Is there a way to associate my local enterprise identity management system with Apigee identity management so when I delete a user in my local IDM a corresponding Apigee Organization user in Apigee will also be deleted?

[sarthak · Accepted solution]

@TIM

@Tim Mickol yes you should be able to do that using Edge's management APIs. Learn more about global user roles here: http://docs.apigee.com/api-services/content/about-global-users and APIs to manage them here: http://docs.apigee.com/api-services/content/creating-global-users.

If a user is removed in your local IDM you can just remove the user from the org and not delete the user globally. Just by removing access to the org I think you will be able to achieve your desired outcome. Specifically this api: http://docs.apigee.com/management/apis/delete/organizations/%7Borg_name%7D/userroles/%7Brole_name%7D...

[#2]

@sarthakThe management APIs were the first place I looked but I did not find anything - methinks global user management API is only exposed if you are Edge for Private Cloud customer which we are not. From the global user administration doc: "Performing additional tasks to manage users; Many of these operations, such as deleting a global user, require system administrator privileges. For a Cloud-based installation of Edge, contact Apigee Support to perform these actions. For an Edge for Private Cloud installation, the system administrator can perform them."

[sarthak]

I updated the answer. Let me know if this makes sense @Tim Mickol

[#4]

@sarthak that last did the trick nicely :). 1) I created a new user with orgadmin role 2)validated the new user by logging in 3) used curl to execute the DELETE command you identified for me 4) validated that user was deleted. Thanks. Now I just have to write a little Java program that I can have triggered to be parameterized and executed by my enterprise IDM whenever a user with a correlated Apigee account is disabled or deleted locally to delete the correlated Apigee account. Thanks!

[sarthak]

Great to hear.

You can write that logic in node -> deploy in Apigee -> expose that as API and make your local code just call that API? Might even be easier. Just a thought.

[#6]

This is just my fast, dirty and ugly architects spike 😉 I'll hand it off to a genuine developer when it has to be done properly 🙂