Azure child account not working using ARS

[rahul_p]

Hello,

We have configured the dependent application using endpoint filter which is working as expected when triggered the provisioning using technical rule.

But when we are requesting using ARS then new account task of child endpoint failing with below error:

Spoiler

{"call1":{"headers":null,"message":{"error":{"code":"Request_BadRequest","message":"A conflicting object with one or more of the specified property values is present in the directory.","details":[{"code":"ObjectConflict","message":"Another object with the same value for property proxyAddresses already exists.","target":"proxyAddresses"},{"code":"ObjectConflict","message":"Another object with the same value for property userPrincipalName already exists.","target":"userPrincipalName"},{"code":"ConflictingObjects","message":"A conflicting object with one or more of the specified property values is present in the directory.","target":"User_<id>"}],"innerError":{"date":"2024-10-16T14:30:04","request-id":"<id>","client-request-id":"<cid>"}}},"statusCode":400,"description":null,"status":"Failed"}}

Any suggestion here?

Regards,

Rahul

[rahul_p]

FYI...

We have child endpoint exposed in the ARS module as application.

Thanks!

[rushikeshvartak]

• Enable Entitlements Only under Security System
• 

[rahul_p]

Hello @rushikeshvartak ,

Thanks for the response as always Man.

I tried this option but its not working, I analyzed the logs and here what I found :

Spoiler

quartzScheduler_Worker-2-hnkhl","DEBUG","Add access task - <taskid> is found without accountkey, validating further...

ERROR","Call response: {"error":{"code":"Request_BadRequest","message":"A conflicting object with one or more of the specified property values is present in the directory.","details":[{"code":"ObjectConflict","message":"Another object with the same value for property proxyAddresses already exists.","target":"proxyAddresses"},{"code":"ObjectConflict","message":"Another object with the same value for property userPrincipalName already exists.","target":"userPrincipalName"},{"code":"ConflictingObjects","message":"A conflicting object with one or more of the specified property values is present in the directory.","target":"User_<id>"}],"innerError":{"date":"2024-10-17T07:30:03","request-id":"<rid>","client-request-id":"<cid>"}}}"

Error in provisioning: AccountID is mandatory
DEBUG","taskResult:: false
ecm-worker","azure.AzureADRestProvisioningService","quartzScheduler_Worker-5-hnkhl","ERROR","Error while creating account - <accountName> removing tasks from the list

Regards,

Rahul

[NM]

@rahul_p is the account name rule same?? In both the endpoints?

[rushikeshvartak]

It seems a proxy address is already in use. 

Key Errors:

1. ObjectConflict for proxyAddresses:
   • Another object already has the same proxyAddresses value.
2. ObjectConflict for userPrincipalName:
   • Another object already has the sameuserPrincipalName.
3. AccountID is mandatory:
   • The provisioning task fails because the AccountID is missing

Root Causes and Solutions:

1. proxyAddresses Conflict:

   • This occurs if the new user’s proxy email address matches an existing user or resource in the directory. Solution:
     • Check if theproxyAddresses value is already assigned to another account.
     • Use a unique email alias during the account creation.
     • Implement error handling logic to catch this conflict and log the conflicting object.

2. userPrincipalName Conflict:

   • TheuserPrincipalName (UPN) must be unique in Azure AD. Solution:
     • Verify the UPN before provisioning to ensure it doesn't already exist.
     • Consider using an alternative naming convention (e.g., adding a numeric suffix) when conflicts are detected.
     • Use the Azure AD Graph API or MS Graph API to pre-check for UPN conflicts.

3. AccountID is mandatory:

   • This indicates that a required field (likely AccountID or accountKey) was missing in the provisioning request. Solution:
     • Ensure that all required attributes, including AccountID and AccountKey, are correctly mapped in the provisioning logic.
     • Verify that the task JSON payload includes the necessary fields before it is submitted.

Pre-validation Check: Use API calls to verify if userPrincipalName and proxyAddresses are unique before submitting a request. For example, use MS Graph API:

GET https://graph.microsoft.com/v1.0/users?$filter=userPrincipalName eq 'testuser@example.com'

[rahul_p]

Hello @NM ,

Thanks for the response.

We have same account name rule and co-relation rule in both the endpoints.

Regards,

Rahul