Some AD accounts are not getting aggregated from AD into ISC

Identity Security Cloud (ISC) ISC Community Knowledge Base
, ,
1

Problem

When we are aggregating the accounts from AD, nearly 10 to 15 AD accounts were not getting aggregated from AD even though they were present in it.

Diagnosis

1. We validated whether account was present in Uncorrelated CSV file but that was not the case.

2. Then, we made some changes to the description attribute of AD and tried to re-aggregate the AD, still the same result

3. Through SailPoint, we extracted the AD connector loggers and there was an exception thrown by the AD connector saying.

Error Details

Incorrect string value: ‘\xF0\x9F\x90\xB3$4…’ for column ‘attributes’ at row 1

4. The above error was due to an incorrect character in one the fields that we were aggregating from AD. This incorrect string was of a “Whale” Emogi.

5. Hence, we extracted all user’s AD attributes using PowerShell command of :: Get-ADUser.

6. In the result extract, we checked against each attribute that we were aggregating.

7. Finally, we found the issue in registerAddress attribute. This attribute was storing the MFA data from one of the applications of the customer in AD.

Solution

1. We checked whether “registerAddress” AD account attribute was used in any identity attribute in any of the identity profiles in scope.

2. We validated whether this attribute was used for provisioning in any other target system.

3. As we were not using this attribute in any of the identity profiles or downstream systems, hence, we removed the account attribute of “registerAddress” from Account Schema of AD.

4. Performed the aggregation again from AD and now, the data was getting aggregated for missing accounts.

Good practice

1. Its always recommended to only aggregate the accounts attribute from AD which are required for your identity setup, the rest should be removed from account schema setup of AD.

2

Thanks @rohit_wekhande

I think a better way to frame it is to not aggregate any attributes that may contain binary values, as ISC does not natively support binary syntax attribute values.

Also, I disagree with your statement on Best Practice. To only aggregate attributes used in Identity profiles or downstream systems defeats the purpose of an Identity Governance platform. Best Practice is to aggregate Account Attributes based on what Account Attributes you want to Aggregate (ISC is more than just a provisioning engine).

1 Like