Activedirecory - Manager DN

[AbdulGaffar]

Hi ,

There is a requirement to fetch user's manager attribute value while creating the AD account and populate it with  AD manager attribute(DN) at the time of account creation.

I have tried by specifying as follows in create account json as :

"manager" : "${user.manager}"

however , this did not work , as after provisioning I was not able to fetch the manager's DN 

please suggest what shall be the next steps

thanks

Abdul Gaffar

[SumathiSomala]

Hi @AbdulGaffar 

Try the below mapping.

"manager":"${managerAccount==null?'':managerAccount.comments}"
"manager":"${managerAccount==null?'':managerAccount.accountID}"

comments or accountID  attribute should have user's DN .

or you can use any customproperty x which stores the user's DN.

[AbdulGaffar]

Hi Sumathi,

Manager account is AD attribute right , our requirement is like passing in manager username in createaccount json and in AD its associated DN should be populated 

As per above suggestion should I leverage that in createaccount JSON

Thanks

Abdul Gaffar 

[SumathiSomala]

Yes  @AbdulGaffar above manager mapping will populate the user's manager DN in active directory once new account is provisioned.

Let me know if it helps.

[Saviynt_learner]

Hi @SumathiSomala 

Could you please explain how the mapping works, I mean what's the logic there, I quite didn't understand it. is there any document mentioned this one, or you have any idea ....

[SumathiSomala]

@Saviynt_learner ,

managerAccount is a binding varaible and you can use it to retrieve the manager user's AD account id. I hope you have mapped DN as a account id for AD application.

In my case i have DN as comments.

So i have used below mapping in createaccountjson
"manager":"${managerAccount==null?'':managerAccount.comments}"
Once new account is created in AD, manager field will be populated with user's manager DN.

Let me know if it helps.

[AbdulGaffar]

Hi @SumathiSomala 

I tried "manager":"${managerAccount==null?'':managerAccount.comments}" in the create account JSON , however the manager did not get populated with its DN 

As a prereq check The maanger already has an account in AD and DN is specified in comments

is there any alternative way for this to be handled

Regards,

Abdul Gaffar

[SumathiSomala]

@AbdulGaffar Could you please share you ACCOUNT_ATTRIBUTE mapping

[AbdulGaffar]

Hi @SumathiSomala ,

PFB the account attribute mapping 

[
CUSTOMPROPERTY1::cn#String,
CUSTOMPROPERTY2::userPrincipalName#String,
CUSTOMPROPERTY3::sn#String,
CUSTOMPROPERTY4::homeDirectory#String,
CUSTOMPROPERTY5::co#String,
CUSTOMPROPERTY6::employeeNumber#String,
CUSTOMPROPERTY7::givenName#String,
CUSTOMPROPERTY8::title#String,
CUSTOMPROPERTY9::telephoneNumber#String,
CUSTOMPROPERTY10::c#String,
CUSTOMPROPERTY11::uSNCreated#String,
CUSTOMPROPERTY12::logonCount#String,
CUSTOMPROPERTY13::physicalDeliveryOfficeName#String,
CUSTOMPROPERTY14::extensionAttribute1#String,
CUSTOMPROPERTY15::extensionAttribute2#String,
CUSTOMPROPERTY16::streetAddress#String,
CUSTOMPROPERTY17::mailNickname#String,
CUSTOMPROPERTY18::department#String,
CUSTOMPROPERTY19::countryCode#String,
CUSTOMPROPERTY20::erp-custom2#String,
CUSTOMPROPERTY21::manager#String,
CUSTOMPROPERTY22::homePhone#String,
CUSTOMPROPERTY23::mobile#String,
CUSTOMPROPERTY24::l#String,
CUSTOMPROPERTY25::company#String,
CUSTOMPROPERTY26::distinguishedName#String,
CUSTOMPROPERTY27::objectSid#Binary,
CUSTOMPROPERTY28::primaryGroupID#String,
CUSTOMPROPERTY29::st#String,
CUSTOMPROPERTY30::userAccountControl#String,
CUSTOMPROPERTY31::objectGUID#Binary,
CUSTOMPROPERTY32::displayName#String,
CUSTOMPROPERTY33::Division#String,
CUSTOMPROPERTY34::employeeType#String,
CUSTOMPROPERTY35::mail#String,
CUSTOMPROPERTY36::postalCode#String,
CUSTOMPROPERTY37::lastLogon#String,
CUSTOMPROPERTY38::LastLogonTimeStamp#String,
CUSTOMPROPERTY39::extensionAttribute6#String,
CUSTOMPROPERTY40::extensionAttribute13#String,
CUSTOMPROPERTY41::extensionAttribute14#String,
CUSTOMPROPERTY42::extensionAttribute15#String,
CUSTOMPROPERTY43::msExchExtensionAttribute43#String,
CUSTOMPROPERTY44::WMAD-ExtensionString64#String,
CUSTOMPROPERTY45::WMAD-ExtensionString69#String,
CUSTOMPROPERTY46::WMAD-ExtensionString70#String,
CUSTOMPROPERTY47::extensionAttribute2#String,
CUSTOMPROPERTY48::extensionAttribute7#String,
CUSTOMPROPERTY49::extensionAttribute8#String,
CUSTOMPROPERTY50::extensionAttribute9#String,
CUSTOMPROPERTY51::extensionAttribute1#String,
CUSTOMPROPERTY52::telephoneNumber#String,
CUSTOMPROPERTY53::extensionAttribute11#String,
CUSTOMPROPERTY54::proxyAddresses#String,
CUSTOMPROPERTY55::targetAddress#String,
CUSTOMPROPERTY56::WMAD-ExtensionString71#String,
CUSTOMPROPERTY57::WMAD-ExtensionString77#String,
CUSTOMPROPERTY58::erp-customid#String,
CUSTOMPROPERTY59::WMAD-ExtensionString40#String,
LASTLOGONDATE::LastLogonTimeStamp#millisec,
DISPLAYNAME::name#String,
COMMENTS::distinguishedName#String,
LASTPASSWORDCHANGE::pwdLastSet#millisec,
DESCRIPTION::description#String,
VALIDTHROUGH::accountExpires#millisec,
UPDATEDATE::whenChanged#date,
NAME::sAMAccountName#String,
CREATED_ON::whenCreated#date,
ACCOUNTCLASS::objectClass#String,
ACCOUNTID::objectGUID#Binary,
RECONCILATION_FIELD::CUSTOMPROPERTY31
]

Regards

Abdul Gaffar

[SumathiSomala]

@AbdulGaffar Same mapping is working for me.

Could you please try the below mappings?

"manager": "${managerAccount.comments}",
"manager": "${managerAccount.customproperty26}",
"manager":"${managerAccount==null?'':managerAccount?.comments}"
"manager":"${managerAccount==null?'':managerAccount?.customproperty26}"

Let me know if it helps.