# Username Generation Rule not Iterating Suffix Beyond "a"

**URL:** <https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744>\
**Category:** SHF Discussion and Questions\
**Tags:** identity-security-cloud\
**Created:** [September 9, 2025, 4:57am UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744 "2025-09-09T04:57:17Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [September 9, 2025, 4:57am UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/1 "2025-09-09T04:57:18Z")

</div>

> ‼ Please be sure you’ve read the [docs](https://developer.sailpoint.com/idn/docs/) and [API specs](https://developer.sailpoint.com/idn/api/getting-started) before asking for help. Also, please be sure you’ve [searched](https://developer.sailpoint.com/discuss/search?expanded=true) the forum for your answer before you create a new topic.

Hi,

I’ve implemented a custom AttributeGenerator rule to generate a unique`sAMAccountName`for AD accounts.

**Logic:**

- Username = first letter of `preferredName` + first letter of `lastname` + start date (`MMyy`) + suffix (`a`–`z`).
- Example: John Doe, start date `2023-10-15` → base username = `JD1023`.
- Expected: `JD1023a`, `JD1023b`, `JD1023c`, etc.

**Issue:**

- First account generates `JD1023a` correctly.
- On duplicate, it still returns `JD1023a` instead of incrementing to `b`, `c`, etc.

**Rule:**

```java
    /* Rule to generate a unique username for Active Directory.
       The username is generated using the first letter of preferredName, first letter of lastname,
       the start date in mmyy format, and a suffix letter from 'a' to 'z' to ensure uniqueness.
       For example, for preferredName "John", lastname "Doe", and startDate "2023-10-15",
       the base username would be "JD1023". The rule will then try "JD1023a", "JD1023b", etc.,
       until it finds a unique username. */

    import sailpoint.tools.GeneralException;
    import sailpoint.object.Application;
    import sailpoint.object.Field;
    import sailpoint.object.Identity;
    import sailpoint.server.IdnRuleUtil;
    import sailpoint.api.*;

    import java.util.ArrayList;
    import java.util.List;
    import org.apache.commons.lang.StringUtils;
    import java.text.Normalizer;
    import java.text.SimpleDateFormat;
    import java.util.Date;
    import java.text.ParseException;
    import java.util.Calendar;
    import java.util.Locale;
    import java.util.TimeZone;
    import java.util.regex.Pattern;
    import java.util.regex.Matcher;
    import java.util.regex.PatternSyntaxException;
    import java.util.Collections;
    import java.util.HashMap;
    import java.util.Map;
    

    public String generateUsername(String preferredName, String lastname, String startDate) throws GeneralException {
        preferredName = cleanAlphaNumeric(StringUtils.trimToNull(preferredName));
        lastname = cleanAlphaNumeric(StringUtils.trimToNull(lastname));
        startDate = StringUtils.trimToNull(startDate);

        if(preferredName == null || lastname == null || startDate == null) {
            throw new GeneralException("Invalid input: preferredName" + preferredName + ", lastname" + lastname + ", and startDate" + startDate + "cannot all be null.");
        }

        String preferredNamefirstLetter = preferredName.substring(0, 1);
        String lastnamefirstLetter = lastname.substring(0, 1);
        String dateFormatmmyy = extractDateFormat(startDate);
        String baseUsername = preferredNamefirstLetter + lastnamefirstLetter + dateFormatmmyy;  

        for (char suffix = 'a'; suffix <= 'z'; suffix++) {
            String username = baseUsername + suffix;
            if (isUnique(username)) {
                log.debug("GSB AD Unique sAMAccountName generated: " + username);
                return username;
            }
        }
        throw new GeneralException("Unable to generate a unique username after trying all suffixes."); 
    }

    public String cleanAlphaNumeric(String input) {
        if (input == null) {
            return null;
        }
        String cleanedInput = input.replaceAll("[^a-zA-Z0-9]", "");
        return cleanedInput.length() > 0 ? cleanedInput : null;
    }

    public String extractDateFormat(String date) throws GeneralException {
        try {
            SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd");
            Date parsedDate = sdf.parse(date);
            SimpleDateFormat outputFormat = new SimpleDateFormat("MMyy");
            return outputFormat.format(parsedDate);
        } catch (ParseException e) {
            throw new GeneralException("Invalid date format: " + date, e);
        }
    }

    public boolean isUnique(String username) throws GeneralException {
        List sourceIds = Collections.singletonList(application.getId());
        List searchValues = Collections.singletonList(username);
        int count = idn.attrSearchCountAccounts(sourceIds, "sAMAccountName", "Equals", searchValues);
        log.debug("GSB AD sAMAccountName uniqueness check for '" + username + "': found " + count + " existing accounts.");
        return count == 0;
    }

    return generateUsername(identity.getAttribute("preferredName"), identity.getAttribute("lastname"), identity.getAttribute("startDate"));

