data on what groups add to user.

Array data will ha the syntax:

[{"id":"1234567","displayName":"Group 1"}]

The configuration is divided in two blocks, config & ui where config parameters are marked as config.<parameter name> and ui parameters are marked as ui.<parameter name>.

See the Example tab for a full example.

Only showing used by end user

Set owned_users_only_attribute will cause control match the data from owned_users_only_attribute. Matching is done using data from owned_users_only_attribute and entra_identifier.

entra_identifier is read from session or flow. Session read first then flow.

Settings "owned_users_only_attribute":"manager", will match value from entra_identifier with id in "manager". Only showing users where user is set to owner.

Exposed data to flow

"selected_entra_id" - id of selected group

"selected_entra_displayName" - display name of selected group.

Use this control to find and selected a Microsoft Entra ID user. Note. When user is selected you might like to manage groups for the user. Use the control EntraUserEditUserMember.

Requirements

An Entra ID module deployed with matching name as defined in "namespace".

Requirements

An LdapClient module deployed with matching name as defined in "namespace".

Configuration

{
    "id": "<enter_unique_id_for_this_control>",
    "type": "ActiveDirectoryUserEditGroupMember",
    "config": {
        "namespace": "ldap_client_1",
        "base_dn": "DC=company,DC=local",
        "current_filter": "(&(objectClass=group)(member={{{flow.findMyActiveDirectoryUsers}}}))",
        "available_filter": "(&(objectClass=group)(!(member={{{flow.findMyActiveDirectoryUsers}}})))",
        "columns": [
            "cn",
            "sAMAccountName"
        ]
    }
}

Exposed data to flow

Object array, "ad_pending_remove" - contains data on what groups to remove from user.

Object array, "ad_pending_add" - contains data on what groups to add to user.

Array data will have the syntax:

"ad_pending_add": [
    {
        "id": "CN=AWS administrator,OU=access_review,OU=Governance,OU=IdM_demo,OU=Product_Testing,DC=company,DC=local",
        "description": "Test",
        "cn": "AWS administrator",
        "sAMAccountName": "AWS administrator"
    },
    {
        "id": "CN=Cert Publishers,CN=Users,DC=company,DC=local",
        "description": "Members of this group are permitted to publish certificates to the directory",
        "cn": "Cert Publishers",
        "sAMAccountName": "Cert Publishers"
    }
],
"ad_pending_remove": [
    {
        "id": "CN=Access Control Assistance Operators,CN=Builtin,DC=company,DC=local",
        "cn": "Access Control Assistance Operators",
        "sAMAccountName": "Access Control Assistance Operators",
        "description": "Members of this group can remotely query authorization attributes and permissions for resources on this computer."
    }
]

Valves used in finalize pipe

ActiveDirectoryAddMemberToGroups

Used to add a single group member to groups

ActiveDirectoryRemoveMemberFromGroups

Used to remove a single group member from groups