AD error[LDAP: error code 68 - 00000524: UpdErr: DSID-031A11F8, problem 6005 (ENTRY_EXISTS), data 0]

[kavitakamtekar4]

Hi all,

We are using basic CreateAccountJSON for AD provisioning. But we are getting this error: Error while creating account in AD - [LDAP: error code 68 - 00000524: UpdErr: DSID-031A11F8, problem 6005 (ENTRY_EXISTS), data 0 ],

I have also checked but I don't see user in AD.

Below is the  CREATEACCOUNTJSON code,

{
"cn": "${cn}",
"givenName": "${user?.firstname}",
"sn": "${user?.lastname}",
"displayname": "${user?.displayname}",
"sAMAccountName": "${task?.accountName}",
"userprincipalname": "${user?.email.toString().toLowerCase()}",
"objectClass": ["top", "person", "organizationalPerson", "user"]
}

[pmahalle]

@kavitakamtekar4 ,

Which attribute did you considered to check whether user present or not in AD? Check with DN as well as userprincipalname.

[kavitakamtekar4]

We checked with both, userprincipalname and common name.

[pmahalle]

@kavitakamtekar4 ,

Make sure email id you are using for user to be created is not assigned to any other user in userprincipalname as well as not present in proxyaddress.

Check proxyaddress of all the existing user whether email id already exists or not?

[NM]

@kavitakamtekar4 as suggested by  @pmahalle check the attributes and also sam account name if it exist or not.

[Manu269]

Can you also validate the accountname rule?

[stalluri]

@kavitakamtekar4 
Make sure you check the Accountnamerule and Checkforunique has the validation to not allow duplicates values.

System will check for this and create unique UPN and CN. AD-v24 

Specifying the Account Name Rule

Specify the rules to generate the DN for the account for provisioning separated by ### in the ACCOUNTNAMERULE parameter. This parameter is evaluated while creating an account and update of any attribute-driven name rule and OU movements for an account.

To create accounts using the first name and last name, define the rule in the following formats:

Example 1:

Rule

CN=${user.lastname}\\, ${user.firstname} (Global-V) 
[${user.username}],CN=Users,DC=abccompany,DC=com###CN=${user.lastname}1\\, 
${user.firstname}1 (Global-V) 
[${user.username}1],CN=Users,DC=abccompany,DC=com###CN=${user.lastname}\\, 
${user.firstname} (Global-V) [${user.username}2],CN=Users,DC=abccompany,DC=com

Checking the Uniqueness of an Attribute

To evaluate the uniqueness of an attribute in the Active Directory domain before it is provisioned, specify the CHECKFORUNIQUE parameter.

The attribute is evaluated for all provisioning operations and the associated changes are made to it to make it unique. To use this parameter, specify the attributes that you want to check in Active Directory for the unique constraint of rules separated by ###.

Example:

JSON

{
"userPrincipalName": "${user.firstname}.${user.lastname}@<specify company 
name>com###${user.firstname}.${user.lastname}1@<specify company name>.com" 
, "cn":"${user.lastname}
, ${user.firstname} (Global-V) [${user.username}]###${user.lastname}
, ${user.firstname} (Global-V) 
[${user.username}1]","name":"${user.username}###${user.username}1###${user.username}
2###${user.username}3"
}