Duplicate CN Handling Issue for Identities with Same Name in ISC (AD Birthright Provisioning)

Identity Security Cloud (ISC) ISC Discussion and Questions
, , , ,
1

Hi everyone,

I’m facing an issue in ISC while onboarding two identities that have the same first name and last name (e.g., Test User).

We have a birthright role configured using role assignment criteria, which provisions accounts in Active Directory. The CN/DN naming convention is defined as:
$(firstname)$(lastname)$(uniqueCounter)

  • For the first identity, the account gets created successfully (e.g., testuser)

  • For the second identity:

    • Provisioning fails with an “object already exists” error as it tries to create account with same CN (e.g., testuser for both)

    • The system does not retry with an incremented uniqueCounter

    • No alternate CN (like testuser1) is attempted by System on failing even though Role is still assigned to failed identity.

What i was expecting was that both identities should be provisioned successfully with unique CNs, such as:

  • testuser

  • testuser1

It seems that even though $(uniqueCounter) is part of the naming logic, ISC is not handling CN conflicts dynamically or retrying with an incremented value when a duplicate is detected in AD.

Has anyone encountered this behavior before?

  • Is there a way to enable retry or auto-increment logic for uniqueCounter?

  • Do we need to implement a before-provisioning rule to handle CN uniqueness manually?

  • Are there any best practices for handling duplicate names in AD provisioning via ISC?

2

Hi @ashwinVnair

This happen only when you try to create to identity with the same name at the same time ?

3

Yes, Only when both identities have same name and onboarded at same time. I was testing if it would create accounts for both with distinguish CN/DN

4

@ashwinVnair by default ISC work with multithread and things are doing in parralel, so if he try to check uniqueness as accounts are not created, the existence of the unique CN will not detected that’s why may be he try to create those accounts with the same CN.

It’s possible to create a retry logic as mentionned here : Configuring Retry Errors

You can use api to update the configuration or directly upadate your configure using VSCode plugin.

image

5

Is the process only failing at the 1st instance, and is the account being successfully created on the retry event?

6

Hi @ashwinVnair Could you share the transform which is failing?

7

Hi @ashwinVnair

I would try usernameGenerator transform with sourceCheck: true This checks the target system directly at the moment of the provisioning.