Dynamic AD distinguishedName generation in ISC Create Account policy using generated sAMAccountName and dynamic OU

[mayurSuresh]

Hello,

I am working on an Active Directory Create Account policy in SailPoint ISC and need some guidance on the best approach for generating the AD distinguishedName.

Requirement

For AD account creation, I need to generate the distinguishedName dynamically using:

CN=<generated sAMAccountName>,<dynamic target OU>

Example expected values:

CN=testuser,OU=Employees,OU=User Accounts,DC=example,DC=com

or

CN=testuser,OU=Contractors,OU=User Accounts,DC=example,DC=com

(there are more of these)

Current Create Account setup

sAMAccountName is currently generated using an Attribute Generator rule. That part works correctly, it is a more complex generation so I am using the rule to generate it and this cannot be touched,

What I tried

I created an identity attribute that resolves the target AD OU based on employee type. The identity attribute value resolves correctly on the identity side.

I then tried to reference that value in the Create Account policy distinguishedName Static value:

$adTargetOU → Identity Attribute not mapped anywhere in the policy this has a transform to dynamically get the OU based on the Employee Type. (I do realize it is kinda dumb to reference it like this but I needed something)

CN=$sAMAccountName,$adTargetOu

I also tested using an approved unused AD extension attribute as a helper attribute. I added the extension attribute to the AD account schema and mapped the OU value (identity attribute) to it and yes I did move the extension attribute above DN in the policy.

CN=$sAMAccountName,$extensionAttribute15

That also failed with:

com.sailpoint.seaspray.template.TemplateException: Invalid get reference: $extensionAttribute15 - seaspray[line 1, column 20]

So based on testing, Static distinguishedName can reference $sAMAccountName, but it does not appear able to reference the OU identity attribute or the extension attribute.

Question

What is the recommended approach in ISC for this use case?

I need the final distinguishedName to use both:

1. The generated sAMAccountName 2. A dynamic OU based on employee type

I would like to keep the rule to the very end until I have no other choice. All i need to know is:

1. Can I reference both a create account profile attribute (sAMAccountName) and a identity attribute(adTargetOu) in a create account profile attribute (distinguishedName)?
2. Why I do I ger the Invalid get reference error when I reference the extensionAttribute15 inside the distinguishedName?

Any guidance or example configuration would be appreciated.

Thank you.

[Bapu-Gogu]

For Best Practices follow below reference documents:

Best Practices: Active Directory Account Moves - Compass
Active Directory Source Configuration Reference Guide - Compass

first thing it won’t allow to map source attributes on create or update provisioning policy. if you want to populate that attribute value with identity attribute and use it in provisioning policies.

for your questions:

1. Yes, you can use identity attributes in provisioning policies like create account profile.
2. You are using source attribute(AD), thats why your facing invalid, seaspray error. it woont allow us to map account attributes in create account profile.

[mayurSuresh]

@Bapu-Gogu

Hi,

Thank you for getting back to me.

I understand the point that source/account attributes from AD should not be referenced directly in the Create Account policy, and that identity attributes should be used instead.

In my case, I am trying to confirm the correct syntax for referencing an identity attribute inside a Static value in the Create Account policy.

For example, I created an identity attribute that resolves the target AD OU value. I then tried to reference it in the distinguishedName Static value like this:

CN=$sAMAccountName,$adTargetOu

However, this failed with a Seaspray error stating that $adTargetOu(identity attribute) is an invalid reference.

The part I am trying to understand is: if identity attributes are supported in Create Account provisioning policies, what is the correct way to reference that identity attribute inside a Static/Velocity value?

Also, $sAMAccountName works successfully in the same Static distinguishedName value, but that is a Create Account policy attribute populated by a rule. So I am trying to understand the difference between referencing another Create Account policy attribute like $sAMAccountName versus referencing an identity attribute such as the target OU value.

Any example syntax would be very helpful.

Thanks,
Mayur Suresh

[Bapu-Gogu]

Ok, sAMAccountName must me top on you distinguishedName like below:

call any identity attribute directly in parathesis like $(identity attribute technical name)

[baoussounda (Ousmane N'DIAYE)]

Hi @mayurSuresh ,

We’ve a similar configuration. And we’ve also use an Identity Attribute to resolve the $adTargetOu.

You have choice to mapped the adTargetOu as an Identity Attribute in your account profile (this will be useful if you need to manage the movement beetween AD OU during the mover process) or you can just have a transforms.

The following transform should work :

In your case, you can replace $cn with $sAMAccountName, and make sure that sAMAccountName is defined before distinguishedName in the Create Account Profile.

Also, if you’re using a transform to calculate the target OU, you can reference that transform directly in the Create Account Profile instead of first storing the value in an Identity Attribute.

"ouDetails" : {
   "type": "reference",
    "attributes" : {
     "id": "yourTransformName"
}
}

[mayurSuresh]

@Bapu-Gogu

Thank you. I tested using the parentheses format with the identity attribute technical name:

CN=$sAMAccountName,$(adTargetOU) → I made sure the identity attribute is the correct technical name.

However, the provisioning plan passed the value literally as:

CN=workerts,$(adTargetOU)

and AD rejected it as an invalid distinguishedName. The identity attribute exists and resolves a full OU value on the identity. Is there a specific syntax required for referencing identity attributes inside a Static distinguishedName value, or does this only work in a generator/transform context?

Errors

Invalid name: CN=workerts,$(adTargetOU), provided nativeIdentity is not a valid distinguishedName

[Bapu-Gogu]

Try with generator:

[mayurSuresh]

@baoussounda

Thank you very much!

I did not even think of this method and it worked! I have no clue why I did not think about using a static transform it self, then reference the identity attribute.

This is great!

Thank you,

Mayur Suresh

[mayurSuresh]

@Bapu-Gogu

Thank you very much for all you help !

This also worked!

More specifically:

I really appreciate it!

Thanks guys!

Mayur Suresh