Hi all, I am using a before provisioning rule to change the cn & dn of a AD account. I am not updating both at once. Its either CN or DN. Adding the snippet: accountRequest.add(new AttributeRequest("AC_NewParent", ProvisioningPlan.Operation.Add, newOU)); accountRequest.add(new AttributeRequest("…

Hi all, This has been resolved, we identified that this was happening due to AD configuration, we were using VIP configuration (which was doing it in round robin fashion) and was taking time to replicate to Other DC’s. Due to which we were getting the error where AC_NewName and AC_NewParent was not…

Hi @neeraj99 Any naming convention that matches the failed attribute updates? Wondering whether any special (to LDAP) characters in AC_NewParent or AD_NewName?

Thats the problem, There are no errors/failures. It updated properly but its just not aggregating the updated information back to ISC. On target its updated with the new information.

Yeah, appreciate no errors, but the single aggregation that occurs after rename is not, I would guess, standard code so it may not be matching any special characters in DN. I was just wondering whether you had commas or anything like that in the one’s that are not immediately aggregated back.

Ah, I can see in your screenshot that you are replacing a ‘.’ with a ', '. I also see that you have an attribute of ‘escapedCN’. Are you using javax.naming.ldap.Rdn.escapeValue() to escape the value? Single aggregation won’t work in this case, because the DN hasn’t been updated to new value.

No i am using a regex to escape any special characters. String escapedCn = generatedCn.replaceAll("([,\\\\#+<;>=])", "\\\\$1"); And, does it make any difference changing ‘.’ to ‘,’ ? because i am eventually changing the CN (which in turns automatically changes the DN).

Hi @neeraj99 From Active Directory Connector - FAQ and troubleshooting - Compass its recommended to use javax.naming.ldap.Rdn.escapeValue()

Oh i see, will make that change in next rule deployment… but for now; both are doing the same thing of escaping the characters like (, " \ etc) right? And the reason why i am saying this is to rule out the possibilities of what may be messing this up sometimes… as far as Target is concerned i can …

I understand that target is getting updated. My point is that when you use NewName/NewParent there is additional code to trigger a single aggregation of the “assumed” new DN. The assumed new DN doesn’t appear to be matching the new DN so can’t aggregate. My guess is it is because of special characte…

Ok @j_place , so letme make that change and see if that gets resolved. & Just in case to check for the OU update as well. OU’s are like this: OU=Users,OU=Active,DC=sailpoint,Dc=com So don’t need to do escaping for this OU right?

Hi Neeraj, agreed not needed for that OU. I, personally, would escape both for consistency and portability, but up to you.

New "AC_NewName" & "AC_NewParent" not aggregating back to ISC

Identity Security Cloud (ISC) ISC Discussion and Questions

neeraj99 (Neeraj Nautiyal) August 1, 2025, 8:02am 15

Hi Jeremy not yet, we have raised a sailpoint support ticket for this now.
I will keep you posted here on what comes out of that call.

1 Like

AD Deprovisioning intermittent fault

Topic		Replies	Views
New AD Account Created during AD Aggregation ISC Discussion and Questions aggregation , identity-security-cloud	7	259	December 8, 2024
Provisioning Error: "Failed to update attribute AC_NewName Error - There is no such object on the server." ISC Discussion and Questions identity-security-cloud , provisioning	14	279	August 3, 2025
AC_NewName Error ISC Discussion and Questions rules , identity-security-cloud , reports	5	576	July 29, 2024
AC_NewName being updated many times ISC Discussion and Questions	8	3286	July 19, 2023
Issues with Active Directory Connector ISC Discussion and Questions identity-security-cloud , provisioning	26	2274	January 8, 2024

New "AC_NewName" & "AC_NewParent" not aggregating back to ISC

Related topics