We are setting the proxyaddresses in AD. The JSON has been updated to allow multiple values. However, when setting static values I’m not sure of the syntax to use.
If I have the static value set to: {SMTP:[email protected],smtp:[email protected]} to generates multipe values, but retains the curly braces. I have tried quotation marks, which keeps only one value with the full string, ignoring the comma delimited value setting.
When you set it to multi, it converts back to isMultiValued. I tried it again using multi and running it through, and when I went back to set it to isMultiValued, it was already set. My assumption is that SailPoint is updating all with multi to the new value. Although it is also defaulting it to false.
I tried using a different delimiter with no success. The symptoms are the same where the delimiter is removed but only the first value is populated.
If I set the static value enclosed in curly braces, it populates both values as independent values in AD however the curly braces remain. The opening curly brace on the first value, the closing brace on the second value and the delimiter not showing on either value.
My assumption at this point is that we need a specific syntax when setting the static value on the account creation, or this is a bug that needs to be fixed.
It does appear that this behavior is an issue with the values being the same, even though the case is different on the “SMTP” vs “smtp”.
The provisioning plan does correctly contain both values:
But the result is as you said, only one get’s added. There appears to be a check if you try to do the same using Active Directory Users and Computers, you get this prompt to confirm you want to add the same value twice.
This makes sense to me since, as I understand it, the upper case is just signifying the main email address. What is the requirement to add it again?
When using different values in the provisioning plan, either of these syntaxes worked:
So it seems that somewhere either the IQ service eliminates case insensitive duplicates for this attribute or a windows policy is not allowing the same case-insensitive value. the iqservice logs have no error of any kind. I’m not aware of any setting in the iqservice to change this.
If you do have a requirement for the email to be added in both “SMTP” and “smtp” form, you could possibly do this using an after create script, assuming there are no restrictions to do this using powershell.
note: I did find this bullet point below in the AD documentation. It doesn’t mention the proxyAddresses attribute but I thought it was relevant to mention it here.
For the Active Directory source, the mailNickname, homeMBD, and msExchHideFromAddressLists attributes are case insensitive when processed by the IQService.
