I am working on project where a customer wants a transform that builds an AD DN path dynamically based on department, region, and title. How do you approach this?

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I have already checked the document but unable to find the resolution

3

Hi Pankaj,
Thanks for quick respose.

4

Hi @MS62 ,

Please create an identity attribute and apply the below transform. This attribute can then be used as a variable in the Create Account configuration for Active Directory (AD).

Transform:

{
  "name": "DN Build",
  "type": "Concat",
  "attributes": {
    "values": [
      "CN=",
      {
        "type": "accountAttribute",
        "attributes": {
          "attributeName": "Display Name",
          "sourceName": "XYZ"
        }
      },
      ",OU=",
      {
        "type": "accountAttribute",
        "attributes": {
          "attributeName": "Department",
          "sourceName": "XYZ"
        }
      },
      ",OU=",
      {
        "type": "accountAttribute",
        "attributes": {
          "attributeName": "Region",
          "sourceName": "XYZ"
        }
      },
      ",OU=",
      {
        "type": "accountAttribute",
        "attributes": {
          "attributeName": "Title",
          "sourceName": "XYZ"
        }
      },
      ",DC=ab,DC=com"
    ]
  }
}

Once created, reference this identity attribute as a variable in the Create Account tab for AD.

If uniqueness is required, use the following naming pattern:

CN=$(firstname).$(lastname)$(uniqueCounter),$(variableName)

In this case:

  • Remove “CN=” from the transform.

  • Pass firstname and lastname in the Create Account configuration.

  • The uniqueCounter will ensure the CN value remains unique.

Please let me know if any clarification is required.

Thanks.

5

HI @Pankaj_IAM_SailPoint Surely this can be done via a Transform rather than a Rule?

6

Hi @suraj_gorle Why an Identity Attribute, when this Transform could be applied on the Account Create profile? It’s best practive to only create additional Identity Attributes when absolutely necessary. Also, an Identity attribute would restrict functionality in terms of renames and moves.

3 Likes
7

Hi @j_place ,

This is well Noted. Could you please confirm whether the generator can be used directly within the custom transform incase of uniqueness check ?

9

Thanks @Pankaj_IAM_SailPoint That’s exactly my point, but you specifically recommended a Rule above and your post has been marked as the solution.

10

Hi @suraj_gorle I’m not sure what you mean by “custom” transform, but obviously uniqueness checks can be performed on the target system using Create Unique Account ID generator

11

Hi @j_place When we will attached transform in create account profile so that attribute is shown as custom transform.

image
image800Ă—235 49 KB

Can we use generator in transform for checking uniqueness ?