AD Account Creation Error

Ok, I think I know why this isn’t working. The username generator transform only works on the attribute that is marked as the account ID in the attribute schema. The way it works, I believe, is it tries to provision an account using each pattern in the list until one succeeds. If the provision fails, it moves on to the next pattern in the list until the provision succeeds. This is why username generator works for distinguished name, because it is the account ID for active directory sources.

The username generator doesn’t do a lookup in the source system to see which value in the pattern will be unique, and therefore it can’t be used to generate unique account attributes other than the account ID. If you need to create unique account attributes in an Active Directory source, you must use the “Create Unique LDAP Attribute” rule, which has the ability to do a lookup in active directory before provisioning to calculate the unique value. This rule can only accept a single template string to determine uniqueness, which means you will be stuck using the last pattern of "$fi3$ln(uniqueCounter)" to make this rule work. I recommend creating a new identity attribute to hold the samaccountname value that you want to use in the template. Your final provisioning policy can then reference the identity attribute with the unique counter.

If you must have the different patterns for the samaccountname, then you will need to engage professional services to build a custom rule that will perform the account attribute lookup using a variable number of patterns.