Active Directory Source - After Modify Rule - Issue with &

Feedback Idea Discussions
,
1

I need to put a logic in AD aftermodify rule to call a PS script if a certain AD group is removed. That AD group has “&” in the name. I am using the following in my rule.
if($requestEntry.value -eq “CN=Build & Test Prod,OU=ABC,OU=ABC,DC=A,DC=B,DC=C,DC=edu”) {
$Build = $true
}
It looks like when I deploy the after modify rule using the API, it is converting “&” to amp; and $Build is not set to true because of this mismatch (& and amp;). How can i make this work?

2

There are two ways with which I have solutioned it previously:

i. In the AfterModify Rule I just check whether the Modify operation was invoked and then proceed with PSScript on the IQService box wherein I will check if requestedAttribute is memberOf and then iterate through the object and replace "&amp ; "with & and perform the necessary activities.

ii. Get the CN changed which of course is a huge issue from client perspective.

Please let me know if the above observations help you with the solutioning.

Thanks,
Aman

3

Thank you. Will put that on the PS script side. Not sure why sailpoint is converting it to ampersand. It just add some extra coding to acehive this usecase.

Thank you,
Biplav

4

Let me know if the solution works.

Thanks,
Aman

5

Hi Biplav, we are facing similar issue. In the after script, we are using some attributes from the account request and one of them has value like “Abc & xyz” but we are getting an error The ampersand (&) character is not allowed. The & operator is reserved for future use; wrap an ampersand in double quotation marks (“&”) to pass it as part of a string. How did you eventually solve it? Could you please share example if possible?
Thanks!