Skip to main content

Dynamic User Group

The DynamicUserGroup service manages dynamic user group objects in Strata Cloud Manager, enabling user-based policies and filtering through tag-based membership expressions.

Class Overview​

The DynamicUserGroup class provides CRUD operations for dynamic user group objects. It is accessed through the client.dynamic_user_group attribute on an initialized Scm instance.

from scm.client import Scm

client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

# Access the DynamicUserGroup service
dugs = client.dynamic_user_group

Key Attributes​

AttributeTypeRequiredDescription
namestrYesName of dynamic user group (max 63 chars)
idUUIDYes*Unique identifier (*response only)
filterstrYesFilter expression for matching users (max 2047 chars)
descriptionstrNoObject description (max 1023 chars)
tagList[str]NoList of tags (each max 127 chars)
folderstrYes**Folder location (**one container required)
snippetstrYes**Snippet location (**one container required)
devicestrYes**Device location (**one container required)

* Exactly one of folder, snippet, or device is required.

Methods​

List Dynamic User Groups​

Retrieves a list of dynamic user group objects with optional filtering.

dugs = client.dynamic_user_group.list(
    folder="Texas",
    tags=["Automation"]
)

for dug in dugs:
    print(f"Name: {dug.name}, Filter: {dug.filter}")

Fetch a Dynamic User Group​

Retrieves a single dynamic user group by name and container.

dug = client.dynamic_user_group.fetch(
    name="high_risk_users",
    folder="Texas"
)
print(f"Found group: {dug.name}")

Create a Dynamic User Group​

Creates a new dynamic user group object.

new_dug = client.dynamic_user_group.create({
    "name": "high_risk_users",
    "filter": "tag.criticality.high",
    "description": "Users with high risk classification",
    "folder": "Texas",
    "tag": ["RiskManagement", "Automation"]
})

Update a Dynamic User Group​

Updates an existing dynamic user group.

existing = client.dynamic_user_group.fetch(
    name="high_risk_users",
    folder="Texas"
)
existing.filter = "tag.criticality.high or tag.risk_score.gt.80"
existing.description = "Users with high risk assessment score"

updated = client.dynamic_user_group.update(existing)

Delete a Dynamic User Group​

Deletes a dynamic user group by ID.

client.dynamic_user_group.delete("123e4567-e89b-12d3-a456-426655440000")

Use Cases​

Role-Based User Groups​

Create dynamic groups for different organizational roles.

from scm.client import Scm

client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

# High-risk users
client.dynamic_user_group.create({
    "name": "high_risk_users",
    "filter": "tag.criticality.high",
    "folder": "Texas",
    "description": "Users with high risk classification",
    "tag": ["RiskManagement"]
})

# External contractors
client.dynamic_user_group.create({
    "name": "external_contractors",
    "filter": "tag.user_type.contractor",
    "folder": "Texas",
    "description": "All external contractor accounts"
})

Filtering Dynamic User Groups​

Use advanced filtering to narrow results.

# Exact match with exclusions
filtered = client.dynamic_user_group.list(
    folder="Texas",
    exact_match=True,
    exclude_folders=["All"],
    exclude_snippets=["default"],
    exclude_devices=["DeviceA"]
)

for dug in filtered:
    print(f"Group: {dug.name} in {dug.folder}")

Error Handling​

from scm.client import Scm
from scm.exceptions import (
    InvalidObjectError,
    MissingQueryParameterError,
    NameNotUniqueError,
    ObjectNotPresentError
)

client = Scm(
    client_id="your_client_id",
    client_secret="your_client_secret",
    tsg_id="your_tsg_id"
)

try:
    new_dug = client.dynamic_user_group.create({
        "name": "test_group",
        "filter": "tag.department.it",
        "folder": "Texas",
        "description": "IT department users"
    })
except InvalidObjectError as e:
    print(f"Invalid data: {e.message}")
except NameNotUniqueError as e:
    print(f"Name already exists: {e.message}")
except ObjectNotPresentError as e:
    print(f"Not found: {e.message}")
except MissingQueryParameterError as e:
    print(f"Missing parameter: {e.message}")