adobe-apiplatform / user-sync.py

Application for synchronizing Adobe customer directories via the User Management API
https://adobe-apiplatform.github.io/user-sync.py/en/user-manual/
MIT License
87 stars 67 forks source link

Product Admin groups when multiple Login Companies within an IMS Org #806

Closed optumgadell closed 1 year ago

optumgadell commented 1 year ago

Our organization has two Analytics Login Companies with the same IMS Org. This results in two identically named groups with different groupIds (which can be found by dumping all of the groups with Postman connecting to UMAPI:

{ "groupId": 8466089, "groupName": "_product_admin_Adobe Analytics", "type": "PRODUCT_ADMIN_GROUP", "memberCount": 50, "productName": "Adobe Analytics" }

{ "groupId": 34878106, "groupName": "_product_admin_Adobe Analytics", "type": "PRODUCT_ADMIN_GROUP", "memberCount": 12, "productName": "Adobe Analytics" }

UMAPI will return the correct user list if I pass it the groupId (instead of name), like: https://{{UMAPI_ENDPOINT}}/v2/usermanagement/users/{{UMAPI_IMS_ORG}}/{{UMAPI_PAGE}}/34878106

However there doesn't seem to be a way to specify which group to target within UST. If I try to use the groupId, UST interprets it as a groupName.

Anyone encounter this or have a way to resolve?

adorton-adobe commented 1 year ago

Hello - my understanding as the UST maintainer is that UMAPI groups should be unique. Though given the situation you describe I can see how you can end up with duplicate group names. I'm not sure why identical product names would be permitted. Could be an unanticipated edge case.

In any event, this unfortunately is outside the scope of the User Sync Tool so I'll have to close the issue. The reason the UST only maps groups by name is because that is what the User Management API permits us to do. It doesn't support group assignment by ID or else the UST would support it. I imagine if you were to assign groups to users directly in the UMAPI you'd run into some kind of ambiguous situation because it wouldn't be clear which group you're assigning when you assign _product_admin_Adobe Analytics.

I recommend opening a ticket here - https://github.com/adobe-apiplatform/umapi-documentation/

You can provide the same information. I also recommend providing your Org ID.