In IDN how can customization rule be added to active directory

Identity Security Cloud (ISC) ISC Discussion and Questions
1

How to add customization rule to add custom attribute in active directory.

2

Hey @k_diksha, if you’re trying to provision to or update an attribute in Active Directory from the Identity, you can do that through expanding the Account Schema for your Active Directory source.

Go to Sources → Active Directory → Import Data tab → Account Schema → Add New Attribute

After adding the attribute, you can then include it in your Create Profile/Provisioning Policy and configure it for Attribute Sync (if it is utilizing an identity attribute for initial provisioning in the Create Profile/Provisioning Policy).

Is this what you are trying to accomplish?

3

Hi @brennenscott
I am trying to create additional attribute but in order to do that i have build logic to convert lastlogonTimestamp to humanreadable format in customization rule, so how can I add customization rule which will have logic of simpledateformat.

4

Hey @k_diksha, I think what you’re looking for is the building of a custom transform, not a rule. In this case, you will want to use the date-related transforms: Date Format, Date Compare, and Date Math.

Below is an example that may help get you started:

{
    "name": "AD_lastLogonTimestamp_Conversion",
    "attributes": {
        "inputFormat": "EPOCH_TIME_WIN32",
        "outputFormat": "yyyy-MM-dd"
    },
    "type": "dateFormat"
}

After you have created this transform, you would then use it in an Identity Profile mapping like so:

image
image1211×138 3.61 KB

This will then result in the Identity Attribute “Last Logon” displaying the user’s lastLogonTimestamp but in the format of yyyy-MM-dd:

image
image1275×44 800 Bytes

Does this help, or is there something else you’re trying to accomplish?

5

Hi Brennen,

We can use this if AD source is part of Identity Profile/authoritative source. How can we achieve this if the source is non-authoritative/not a part of identity profile?

6

Hi @sameer_raghuraj, the steps provided in my last reply would not set Active Directory as an authoritative source. The only way Active Directory–or any other source for that matter–would become an authoritative source is if it is the “Account Source” in the Identity Profile settings tab is set to that source, as seen below:

image
image1515×505 21.4 KB

You can use any source and attribute within the Identity Profile mappings. As long as the Identity has an account on that source and that attribute has a value, it will show up in the Identity Details. If the Identity does not have an account on that source or that attribute is null, then the Identity attribute will just show an empty value or not appear.

If you are asking if there is a way to convert this date format in the account itself and not in the Identity as an attribute, then I do not know if that is possible and would have to defer to someone else.