Unable to stamp manager DN on 'manager' attribute in AD while provisioning user's AD account

[kushalpatadia]

Saviynt Version: v24.2

Hi Team,

For all users, we are storing their DN value on their AD account customproperty4.
While provisioning AD account for new user, requirement is to store his/her manager's DN value on 'manager' attribute in AD.

Tried using below code in our CREATEACCOUNTJSON for this requirement:
"manager": "${managerAccount==null?'':managerAccount.customproperty4}"

This code works fine when a user's manager is having an AD account with customproperty4 value.

But when user's manager does not have an AD account, New Account and Add access tasks for AD are not getting completed for user with below error message. For the same user if a manager having AD account is added, these tasks get completed successfully.

"Error while creating account in AD - [LDAP: error code 21 - 00000057: LdapErr: DSID-0C091363, comment: Error in attribute conversion operation, data 0, v4563 ]"
"2024-03-20T11:38:20.442+00:00","ecm-worker","","null-t9np2","","javax.naming.directory.InvalidAttributeValueException

Also noticed Creating Account Datamap in logs is not fetching any value for manager attribute when user's manager is not having AD account.

Referring to multiple forum posts for similar issue from other people, tried below combinations within the JSON as well but still get the same error:

(a) "manager":"${managerAccount==null?'':managerAccount?.customproperty4}"

(b) "manager": "${managerAccount!=null?managerAccount.customproperty4:''}"

(c) "manager": "${managerAccount!=null?managerAccount?.customproperty4:''}"

(d) "manager": "${if(managerAccount == null || managerAccount?.customproperty4 == null || managerAccount?.customproperty4 == ''){''} else {managerAccount?.customproperty4}}"

(e) "manager": "${managerAccount?.customproperty4}"

Any help here would be appreciated.

Thanks,
Kushal

[dgandhi]

Can you store DN value of the AD account on User's cp and then provision that CP value?

"manager": "${manager.custompropertyXX}", 

[rushikeshvartak]

"manager": "${managerAccount != null && managerAccount.customproperty4 != null ? managerAccount.customproperty4 : ''}"

[kushalpatadia]

Hi @dgandhi 

Thank you for your response.

If a manager is not having an AD account, manager's custompropertyXX (For example lets take customproperty40) on its identity will not be updated with any DN value.
In such a case when we tried passing something like "manager":"${manager?.customproperty40}" and "manager":"${manager.customproperty40}" it throws below error while processing the tasks

"ERROR","Error while creating account in AD - [LDAP: error code 19 - 000020B5: AtrErr: DSID-03153438, #1:"
"2024-03-20T17:29:42.310+00:00","ecm-worker","","null-t9np2",""," 0: 000020B5: DSID-03153438, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 15000a (manager)"
"2024-03-20T17:29:42.310+00:00","ecm-worker","","null-t9np2",""," ]"
"2024-03-20T17:29:42.310+00:00","ecm-worker","","null-t9np2","","javax.naming.directory.InvalidAttributeValueException

Thanks,

Kushal

[kushalpatadia]

Hi @rushikeshvartak 

Thank you for your response.

We tried using below code but still it throws same error as reported in the post.

"manager": "${managerAccount != null && managerAccount.customproperty4 != null ? managerAccount.customproperty4 : ''}"

ERROR:

"ERROR","Error while creating account in AD - [LDAP: error code 21 - 00000057: LdapErr: DSID-0C091363, comment: Error in attribute conversion operation, data 0, v4563 ]"
"2024-03-21T12:08:49.943+00:00","ecm-worker","","null-t9np2","","javax.naming.directory.InvalidAttributeValueException

Thanks,
Kushal

[rushikeshvartak]

Does manager with CP4 works ?

[kushalpatadia]

@rushikeshvartak yes it works for a manager who has an AD account and account CP4 is having a DN value.

[rushikeshvartak]

"manager": "${managerAccount != null && managerAccount?.customproperty4 != null && managerAccount?.customproperty4 != '' ? managerAccount?.customproperty4 : ''}"

[Manu269]

@kushalpatadia try this :

"manager": "${managerAccount==null?'':managerAccount?.customproperty4 }",