Getting Error: OBJ_CLASS_VIOLATION while setting the owner for service account in AD

[Ajit]

Hi Team,

We have a requirement to set the owner for 'service accounts' while creating. We have stored the DN value of account in a user customproperty.

Below is the create account JSON:

{
"sAMAccountName": "${task.accountName}",
"displayName": "${'Service Account - ' + displayName}",
"givenName": "${task.accountName}",
"sn": "${task.accountName}",
"objectclass": ["top", "person", "organizationalPerson", "user"],
"userPrincipalName": "${task.accountName + '@XYZ.gov.au'}",
"description": "${description}",
"userAccountControl": "65536",
"owner":"${user.custompropertyX}"
}

But, its giving the below error in logs:

Could you please help what is the issue here?

Thanks,

[rushikeshvartak]

Does owner attribute exists in target?

[Ajit]

@rushikeshvartak Thank you for the response.

Yes, owner attribute exists. We are able to see the owner attribute using softerra browser in AD.

Thanks,

[rushikeshvartak]

Are you able to create user outside saviynt using tool mentioned ? If yes share sample user metadata 

⚠️ Reminder: Mask possible PII such as employee names, email addresses, phone numbers, IP addresses, account details, company-specific URLs, and client names before sharing.⚠️

[Ajit]

@rushikeshvartak Sorry didn't get this. Create user outside Saviynt means?

We are able to create the service account in AD through Saviynt. If we are removing the owner mapping from create account JSON.

Thanks,

[rushikeshvartak]

Please share sample user metadata

[Ajit]

@rushikeshvartak  PFB:

Thanks,

[rushikeshvartak]

Share any existing user with owner field

[Ajit]

@rushikeshvartak  For user account creation we are setting the manager field not the owner field:

For service account creation requirement is to set the owner attribute.

Thanks,