Move AD account between different sub-domains from the same AD connector

Hi Everyone,

We have a use case where a single AD connector is connecting to multiple child domains and for “mover” cases, we need to move users from one child domain to another.

To achieve the movement between child domains, AD account from old child domain needs to be disabled, the AD account from old child domain needs to be uncorrelated from the identity and new AD account in the new child domain has to be created. We want to achieve this on a single “mover” event from Authoritative source.

Wanted to check if any suggestions/ideas to handle this.

Thanks,
Shailee

Hi,

Where there is an AD account existing already, ISC will not be able to trigger new AD account creation. We need to handle it from powershell script.

We need to create a powershell script for all the scenarios (disabling AD, creating new AD account) and in after operation rule we can invoke the powershell script.

We should add a correlation logic such that the newly created account correlates to Identity after aggregation.

This is one approach we can follow.

-Abhinov

1 Like

@shaileeM And what about the old account? we should leave as it is?

I would say change the DN for existing account instead of creating new one.

Anyway for your requirement.

  1. You can use Before Provisioning Rule
  2. Workflow to disable and to create new account
  3. Have an attribute sync for mover, use some AD attribute for it. Make use of Native Rules.

For uncorrelation, you need to change the values for attributes that are used for correlation. You can append _old for the existing values.

Thanks
Krish

4 Likes

Hi Abhinov,

Yes, old account should be left as disabled in the old domain. Shouldn’t rename the old account ADID.

Hi @KRM7 , we cannot rename the attributes of the old account that are used for correlation, so cannot rely on uncorrelation in this way. Is there any other way to uncorrelate

Thanks,
Shailee

Hello there,

I did not test it yet, but what about patching the account by setting the “uncorrelated” attribute to true?
Would this have the desired effect?

Hi,

You cannot update the uncorrelated attribute of the account.

We can only update “manually correlated” attribute but it would not suffice our requirement here.

One thing you can do is update the identityId of the account. This will un-correlate the account from current identity and correlate the account to new Identity.

-Abhinov

1 Like

Hi @Abhinov7 ,

There is one problem with updating identityId. We cannot update it to empty.

We cannot empty it. We can create a dummy identity or so and correlate all these accounts to it.

-Abhinov

Have you tried setting the ‘OU=Disabled’ to an root that is not brought in via the aggregation?
That will uncorrelate it from the cube. The downside is that if you need to re-enable it at a later date, it will have to be a manual process, as Sailpoint won’t be able to see it.
I do agree with Krishna that it would be an easier solution just to rename the existing DN

Thanks
Phil

Thank you @phil_awlings . I do understand both the possible approaches:

  1. Renaming the existing DN value for the old account
  2. Removing OU=Disabled from the aggregation

However, both of them are not possible here.

Is there a way to create a new account in the new sub-domain on the same connector without uncorrelation of the old account

Thanks,
Shailee

Use the afterModify Connector Rule to create a new account via Powershell.

I can’t think of another way for Sailpoint to create an account if one already exists on the cube

You will have to update all transforms that reference to that source to check if the sub-account is enabled/disabled or when.created otherwise Sailpoint won’t know which of the two accounts it needs to update

Phil

Thank you @phil_awlings @KRM7 @Abhinov7 for your quick responses.

To sum up -

Option 1 - Do not uncorrelate old account:
1. Disable the old account using disable PP
2. Using AfterModify Connector Rule and powershell scripts, create the new account in the new domain
3. Update references to the source to ensure new account is updated for any modifications

Option 2 - Uncorrelate old account:
1. Disable the old account using disable PP
2. Uncorrelate the old account from the Identity -
a. either change the correlation attribute value
OR
b. use API to update identityId value
3. Using AfterModify Connector Rule and powershell scripts, create the new account in the new domain

I believe there is no other possible way for Option2: 2

We usually maintain an obsolete Identity to correlate Service Accounts and for some other purposes. You can correlate these account as well to that Identity.

But please note that max of 100 accounts you can correlate to an identity.

Thanks
Krish

2 Likes

Hi @KRM7 , How about using remove account API to uncorrelate the account.

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.