Timeout Issue While AD Account Creation

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi Team

I am getting error while bulk account provisioning for active directory application , few accounts are getting created but few are not, please refer to the image below for the error for those the account are failed creating.

image
image492Ă—385 7.78 KB

In create provisioning policy for the distinguished name I am using the generator as - CN=$(firstname).$(lastname)$(uniqueCounter),OU=$(organization),OU=India, DC=Acme,DC=org

If i do process identity for the same single identity then their is no issue with the account creation.

I also tried increasing the connection timeout values in source using api. Also checked there are no duplicate accounts exist in AD. Also made this attributes like distinguishedName, upn and mail attribute as indexed in AD.

2

Hello @Akhila_2001 ,

Have you tried increasing provisioning Timeout?

image
image1480Ă—382 26.9 KB

3

Hi @JackSparrow

I tried by adding the provisioningTimeout also but no luck still facing the same issue

4

@Akhila_2001 try increasing the IQ service timeout as well and see if it works

5

Hi @schattopadhy i tried increasing the iqservice timeout as well, still facing same issue

6

Hi @Akhila_2001!

Can you confirm what your Source Account Schema Account ID is set to? is Account ID = distinguishedName? Since the error references UniqueAccountIdValidator[nativeIdentity=CN=…], it would help to know which attribute ISC treats as the Account ID during create.

Thanks

7

hi @Tursun The account ID is set to distinguishedName only

8

@Akhila_2001 have you reviewed and adjusted the priority on the Identity Profile?

9

Ok, got it. Thanks.
Can you check bellow attached link. Looks like identical to your error.

UniqueCounter is not working for UniqueAccountIdValidator on AD

10

How many are in the “bulk” request? Could be an active directory issue if you are using up all the ports on the server. Also check to make sure you have the correct DCs in the list in your config. They don’t always tell the Identity Team when a DC gets decommissioned :slight_smile:

11

Hi all thanks for your inputs, I changed the identity profile priority and used the username generator transform it helped me in achieving this