Username generator in create Account causing issue in AD

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hi All,

we have used username generator for DistinguishedName in create account of AD
as firstname.lastname{uniqueCounter} whenever this user meets assignement criteria as per joiner (on identity processing ) it is trying to provision user to AD and it is failed as user already exists with name firstname.lastname as DistinguishedName in this case it used uniqueCounter and provisioned new account with DistinguishedName as firstname.lastname.1 ,2 ,3 … so on this caused RPC Error in target AD stating Disk Space full any one encountered the same issue and how to resolve it.

and also why it is again provisioning multiple accounts to same identity using uniqueCounter even if the identity matches the assignement criteria on identity process first time it is throwing RPC Error as identity already exists but it using uniqueCounter to provision multiple accounts to same identity( as per my knowlegde it is provisiong multiple accounts as provisioning errors are re-tryable errors and also uniqueCounter uses iterator ) is there anything else causing the issue or any one reasons causing the issue or both.

thanks in advance,

avi.

2

Hi,

Since you are recieving User already exist error, is this existing user correlated to the identity in IDN ? If its not, IDN will keep trying to create the account.

For the RPC error , is it happening only for the cases which have unique generator or its happenkng for all cases ? The error looks like insufficient disk space at AD DC.

Thanks,
Shailee

1 Like
3

@amulpuru you mentioned that this is part of the joiner process. Are you using roles to provision the access or using life cycle states? How many roles would this user receive?

Thanks,

Alicia

1 Like
4

Are your correlation rules correct?
ie. If the account creation is not attaching the new account to the cube, then it will try to create a .1 account. When this fails to correlate, it will then create a .2 account, and keep going until the ‘uniqueCounter’ number reaches the end.

Thanks
Phil

1 Like
5

hi @agutschow ,
the user will receive one role based on department assignment criteria

6

@shaileeM I was wondering if there was a possibility that your user was getting Active Directory triggered from two separate processes but that doesn’t seem to be the case.

Can you sanitize your transform and post it?

Alicia

7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.