How to use dynamic attribute in AD connection Account name rule

[AshirvadhN]

Hi Experts,

Am trying to use dynamic attribute in AD connection Account name rule.

We have created the dynamic attribute called accountype.

Our requirement is

If accounttype==Developer account then assign 'CN=${user.lastname}\\,${user.firstname+'(Developer)'},OU=............................'

else

if accounttype==Super User then assign 'CN=${user.lastname}\\,${user.firstname+'(Super User)'},OU=............................'

Does any of you worked on this and please let me the solution if any of you worked on this.

[pmahalle]

Hi @AshirvadhN ,

Can you try below expression in account name rule in your connection:

CN=${user.lastname}\\,${user.firstname} + ${if(requestAccessAttributes.get('accountype')=='Developer'){'(Developer)'} else if(requestAccessAttributes.get('accountype')=='Super User'){'(Super User)'}} ,OU=............................

[AshirvadhN]

Hi @pmahalle 

Thanks for your respose.

I have created it, please can you verify it is correct or not.

CN=${user.lastname}\\,${user.firstname} + ${if(requestAccessAttributes.get('accountype')=='Developer'){'(Developer)'},OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net else if(requestAccessAttributes.get('accountype')=='Super User'){'(Super User)'}},OU=Super User Account,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net

[AshirvadhN]

Hi @pmahalle 

I tried with this below json in account name rule.

but getting the error.

CN=${user.lastname}\\,${user.firstname} + ${if(requestAccessAttributes.get('accountype')=='Developer'){'(Developer),OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net'} else ${if(requestAccessAttributes.get('accountype')=='Super User'){'(Super User),OU=Super User Account,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net'}}}

Error while creating account in AD - No such property: requestAccessAttributes for class: SimpleTemplateScript6

Is there anything issue in the json.

[armaanzahir]

Hi @AshirvadhN ,

Referencing dynamic attributes on the AD connection json's, can you simply use ${<dynamic attribute name>} and check? ${accountype}

Thanks,

Armaan

[AshirvadhN]

Hi @armaanzahir 

Am facing this error 

Error while creating account in AD - No such property: requestAccessAttributes for class: SimpleTemplateScript6 Error while creating account in AD - No such property: accountype for class: SimpleTemplateScript7

CN=${user.lastname}\\,${user.firstname} + ${if(accountype=='Developer'){'(Developer),OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net'} else ${if(accountype=='Super User'){'(Super User),OU=Super User Account,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net'}}}

[armaanzahir]

Can you share the definition of this dynamic attribute?

Thanks,

Armaan

[AshirvadhN]

We have created the dynamic attribute called accountype.

Our requirement is

If accounttype==Developer account then assign 'CN=${user.lastname}\\,${user.firstname+'(Developer)'},OU=............................'

else

if accounttype==Super User then assign 'CN=${user.lastname}\\,${user.firstname+'(Super User)'},OU=............................'

[armaanzahir]

@AshirvadhN , As per the screenshot the name of the dynamic attribute is privaccount and not accountype. Let me know if this understanding is correct?

[AshirvadhN]

Sorry the dynamic attribute name is privaccount

[AshirvadhN]

Hi @armaanzahir 

Am getting this error now

Error while creating account in AD - No such property: privaccount for class: SimpleTemplateScript4

[armaanzahir]

@AshirvadhN ,

Can you try the below JSON:

${if (privaccount.equals('Developer')) { 'CN='+user.lastname+'\\,'+user.firstname+' (Developer),OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net' }
else if(privaccount.equals('Super User')) { 'CN='+user.lastname+'\\,'+user.firstname+' (Super User),OU=Super User Account,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net' }}

Thanks,

Armaan

[AshirvadhN]

Hi @armaanzahir

Am getting this error

Error while creating account in AD - No such property: privaccount for class: SimpleTemplateScript10

[AshirvadhN]

Hi @pmahalle  and @armaanzahir 

I have tried many possibilities still am not able do the account name rule in AD connection.

Please help me with this.

${if (privaccount.equals('Developer')) { 'CN='+user.lastname+'\\,'+user.firstname+' (Developer),OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net' }
else if(privaccount.equals('Super User')) { 'CN='+user.lastname+'\\,'+user.firstname+' (Super User),OU=Super User Account,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net' }}

Am getting this error

Error while creating account in AD - No such property: privaccount for class: SimpleTemplateScript10

[pmahalle]

Hi @AshirvadhN ,

Can you try below one in ACCOUNT NAME RULE

CN=${user.lastname}\\,${user.firstname},${if(privaccount.equals('Developer')){'(Developer),OU=Developer Accounts'} else if(privaccount.equals('Super User')){'(Super User),OU=Super User Account'}},OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net

[AshirvadhN]

Hi @pmahalle 

Nope it didn't worked for me

It is showing null in dynamic attribute selection filed please find the highlighted field.

Checking DN for CN=test10\,Simeio,null,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net.Error while searching for DN-CN=test10\,Simeio,null,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net: [LDAP: error code 34 - 0000208F: LdapErr: DSID-0C090B26, comment: Error processing name, data 0, v4563] SAV-Error while creating account,Could not find a unique DN to provision

[pmahalle]

@AshirvadhN 

Seems like you are selecting "Developer Account" in dynamic attribute and not Developer. I mentioned only Developer in if condition. Did you change it in you json. If not try below:

CN=${user.lastname}\\,${user.firstname},${if(privaccount.equals('Developer Account')){'(Developer),OU=Developer Accounts'} else if(privaccount.equals('Super User')){'(Super User),OU=Super User Account'}},OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net

[AshirvadhN]

It is throwing the error.

SAV-Error while creating account,Could not find a unique DN to provisionChecking DN for CN=test10\,Simeio,(Developer),OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net.Error while searching for DN-CN=test10\,Simeio,(Developer),OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net: [LDAP: error code 34 - 0000208F: LdapErr: DSID-0C090B26, comment: Error processing name, data 0, v4563] SAV-Error while creating account,Could not find a unique DN to provision

[pmahalle]

@AshirvadhN ,

So now No such property issue is resolved, right?

Seems like account with DN CN=test10\,Simeio,(Developer),OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net is already present in Active directory.

In that case you need to write few more rule separated by ### in Account Name Rule as per requirement. So that if DN is present next rule will be picked up and new DN will be generated.

[AshirvadhN]

For this user am requesting fresh account and this user not in target.

[pmahalle]

@AshirvadhN 

Make sure "OU=Developer Accounts,OU=User Accounts,OU=Secured Resources,OU=Savyint-Dev,DC=datacenter,DC=radiangroupinc,DC=net" is present in target AD.