Hello Everyone,
When we are trying to create a new account in Active Directory, the account is created but some attributes are not updated and are getting failed to provision.
We are getting the error : “Account created but some attributes are not updated properly”
The same attribute values are getting updated properly during Modify operation.
If anyone has encountered this issue before can you please suggest any solutions.
@RohithVemuganti could you please share the create and modify account requests?
Hi @RohithVemuganti , welcome to Sailpoint developer community,
Please check if all schema attributes mentioned in IIQ Create account Provisioning Policy are present in target AD
Hello Yes I have checked all schema attributes are present in Active Directory Application, if not modify operation would also have failed.
Hi @RohithVemuganti One or more of the attribute values passed in the create policy are not matching the expected syntax. I would check the ones that are not in the update policy. Maybe start with UPN value?
@RohithVemuganti samaccountname and password are two attributes which you are passing in create but not in modify. Do you know if you have any auto populate script written for samaccountname? Could you please try removing samaccountname and try to create account?
It maybe Password vs password. As there is no AD attribute called Password, my assumption is that IIQ converts password (lower case) in the provisioning plan into unicodePWD.
@RohithVemuganti Please check the case of the attributes. This may be the reason
Password is a mandatory attribute, without which AD Account creation itself is failing, so we had to include. I tried without sending samaccountname as well, still the same issue.
@RohithVemuganti I would recommend create a test plan with bare minimun attributes to create account and then add one attribute at a time, then execute the plan. It’ll tell you which attribute is causing the issue.
There is no AD attribute “Password”. There is, however, an AD attribute called “unicodePwd”. This is mandatory for a userAccountControl of 512.
Either:
Did you narrow down on the attributes that fails during create but succeed during modify operation? do they succeed with same values as passed in create?
Also what exact error codes you are getting from AD? that might help to exactly understanding why AD is not able to set them during create.
We used to have similar issue when we used to have LB for AD domain controller configured in SailPoint AD application. So our create request would split into create and set attribute requests. So LB would send create to one DC and set attribute to another. and if the second DC is not synced with first DC by then (which would be very fraction of second), we would get same error but error code indicating object not found. (since the new account was not synced to DC where attribute were being set).
So similarly in your case, if you know what attribute fails in create but work in modify with same values, and what exact error code you get from AD, would help to investigate this further.
Hi @RohithVemuganti I have seen this issue before. In the Application Schema, please check whether all mandatory attributes are present. Also verify that all attributes used in the Create Provisioning Policy are available in the schema.
Please make sure all mandatory attributes are added in the Create Policy as well.
Additionally, please check the Provisioning Transaction for more details on which attribute is failing during account creation.
Thanks Jeremy, actually it was the P vs ‘p’ and also the value that we are passing in the password was not matching with the configured Password Policy on AD. so we had to update the attribute name and the value as per the proper password policy.
