Attribute Target Address is failing to be updated on Active Directory

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi all,
I am trying to update the “targetAddress” attribute when creating an account on active directory.
I have done below things:

  1. Created account attribute “targetAddress”
  2. Created a create profile mapping for the attribute targetAddress as value= SMTP:[email protected]
  3. Once all this was done i created a new account in Sandbox and it works. But the same configuration when moved to prod fails with an ERROR

“The specified directory service attribute or value does not exist.”

Checks we did:

  1. We have checked and the same permissions are on both sandbox and prod service account.
  2. We have also checked to see if target address attribute is on Prod AD, and it is indeed there.
  3. We tried to aggregate the target address as well, and it does gets pulled form AD just a note here is that it is aggregated in “externalEmailAddress” attribute on IDN.
  4. Later on we also tried to directly add externalEmailAddress as a create profile mapping instead of targetAddress to see if that gets populated. But got the same error and also saw that the Attribute request was sent as targetAddress: SMTP:[email protected]

Just to highlight:
This is still working in Non-Prod sandbox and is indeed updated on Active directory. But Fails in production

Thanks for the help in advance.

2

Hi @neeraj99 ,

Do you have exchange settings enabled on the source in prod ? How is it in non-prod

2 Likes
3

Hi @neeraj99
It might be due to other attributes being provisioned during user creation. Verify in prod , if any schema attributes are exceeding length constraints or if you’re provisioning an attribute that doesn’t exist in Active Directory.Also check case sensitivity of targetAddress.

4

Hi @neeraj99,

By any chance did you try the solution mentioned in this blog post: targetAddress attribute is mapped to exch_externalEmailAddress in AD? - #5 by Prashanth1812

it is some what similar behavior in the above post.

Also, based on the AD Connector documentation, targetAddress is the internalName for externalEmailAddress attribute.

image
image1569×307 22.5 KB

I hope this helps.

5

I did that, so if i remove target address and retry provisioning the account, It will work and create AD account but if i add target address will fail.
yes targetAddress is the name of attribute.

6

I did checked that post out, but in my case externalEmailAddress is getting populated. rather than exch_externalEmailAddress.
And i did tried to populate the attirbute via both the names i.e
targetAddress
externalEmailAddress

but in both cases it fails and on account activity->attribute request, it shows as targetAddress.

7

I will check on this. I am not sure how it is in prod but i think it is enabled in Non-Prod.

Btw, will that make any difference? Because my end goal is to populate target address and not exch_externalEmailAddress.

8

Hi @neeraj99 ,
One more suggestion , Ask Prod Admin/Operations Team to update the value of targetAddress directly in Prod using same svc account that ISC is using.In this way at least we can confirm the attribute does not have any constraints.

9

Yes we have tried populating the attribute directly from AD, it works.
Next, we have also tried to update the attribute using a powershell script with the svc we are using and it works there as well, i.e the attribute is being updated in AD.

10

Just a quick update over here if anyone see’s this later on. So we ended up removing the Exchange setting from AD source Using PATCH Source API. Which then started populating the targetAddress attribute on AD.

1 Like
11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.