Proxyaddress sync from secondarymail

SailPoint Human Fabric (SHF) SHF Discussion and Questions
, , ,
1

Hi,

We have a requirement to raise a secondary email role request.

Once the request is completed, we need to add the secondary email to the proxyAddresses attribute. To achieve this, we created a secondaryMail attribute on the identity profile, which syncs to the AD proxyAddresses. Once the role is updated, we update the secondaryMail attribute on the identity.

In the Before Provisioning rule, we get the existing proxyAddresses and append the new secondary email address to them. I need to keep the secondaryMail attribute and proxyAddresses identical so that multiple modify events are not triggered.

Currently, secondaryMail is a comma-separated string attribute. However, when fetching the multi-valued proxyAddresses attribute from AD, the transform just returns a single string from the array list of proxy addresses.

How can we resolve this issue? and avoid multiple modify event.

Regards,
Sumit

2

Hello @sukarande ,

This can be achieved "After Modify Native Rule ", Pass the secondary email address from the Before Provisioning rule as an argument in the provisioning plan.

Then in After modify rule (PowerShell Rule) get secondary email from provisioning plan use AD commands to update the proxyAddresses .

# Variables
$SamAccountName = $nativeIdentity
$SecondaryEmail = <Extract it from plan>

# Get user
$user = Get-ADUser -Identity $SamAccountName -Properties proxyAddresses

# Add secondary SMTP address if it does not already exist
if ($user.proxyAddresses -notcontains "smtp:$SecondaryEmail") {
    Set-ADUser -Identity $SamAccountName -Add @{
        proxyAddresses = "smtp:$SecondaryEmail"
    }
    Write-Host "Secondary SMTP address added successfully."
}
else {
    Write-Host "Secondary SMTP address already exists."
}
3

Hello SUmit. The problem is that secondaryMail is a single identity value, while AD proxyAddresses is multi-valued. Trying to synchronize them directly can cause ISC to keep detecting a mismatch because the two are represented differently. Ordering, case, or serialization differences can also prevent an exact comparison even when the intended address is already present.

The Attribute Sync documentation notes that multi-valued sync requires custom rules and cautions against syncing attributes also modified by rules, since this creates a repeated synchronization loop.

Remove proxyAddresses from standard Attribute Sync and use secondaryMail only as the alias to add. A Before Provisioning Rule can only modify an existing plan, so another AD provisioning event is still required. If the role provisions a group or entitlement on the same AD source, that plan can act as the trigger, provided secondaryMail is already populated when the rule executes.

Inside the correctly scoped AD AccountRequest, the append logic would look like this:

Identity identity = plan.getIdentity();
String secondaryEmail =
    identity != null
        ? identity.getStringAttribute("secondaryMail")
        : null;

if (secondaryEmail != null && !secondaryEmail.trim().isEmpty()) {
    List proxyList = new ArrayList();
    proxyList.add("smtp:" + secondaryEmail.trim().toLowerCase());

    accountRequest.add(new AttributeRequest(
        "proxyAddresses",
        ProvisioningPlan.Operation.Add,
        proxyList));
}

The rule must identify the intended Modify request and verify the alias isn’t already present before adding it. Operation.Add avoids replacing the full proxyAddresses list, and removing it from Attribute Sync eliminates the comparison loop.