Regarding update AD source Account password in before provisioning rule

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi Team,

Issue Summary: I am encountering a RuleExecutionException (BSFException) during a BeforeProvisioning Rule for an Active Directory application. The rule logic appears to execute and complete based on my log statements, but IdentityNow throws an exception immediately after the rule returns, preventing the provisioning plan from proceeding.

Code Snippet:

// Inside BeforeProvisioning Rule
if (accountRequest != null) {
    // Logic to generate/retrieve password exists here
    accountRequest.add(new AttributeRequest("password", ProvisioningPlan.Operation.Set, password));
}

Observed Behavior:

  • Logs: Custom log.debug statements immediately before the return show the password variable is populated and the script reaches the end.

  • Error: RuleExecutionException (ruleName=XXXXXXXBPRule): BSFException: BeanShell script error: Sourced file: inline evaluation of...

  • Environment: SailPoint IdentityNow (Active Directory Direct Connector).

Questions:

 Is it possible update ad source account password by using the above code?

  1. Is "password" the correct attribute name for the AD Connector in a BP Rule?

  2. Does the Provisioning Engine require a specific Object Type for the password value in this context?

  3. Could this error be caused by a schema violation if a “password” attribute isn’t explicitly defined in the AD Application Schema?

Any advice will be very grateful. Thank you in advance.

2

Hi @Zhenxiong,

To answer your questions:

  1. Yes this is the correct attribute.
  2. No specific object is required.
  3. I don’t think so.

Would it be possible for you to share complete rule here, make sure to remove sensitive info if any.

3

Hi @UjjwalJain ,

Thank you so much for your help. This is code

import sailpoint.object.ProvisioningPlan;
import sailpoint.object.ProvisioningPlan.AccountRequest;
import sailpoint.object.ProvisioningPlan.AttributeRequest;
import sailpoint.object.ProvisioningPlan.*;
import sailpoint.object.*;
import sailpoint.object.Identity;
import java.util.*;
import java.io.*;
import java.security.*;
import sailpoint.object.Application;
import sailpoint.server.IdnRuleUtil;
import java.security.SecureRandom;
import sailpoint.tools.Util;
import sailpoint.object.*;
import java.util.List;
import java.util.*;
import java.util.Map;
import sailpoint.rule.Account;
import org.apache.commons.logging.Log;

public boolean isArrayList(Object obj) {
    return obj instanceof ArrayList;
}

Identity identity = plan.getIdentity();

List accountRequests = plan.getAccountRequests();

if (accountRequests != null) {
	for(AccountRequest accountRequest : accountRequests) {
		if (AccountRequest.Operation.Modify.equals(accountRequest.getOperation())) {
			passwordResetValidation(identity, accountRequest, log);

		}
} else {
    log.error("Rule:XXXXXXDBPRule - AccountRequests list is null. Skipping iteration.");
}
4

Also share the whole error that you are encountering.

5

Hi @UjjwalJain

This is the error message

[
“RuleExecutionException (ruleName=XXXXXBPRule): BSFException: BeanShell script error: Sourced file: inline evaluation of: import sailpoint.object.ProvisioningPlan; import sailpoint.object.Provisioni . . . '' unknown error: null : at Line: 291 : in file: inline evaluation of: import sailpoint.object.ProvisioningPlan; import sailpoint.object.Provisioni . . . ‘’ : if ( accountRequests != null ) { \n BSF info: XXXXXBPRule at line: 0 column: columnNo, caused by org.apache.bsf.BSFException: BeanShell script error: Sourced file: inline evaluation of: import sailpoint.object.ProvisioningPlan; import sailpoint.object.Provisioni . . . '' unknown error: null : at Line: 291 : in file: inline evaluation of: import sailpoint.object.ProvisioningPlan; import sailpoint.object.Provisioni . . . ‘’ : if ( accountRequests != null ) { \n BSF info: XXXXXBPRule at line: 0 column: columnNo”
]

6

I noticed a closing bracket (}) is missing for this block:

if (accountRequests != null) {

    for(AccountRequest accountRequest : accountRequests) {

        if (AccountRequest.Operation.Modify.equals(accountRequest.getOperation())) {

            passwordResetValidation(identity, accountRequest, log);

        }

   //Missing closing bracket
} else {

    log.error("Rule: ActiveDirectorySourceMFADBPRule - AccountRequests list is null. Skipping iteration.");

}

Also, can you try evaluating your rule via RDK and validator provided by Sailpoint ?

RDK - Rule Development Kit | SailPoint Developer Community
Validator - IdentityNow Rule Validator - Compass

7

Add one more closing brace } before the else.

Corrected code.

if (accountRequests != null) {
	for (AccountRequest accountRequest : accountRequests) {
		if (AccountRequest.Operation.Modify.equals(accountRequest.getOperation())) {
			passwordResetValidation(identity, accountRequest, log);
		}
	}
} else {
    log.error("Rule: ActiveDirectorySourceMFADBPRule - AccountRequests list is null. Skipping iteration.");
}
8

Hi @UjjwalJain ,

This is not the code problem. I just deleted some irrelevant code.

if (accountRequests != null) {   for (AccountRequest accountRequest: accountRequests) {      if (AccountRequest.Operation.Modify.equals(accountRequest.getOperation())) {         passwordResetValidation(identity, accountRequest, log);         applyDisabledAccountLogic(accountRequest, plan);      } else if (AccountRequest.Operation.Create.equals(accountRequest.getOperation())) {         applyDisabledAccountLogic(accountRequest, plan);      }   }} else {   log.error(“Rule: XXXXXXXXXXBPRule - AccountRequests list is null.Skipping iteration.”);}
9

Hi @msingh900

Thank you for your help. This is not code syntax problem. I just deleted some irrelevant code.

if (accountRequests != null) {
   for (AccountRequest accountRequest: accountRequests) {
      if (AccountRequest.Operation.Modify.equals(accountRequest.getOperation())) {
         passwordResetValidation(identity, accountRequest, log);
         applyDisabledAccountLogic(accountRequest, plan);
      } else if (AccountRequest.Operation.Create.equals(accountRequest.getOperation())) {
         applyDisabledAccountLogic(accountRequest, plan);
      }
   }
} else {
   log.error(“Rule: XXXXXXDBPRule - AccountRequests list is null.Skipping iteration.”);
}
10

Hi @UjjwalJain ,

Thank you. This issue is resovled. It seems I nested too much method call, which maybe caused the Exception in Beanshell ENV. Your answer is definitely correct.