Active Directory not mapping the attribute from Saviynt.

[Santosh]

Hello there, we had an issue with AD account creation. the implementation partners created an external jar that creates email and sAMAccount for the newly onboarded users. The job runs every hour. But the efficiency of this is around 60-70 % right now, which used to be almost 100% before. I am thinking of getting rid of jar and used the Global Configuration---Lifecycle feature to create and email.

1. If incase email generation fails doing so, how can we re-trigger email generation (currently we have user update rule--custom Action to call the class and method of the jar)

2. How can we create a sAMAccount within Saviynt? Is it something from the CREATEACCOUNTJSON?

3. For an AD account creation failure (because the jar failed to create the email and sAMAaccount), I re-ran using the rule, but the account got create don AD with missing the mapping of attributes like Location, Office, Postal Code etc.. how can I fix this?

[rushikeshvartak]

2. How can we create a sAMAccount within Saviynt? Is it something from the CREATEACCOUNTJSON? Yes

3. For an AD account creation failure (because the jar failed to create the email and sAMAaccount), I re-ran using the rule, but the account got create don AD with missing the mapping of attributes like Location, Office, Postal Code etc.. how can I fix this? You can create analytics report with update account action

[Santosh]

Thank you for your response, regarding my 1st question, creating an email from Saviynt Global Config. If it fails to create an email, is there a way to retrigger email generation?

[rushikeshvartak]

You can enable detective rule checkbox

[Santosh]

Thank you for your response @rushikeshvartak. Not sure if I followed the instructions correctly here, please correct, I have a technical rule in place with a detective box checked---job or user update rule to trigger it? If so, what would be the Object Type on action?

[rushikeshvartak]

You can use re-run all provisioning rules

[Santosh]

I am testing the CREATEACCOUNTJSON and UPDATEACCOUNTJSON with this, does this look right?

"sAMAccountName":"${concat((substring(users.firstname,1,1),substring(users.lastname,1,9))###
concat((substring(users.firstname,1,2),substring(users.lastname,1,8))###
concat((substring(users.firstname,1,3),substring(users.lastname,1,7))###

concat((substring(users.firstname,1,3),substring(users.lastname,1,6)) }",

[rushikeshvartak]

Is this account name rule ? if not then not correct

[Santosh]

Nope, it would be the sAMAccount towards the Active Directory, CREATEACCOUNTJSON, also it is mapped to customproperty 64. which currently is being generated using an external JAR

{"objectClass":["top","person", "organizationalPerson","user"],
"cn": "${cn}",
"co": "${user.country}",
"division": "${user.username}",
"manager": "${managerAccount.accountID}",
"employeeNumber": "${user.systemUserName}",
"employeeID": "${user.employeeid}",
"company": "${user.companyname}",
"department": "${user.departmentname}",
"l": "${user.city}",
"mail":"${user.email}",
"middleName": "${user.middlename}",
"mobile": "${user.phonenumber}",
"name":"${user.customproperty64}",
"st":"${user.state}",
"streetAddress":"${user.street}",
"userAccountControl":"512",
"sAMAccountName":"${concat((substring(users.firstname,1,1),substring(users.lastname,1,9))###
concat((substring(users.firstname,1,2),substring(users.lastname,1,8))###
concat((substring(users.firstname,1,3),substring(users.lastname,1,7))###
concat((substring(users.firstname,1,3),substring(users.lastname,1,6)) }",
"sn":"${user.lastname}",
"userPrincipalName":"${user.email}",
"title":"${user.title}",
"description": "${user.title}",
"homeDrive":"W:",
"homeDirectory":"\\\\files\\users\\${user.customproperty64}"}

[rushikeshvartak]

You need to add unique check under CheckForUnique 

https://forums.saviynt.com/t5/community-knowledge-base/how-to-achieve-user-account-name-uniqueness-c...