Disable AD account through rule

IdentityIQ (IIQ) IIQ Discussion and Questions
, , , ,
1

Hi all,

I am trying to disable an Active Directory account using rule in IIQ. But it does not seem to be working.

Can someone please assist.

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Rule PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Rule language="beanshell" name="asdasdasdasd" significantModified="1788318368733">
  <Description>Rule to create CSV.

    A correlation rule must return a Map with one of the specified Return arguments.</Description>
  <Source>
  import sailpoint.api.SailPointContext;
  import sailpoint.api.Provisioner;
  import sailpoint.object.Application;
  import sailpoint.object.Identity;
  import sailpoint.object.ProvisioningPlan;
  import sailpoint.object.ProvisioningPlan.AccountRequest;
  import sailpoint.object.ProvisioningPlan.AttributeRequest;
  import sailpoint.tools.GeneralException;
  import sailpoint.tools.Util;

  import javax.crypto.Mac;
  import javax.crypto.spec.SecretKeySpec;
  import java.nio.charset.StandardCharsets;
  import java.util.Base64;
  import java.util.HashMap;
  import java.util.Map;
  import sailpoint.tools.Util;

  import sailpoint.object.Identity;
  import sailpoint.object.Link;
  import java.util.List;

  ProvisioningPlan plan = new ProvisioningPlan();
  //return plan.toXml();

  ProvisioningPlan.AccountRequest acctReq = new ProvisioningPlan.AccountRequest();

  Application adAppObject = context.getObjectByName(Application.class, "AD-Direct");

  //return appName.getName();

  String adAppName = adAppObject.getName();
  String accountName = "CN=ak,OU=Users,OU=xxxx,OU=SE,OU=xx Finance,DC=bxxxxtest,DC=local";
  String password = "somethingencryoted";


  acctReq.setApplication(adAppName);
  acctReq.setNativeIdentity(accountName);
  //acctReq.setOperation(ProvisioningPlan.AccountRequest.Operation.Disable);
  acctReq.setOperation(AccountRequest.Operation.Disable);

  acctReq.add(new AttributeRequest("userAccountControl", "514"));       
  acctReq.add(new AttributeRequest("password", password));
  plan.add(acctReq);


  Provisioner provisioner = new Provisioner(context);
  provisioner.execute(plan);



  //return plan.toXml();
  //return plan;
  return "Success";

  </Source>
</Rule>

Thanks in advance.

2

hi @rishavghoshacc

A few things stand out in your rule:

  1. The rule execution itself may be succeeding, but the provisioning operation may not be reaching AD. Check the IIQ logs (iiq.log) for any provisioning or connector errors after provisioner.execute(plan).

  2. For an AD disable operation, you typically only need:

acctReq.setOperation(AccountRequest.Operation.Disable);

  1. Verify that the value used in:
    acctReq.setNativeIdentity(accountName);

exactly matches the account’s native identity stored in IdentityIQ for that application. If the DN is incorrect or differs from the Link’s native identity, the connector will not find the account.

3

Hi @rishavghoshacc ,

Please verify the following points

  1. The test connection of the application is successful
  2. The native identity of the account is correct and exists in AD

And check for any errors in Provisioning Transaction in Administrator console or from logs

4

This is solved. The plan was missing plan.setIdentity();