AD Email Uniqueness Checking Across the domains

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Dear Friends,

We are facing an issue with email duplication across multiple domains within a single forest setup. We have configured 11 different sources per domain, and our current cloud rule is intended to ensure email uniqueness by appending a unique counter to the first name if the same first name and last name combination already exists.

Example:
If the email prefix “Siva.Krishna” already exists, the rule should create “Siva1.Krishna” for a new user with the same name.

Current Issue:
Our current implementation only checks for email duplication within each individual domain. This leads to duplicate email addresses being created across different domains. For instance, “Siva.Krishna@example.com” and “Siva.Krishna@example.com” can both exist, which violates our uniqueness requirement across all domains.

Objective:
We need assistance to modify our cloud rule or approach so that it checks for email uniqueness across all 11 domains and ensures no duplicates are created, regardless of the domain.

Referring below doc:

Below are the Testing Results:

image (8)
image (8)1148×397 25.7 KB

Attribute Generator rule is
Rule - AttributeGenerator - UniqueEmailGenerator 2.xml (5.0 KB)

2

Hi @Sivakrishna1993 ,

I think you might need to check with “smtp” as well as the “sip” too, in isUnique() method.

List searchValues = new ArrayList(Arrays.asList(new String[] {
                "smtp:" + emailPrefix + "@", "sip:" + emailPrefix + "@"
            }));

Just append this.

Try to use “accountAttributes” instead of “identityAttributes”. Also, in isunique() method → try to check for the generated email value is existing in email Identity Attribute of all the identities belonging to that IP.

idn.countIdentitiesBySearchableIdentityAttribute("ATTRIBUTE_NAME", "Equals", "ATTRIBUTE_VALUE");

Also, try to replace getting the attribute values from “identityAttribute” to “accountAttribute”.

I can’t find any other discrepencies here.

3

Hi Gokul,

Thank you for your response. I will check and let you know.

Best Regards,
Siva.K

4
  1. Create Email Prefix and Email Suffix Identity attributes
  2. Make Email Prefix as searchable
  3. Generate email prefix in your desired format, don’t attempt to apply uniqueness at Identity level which won’t work all the times. Use firstValid Transform, read mail from AD, if no AD account then only generate email.
  4. Use Account Profile Attribute Generator Rule for email attribute, concat email prefix, uniqueness and email suffix
  5. Check the uniqueness using countIdentitiesBySearchableIdentityAttribute method.
  6. Use $mail reference for UPN and SMTP

Thanks
Krish

5

Hi Krishna,

Thank you for your time, I will try your approach as well thanks.

Best regards,
Siva.K

6

Krishna, Do we need to write a cloud rule to use this method “countIdentitiesBySearchableIdentityAttribute” ?

7

Yes, You need to use Account Profile Attribute Generator Rule which is a Cloud Rule.

8

Hi Krishna,

Well noted with thanks.

Best Regards,
Siva.K