AD LDS Sync Error - CN

Identity Security Cloud (ISC) ISC Discussion and Questions
1

:bangbang: Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

Hi Everyone ,

I’m trying to update the CN value for AD LDS account during attribute Sync. I understand that CN can’t be directly modified, so I attempted to use the newRDN attribute in a Before Provisioning Rule.

Here’s the logic I used:

accountRequest.add(new AttributeRequest("newRDN", ProvisioningPlan.Operation.Set, newCN));

However, I’m getting the following error during execution:

sailpoint.connector.ConnectorException: [LDAP: error code 16 - 00000057:
LdapErr: DSID-0C091275, comment: Error in attribute conversion operation, data 0, v4563]

Could anyone please advise on how to resolve this? Thanks in advance.

Thanks,

Naveen

2

Hi @naveenkarthikkrk ,

Please change the attribute name from “newRDN” to “AC_NewName”.

Please find the attached link for your reference : Default Provisioning Attributes Reference

3

Hi @PrashRV,

I have tried it but it didn’t work . AC_NewName works for AD application but I’m working on AD LDS (LDAP) source.

Thanks,

Naveen

4

Hi @naveenkarthikkrk ,

I thought it’s AD. For AD LDS ( LDAP) we can’t modify CN so we need to change DN value by adjusting CN value.

Find the attached document for your reference - https://documentation.sailpoint.com/connectors/microsoft/lightweight_directory_services/help/integr…

5

Hi @naveenkarthikkrk If newRDN works the same way as AC_NewName (I dont know, havent tried it) have you ensured that the value is prefixed with “CN=”?

6

Hi @j_place , I tried it but it didn’t work.

7

Hi @naveenkarthikkrk Are you including a new superior attribute as well?

8

I tried that too but it didn’t work . I believe there is an order to call newRDN and newSuperior to change the CN.

9

Can you share the values passed in those attributes?

10

I have created a beforeProvisioning Rule for it . I’m passing the below values in the rule.

newCN = “CN=xyz“

accountRequest.add(new AttributeRequest(“newRDN”, ProvisioningPlan.Operation.Set, newCN));

newOU = “OU=test, DC=domain,DC=com“

accountRequest.add(new AttributeRequest(“newSuperior”, ProvisioningPlan.Operation.Set, newOU));

11

I assume you’ve confirmed the presence of the parent OU, so another thing to check is case sensitivity. Have you tried “cn=“ “ou=“ etc?

12

Also, maybe deleteOIdRDN is a mandatory attribute for modifyDN.

13

Hi Everyone , Rename of CN and OU movement is not supported in ADAM connector.

14

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.