I am trying to determine the operational differences between a Veto and
a Break. There is not much to go by in the documentation:
Veto - This action causes the current operation to be cancelled.
Break - This action causes the current operation to not be processed by
any more actions or rules within the current policy.
Here is my problem. Someone had setup an eDir-eDir driver to do some
stand alone functions. The driver does not actually connect to any other
tree (poor man's loopback?) What it does do is a lot of "send email
from template" operations, set an initial password for users by hashing
the GUID, and Clears an attribute that flags new users without
passwords, and saves the initial password in a different attribute.
Entry to the rule is controlled by the password required attribute. New
users, without passwords enter the rule, the rule creates a password,
sends out some emails, and clears the password required attribute. At
the end is a VETO.
Here is the problem, some new user objects seem to be going thru twice.
What I see on the trace is, right after the veto, the password
required attribute is reset to indicate a password is necessary. The
Initial Password (in the password field, and the separate attribute) and
the clearing of the password required flag are the only changes made to
the source object, and it appears that the Veto is undoing the changes,
but not always. Not all users go thru twice (have not figured out just
what is the difference between the two trip users and the one trip
users). The actual operation on the password required attribute is a
Clear. Attribute present and set to a certain string, password is
required. Attribute not present, no password required. After the veto,
the attribute string value is restored, according to the trace. Since
the attribute is back to saying password required, the driver fires
again, but this time as a modify instead of a new object, and it does
not change anything after the veto.
My question regarding the Veto vs Break is this. Should it be a Veto at
the end, or a Break? What do they actually do?