Clear AD attribute "msExchMailboxGuid" through Saviynt

[rahul_shetty]

Hello All,

We are encountering difficulties clearing the LDAP attribute "msExchMailboxGuid" through Saviynt.

Our attempts to clear the attribute by passing Null or an empty string have resulted in an error. Considering that the attribute is in hexadecimal format, we are reaching out to seek guidance on alternative methods to clear the value.

In our troubleshooting efforts, we also experimented with updating the attribute using a sample GUID, specifically "41ab69cc-ccbf-4488-ab1c-264fec17abd2." Unfortunately, this approach has also led to an error. We are now seeking your expertise to provide more information on the correct procedure for clearing this attribute or offer assistance in troubleshooting the encountered issue.

Any insights, best practices, or suggestions you can share would be highly valuable to us. Thank you in advance for your time and assistance.

please find the error log below

Error while Update operation for account-alarcoa in AD - [LDAP: error code 16 - 00002085: AtrErr: DSID-03152B08, #1: 0: 00002085: DSID-03152B08, problem 1001 (NO_ATTRIBUTE_OR_VAL), data 0, Att 8d0f97f4 (msExchMailboxGuid):len 30 ]

ldap.SaviyntGroovyLdapService - Error Updating the Account from AD - [LDAP: error code 16 - 00002085: AtrErr: DSID-03152B08, #1:\n","stream":"stdout","time":"2023-12-14T11:42:50.971691515Z"}"
"ecm-worker","2023-12-14T11:42:51.219+00:00","{"log":"\u00090: 00002085: DSID-03152B08, problem 1001 (NO_ATTRIBUTE_OR_VAL), data 0, Att 8d0f97f4 (msExchMailboxGuid):len 30\n","stream":"stdout","time":"2023-12-14T11:42:50.971712046Z"}"
"ecm-worker","2023-12-14T11:42:51.219+00:00","{"log":"\u0000]\n","stream":"stdout","time":"2023-12-14T11:42:50.971716915Z"}"
"ecm-worker","2023-12-14T11:42:51.219+00:00","{"log":"javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00002085: AtrErr: DSID-03152B08, #1:\n","stream":"stdout","time":"2023-12-14T11:42:50.97172095Z"}"
"ecm-worker","2023-12-14T11:42:51.219+00:00","{"log":"\u00090: 00002085: DSID-03152B08, problem 1001 (NO_ATTRIBUTE_OR_VAL), data 0, Att 8d0f97f4 (msExchMailboxGuid):len 30\n","stream":"stdout","time":"2023-12-14T11:42:50.97172456Z"}

Regards,

Rahul

[adarshk]

 Hi Rahul,

Meanwhile as we check on the on the possible options, please share the JSON used to perform this action. 

Thanks,
Adarsh

[rahul_shetty]

Hello @adarshk ,

Please find the json below:

{ "cn": "${cn}", "displayName": "${(user?.lastname == 'LNU' )?user.firstname:user.lastname+', '+user.firstname}", "department": "${user.orgunitid}", "division": "${user.entity}", "employeeID": "${user.employeeid}", "employeetype": "${user.employeeType}", "givenName": "${user.firstname}", "l": "${user.city}", "manager": "${user.customproperty25==null?'':user.customproperty25}", "mail": "${(user?.customproperty20 == 'SERVICENOW' )?user.customproperty36:user.email}", "mailNickname": "${user.systemUserName}", "name": "${user.systemUserName}", "postalCode": "${user.locationnumber}", "sn": "${user.lastname}", "sAMAccountName": "${user.systemUserName}", "streetAddress": "${user.street}", "st": "${user.state}", "title": "${user.title}", "targetAddress": "${if(user.customproperty20=='SERVICENOW') {'smtp:'+user.customproperty36} else {'smtp:'+user.systemUserName+'@dev.mail.onmicrosoft.com'}}", "userAccountControl": "512", "userPrincipalName": "${user.email}", "accountExpires": "${user.termDate!=null ? 10000*(user.termDate.getTime() + 11644473600000) : 0}", "info": "${user.entity+'/'+user.costcenter}", "extensionattribute6": "${user.entity+'/'+user.costcenter}", "extensionattribute3": "${user.customproperty19}", "extensionattribute10": "${user.customproperty18}", "physicalDeliveryOfficeName": "${user.customproperty15}", "msExchMailboxGuid": "${user.customproperty60}", "proxyaddresses": ["SMTP:${if(user.customproperty20=='SERVICENOW') {user.customproperty36} else {user.customproperty13}}", "smtp:${user.systemUserName}@dev.mail.onmicrosoft.com"], "c": "${user.customproperty17}", "countryCode": "${user.customproperty16}", "Co": "${user.country}", "Company": "${user.companyname}", "departmentNumber": "${user.costcenter}", "objectclass": ["top", "person", "organizationalPerson", "user"] }

We have also tried passing empty string,sample GUID ("550e8400-e29b-41d4-a716-446655440000","\c2\a4\11\f9\de\42\c1\42\8d\97\ab\ef\77\66\06\3c" ) and null to "msExchMailboxGuid" attribute but none of them are working.

Regards,

Rahul

[This post has been edited by a Moderator to remove sensitive information.]

[adarshk]

Hi Rahul,

To set the value to a valid GUID, please pass the value in below format.

"msExchMailboxGuid#binary":"${adObjectGUID}"

adObjectGUID can be any attribute where you have a valid GUID

You can also try setting the value to 0 by using the below format:

{

"msExchMailboxGuid#binary": "00000000-0000-0000-0000-000000000000"

}

Here, #binary will first convert objectGUID in standard format to the hexadecimal value. Then it will convert the Hexadecimal value to byte array and will push it to AD target.

However, setting it to null is currently limited, can you try setting the value to null from LDAP browser or run any scripts to set it to null if its an initial activity. 

Thanks,

Adarsh Kulkarni

[rahul_shetty]

Hi @adarshk ,

Following your instructions, the "msExchMailboxGuid" attribute is being transmitted from Saviynt to AD using the specified format: "msExchMailboxGuid#binary":"${adObjectGUID}".

I will confirm whether using "00000000-0000-0000-0000-000000000000" as a value can resolve our issue of clearing the attribute. In the meantime, could you assist us in storing the "msExchMailboxGuid" value of an account in the account's custom property during reconciliation?

Currently, we are employing the following format in ACCOUNT_ATTRIBUTE: {CUSTOMPROPERTY55::msExchMailboxGuid#String}, but the data isn't being stored correctly due to it being a hexadecimal value.

I experimented with {CUSTOMPROPERTY55::msExchMailboxGuid#Binary}, but it resulted in the failure of the import job. Can you provide guidance on the correct format, please?

Regards,

Rahul

[adarshk · Accepted solution]

FYI: For reconciling this value and storing it on an attribute in saviynt, this is not supported in the current versions. 

Thanks,
Adarsh Kulkarni