```

Has anyone else run into this? Am I using `attrSearchCountAccounts` incorrectly, or is there another recommended way to ensure suffix increments properly?

---

<div class="post-metadata">

**Author:** ![UjjwalJain](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/ujjwaljain/32/24704_2.png) [@UjjwalJain](https://developer.sailpoint.com/discuss/u/UjjwalJain)\
**Post date:** [September 9, 2025, 5:19am UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/2 "2025-09-09T05:19:25Z")

</div>

Hello @thiruppathit,

Please consider using the **isUniqueLDAPValue** method provided by **idnRuleUtil** to check the uniqueness of sAMAccountName.

You can find more details in the Java documentation here: [Java docs | SailPoint Developer Community](https://developer.sailpoint.com/docs/extensibility/rules/java-docs/)

---

<div class="post-metadata">

**Author:** ![iamnithesh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamnithesh/32/42445_2.png) [@iamnithesh](https://developer.sailpoint.com/discuss/u/iamnithesh)\
**Post date:** [September 9, 2025, 4:22pm UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/3 "2025-09-09T16:22:05Z")

</div>

Are you trying to provision those accounts at the same time? If so, this is an expected behavior

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [September 9, 2025, 9:24pm UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/4 "2025-09-09T21:24:53Z")

</div>

No, I am not trying at the same time.

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [September 9, 2025, 9:25pm UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/5 "2025-09-09T21:25:09Z")

</div>

Thanks, will try with this method and keep you posted.

---

<div class="post-metadata">

**Author:** ![iamnithesh](https://sea1.discourse-cdn.com/sailpoint/discuss/user_avatar/developer.sailpoint.com/iamnithesh/32/42445_2.png) [@iamnithesh](https://developer.sailpoint.com/discuss/u/iamnithesh)\
**Post date:** [September 9, 2025, 10:44pm UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/6 "2025-09-09T22:44:33Z")

</div>

> [@thiruppathit](#):
>
> `sAMAccountName`

Have you promoted sAMAccountName as searchable attribute?

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [September 9, 2025, 11:58pm UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/7 "2025-09-09T23:58:48Z")

</div>

Yes, I did. See the search-attribute-config response.

> ```auto
> [
> 
> {
> 
> “name”: “sAMAccountName”,
> 
> “displayName”: “Searchable sAMAccountName”,
> 
> “applicationAttributes”: {
> 
> “3c1c9364e8514089bed10ddb78fbcf2c”: “sAMAccountName”
> 
> }
> 
> }
> 
> ]
> 
> ```

---

<div class="post-metadata">

**Author:** ![thiruppathit](https://avatars.discourse-cdn.com/v4/letter/t/3bc359/32.png) [@thiruppathit](https://developer.sailpoint.com/discuss/u/thiruppathit)\
**Post date:** [September 10, 2025, 12:00am UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/8 "2025-09-10T00:00:53Z")

</div>

Thanks Ujwal. Using “ **isUniqueLDAPValue”** solved the problem. I have replaced the logic with below code and its working fine now:

> ```java
> 
> public boolean isUnique(String username) throws GeneralException {
> String applicationName = application.getName();
> String identityName = identity.getName();
> return idn.isUniqueLDAPValue(identityName, applicationName, "sAMAccountName", username);
> }
> 
> ```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/sailpoint/original/2X/f/f2136700ed5e3703e0b85e02f6be799dacca7735.png) [@system](https://developer.sailpoint.com/discuss/u/system)\
**Post date:** [November 9, 2025, 12:01am UTC](https://developer.sailpoint.com/discuss/t/username-generation-rule-not-iterating-suffix-beyond-a/177744/9 "2025-11-09T00:01:52Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.