# Adding a specific attribute breaks provisioning in Active Directory

**URL:** <https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud, access-requests, ootb-connector\
**Created:** [December 17, 2024, 7:14pm UTC](https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868 "2024-12-17T19:14:47Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![ninfante](https://avatars.discourse-cdn.com/v4/letter/n/f19dbf/32.png) [@ninfante](https://developer.sailpoint.com/discuss/u/ninfante)\
**Post date:** [December 17, 2024, 7:14pm UTC](https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868/1 "2024-12-17T19:14:47Z")

</div>

Hi all!

Hope everything’s going well.  
We are working on the integration of an AD connector in INow, and so far everything works. We can read, modify and create accounts in AD.  
Now, I’ve got the requirement of adding a couple of additional attributes in the schema that need to be populated when the account is created.  
Most of them worked, I’ve been adding one by one, testing that each attribute is being sent correctly to AD without any issue.  
Everything worked until I tried to add the attribute uidNumber.  
This attribute exists in AD, and also is present in our schema. When we run the aggregation, SailPoint is able to read the values that are present in those accounts that contain a valid value.  
We also tried sending a static value and it worked for some reason, but when we map the value to be grabbed from the identity, it fails saying:

> Errors  
> Account created but some attributes are not updated properly.
> 
> Warnings  
> Account created but failed to modify : Failed to update attributes for identity CN=nflander,OU=TestOU,DC=exampledc1,DC=exampledc2. The attribute syntax specified to the directory service is invalid.
> 
> Stage  
> Completed with errors. Refer to the remediation status report.

Have you received this error from SailPoint?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![jishnu\_suresh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/jishnu_suresh/32/20590_2.png) [@jishnu\_suresh](https://developer.sailpoint.com/discuss/u/jishnu_suresh)\
**Post date:** [December 17, 2024, 8:09pm UTC](https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868/2 "2024-12-17T20:09:37Z")

</div>

Hi Nicolas,

This looks like an issue due to mismatch in datatype of the value you are trying to push and the datatype of the AD schema.  
Please refer to the post below.

> [@accountExpires attribute in AD](https://developer.sailpoint.com/discuss/t/accountexpires-attribute-in-ad/72517):
>
> Hi Team, I need a little assistance getting over a hump in reference to AD account creation for Contractors. I am getting the error after the account is created only on Contractors. The attribute syntax specified to the directory service is invalid.\n"] I have a feeling it may be the accountexpires attribute in AD. How do I get passed this to render a successful account creation for contractors with an expiration date? Goal. Set employees to “Never” and contractors to a specific date. Thanks

---

<div class="post-metadata">

**Author:** ![ninfante](https://avatars.discourse-cdn.com/v4/letter/n/f19dbf/32.png) [@ninfante](https://developer.sailpoint.com/discuss/u/ninfante)\
**Post date:** [December 18, 2024, 7:53pm UTC](https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868/3 "2024-12-18T19:53:46Z")

</div>

Hi Jishnu! Thanks for replying.  
Yes, I thought about this, but the issue is that the value I’m trying to send is already a number.  
This number is being generated by a transform, which is used to add a number to another attribute that holds the user id, and the result is shown as an identity attribute.  
Let’s say that the identity number is 100 and the number that is added is 200, so the final attribute is 300.  
This is the value that I try to send to AD, but for some reason AD doesn’t accept this value."

The user id is like this in the identity “identificationNumber”: 1234567890  
The transform, if helps, that I use to generate the identity attribute is the following:

```auto

{
	"name": "FinalEmployeeNumber",
	"type": "static",
	"attributes": {
		"employeeNumber": {
			"attributes": {
				"values": [
					{
						"attributes": {
							"name": "identificationNumber"
						},
						"type": "identityAttribute"
					},
					"00"
				]
			},
			"type": "firstValid"
		},
		"value": "#set( $Integer = 0 ) #set( $numberAsString = $employeeNumber ) #set( $parsedNumber = $Integer.parseInt($numberAsString) ) #set( $baseNumber = 20000 ) #set( $finalNumber = $parsedNumber + $baseNumber ) $finalNumber"
	}

```

---

<div class="post-metadata">

**Author:** ![edmarks](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/edmarks/32/2896_2.png) [@edmarks](https://developer.sailpoint.com/discuss/u/edmarks)\
**Post date:** [December 18, 2024, 11:24pm UTC](https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868/4 "2024-12-18T23:24:38Z")

</div>

A suggestion for testing would be to create a “Test Attribute” for the identities and then populate this value in the associated identity profile using the same transform.

This would create a human readable value directly on the identity that you could look at to confirm if it’s the expected value (at least as a “string”).

---

<div class="post-metadata">

**Author:** ![j\_place](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/j_place/32/19181_2.png) [@j\_place](https://developer.sailpoint.com/discuss/u/j_place)\
**Post date:** [December 19, 2024, 2:18pm UTC](https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868/5 "2024-12-19T14:18:28Z")

</div>

I would check you’re not out of bounds of the Int32 data type [System.Int32 struct - .NET | Microsoft Learn](https://learn.microsoft.com/en-us/dotnet/fundamentals/runtime-libraries/system-int32)

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [February 17, 2025, 2:19pm UTC](https://developer.sailpoint.com/discuss/t/adding-a-specific-attribute-breaks-provisioning-in-active-directory/93868/6 "2025-02-17T14:19:20Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.