We are currently syncing the AD proxyAddresses attribute from an identity attribute that contains the expected list of proxy addresses.
However, we are seeing sync/provisioning events being triggered even when the identity attribute value has not actually changed.
My assumption is that the issue may be related to the order of the values. For example, the identity attribute contains:
[proxyAddress1, proxyAddress2, proxyAddress3]
while the AD account attribute contains:
[proxyAddress3, proxyAddress1, proxyAddress2]
The values are the same, but the order is different.
Has anyone encountered this behavior before with multi-valued attributes such as proxyAddresses? If so, how did you handle the comparison/synchronization to avoid unnecessary provisioning events?
ISC does not truly hold the multi-valued attributes as an array in the identity attributes. Instead, it is translated into a comma separated string. This causes the equality check to fail on each refresh.
I’d recommend following this approach for achieving the multi-valued syncing: Multivalued Attribute Sync
Yhank you for your reply, and sorry for my late response.
The approach you recommended seems a litte bit too complex to implement, and I also noticed it dates back to 2023.
I was wondering whether there have been any improvements or new capabilities introduced in ISC since then that would allow synchronization of multi-valued attributes in a simpler way.
Hi @DivyaL_7
Unfortunately that is how attribute sync works.
As mentioned previously by Braden that it is due to how ISC stores values version how is it stored in the application.
I would recommend not to use ISC to sync proxy addresses since after every import it will trigger too many sync request which could lead to some serious performance issues.
You might need to write a transform for this on the Identity Attribute and do a check by yourself that if the value are the same then Active Directory should take precedence.
Rather than using Identity Attribute Sync, we generally use Before Provisioning Rules or connector Before/After Rules to synchronize proxyAddresses.
Since proxyAddresses is a multi-valued attribute and identity attributes in ISC do not natively support multi-valued attributes (only string values), it is difficult to implement this seamlessly using ISC’s native Attribute Sync.