Native Identity should not be null or empty

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi,

I’m facing a problem with AD account provisioning, both in automatic and manual mode. When it tries the account creation I recieve this error: Native Identity should not be null or empty.

The process starts with the accounts aggregation from HCM authoritative source, it creates the correspondents accounts and identities and then it should starts the AD account provisioning thanks to the association of a role with some entitlements from AD but it goes in error.

I tried to manually request entitlements from AD source in order to trigger the provisiong phase but it gives me back the same error.

Can you help me with this problem? Thanks in advance

2

identity Mapping Configuration:

  • Ensure that the identity mapping from your authoritative source (HCM) to SailPoint IdentityNow is correctly set up.
  • Verify that the mapping rules are correctly associating the relevant identity attributes from HCM to SailPoint and then from SailPoint to AD
3

Can you let me know if you’ve configured the distinguishedName field on your Create Account page of Active Directory source correctly?

Can you help me with what value you’re passing in it?

4

Can you check whether multiple AD accounts are correlated from same source to an identity? If so, resolve it by correlate only one account and try the provisioning. It could resolve the issue. I know you are saying it gets failed during account creation, but it is worth to verify it.

5

It gets the value from an Identity Attribute that returns the value of this transform:

{
        "name": "Transform OU Concatenation",
        "type": "concat",
        "attributes": {
            "values": [
                "CN=",
                {
                    "attributes": {
                        "sourceName": "HR Oracle HCM Cloud (Source)",
                        "attributeName": "Person_Last_Name"
                    },
                    "type": "accountAttribute"
                },
                " ",
                {
                    "attributes": {
                        "sourceName": "HR Oracle HCM Cloud (Source)",
                        "attributeName": "Person_First_Name"
                    },
                    "type": "accountAttribute"
                },
                ",OU=",
                {
                    "type": "static",
                    "attributes": {
                        "value": "$identity.getStringAttribute('locationIdAlias')"
                    }
                },
                ",OU=",
                {
                    "type": "static",
                    "attributes": {
                        "value": "$identity.getStringAttribute('countryIso2char')"
                    }
                },
                ",OU=",
                {
                    "type": "static",
                    "attributes": {
                        "value": "$identity.getStringAttribute('ouIdentityType')"
                    }
                },
                ",OU=Users,OU=",
                {
                    "type": "static",
                    "attributes": {
                        "value": "$identity.getStringAttribute('legalEmployerAlias')"
                    }
                },
                ",OU=Customer Objects,OU=TestOU,DC=CAAUTOBANK,DC=GCA"
            ]
        }
    }
6

The correlation is done between the sAMAccountname on AD side and the Sailpoint username on Identity side, so the account should be unique

7

@l_pulignano try to use the transform at identity level and use that attribute(adou) in the create account some thing like this
CN=$(firstname).$(lastname)$(uniqueCounter),$adou

8

With the logic you mentioned, you can directly configure the create profile with “Create Unique Account ID” generator for distinguishedName with the below format considering that your “Person_Last_Name” and “Person_First_Name” are linked lastname and firstname identity attribtues.

CN=$(firstname) $(lastname)$(uniqueCounter),OU=$(locationIdAlias),OU=$(countryIso2char),OU=$(ouIdentityType),OU=Users,OU=$(legalEmployerAlias),U=Customer Objects,OU=TestOU,DC=CAAUTOBANK,DC=GCA

9

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.