Error on Active Directory Attribute Sync, doubled value on the request

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hey guys.

I am currently working on a before modify rule for Active Directory.
I have Department mapped on Attribute Sync:

image
image1366×677 40.5 KB

When I update the Department for the identity, I get this error:

<AccountRequest application="Active Directory [source]" op="Modify" nativeIdentity="<dn>">
  <AttributeRequest op="Add" name="department">
    <Value>
      <List>
        <String>Nucleo Digital</String>
        <String>Farma</String>
      </List>
    </Value>
  </AttributeRequest>
  <AttributeRequest op="Add" name="AC_NewParent" value="<ou>" />
  <AttributeRequest op="Add" name="AC_NewName" value="<cn>" />

Where “Nucleo Digital“ is the original value, and “Farma“ the new one.

This is the Update Provisioning Policy:

{
    "name": "Update Account",
    "description": null,
    "usageType": "UPDATE",
    "fields": [
        {
            "name": "manager",
            "transform": {
                "type": "rule",
                "attributes": {
                    "name": "Get Manager LDAP DN"
                }
            },
            "attributes": {
                "cloudRequired": "true"
            },
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        },
        {
            "name": "AC_NewParent",
            "transform": {
                "type": "identityAttribute",
                "attributes": {
                    "name": "ou"
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        },
        {
            "name": "AC_NewName",
            "transform": {
                "type": "identityAttribute",
                "attributes": {
                    "name": "cn"
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        }
    ]
}

Have you guys ever seen an error like this?
Thanks in advance!

2

Ho @Caio_Nakayama Could you share the account schema for Department?

3

Just as a heads up, EVERY time there is ANY change on the account, it will try to run the OU move. You might want to put a check in there so its only tries to move when there is a difference between where it is and where it should be

4

Hey, Jeremy. We are using the default schema:

image
image1903×992 53.3 KB

        {
            "name": "department",
            "transform": {
                "type": "identityAttribute",
                "attributes": {
                    "name": "department"
                }
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
        }
5

Hey, Phil.

Do you know if there is a way of doing this only using transforms and the provisioning policy? We can’t develop a cloud rule for that now

6

Hi,
Check out this thread that has my code in:
Substring Transform within Workflow - Identity Security Cloud (ISC) / ISC Discussion and Questions - SailPoint Developer Community

7

Hi @Caio_Nakayama What is the actual error message and/or what is the outcome in AD? Also, have you had any failed attribute syncs which it may be attempting to retry?

8

Hello @Caio_Nakayama,

I’m not sure there’s an error in your initial post. What you shared is the Provisioning Plan

I believe the fact that the data is multivalued is because it’s multivalued on the identity level (thus it is so on the authoritative source(s) level). If that’s the case, you might need to recheck how you’re aggregating your data and your data quality.

I’m also aligned with @phil_awlings’s perspective about the new parent and new name, the solution he shared is interesting. But if you can deploy a Service Standard Before Provisioning Rule that will be better as it can be reused for any other source.

Good luck :wink:,

9

Hi @WhiteBat Sidebar: not sure you can have multi valued attributes on the identity?

10

This is the result:

<ServiceResult>
<Errors>
<List>
<String>Failed to update attributes for identity <dn>. The specified directory service attribute or value already exists.
</String>
</List>
</Errors>
<Attributes>
<Map>
<entry key="requestProcessedOn" value="8/15/2025 4:34:00 PM" />
<entry key="returnRequest">
<value>
<AccountRequest application="Active Directory [source]" op="Modify" nativeIdentity="<dn>">
<AttributeRequest op="Add" name="department">
<Value>
<List>
<String>Nucleo Digital</String>
<String>Farma</String>
</List>
</Value>
<ProvisioningResult status="failed">
<Errors>
<Message type="Error" key="Failed to update attribute department Error - The specified directory service attribute or value already exists.&#xD;&#xA;" />
</Errors>
</ProvisioningResult>
</AttributeRequest>
<AttributeRequest op="Add" name="AC_NewParent" value="<ou>">
<ProvisioningResult status="committed" />
</AttributeRequest>
<AttributeRequest op="Add" name="AC_NewName" value="<cn>">
<ProvisioningResult status="committed" />
</AttributeRequest>
</AccountRequest>
</value>
</entry>
<entry key="atleastOneAttrReqFulfilled">
<value>
<Boolean>true</Boolean>
</value>
</entry>
<entry key="distinguishedName" value="<dn>" />
<entry key="createdOnServer" value="" />
</Map>
</Attributes>
</ServiceResult>

The problem is, the department is not a multi-valued attribute:

image
image1892×987 46 KB

I’m using this api to update the account on the auth source:

  {
    "op": "replace",
    "path": "/attributes/Departamento",
    "value": ""
  }

I don’t why it is trying to sync it as multi value.

11

Sounds odd right ?
I had some cases where the attribute has comma separated values on the identity level (type String not List) and when pushed to the target application, it was parsed as a List.

Had a big issue for a client that was pushing a Json object inside a String but SailPoint kept parsing it as an Object so instead of :

{“data”: “{1:2, 3:4}”}
it was :
{“data” : { 1:2 , 3:4} }

12

Seems clearer now @Caio_Nakayama ,

Can you now go to the search and write this query : sources:"Active Directory" and find the result of type Account Activity corresponding to that request then click on the source on the left side of the result: Active Directory and share with us the result (it should be the provisioning plan sent to your AD)

13

Hi @Caio_Nakayama Try removing the update policy to isolate the issue. Get it to a point where it is just doing attribute sync

14

I removed everything from the update policy and this is the result from the query that @WhiteBat passed:

image
image1040×621 28.3 KB

15

Is this supposed to happen?
I deleted the update policy and unmarked the attributes from attribute sync, but it still tries to update as multi valued:

image
image1903×995 61.1 KB

image
image1032×987 30.8 KB