Active Directory Account Sync Error - "A constraint violation occurred"

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hey Sailors,

I am having an issue with some accounts when their attributes are synchronized to Active Directory. Some users–I noticed–do not have their attributes updated to reflect what their Identity displays and is configured to populate to Active Directory, while others update just fine. When I look at the Activity tab in their identity, I see this:

image
image1782×191 20.7 KB

When expanding for more detail, I see:

image
image903×502 53 KB

I did some research and I see that Microsoft has some documentation on this, and the support document claims that this issue is due to replication issues (reference the document here). This mentions stuff about IPSec and group policy, so it’s a little less relevant. However, I see a One Identity support article that speaks about this problem as well, and says it is related to an issue of the UPN not being unique, which doesn’t make sense to me either (reference the document here).

What confuses me is how some accounts within the exact same OU are updated just fine, while others fail and experience this error. Additionally, no matter how many times I try to manually sync the attributes for each specific identity, the same error comes up for each of them. These lead me to believe that the issue is not related to replication issues.

I’m curious if anyone else has experienced this problem before, and if anyone has a solution that they can recommend.

Thank you!

2

I received support from SailPoint Cloud Support Engineer Paul Gonzalez on this issue. The reason this issue was occurring is because, for the specific users in question, their Middle Name was being updated to the initials attribute in Active Directory, and the values of the Middle Name for these users exceeded the 5 character length restriction.

The error message showed “displayName,” “description,” “company,” and many more attributes in the failure, but the actual failure was with the initials attribute, and all of the other attributes failed to update due to this.

By changing the logic to just use the first letter, this was corrected.

3 Likes