AC_NewName Error

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi all,

Our team has developed a Before Provisioning Rule for Active Directory (AD). This rule updates the ‘AC_NewName’ and ‘displayName’ attributes in case of a name change scenario, and the ‘AC_NewParent’ attribute in case of an OU change scenario. In scenarios where both a name change and an OU change occur, the rule updates the ‘AC_NewName’, ‘displayName’, and ‘AC_NewParent’ attributes.

While working on a scenario involving both a name change and an OU change, we received the following error: [“Failed to update attribute ‘AC_NewName’. Error - An invalid DN syntax has been specified.”]

21
211901×505 59.1 KB

Here is the part of Before provisioning rule for reference,

if (plan!=null) {
List accountRequests = plan.getAccountRequests();

if (accountRequests!=null) {
for (AccountRequest accountRequest : accountRequests) {
    AccountRequest.Operation op = accountRequest.getOperation();

    Identity identity = plan.getIdentity();
    String applicationName = application.getName();
    String nativeIdentity = accountRequest.getNativeIdentity();

    String firstName, lastName, middleinitial, defaultOU, lcs;

    if(identity.getAttribute("oudetails")!=null) {defaultOU = (String) identity.getAttribute("oudetails");}
    if(identity.getAttribute("firstname")!=null) {firstName = (String) identity.getAttribute("firstname");}
    if(identity.getAttribute("lastname")!=null) {lastName = (String) identity.getAttribute("lastname");}
    if(identity.getAttribute("middleInitial")!=null) {middleinitial = (String) identity.getAttribute("middleInitial");}
    if(identity.getAttribute("cloudLifecycleState")!=null) {lcs = (String) identity.getAttribute("cloudLifecycleState");}
    log.error("Before Rule: Values -> Operation:" + op + " | Identity:" + identity + " | Application:" + applicationName + " | Native Identity:" + nativeIdentity + " | OU Details" + defaultOU + " | First Name:" + firstName + " | Last Name:" + lastName + " | Middle Initial:" + middleinitial + " | LCS:" + lcs);

    List attributeRequests = accountRequest.getAttributeRequests();
    boolean nameChanged = false, ouChanged = false;

    if(attributeRequests!=null) {
        log.error("Before Rule: Fetching the values from Attr Req and comparing. Finding a match");
        for (AttributeRequest attributeRequest : attributeRequests) {
            String nameAttrReq = attributeRequest.getName();
            if (nameAttrReq.equalsIgnoreCase("givenName") || nameAttrReq.equalsIgnoreCase("sn") || nameAttrReq.equalsIgnoreCase("initials")) {
                nameChanged = true;
            }
            if (nameAttrReq.equalsIgnoreCase("company")) {
                ouChanged = true;
            }
        }
    }

    if (null!=op && null!=nativeIdentity && op.equals(AccountRequest.Operation.Modify)) {
        String name = generateName(firstName, lastName, middleinitial);
        String newCN = generateCN(applicationName, name, defaultOU, nativeIdentity);
        String newDN = "CN=" + newCN + "," + defaultOU;
        
        if (null!=newCN && nameChanged) {
            accountRequest.add(new AttributeRequest("AC_NewName", ProvisioningPlan.Operation.Set, newCN));
            accountRequest.add(new AttributeRequest("displayName", ProvisioningPlan.Operation.Set, newCN));
        }
        if(null!=newDN && ouChanged) {
            accountRequest.add(new AttributeRequest("AC_NewParent", ProvisioningPlan.Operation.Set, newDN));
        }
        log.error("Before Rule: Modify Operation Triggered -> CN:" + newCN + " | DN:" + newDN + " | Provisioning STATUS_COMMITED");
    }
}
2

Hi Gokul,

Can you share the sample dn value that was framed for AC_NewName attribute?

3

Hey!

Instead of trying to apss the Whole DN , try using just the new Name. Iqservice should me able to solve the rest :slight_smile:

Best!

4

Based on my understanding, If your new CN is John Doe, while trying to set AC_NewName, shouldn’t we set it something like CN=John Doe and not just John Doe which is what is returned by generateCN() function? Try appending CN= in front of the name and set it.

If you still face some other issues further, One more thing I noticed is in the AC_NewParent, you are trying to set the whole DN but shouldn’t it be just the OU without the CN something like OU=Services,OU=Users,DC=acme,DC=com?
Please clarify if I’m wrong.

Thanks!

1 Like
5

DN value → CN=Bary N. Michele,OU=SailpointTest1,OU=Br****,OU=C****,DC=,DC=

6

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.