To Generate user password and send email

[Anshu_07]

We have a requirement to automatically change a user's password to a randomly generated one upon onboarding. This new password should also update their Active Directory password and be sent to the user via email.

[rushikeshvartak]

You can call change password action from rule

[Anshu_07]

You mean User  update rule? will it generate a random password ? and how do we send email to the users

[NM]

@Anshu_07 in endpoint email template set change password attach email template which will send to respective user.

[Anshu_07]

Hi , In endpoint there is  no option to attach email. Could you please provide any screenshot where specially I can attach the template

[rushikeshvartak]

• User vs endpoint has no relation so discard that

[Anshu_07]

Ok in that case how end users will receive the password via email?

[rushikeshvartak]

Refer https://forums.saviynt.com/t5/identity-governance/random-password-generation-for-new-user-onboard-an...

[Anshu_07]

Thank you , I could see we can attach for new account creation. Could you please tell how do I attach template for specific task type ?

[rushikeshvartak]

• This is when you want to change password of account , you need to attach under endpoint - email templates

[rushikeshvartak]

You can generate random from connection

[Anshu_07]

Hi,

Even after the change password task is getting completed the password is not updated in AD , I checked in the accounts tabled lastpasswordchange attribute is also not changed. 

[rushikeshvartak]

• Did you validated logs ?

[Anshu_07]

Yes, I have checked the logs. Now I could see Accounts.lastpasswordchange is getting updated but the password is still not getting updated in AD. Could you provide what should be in the connect Jason
At present I am using this "pwdLastSet": "account.LASTPASSWORDCHANGE" in Create account Jason. 

[rushikeshvartak]

Please share the logs & JSON in text file for easier debugging. Additionally, provide the task ID, error details, or specific line numbers where the issues occur to help us review the relevant sections efficiently.



⚠️ Important: Do not upload attachments containing sensitive information, such as IP addresses, URLs, company/employee names, or email addresses. For more information, refer to the Saviynt PII Policy.

[Anshu_07]

{
"givenName": "${user.firstname}",
"sn": "${user.lastname}",
"manager": "${user.manager!=null ? managerAccount.accountID : ''}",
"displayName": "${user.displayname}",
"middleName": "${user.middlename}",
"employeeNumber": "${user.employeeid}",

"accountExpires": "${user.enddate!=null ? 10000*(user.enddate.getTime() + 11644473600000) : '0'}",
"employeeType": "${user.employeeType}",
"title": "${user.jobDescription}",
"objectClass": [
"top",
"person",
"organizationalPerson",
"user"
],
"userAccountControl": "${user.statuskey==1?'512':'514'}",
"company": "${user.companyname}",
"departmentNumber": "${user.departmentNumber}",
"department": "${user.departmentname}",
"businessCategory": "${user.orgunitid}",
"otherMailbox": "${user.secondaryEmail}",
"l": "${user.location}",
"userPrincipalName": "${user.customproperty6}",
"employeeID": "${user.username}",
"sAMAccountName": "${user.systemUserName}",
"mail": "${user.email}",
"st": "${user.state}",
"co": "${user.country}",
"msDS-cloudExtensionAttribute1": "${user.customproperty2}",
"msDS-cloudExtensionAttribute2": "${user.customproperty3}",
"msDS-cloudExtensionAttribute3": "${user.customproperty4}",
"msDS-cloudExtensionAttribute4": "${user.customproperty5}",
"msDS-cloudExtensionAttribute5": "${user.locationnumber}",
"msDS-cloudExtensionAttribute6": "${user.customproperty1}",
"msDS-cloudExtensionAttribute7": "${user.startdate!=null?new java.text.SimpleDateFormat('yyyyMMddHHmmss').format(user.startdate).concat('.0Z'):''}",
"msDS-cloudExtensionAttribute8": "${user.employeeclass}",
"msDS-cloudExtensionAttribute9": "${user.leaveStatus}",
"msDS-cloudExtensionAttribute10": "${user.customproperty52}",
"msDS-cloudExtensionAttribute11": "${user.customproperty45}",
"businessCategory": "${user.customproperty10}",
"division": "${user.customproperty13}",
"pwdLastSet": "account.LASTPASSWORDCHANGE"
}

