Unable to send null value on manager attribute in AD via attributeSync

[ashish_kumar3284 (Ashish Kumar)]

Hello Sailors,

I am trying to set a null value to the manager attribute using the attribute sync and transform on the Identity attribute. As per transform, the identity attribute is populating with a null value but when trying to push the same value to AD’s manager attribute via attribute sync, getting the below exception.

I tried to set the value as “not set” but still got the same error.

Checked with AD team, and there is no policy on the manager attribute which is restricting this.

Please provide your valuable input.

@colin_mckibben @ethompson @sunnyajmera @sharvari

[sharvari (Sharvari Shah)]

I would recommend using below snippet to set the manager value to null in the transform.

"blank": {
	"attributes": {
		"value": ""
	},
	"type": "static"
}

Use $blank in your transform wherever you want to set manager value to null.

[ashish_kumar3284 (Ashish Kumar)]

Hello @sharvari,

Thank you for sharing the code snippet and it is working as expected on Identity Attribute. But, while promoting the value to AD attribute via attribueSync. It is not working and throwing the below exception:

[anneragh (Raghunath Anne)]

@ashish_kumar3284 That is strange, Looks like the blank value is getting overwritten someplace. Do you have the OU it is showing in the error configured in create account profile/transformation?

[ashish_kumar3284 (Ashish Kumar)]

@anneragh Yes, OU is there. If I will pass a value of another account as manager, it will be set without fail.

[atarodia (Animesh Tarodia)]

Hi @ashish_kumar3284,

Could you please show the manager attribute in create account profile?

For the value to be set as null, you should not pass any value in create account profile.

[ashish_kumar3284 (Ashish Kumar)]

@atarodia Please refer below:

{
  "name": "manager",
  "transform": {
      "type": "identityAttribute",
      "attributes": {
          "name": "adManagerDn"
      }
  },
  "attributes": {
      "cloudRequired": "true"
  },
  "isRequired": false,
  "type": "string",
  "isMultiValued": false
}

[atarodia (Animesh Tarodia)]

This is a very strange behavior. I just tested this is my lab and the sync is working as expected. Any helpful information in IQService logs?