Error rendering template: Nested Conditional Transform failing on AD Move logic

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hi Community,

I am working on a transform to move users to specific “Disabled” OUs based on their distinguishedName and cloudLifecycleState.

The Goal:

  1. If the user is terminated or manualTerminated:

    • Check if their current AD DN contains “india”.

    • If yes: Move to the India Disabled OU.

    • If no: Move to the USA Disabled OU.

  2. If they are active, return their current distinguishedName.

The Issue: I keep receiving an “Error rendering template” or “Exception while calculating value.” I suspect it is related to how variables are passed into the nested positiveCondition or how null values are handled for users without an AD account.

Here’s the current JSON:

{
    "name": "Disabled Ou Movement - Transform",
    "type": "conditional",
    "attributes": {
        "expression": "$cloudLifecycleState == 'terminated' || $cloudLifecycleState == 'manualTerminated'",
        "positiveCondition": {
            "type": "conditional",
            "attributes": {
                "dn": {
                    "type": "accountAttribute",
                    "attributes": {
                        "sourceName": "Active Directory",
                        "attributeName": "distinguishedName"
                    }
                },
                "sAMAccountName": {
                    "type": "accountAttribute",
                    "attributes": {
                        "sourceName": "Active Directory",
                        "attributeName": "sAMAccountName"
                    }
                },
                "expression": "dn.toLowerCase().contains('india')",
                "positiveCondition": {
                    "type": "static",
                    "attributes": {
                        "value": "CN=$sAMAccountName,OU=Disabled Accounts,OU=Users,OU=India,DC=spdev,DC=local"
                    }
                },
                "negativeCondition": {
                    "type": "static",
                    "attributes": {
                        "value": "CN=$sAMAccountName,OU=Disabled Accounts,OU=Users,OU=USA,DC=spdev,DC=local"
                    }
                }
            }
        },
        "negativeCondition": {
            "type": "accountAttribute",
            "attributes": {
                "sourceName": "Active Directory",
                "attributeName": "distinguishedName"
            }
        }
    }
}

Questions for the experts:

  1. Do I need to re-declare sAMAccountName and dn inside the nested positiveCondition attributes block?

  2. How can I safely handle the .contains() check if the distinguishedName attribute is null for a specific user?

  3. Is there a more efficient way to achieve this using a single static transform with Velocity instead of nested conditionals?

Any guidance would be greatly appreciated!

2

Hi @testipona

I will simply it with by using only static :

{
  "name": "Disabled Ou Movement - Transform",
  "type": "static",
  "attributes": {
    "cloudLCS": {
      "type": "identityAttribute",
      "attributes": {
        "name": "cloudLifecycleState"
      }
    },
    "dn": {
      "type": "accountAttribute",
      "attributes": {
        "sourceName": "Active Directory",
        "attributeName": "distinguishedName"
      }
    },
    "sAMAccountName": {
      "type": "accountAttribute",
      "attributes": {
        "sourceName": "Active Directory",
        "attributeName": "sAMAccountName"
      }
    },

    "indiaOU": {
      "type": "static",
      "attributes": {
        "value": "OU=Disabled Accounts,OU=Users,OU=India,DC=spdev,DC=local"
      }
    },

    "usaOU": {
      "type": "static",
      "attributes": {
        "value": "OU=Disabled Accounts,OU=Users,OU=USA,DC=spdev,DC=local"
      }
    },

    "value": "#if($cloudLCS == 'terminated' || $cloudLCS == 'manualTerminated') #if($dn && $dn.toLowerCase().contains('dc=india')) CN=$sAMAccountName,$indiaOU #else CN=$sAMAccountName,$usaOU #end #else $dn #end"
  },
  "internal": false
}
3

Hi @baoussounda , thank you for this! We were able to successfully change the DN value using the code. It also correctly retrieves the existing DN when neither condition is met. We truly appreciate your help, thank you so much!