sAMAccountName Generator

[dgomez]

Hello,

I am trying to use the below code for generating a sAMAccountName, for some reason it keeps erroring out in IdentityNow, I followed some guidance provided in: IdentityNow Transforms - Username Generator - Compass

But it is still failing on this attribute, any recommendations?

{

                "attributes": {

                    "cloudMaxSize": "100",

                    "cloudMaxUniqueChecks": "5",

                    "cloudRequired": "true"

                },

                "isRequired": false,

                "multi": false,

                "name": "sAMAccountName",

                "transform": {

                    "attributes": {

                        "fi": {

                            "attributes": {

                                "begin": 0,

                                "end": 1,

                                "input": {

                                    "attributes": {

                                        "name": "firstname"

                                    },

                                    "type": "identityAttribute"

                                }

                            },

                            "type": "substring"

                        },

                        "fn": {

                            "attributes": {

                                "name": "firstname"

                            },

                            "type": "identityAttribute"

                        },

                        "ln": {

                            "attributes": {

                                "input": {

                                    "attributes": {

                                        "name": "lastname"

                                    },

                                    "type": "identityAttribute"

                                }

                            },

                            "type": "upper"

                        },

                        "mi": {

                            "attributes": {

                                "begin": 0,

                                "end": 1,

                                "input": {

                                    "attributes": {

                                        "name": "middleName"

                                    },

                                    "type": "identityAttribute"

                                }

                            },

                            "type": "substring"

                        },

                        "patterns": [

                            "$fi.$ln",

                            "$fn.$mi.$ln",

                            "$fn.$mi.$ln${uniqueCounter}"

                        ],

                        "sourceCheck": true

                    },

                    "type": "usernameGenerator"

                },

                "type": ""

            },

[dgomez]

The error received:

sailpoint.tools.GeneralException: Error generating account username for identity: **********, appName: ********** Exception error msg: Error rendering template: $fn.$mi.$ln at sailpoint.server.ScriptletEvaluator.doCall(ScriptletEvaluator.java:175)

[colin_mckibben]

Just looking at the JSON you shared, there might be a typo in your middle name attribute. Your firstname and lastname attributes are all lower case, but your middleName attribute is camel case. Is that correct, or should middle name also be all lower case? That could explain why the generator fails on the second pattern and not the first, since the second pattern introduces the middle name attribute.

[dgomez]

Hi Colin,

Thank you for your response, the technical name for Middle Name is correct, I created that attribute in the Identity Profile and used the generated camel case.

[colin_mckibben]

Hmm. I still have a hunch it has something to do with the middle name attribute, since it fails on that pattern. Could you try the following?

1. Remove all patterns except for $fi.$ln and see if that is successful? That will tell us if the JSON at least works for first/last name.
2. Remove the substring logic from the middle name attribute to see if that is causing the error. If the error goes away, then it must have something to do with the substring.

[dgomez]

Still provides an error, but a slightly different one this time:

Stopped processing username creation for pattern: $fn.$ln${uniqueCounter} because maximum attempts reached: 5

This would bring two questions:

• There should be no collision as nobody else exists with this same firstName (checked), why would the counter increase in this case?
• Why would the middle name be the cause for the initial fail? When it has the same logic as the first name.

[colin_mckibben]

It actually might be your $fn variable. I didn’t realize you had a first initial ($fi) and first name ($fn). You can verify it is not the $mi by doing a pattern like $fi.$mi.$ln. If that succeeds, then there is something going in with your first name ($fn) variable.

As to why the counter increased, I’m not sure. While you validate that it is not the $mi variable and just the $fn variable causing issues, I’ll ask around internally to see if someone can shed some light on this.

[lisa_ivy]

The code looks correct to me - I compared it to a usernameGenerator attribute I’m using in a create profile, and the only difference is that instead of “multi”: false, I have “isMultiValued”: false – but I believe both formats are acceptable. Are you testing with a user who has a first name, middle name, and last name populated?

[jordan_violet]

Hey @dgomez,

I wanted to check in and see if the above was able to be of any help for you. We would love to hear an update and please let us know if we can be of any further assistance to you!

[dgomez]

Hi,

I still get the same error, I have changed the code to slightly different variations and it still drops the same error:

error msg: Stopped processing username creation for pattern: $fi.$ln${uniqueCounter} because maximum attempts reached: 10 (I increased the checks, even thought thre shouldn’t be a duplicate).

The simplified code:

           {
                "attributes": {
                    "cloudMaxSize": "100",
                    "cloudMaxUniqueChecks": "10",
                    "cloudRequired": "true"
                },
                "isRequired": false,
                "isMultiValued": false,
                "name": "sAMAccountName",
                "transform": {
                    "attributes": {
                        "fi": {
                            "attributes": {
                                "begin": 0,
                                "end": 1,
                                "input": {
                                    "attributes": {
                                        "name": "firstname"
                                    },
                                    "type": "identityAttribute"
                                }
                            },
                            "type": "substring"
                        },
                        "fn": {
                            "attributes": {
                                "input": {
                                    "attributes": {
                                        "name": "firstname"
                                    },
                                    "type": "identityAttribute"
                                }
                            },
                            "type": "upper"
                        },
                        "ln": {
                            "attributes": {
                                "input": {
                                    "attributes": {
                                        "name": "lastname"
                                    },
                                    "type": "identityAttribute"
                                }
                            },
                            "type": "upper"
                        },
                        "patterns": [
                            "$fi.$ln",
                            "$fi.$ln${uniqueCounter}"
                        ],
                        "sourceCheck": true
                    },
                    "type": "usernameGenerator"
                },
                "type": ""
            },

[jordan_violet]

Hey @dgomez,

Your code looked good upon review. Above, Lisa asks if you have all of the attributes populated (i.e. are you testing with a user with a first, middle, and last name populated)? Could this be the issue?

[dgomez]

That’s correct, all these attributes are populated in my test cases.

[jordan_violet]

Hey @dgomez,

Thanks for the prompt reply. I am sorry the above was not able to resolve the issue.
Given the facts in this case, we should likely escalate your issue and file a support ticket. The support team are going to be the best folks for helping you with diving into specifics, debugging, and to having your issue investigated more closely.

Please let me know if you encounter any issues filing a a ticket and I would be glad to assist you further.

Regards,

Michael Ellis
Developer Community Manager

[chrisp (Chris Peterson)]

Has anyone been able to generate a sAMAccountName using the usernameGenerator transform?

I found a different topic where is was mentioned that this could only be used for the account ID for a source, and for AD that is the distinguishedName.

usernameGenerator Transform

Hello, Can we use “usernameGenerator” type transform to generate the unique value for any attribute like userPrincipalName, mail that’s present on the “create profile” page, or are there any limitations on the attribute on which we can use that type of transform? Thanks, Sushant

Check the solution by lisa.ivy.

We have a need to generate the DN and the sAMAccountName, with different patters, and using the uniqueCounter. Can we use the usernameGenerator transform for both attributes?

Thanks,
Chris

[Sushant (Sushant Maharjan)]

Hi @chrisp,

I tried the “usernameGenerator” transform for attributes other than Account ID and it didn’t work for me. It only works for the Account ID. If you want to generate a unique sAMAccountName using different patterns then I believe you will need to leverage the “AttributeGenerator” rule.

Thanks,
Sushant