AD Connector EnableAccountJSON Delete Value

[Testy]

I have a disabled account, which I want to re-enable. To disable the account we add an nsRole (attribute) to the account, nsRole= 'Disabled'. To re-enable the account I need to delete the 'Disabled' nsRole. How can I achieve this? I don't think there is functionality in the enableAccountJSON to delete an attribute value. Please note that the nsRole attribute is multivalued, so the user has nsRole = 'Disabled', 'user', 'admin', etc.

[sai_sp]

There is one way to achieve this use case. You can import the nsRole attribute to one of Saviynt's account custom properties. This data will be imported as comma separated values since it is a multi valued attribute in AD. Once the data is in Saviynt, you can use Replace function in the enable account json and try to replace the Disabled value in the customproperty with a blank space and send the update to AD. You can try this and let us know.

[Testy]

Can you please give an example of the replace function, documentation only has these parameter:

DISABLEACCOUNTCHECKRULE: Define a rule for reusing inactive accounts. When this rule is defined and a user is terminated, EIC tries to reuse the inactive account IDs of the user by checking the IDs in the DISABLEACCOUNTOU attribute. If the IDs are found in the DISABLEACCOUNTOU attribute, the OU is fetched and the account is enabled. 

• ENABLEACCOUNTOU: Specify the name of the destination container to move the account. You must define it only if the MOVEDN attribute is set to Yes. 

• REMOVEGROUPS: Instruct the connector to remove the previously assigned groups of the user after the account is enabled or reassign the user to the same group. When set to No, the user is reassigned to the same group.

• USEDNFROMACCOUNT: Instruct the connector to obtain the existing DN of the account from the accounts table. When set to Yes, the connector obtains the existing DN of the account.

• MOVEDN

[mbinsale]

replace function would be a regular JAVA String function

[Testy]

How would this look like in the EnableAccountJSON?

[mbinsale]

The way this can possibly be achieved is by doing the below

1. During account import, map the nsRole to one of the CustomProperties in the account attributes. You can do this using the Account_Attribute Mapping field in the Connection

2. During enableAccount, in the enableAccount JSON you can use the action "AFTERENABLEACTIONS : { nsRole : custompropertyxx} })" where custompropertyxx is the original mapped attribute.

Now the nsRole / custompropertyxx will get updated when the account is disabled and the original value will be updated. For this, you can use the JAVA string functions in the JSON to update the value and send it as part of the enableaccountjson

[Testy]

This would not work because nsRole is a multivalue