Unable to generate samAccountName via AttributeGenerator Rule

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

I have written the below AttributeGenerator Rule to create samAccountName during AD account provisioning. I dont see the attribute getting generated. What could be the issue?

	public String generateUsername(String fName, String lName, String mI) {
    	String samAccName = "";
		String modSamAccName = "";
        	
			if((mI == null) || "".equals(mI))
				mI = "x";
				
	if((fName == null) || (lName == null)){ 
	
		return null;
		}
		
	else if((fName != null) && (lName != null)){	
	
		  if(lName.length()>=6)
			samAccName = (fName.substring(0,1)+mI.substring(0,1)+lName.substring(0,6)).toLowerCase();
		  else
			samAccName = (fName.substring(0,1)+mI.substring(0,1)+lName.substring(0,lName.length())).toLowerCase();		
		}
		samAccName = samAccName.replaceAll("[^a-zA-Z0-9]", "");
		modSamAccName = samAccName;
		
		for(int i=2;modSamAccName !="" && modSamAccName != null;i++)
		{
			boolean samAccExistsAD = false;
		
			samAccExistsAD = isUniqueInAD(modSamAccName);
			
			if(!samAccExistsAD)
			 break;		
			else
			{
				modSamAccName = samAccName;
				if(modSamAccName.length() == 8)
				{
					modSamAccName = samAccName.substring(0,7)+ i ;					
				}
				if(modSamAccName.length() < 8)
				{	
					modSamAccName = samAccName.substring(0,samAccName.length())+ i ;					
				}				
			}
		}
		
		return modSamAccName;
	}
		
		

	
    //Check Active Directory for uniqueness
	public boolean isUniqueInAD ( String samAccName) {
      
      if( samAccName != null ) {
        LDAPConnectorService ldap = ServiceModule.getService( LDAPConnectorService.class );
        String generated = null;
        Field field = new Field();
        field.setName( "sAMAccountName" );
        field.setAttribute( "template", samAccName );
        field.setAttribute( "cloudToUpperCase", false );
        field.setType( "String" );
        field.setAttribute( "cloudMaxUniqueChecks", 1 );
        try {
        generated = ldap.generateUniqueLDAPAttribute( context, application, identity, field, null );
		}
		catch(Exception e) {
		// Account found, need to generate second attempt
		}
    
        //if generation failed or a new sAMAccountName string was created via uniqueness counter, return false
        if( generated == null ) {
          return false;
        } else if ( !generated.equals( samAccName ) ) {
          return false;
        } else {
          return true;
        }
      } else {
        return false;
      }
    } 
	
    String fName=identity.getFirstname();
    String lName=identity.getLastname();
	String mI=(String)identity.getAttribute("middleInitial");
 	

    return generateUsername(fName, lName, mI);
2

Can you look at the following part…

modSamAccName = samAccName;
for(int i=2;modSamAccName !="" && modSamAccName != null;i++){
   ............
}

Would the loop ending condition ever be true?

Also, does this comparison work in Java?
modSamAccName != ""

3

Did you get any particular error?

4

This block is giving me result, not sure about

this block as i am not able to create connection with LDAP.

What is the error you are getting?

5

Yes the loop condition is returning true value.

6

I don’t see any error on the UI (Identity’s Activity Tab) .

If I pass a static value for saMAccountName in “Create Account” I can see that AD account getting created for the user.

I don’t have access to the CCG logs.
Can you let me know the best practice to test this rule in IdentityNow ?

7

HI Rajesh,

Please check if this helps:

https://developer.sailpoint.com/idn/docs/rules/

8

I usually test my code locally first by hard coding the identity attributes and having the isUnique function return a true/false randomly to test all the possible combinations. This helps ensure the basic java code for generating a unique id is working. While deploying it mostly what changes is the isUnique function.

I haven’t used the generateUniqueLDAPAttribute function but i’ve used countIdentitiesBySearchableIdentityAttribute Or
attrSearchCountAccounts from IDNRuleUtil class within the isUnique function to verify attribute uniqueness.

You can check their usage here: Using IDNRuleUtil as a Wrapper for Common Rule Operations - Compass

Try to avoid null checks directly, instead try to use StringUtils.isNotBlank(“attr”) or just initialize your variable to some static text and use accordingly. In catch block you can set generated = “failed” and then use that for evaluation instead of relying on null.

9

Hi Everyone,
Thank you for your response. I was able to rewrite the code logic and was able to fix the issue.

1 Like
10

Hi @rajeshs ,

Good to know that you have been able to resolve this issue, please fill free to close this topic.

11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.