This article applies to:

• WebMarshal 7.6 and above
• Imported user groups

Question:

• How do I apply user group updates to WebMarshal policy immediately?

Background

WebMarshal can apply policy based on user group membership. Changes in effective policy require the user sessions to be dropped and re-started. This normally require a manual configuration commit.

Customers may want to apply changes in policy automatically based on changes in retrieved connector groups.

New settings in WebMarshal 7.6 and above allow this functionality.

Procedure:

To configure the functionality, changes are required in Array Manager configuration.

Array Manager:

Add the following line in WMArrayMgr.config.xml:

<AdvancedSettings clearSessionsUserGroupFilter="group list" />

Where the group list is a semicolon separated list of the groups to monitor for changes. When changes are detected in a monitored group, the user sessions are dropped and re-started. 

Note: Do not remove or edit any other lines in the file. If an AdvancedSettings line exists already, add the attribute to the existing line.

The group name is as found in the properties of the group in the WebMarshal console. The format is:

• NT connector example: myserver\testgroup
• AD connector example: CN=policygroup,DC=testdomain,DC=example,DC=com 

For example:

<WebMarshal> 
  <ArrayManager>
     <Config> 
        <AdvancedSettings clearSessionUserGroupFilter="group1;group2;" [other attributes..] />     </Config>
  </ArrayManager>
</WebMarshal>