[This message has been edited by moderator to mask sensitive information]

[rushikeshvartak]

"pwdLastSet": "${account.LASTPASSWORDCHANGE != null ? new java.text.SimpleDateFormat('yyyyMMddHHmmss.SSSZ').format(account.LASTPASSWORDCHANGE) : ''}"

[Anshu_07]

Random password is getting generated and but task is getting completed with an error "Error while change password operation for account-fc1502dev in AD - [LDAP: error code 53 - 0000052D: SvcErr: DSID-031A126C, problem 5003 (WILL_NOT_PERFORM), data 0 ]"

[rushikeshvartak]

Here are some common causes and solutions:

1. Insufficient Permissions: Ensure that the user account performing the operation has the necessary permissions for the requested action.

2. Password Policy Violations: If the operation involves user account modifications (like password changes), check if it violates any password policies (e.g., complexity, history).

3. Account Restrictions: The account you’re trying to modify or access might be disabled or restricted. Make sure the account is enabled and meets any necessary conditions.

4. LDAP Schema Constraints: Check for any schema constraints that might prevent the operation. This can include things like required attributes not being provided.

5. Domain Controller Issues: If you're working in a multi-domain environment, ensure that the domain controller you're connecting to is functioning properly and is up-to-date.

[Anshu_07]

I used this "pwdLastSet": "${account.LASTPASSWORDCHANGE != null ? new java.text.SimpleDateFormat('yyyyMMddHHmmss.SSSZ').format(account.LASTPASSWORDCHANGE) : ''}".
But in AD instead of updating the date it is updating the attribute value to never.

[rushikeshvartak]

"pwdLastSet": "${account.LASTPASSWORDCHANGE != null ? new java.text.SimpleDateFormat('yyyyMMddHHmmssZ').format(account.LASTPASSWORDCHANGE) : new java.text.SimpleDateFormat('yyyyMMddHHmmssZ').format(new Date())}"

[Anshu_07]

Hello, Thank you for your response.
When we are changing the password it is wiping off the existing value and updating as (never). 
Is there a way we can set when Saviynt generates random password it should be minimum 8 characters as currently when random password is getting generated it is of 6 characters.

[rushikeshvartak]

• You can add password policy to security system or
• in connection define MIN password policy under PASSWORD_MIN_LENGTH

[Anshu_07]

Yes , I have added and added minimum 12 characters but sometimes generating 5/6/8 just randomly

[rushikeshvartak]

• Please share connection pwd policy screenshot.
• Did you also added password policy ?

[Anshu_07]

Yes, I have added the password policy in security system

[rushikeshvartak]

What about connection parameters ?

[rushikeshvartak]

Check logs during creation and validate which password policy is used and update configs accordingly 

[Anshu_07]

In connection also it is 12.

[Anshu_07]

Hello,

In email template "TO" i am using ${user.email} for receiver email but I want to send to a different email which is stored in customproperty. I am using ${user.cutomproperty6} but not getting the email. 

[rushikeshvartak]

Does value is getting printed in email body ?

[Anshu_07]

Hi, thank you for your response. 

when I am using ${user.email} I am receiving the email but i am using ${user.customproperty6} I  am not receiving email though I have put my email in customproperty6. 

[rushikeshvartak · Accepted solution]

Did you tried printing ${user.cutomproperty6} in email body ? when using ${user.email}

Did you validated logs ?

try ${user?.cutomproperty6}

[Anshu_07]

I tried  ${user?.customproperty6}  it is working.  Thank you

[rushikeshvartak]

s was missing 🙂 basically ? mark is needed to null check.

${user?.customproperty6}