14.4Adding the node to a workflow

To add the node:

1. 1In a workflow, select + and search for SYNERGY Management Gateway.
2. 2Select the node, then select an action, or add the node and choose Resource and Operation yourself.
3. 3In Credential to connect with, choose your SYNERGY Management Gateway API credential.
4. 4Fill in the operation's fields. Most fields accept n8n expressions, so values can come from earlier nodes.

The node's subtitle on the canvas shows the chosen operation and resource, for example "create: user".

Identifying objects

Operations that act on one existing object ask for its ID, for example User ID, Group ID, OU ID or Object ID (on Object > Get By ID the field is simply ID). The ID is the object's objectGUID, written as a GUID such as 3f2504e0-4f89-11d3-9a0c-0305e82c3301. Read operations return it, so you normally take it from an earlier node with an expression such as {{ $json.objectGuid }}.

The node checks every ID before it sends a request. A value that is not a GUID — an empty field, a distinguished name, a value with extra path characters — is refused with a message naming the value, rather than being sent to the gateway. Leading and trailing spaces are trimmed.

Containers (where to create something, where to search from, where to move something) are given as distinguished names, for example OU=Staff,DC=example,DC=com.

Lists and paging

List operations (Get Many, Search by State, the saved-search operations and others) offer:

• Return All — fetch every match, page by page.
• Limit — when Return All is off, the maximum number of results.

Get Many on users, groups, computers, organizational units and generic objects needs a Base DN or Path to search from; the gateway rejects an empty one. Directory searches are rate-limited per client address (by default 60 searches a minute; see Chapter 15), so a workflow that searches once per input item for thousands of items should search once and filter in n8n instead.

Attribute values

Create and update operations on users, groups, computers and organizational units take Active Directory attributes in a field mapper (User Attributes, Group Attributes, Computer Attributes, Attributes). The node loads the attribute list from the gateway's schema for the object type, so you choose attribute names from a list rather than typing them; each name ends in its type, for example [Bool] or [DN[]]. The Object resource is different: there you type each attribute name and value yourself. Values in the field mapper are checked against each attribute's type before anything is sent:

• A Boolean attribute takes true or false.
• A date attribute (generalized time) takes an ISO date string, $now, or Active Directory's own yyyyMMddHHmmss.0Z format. It is converted to UTC for you.
• A multi-valued attribute takes an array, or one value per line. A single line is always one value; it is never split at commas.

The gateway applies its own limits to every write: at most 100 different attributes in one request, at most 1000 values per attribute, and at most 256 KB per value. See Chapter 15 for details.

Account policy

The Create and Update operations of the User and Computer resources have an Account Policy collection that sets the account flags directly, instead of through the userAccountControl attribute: Account Not Delegated, Allow Reversible Password Encryption, Cannot Change Password, Change Password At Logon, Compound Identity Supported, Enabled, Password Never Expires, Password Not Required, Smartcard Logon Required and Trusted For Delegation. On an update, only the flags you add are changed; the others keep their current values.

The gateway refuses userAccountControl and other security-sensitive attributes (such as servicePrincipalName) in the attribute fields. Use Account Policy for the account flags, and the Security resource for SPNs.