Description:

This step retrieves the Active Directory group memberships of an existing user.

The Get Active Directory User Groups workflow step connects to Microsoft Active Directory through a configured LDAP connection and retrieves all security and distribution groups associated with the specified user account.

The step identifies the user by the specified username and stores the retrieved list of group memberships in a FlowWright Variable or Global Variable. The stored values can then be consumed by subsequent workflow steps for validation, reporting, synchronization, or business logic.

The step supports:

• Active Directory user group membership lookup
• Configurable LDAP connections
• Dynamic username input using workflow variables
• Storage of retrieved group memberships into workflow variables
• Integration with Microsoft Active Directory

This step can be used for:

• Access reviews
• User entitlement validation
• Security auditing
• Identity lifecycle management
• User migration
• Synchronization with external systems
• Business process automation

Usage:

The Get Active Directory User Groups step is typically placed before authorization, synchronization, or auditing operations within a workflow.

The workflow connects to the configured Active Directory server using the selected LDAP connection.

If the specified user exists, FlowWright retrieves all group memberships associated with the user account and stores the results in the configured output variable.

Once the user groups have been retrieved, later workflow steps can:

• Validate user authorization
• Compare group memberships
• Synchronize identity systems
• Generate audit reports
• Provision downstream applications
• Route workflow decisions based on group membership
• Continue identity lifecycle management processes

You need to set up an LDAP connection before using this step.

Go to:

Integration → Connections → Generic Connections

On the Manage Generic Connections page, click:

Actions → Create

Configure an Active Directory connection before using this workflow step.

A sample connection is provided here for reference. 

Example:

Let’s build and execute the “clsGetADUserGroupsDef” example:

• Create a new process definition named “clsGetADUserGroupsDef” and open it in designer mode. 
• Drag an “clsGetADUserGroups” step to the canvas.
• Connect the dots between the “Start” and “clsGetADUserGroups” steps.
• Configure a variable or global to store the list.
• Click the "clsGetADUserGroups" step to configure its "Required" properties. Provide a name for the step. Select the LDAP connection from the drop-down list. Provide the Active Directory “User name”. Provide the variable or global reference to store the group list. Click the Save button to confirm. Note: Click the "AI Predict" button to have the Copilot add new process steps that match your process description. 

• The “Logging” configuration is necessary for documentation and also measures workflow progress and percent complete. This is achieved by configuring the step state and percent fields individually, as shown in the images below. Configure the “Logging” using the following properties.

• Save the Process Definition. Create a new Process Instance and execute it. When the workflow reaches the Get User Groups step, FlowWright connects to the configured Active Directory server using the selected LDAP connection and searches for the specified user account. If the user is found, the workflow retrieves all associated Active Directory group memberships and stores them in the configured output variable. The workflow then follows the True return path. If the user cannot be found, the LDAP query fails, or the directory connection cannot be established, the workflow follows the False return path.

• Click the process step to view its properties. The step should retrieve the Active Directory user's group memberships and return True upon successful completion. You can inspect the configured workflow variable to verify that the returned group list has been populated.

Tips:

• Verify that the LDAP connection has been configured before using this step.
• Use workflow variables to dynamically provide the username.
• Ensure that the specified user exists before retrieving group memberships.
• Configure an output variable to store multiple returned values.
• Use the retrieved group list for authorization, approval routing, or reporting.
• Use the True and False return paths to implement appropriate success and error handling.
• Combine this step with Read Active Directory User, Get Group Members, Add Users to Group, or Remove Users from Group steps to automate complete Active Directory identity management workflows.

Notes:

• A valid LDAP connection must exist before this step can execute.
• The configured LDAP account must have sufficient permissions to read Active Directory user objects and group memberships.
• The specified user account must already exist in Active Directory.
• The retrieved group list reflects the user's current Active Directory memberships at the time the workflow executes.
• Network connectivity or authentication issues may prevent successful retrieval.
• The workflow should include appropriate error handling for the False return path.
• The retrieved groups are stored in the configured workflow Variable or Global Variable for use by subsequent workflow steps.

Definition Sample:

You may download the sample definition(s) from the link provided and later import them (drag-and-drop) into your FlowWright Process Definition (XML file) or Form Definition (HTML file) page.

Note: Verify and complete any missing configuration after importing the sample, including:

• LDAP connection
• Username mapping
• Output variable mapping
• Workflow variable mappings
• Active Directory permissions
• Environment-specific settings

After verifying the configuration, save the Process Definition before execution.

Click here to download the sample file.