Attribute DistinguishedNamedoes not contain expected character

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

I have created a second Active Directory connector to handle the creation of Administrative accounts. The new connector base ou does not overlap with the normal user create Ad connector. I created 3 new attributes AdminDN, AdminSam, and AdminUPN and on the create account on the connector have mapped attributes to SamAccountName, UPN and DN. In the Details of the user account the attributes are correct, but I keep getting the following error “[“Exception occurred while executing the RPCRequest:
Errors returned from IQService.
"Attribute DistinguishedNamedoes not contain expected character
,. Value supplied : RabittBAttribute DistinguishedNamedoes not contain expected character ,.
Value supplied : RabittB. HRESULT:[0x80131500]"”]”

I have set up a multiple Account Options on my AP for normal accounts that says memberof Does not Equal XGroup so the account will ignore the normal Ad connector. Trying to figure out what I missed

createaccount
createaccount850×506 15.5 KB

Detailsof User
Detailsof User1194×114 4.26 KB

2

Hi @krigney ,

Have you verified if the accounts are created successfully on the AD? Do you see any special characters for distinguishedName attribute being passed to AD in IQ service logs during the provisioning request? As per Distinguished Names | Microsoft Learn, there is a list of reserved characters that needs to be prefixed with a backslash (\)

Another way is, you can try creating a new AD connector and see if the same issue happens.

HTH

3

The accounts fail creation due to the error. The DN is correct it is set via a transform for the identity attribute of ADMINDN (cn=RabittB,ou=Privileged,ou=Users,ou=Admin,dc=test,dc=nintendo,dc=com) which shows correct in the attributes of the user accounts

4

Hi @krigney,

Looks like the DN value being passed is RabittB instead of the actual DN.

Here are some of the steps you can follow :

  1. Try checking for the user in search and see what value is being passed for distinguishedName during the account creation (Under Account Activities). You can also check the IQservice logs for more info.

  2. Try giving a static value for distinguishedName in the create profile and see how it behaves.

  3. Delete the distinguishedName attribute in the create profile and re-create it with the mapping.

5

Hi @krigney - Are you mapping the common name (cn) as well? What’s the value in there?

6

I was able to figure it out. I needed to add CN to the create and change the schema so that Distingushedname was the accountID

2 Likes