Add extensionAttribute1 in Active Directory

IdentityIQ (IIQ) IIQ Discussion and Questions
, , , , , ,
1

Hi all,

I just wanted to know the best practice to add an extensionAttribute to an AD application

Is the below correct?

  1. Add the “extensionAttribute1” to the schema
  2. Aggregate and check
  3. Add the attribute in the create provisioning policy
  4. Add a target mapping to the “extensionAttribute1” in Identity Mapping

Is there an official document for this?

Thanks in advance.

2

Hello Rishav,
Yeah, your steps looks correct. Just a small note on step 4.

Add extensionAttribute1 to the AD application account schema as a string, run aggregation and confirm it shows up on the AD link, then add it to the Create provisioning policy. Field name has to match the native AD attribute name exactly.

For step 4, the Target Mapping is only needed if you want IIQ to keep updating that value when the mapped identity attribute changes later. If you just need it set during account creation, the provisioning policy alone should do it. And if you do go with the target mapping, make sure Synchronize Attributes is enabled on your Identity Refresh task, otherwise it won’t actually push the updates.

I would also confirm extensionAttribute1 exists in AD and that the IIQ service account has read/write permission on it before testing.

Docs: