Set nativeIdentity in BeforeCreate Rule

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Dear Experts,

Is it possible to update the nativeIdentity in the BeforeCreate rule for AD?
I am trying to generate a new login name for the user which will be the CN & sAMAccountName. I am able to add the new sAMAccountName to the $requestObject, but i’m unable to update the nativeIdentity. Here is my script:

||$span = AZZ    |
|---|---|
||$newName = Generate-NextName -span $span  --> This generates the next value - BAA  |
||LogToFile(PS Script>>>>>> New name: $newName)    |
||#Add sAMAccountNAme to the requestObject    |
||$attrsAMAccountName = New-Object SailPoint.Utils.objects.AttributeRequest;    |
||$attrsAMAccountName.Name = sAMAccountName;    |
||$attrsAMAccountName.value= QI+$newName;    |
||$attrsAMAccountName.Operation = Add;    |
||$requestObject.AttributeRequests.Add($attrsAMAccountName);    |
||$dn = CN=+QI+$newName+,OU=Users,OU=XXXXX,OU=LXS Objects Test,DC=ad,DC=XXXX,DC=com; |
||$requestObject.nativeIdentity.Set($dn);   --> this method nativeIdentity.Set does not exist |
||$ModifiedRequestObjectXml=$requestObject.toXml();|

$requestObject.nativeIdentity.Set($dn); – this is wrong. Is there any documentation where i can find the availbale metods? I just tried to guess and used $requestObject.nativeIdentity.Set($dn) but this metod does not exist.
Any ideas?

Thanks in advance!

2

No, if you want to do a NameChange and need to update d the object name . you need to use a Powershell for that.

3

Thanks, I was able to do it:

$requestObject.nativeIdentity = "CN="+$custom_loginPrefixExt+$newName+",OU=Users,OU=XXXX,OU=LXS Objects Test,DC=ad,DC=XXXXX,DC=com"

4

I would like to take a step back and ask you why not handle that in Provisioning Policy form itself, why to depend on Native Rules ?

1 Like
5

There is the possibility of that in IDN too?

6

Yes, there are lot of things you can do in IDN but in a different way if you are referring to IIQ.

What is your requirement ?

7

I think you are trying to move the user from one OU to another. For this you can find the example at this post. There is sample rule you may use it and leverage some of the logic which you want

https://community.sailpoint.com/t5/IdentityNow-Forum/IdentityNow-Mock-Project-Services-Standard-BeforeProvisioning/td-p/216158

8

Hi @udayputta , No I was trying to generate the same CN as the sAMAccountNAme. The following worked for me in the BeforeCreate rule: