Rename sAMAccountName on Name Change

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,
We would like to update a user’s sAMAccountName, mail, and userPrincipalName whenever there is a change in the user’s first name or last name. However, we do not want these attributes to be updated automatically as soon as one of these identity fields is modified, as this could abruptly interrupt the user’s access.

Instead, our goal is to notify the user about the upcoming changes as soon as the modification is detected, and then update these attributes after a defined waiting period to ensure a smooth transition.

Has anyone implemented a similar use case or could share best practices for managing this kind of delayed attribute update?

2
  • Create an identity attribute named “nameChangeDate”
  • Set up a transform to calculate the value for this attribute based on below logic
    1. Check if the current value is empty
    2. Check if current first name or last name is different from the values from SoT
    3. If both of the above are true, set current date as the value for “nameChangeDate“ and trigger a workflow to notify user (based on identity attribute change from empty to something)
    4. If condition 1 is not true (ie current value exists) check if the value is “n” days old, where n is when the sAMAccountName will be updated from actual name change
    5. If condition 4 (n days old) is true reset the value to empty and trigger the changes to sAMAccountName and other fields (this will need an entire different logic)

I hope this gives you a good start

3

@FXNOAHOWONO apart from workflow another way you can use a after rule

1- Write an after rule to trigger the powershell script

2-In the powershell script logic check if there is any change in users details like sam account name,email or upn

3-Use an email function to notify them

4-Update the new attributes

Thanks

Shantanu

4

@FXNOAHOWONO

I think one way could be this:

  1. Create a Workflow based on change in First name or Lastname.
  2. Send Email to User for the upcoming change.
  3. Wait for the defined period.
  4. Call put-source-attr-sync-config | SailPoint Developer Community to update the Attribute sync for the source.
  5. Refresh the Identity to sync the attributes.
  6. Again, call put-source-attr-sync-config | SailPoint Developer Community to remove the Attribute sync config.

Thanks.