Using attributes of the same schema in provisioning policies

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,

I have used the usernameGenerator transformation on the distinguishedName attribute and it works correctly. Now, in the sAMAccountName attribute I want to get the calculated value of the distinguishedName by making a substring to remove what I don’t need. Is it possible?

I don’t know how to reference the distinguishedName attribute within the transform of the sAMAccountName attribute

Thank you

:bangbang: Please be sure you’ve read the docs and API specs before asking for help. Also, please be sure you’ve searched the forum for your answer before you create a new topic.

2

Hi @robertoMoreno,

You can use something as below. Make sure that the sAMAccountName attribute is placed below the distinguishedName in the attribute ordering of the policy.

{
            "name": "sAMAccountName",
            "transform": {
                "attributes": {
                    "value": "$distinguishedName.substring(0,2)"
                },
                "type": "static"
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
}

You can try making use of the velocity template if you have more complex operations.

3

Hi @jesvin90 ,
In the above transform that you posted, the reference of “$distinguishedName” has to be an identityAttribute… right?

4

I have:

"name": "sAMAccountName",
            "transform": {
                "type": "substring",
                "attributes": {
                    "begin": 3,
                    "beginOffset": 0,
                    "end": {
                        "type": "split",
                        "attributes": {
                            "delimiter": ",OU=",
                            "index": 1
                        },
                    "input": {
                        "type": "static",
                        "attributes": {
                            "value": "$distinguishedName"
                        }
                    }
                    },
                    "input": {
                        "type": "static",
                        "attributes": {
                            "value": "$distinguishedName"
                        }
                    }
                }
            }

I need to kown the end of substring. The option “Begin” work fine, but the option “End” don’t work

Greetings.

5

No @Prashanth07, It’s a attribute of tha account.

6

This works for me to remove the CN= part: Its not on the schema, but as an Identity attribute, but you can adjust it accordingly

            {
                "type": "static",
                "attributes": {
                    "value": "#set($cleanedDn = $dn.substring($dn.indexOf('OU=')))$cleanedDn",
                    "dn": {
                        "type": "firstValid",
                        "attributes": {
                            "values": [
                                {
                                    "type": "accountAttribute",
                                    "attributes": {
                                        "attributeName": "distinguishedName",
                                        "sourceName": "Active Directory"
                                    }
                                },
                                "OU=NO AD Account on Profile"
                            ]
                        }
                    }
                }
            }
7

Try something as below and see if it works with the velocity template:

{
            "name": "sAMAccountName",
            "transform": {
                "attributes": {
                    "value": "#set($dn = $distinguishedName) #set($startIndex = $dn.indexOf('=') + 1) #set($endIndex = $dn.indexOf(',OU=')) #set($name = $dn.substring($startIndex, $endIndex)) $name"
                },
                "type": "static"
            },
            "attributes": {},
            "isRequired": false,
            "type": "string",
            "isMultiValued": false
}
1 Like
8

OK, it work fine.

Thank you