Is it possible to use usernameGenerator within a firstValid to write out an Identity Value?

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

It may just be me, in addressing the syntax or logic somewhere, but the usernameGenerator doesn’t seem to be working, where the other firstValid evaluations seem to be working. Is it supported when we are writing to an Identity Attribute rather than an account attribute?

HR Source stores the login ID.
If it is a new user we want a unique login id generated.
We are trying to keep the sAMAccountName down to 10 characters.

If this isn’t supported, how do you reference the UPN, DN, email; etc for the account creation when the generated ID is being generated at the same time?

If it is supported, any ideas on where my logic is failing?
Any tricks on evaluating it through vscode?
Does the velocity engine have anything that can be used to evaluate for a unique name?

{
    "id": "543d902b-c826-440a-9152-7699dec947fb",
    "name": "SB-sAMAccountName-TST",
    "type": "firstValid",
    "attributes": {
        "values": [
            {
                "type": "accountAttribute",
                "attributes": {
                    "sourceName": "SB AD",
                    "attributeName": "sAMAccountName"
                }
            },
            {
                "type": "accountAttribute",
                "attributes": {
                    "sourceName": "TST",
                    "attributeName": "LOGIN_ID"
                }
            },
            {
                "type": "usernameGenerator",
                "attributes": {
                    "sourceCheck": false,
                    "patterns": [
                        "$combined",
                        "$combined${uniqueCounter}"
                    ],
                    "ln": {
                        "type": "identityAttribute",
                        "attributes": {
                            "name": "lastname"
                        }
                    },
                    "fi": {
                        "type": "substring",
                        "attributes": {
                            "input": {
                                "type": "identityAttribute",
                                "attributes": {
                                    "name": "firstname"
                                }
                            }
                        },
                        "begin": 0,
                        "end": 1
                    },
                    "mi": {
                        "type": "substring",
                        "attributes": {
                            "input": {
                                "type": "identityAttribute",
                                "attributes": {
                                    "name": "middlename"
                                }
                            },
                            "begin": 0,
                            "end": 1
                        }
                    },
                    "combined": {
                        "type": "substring",
                        "attributes": {
                            "begin": 0,
                            "end": 9,
                            "values": "$fi$mi$ln"
                        }
                    }
                }
            },
            {
                "attributes": {
                    "sourceName": "TST",
                    "attributeName": "FILENUMBER"
                },
                "type": "accountAttribute"
            }
        ]
    },
    "internal": false
}
2

Try this for usernameGenerator

{
   "type": "usernameGenerator",
   "attributes": {
      "sourceCheck": false,
      "patterns": [
         "$combined",
         "$combined${uniqueCounter}"
      ],
      "combined": {
         "type": "substring",
         "attributes": {
            "begin": 0,
            "end": 9,
            "input": {
               "type": "static",
               "attributes": {
                  "value": "$fi$mi$ln",
                  "ln": {
                     "type": "identityAttribute",
                     "attributes": {
                        "name": "lastname"
                     }
                  },
                  "fi": {
                     "type": "substring",
                     "attributes": {
                        "input": {
                           "type": "identityAttribute",
                           "attributes": {
                              "name": "firstname"
                           }
                        },
                        "begin": 0,
                        "end": 1
                     }
                  },
                  "mi": {
                     "type": "substring",
                     "attributes": {
                        "input": {
                           "type": "identityAttribute",
                           "attributes": {
                              "name": "middlename"
                           }
                        },
                        "begin": 0,
                        "end": 1
                     }
                  }
               }
            }
         }
      }
   }
}
3

Your logic makes sense, but it didn’t produce any results, it processed the last evaluation rather than the usernameGenerator. No error reported.

4

Hi @ts_fpatterson,

This is not a perfect solution but could you try this:

{
    "id": "543d902b-c826-440a-9152-7699dec947fb",
    "name": "SB-sAMAccountName-TST",
    "type": "usernameGenerator",
    "attributes": {
        "sourceCheck": false,
        "patterns": [
            "$samName",
            "$loginID",
            "$FiMiLn",
            "$fileNum",
            "$FiMiLn${uniqueCounter}"
        ],
        "FiMiLn": {
            "type": "substring",
            "attributes": {
                "begin": 0,
                "end": 9,
                "input": {
                    "type": "static",
                    "attributes": {
                        "value": "$fi$mi$ln",
                        "ln": {
                            "type": "accountAttribute",
                            "attributes": {
                                "sourceName": "HR Source",
                                "attributeName": "lastname"
                            }
                        },
                        "fi": {
                            "type": "substring",
                            "attributes": {
                                "input": {
                                    "type": "accountAttribute",
                                    "attributes": {
                                        "sourceName": "HR Source",
                                        "attributeName": "firstname"
                                    }
                                },
                                "begin": 0,
                                "end": 1
                            }
                        },
                        "mi": {
                            "type": "substring",
                            "attributes": {
                                "input": {
                                    "type": "accountAttribute",
                                    "attributes": {
                                        "sourceName": "HR Source",
                                        "attributeName": "middlename"
                                    }
                                },
                                "begin": 0,
                                "end": 1
                            }
                        }
                    }
                }
            }
        },
        "samName": {
            "type": "accountAttribute",
            "attributes": {
                "sourceName": "SB AD",
                "attributeName": "sAMAccountName"
            }
        },
        "loginID": {
            "type": "accountAttribute",
            "attributes": {
                "sourceName": "TST",
                "attributeName": "LOGIN_ID"
            }
        },
        "fileNum": {
            "attributes": {
                "sourceName": "TST",
                "attributeName": "FILENUMBER"
            },
            "type": "accountAttribute"
        }
    },
    "internal": false
}

Changes:

  • Converted Identity Attribute transforms to Account attribute transforms (requires update to sourceName attribute)
  • Created custom variables inside the username generator transform

Note: The last first valid condition would have to be moved up (since unique counter must only be used in the last pattern).

If the transform works, you might have to reconsider some of the logic implemented.

Else, custom patterns would have to be created (such as $FiMiLN1, $FiMiLN2, $FiMiLN3, etc.)

Hope this helps!

5

One source indicated that this is too costly as we would be evaluating sAMAccountName on each aggregation.

Is there by chance any property setting that would prevent an evaluation if the IDN attribute already exists?

6

Hi @ts_fpatterson,

The Username Generator transform should only be used in the Account Create Profile configuration.

Currently, there isn’t a straighforward method to meet your requirements.

You can look into using the Random Numeric Transform in a nested transform as a workaround.

If anything comes up during research, I will update the thread :+1:

1 Like
7

We are working on a rule for this.

8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.