AD provisioning failing with partial attributes getting populated (accountExpires)

Identity Security Cloud (ISC) ISC Community Knowledge Base
, , ,
1

Problem

The Provisioning from SailPoint ISC to Active Directory using OOTB Active Directory Connector was partially failing with only few attributes getting populated

Diagnosis

During the Troubleshooting, we used Elimination technique to identify the attributes which we were sending from Create Account configurations during account creation request. We found that accountExpire attribute is the culprit. We were passing the accountExpires attribute MM/dd/yyyy format the way it was coming from Authz Source

Solution

Following was the approach we used.

  1. Created a new identity attribute in Identity Profile Named as “AD AccountExpire”
  2. Created a transform as below and mapped it to newly created identity attribute named as “AD AccountExpire”. The transform details are.
{
  "name": "DateFormat - AccountExpires",
  "type": "dateFormat",
  "attributes": {
    "input": {
      "attributes": {
        "input": {
          "type": "dateFormat",
          "attributes": {
            "input": {
              "type": "accountAttribute",
              "attributes": {
                "sourceName": "TestSource1",
                "attributeName": "end_date"
              }
            },
            "inputFormat": "MM/dd/yyyy",
            "outputFormat": "MM/dd/yyyy"
          }
        },
        "inputFormat": "MM/dd/yyyy",
        "outputFormat": "ISO8601"
      },
      "type": "dateFormat"
    },
    "inputFormat": "yyyy-MM-dd'T'HH:mm",
    "outputFormat": "EPOCH_TIME_WIN32"
  },
  "internal": false
}
  1. The above transform converts the incoming date from Authz source into EPOCH_TIME_WIN32 format which is accepted by accountExpires attribute in AD.
  2. Go to Admin → Connections → Source
  3. Open AD source.
  4. Go to Create Account section
  5. Change the mapping of accountExpire attribute to new identity attribute named as AD AccountExpire" and Save the configurations
  6. Go to attribute sync page and enable the attribute sync for accountExpire attribute.
  7. Validate all the configurations
1 Like
2

Yes, it is very important to consider the format of any attribute that you sync to your end systems, whether that is AD or any other.

This can of course include things such as:

  • Type of attribute (string, integer)
  • Format (such as you experienced with the date)
  • Length (some AD attributes have a max length that is shorter then in ISC)

This is of course not a complete list, but just to give you some idea.

1 Like