How can i create ad account in Joiner workflow without form

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Which IIQ version are you inquiring about?

Version 8.3

Please share any images or screenshots, if relevant.

2023-10-12 102150.png
2023-10-12 102150.png1880×262 6.71 KB

2024-01-25 164933.png
2024-01-25 164933.png1274×409 6.22 KB

Share all details related to your problem, including any error messages you may have received.

I made Joiner business process in IIQ.

After HR aggregation, But ad provisioning is pending.
I found interactions in access request result page.

How can i create ad account in Joiner workflow without form.

below provisioning plan

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<ProvisioningPlan nativeIdentity="ahn19" targetIntegration="UClick AD3">
  <AccountRequest application="UClick AD3" nativeIdentity="CN=ahn19,OU=Staff,DC=hoon,DC=com" op="Create">
    <AttributeRequest name="cn" op="Add" value="ahn19"/>
    <AttributeRequest name="distinguishedName" op="Add" value="CN=ahn19,OU=Staff,DC=hoon,DC=com"/>
    <AttributeRequest name="sAMAccountName" op="Set" value="ahn19"/>
    <AttributeRequest name="ObjectType" op="Set" value="User"/>
    <AttributeRequest name="password" op="Set" value="NTbDl^Z,168mmy*"/>
    <AttributeRequest name="memberOf" op="Add" value="CN=SE_Service,OU=Staff,DC=hoon,DC=com"/>
  </AccountRequest>
</ProvisioningPlan>
4

@Ahn,

Please share the joiner business process design.

5

Please check provisioning policy for AD application. If for this attributes you don’t have authoritative selected for them.

6

Thanks for reply

I attached.

workflow.txt (8.5 KB)

7

Thanks for reply.

AD is not authoritative application.

HR(csv) is authoritative application.

I want to provion ad account after HR aggregation with Joiner business process.

8

It’s not about AD being authoritative application - on the provisioning policy you can select each field as authoritative.

9

Thanks.

Now the input form does not appear.

but. pending and A Manual Changes work item appears.

스크린샷 2024-01-26 153407
스크린샷 2024-01-26 1534071882×760 29 KB

10

Check In the xml of ad app if in featuresString attribute you have PROVISIONING

11

I checked featuresString.

Is there anything else to check?

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE Application PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<Application connector="sailpoint.connector.ADLDAPConnector" created="1706149546830" featuresString="PROVISIONING, SYNC_PROVISIONING, AUTHENTICATE, MANAGER_LOOKUP, SEARCH, UNSTRUCTURED_TARGETS, UNLOCK, ENABLE, PASSWORD, CURRENT_PASSWORD" icon="directory1Icon" id="c0a800e38d0c19d9818d3e700b4e3afe" modified="1706250521355" name="Uclick AD3" profileClass="" type="Active Directory - Direct">
  <Attributes>
12

Hi @kyunghoon ,

I have made couple of changes to your workflow. Please import and test.
Please confirm if it’s working.
Also mark it as solved.

Thank you!
workflow.txt (8.7 KB)

13

Thanks for help.

Your workflow is same error.

so, I tried to test in another IIQ.

It was confirmed that provisoing was performed normally at IIQ elsewhere.

Maybe it didn’t work because my IIQ suffered from many tests.
Thank you again for your help.

14

Perfect!!
Please mark it as solved

15

bad news.

I installed new IIQ and add HR,AD.

but, The same error occured.

스크린샷 2024-01-29 173920
스크린샷 2024-01-29 1739201886×727 29.3 KB

16

Can you share the application.xml for Uclick AD5

17

Thanks for reply.

I attached.

application.txt (35.0 KB)

I installed new tomcat with port 9090 and new IIQ.

But, same error occured.

18

As far as I see your provisioning policy does not contain any logic to generate attribute values needed to execute provisioning. Could you please also show part of code from which you are triggering this operation?

19

workflow.txt (8.7 KB)

could you see this business procesa?

thanks.

20

Check this one, you don’t need to add authoritative=“true” here.

21

@kyunghoon - I can see you have defined all the field as authoritative. Kindly uncheck the same in Application – Provisioning Policy Form.

image
image2052×71 21 KB

22

I unchecked authoritative setting on my laptop. and same error occured.

But, I succeeded provisioning to AD from another PC with same setting.

I think there was a problem when I installed and tested several IIQs on my laptop.

Thanks to you, I learned a lot.

1 Like