Clear AD manager by provisioning policy

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi everyone, I’m having trouble clearing the manager field in Active Directory. I need to clear this field when the identity is terminated, but it’s doing something wrong.

{

"name": "Disable",

"description": null,

"usageType": "DISABLE",

"fields": \[

    {

        "name": "manager",

        "transform": {

            "type": "static",

            "attributes": {

                "LCM": {

                    "type": "identityAttribute",

                    "attributes": {

                        "name": "cloudLifecycleState"

                    }

                },

                "value": "#if($LCM == 'terminated')-#{else}#end"

            }

        },

        "attributes": {},

        "isRequired": false,

        "type": "string",

        "isMultiValued": false

    }

\]

}

image

2

Hello, It’s most likely an error from AD end. Have you tried replacing “-“ with some string or letter? It could be that special characters aren’t allowed.

3

You’re encountering this behavior because Velocity logic is not evaluated within a Static Transform in SailPoint. Static Transform returns the value as-is (literal), so the manager attribute is never cleared as intended.

Recommended approach: Use a Conditional Transform
ISC provides a Conditional Transform designed for scenarios like this, where the output should vary based on an identity attribute or expression.

[Conditional | SailPoint Developer Community]

Example: Clear the AD manager attribute when lifecycle = terminated

{
  "name": "manager",
  "type": "string",
  "isRequired": false,
  "isMultiValued": false,
  "transform": {
    "type": "conditional",
    "attributes": {
      "expression": "$lcm eq 'terminated'",
      "positiveCondition": "",
      "negativeCondition": null,
      "lcm": {
        "type": "identityAttribute",
        "attributes": {
          "name": "cloudLifecycleState"
        }
      }
    }
  }
}
1 Like
4

Hi, SathishKumar, Thank you for your help, but the error persists.

5

Hi @guilherme_sec You can’t set the manager AD attribute to “-” as, if included, it has to be a DN to an existing object.

6

Hi @guilherme_sec

This constraint violated error is most likely from the AD side as it does not allow to set manager as “-”. From my experience, it should be a proper reference to another user via DN of the user or you may set it as blank which ofcourse will require you to update the transform. And frankly i am not even sure if you can return blank value from disable provisioning policy as it might skip the update if you try to do so.
So, i would suggest to clear manager from identity level or use powershell script to update the manager and set it blank.

Thank You
Regards
Vikas.