Active Directory provisioning tidbits

27 Kudos

Introduction
Special attributes
AC_NewParent Example
AC_NewName Example
Terminal services attributes
Exchange provisioning – Connector scripts

Introduction

When provisioning to Microsoft Active Directory there are certain fields that have specific special values that must be assigned to them from your provisioning policy on your active directory application or provisioning policy on a rule in order to have the correct resulting value assigned inside the Active Directory server. The goal of this article is to identify these Active Directory fields that require specialized values and provide a reference for the values need to be assigned to these fields.

The SailPoint document “SailPoint IdentityIQ Direct Connectors Administration and Configuration Guide” introduces these fields in some light detail. However this document does not provide example values for provisioning plans and leaves a bit up to “Experimentation” for the engineer implementing the solution in the field. This article should make that engineer’s job a little bit easier.

Special attributes

The Active Directory has a couple of special attributes for managing scenarios such as “Renames” and “Moves” The attributes are as follows:

Attribute Name	Attribute Value
AC_NewName	New cn value for the given user ( Ex. CN=john.doe)
AC_NewParent	New ou value for user ( Ex. ou=example,dc=com,dc=us)

AC_NewParent Example

AccountRequest acct = new AccountRequest(AccountRequest.Operation.Enable,"ActiveDirectory",adLink.getNativeIdentity());

newParent = "ou=people,ou=newOu,ou=world,dc=exmaple,dc=com";

acct.add(new AttributeRequest("AC_NewParent",ProvisioningPlan.Operation.Set, newParent));

AccountRequest acct = new AccountRequest(AccountRequest.Operation.Enable,"ActiveDirectory",adLink.getNativeIdentity());

newParent = "ou=people,ou=newOu,ou=world,dc=exmaple,dc=com";

acct.add(new AttributeRequest("AC_NewParent",ProvisioningPlan.Operation.Set, newParent));

AC_NewName Example

attributeRequest.setName("AC_NewName");

String attributeValue = "cn="+identity.getLastname()+ "\\, "+identity.getFirstname()+" ("+identity.getAttribute("networkId")+")";

attributeRequest.setValue(attributeValue);

Terminal services attributes

In general setting an AD account attribute to null or “” (the empty string) will cause the API to call a .clear() method on the AD interface, clearing out any previous value for that field.

msNPAllowDialin – sending “NOT SET” (all caps, space in the middle, 7 characters long) will clear out this setting in AD.

msRADIUSCallbackNumber – specifying any value for this field causes the “msRADIUSServiceType” field to be set to 4.

IIQDisabled – sending “true” for this field (that is often not in the AD schema) causes the userAccountControl bit flag 0x0002 to be set high.

Setting pwdLastSet to "true" sets the AD attribute to 0.

Setting pwdLastSet to any other value sets the AD attribute to -1.

AllowLogon - this is set to a 32-bit conversion/truncation of the passed in value.

BrokenConnectionAction - When set to "End session" the value is set to 1. It is set to 0 in all other circumstances.

ConnectClientDrivesAtLogon - this is set to a 32-bit conversion/truncation of the passed in value.

ConnectClientPrintersAtLogon - this is set a 32-bit conversion/truncation of the passed in value.

DefaultToMainPrinter - this is set a 32-bit conversion/truncation of the passed in value.

EnableRemoteControl - This is expecting one of the following strings:

"Disabled"

"Enabled, Require permission, Interact"

"Enabled, Interact"

"Enabled, Require permission, View"

"Enabled, View"

The comparison is done using a switch string so again assume that case matters.

When "Disabled" passed in the value is set to "0".

When "Enabled, Require permission, Interact" passed in the value is set to "1".

When "Enabled, Interact" passed in the value is set to "2".

When "Enabled, Require permission, View" passed in the value is set to "3".

When "Enabled, View" passed in the value is set to "4".

MaxConnectionTime - this is converted to minutes before being applied

MaxDisconnectionTime - this is converted to minutes before being applied

MaxIdleTime - this is converted to minutes before being applied

ReconnectionAction - When set to "From any client" this is set to "0" in AD, it is set to "1" in all other cases.

The following fields are passed through verbatim to Active Directory:

TerminalServicesHomeDirectory

TerminalServicesHomeDrive

TerminalServicesInitialProgram

TerminalServicesProfilePath

TerminalServicesWorkDirectory

BrokenConnectionAction - This is expecting a string value "End session" if this is passed the

value is set to 1, else 0. The comparison for this string uses an Equals() method so assume case matters here

ReconnectionAction - This is expecting the string value "From any client" if this is passed the

value is set to 1, else 0. The comparison for this string uses an Equals() method so assume case matters here

msNPAllowDialin - The default schema type for this attribute is a string. It accepts the string representations of “true” ,”false”, or “Not Set”.

Exchange provisioning – Connector scripts

Type Name	Description
ConnectorBeforeCreate	Before script for create operation
ConnectorAfterCreate	After script for create operation
ConnectorBeforeModify	Before script for modify operation includes enable/disable, unlock
ConnectorAfterModify	After script for modify operation includes enable/disable, unlock
ConnectorBeforeDelete	Before script for delete operation
ConnectorAfterDelete	After script for delete operation

The thing to know with these hooks is that once setup, the rule will fire everytime. So your script must have some intelligence as to know when to take action and when not to. One thing you can do is use a valid Active Directory attribute to write flag data for your script to check. So for instance in the description field for AD you can write a value of “doHomeFolder”. So in your PowerShell script you can have the script interrogate the Attribute Request value for description and decide based on the value whether or not to take action.

hari_mailvaganam · ‎Dec 06, 2013

Very good - thank you!

adam_hampton · ‎Jan 31, 2014

I've merged in some additional content to the document. Nice work, David.

lyndsay_lantz · ‎Jun 16, 2014

The comments that were previously here have been moved to: Delete AD account using custom termination life cycle event?

nukem23 · ‎Aug 23, 2018

Very instructive document.

I was struggling to set pwdLastSet to 0.

Thanks.

Regards,

Alexandre

mpoddar456 · ‎Feb 14, 2020

Hi all,

We are trying to move AD groups from one domain into another domain using AC_NewParent attribute. But it's failing with error "Failed to update attributes for identity CN=TestDomainMove14Feb,OU=IAM,OU=Servers,DC=devadmin,DC=test_dev,DC=co,DC=uk. An unknown error occurred". The movement between OUs of the same domain is working fine. Even tried to change the group into universal groups before updating the domain but no luck there. The service account has exactly the same permissions at both the domains.

Please see below the plan and error returned:

  <ProvisioningPlan targetIntegration="Active Directory" trackingId="c56b6bc5666e4574b486b467742ee44d">
    <Attributes>
      <Map>
        <entry key="requester" value="spadmin"/>
        <entry key="source" value="GroupManagement"/>
      </Map>
    </Attributes>
    <ObjectRequest application="Active Directory" nativeIdentity="CN=TestDomainMove14Feb,OU=IAM,OU=Servers,DC=devadmin,DC=test_dev,DC=co,DC=uk" op="Modify" targetIntegration="Active Directory" type="group">
      <Attributes>
        <Map>
          <entry key="provisioningTransactionId" value="2c9c07c1704259e00170428f12550050"/>
        </Map>
      </Attributes>
      <AttributeRequest name="AC_NewParent" op="Set" value="OU=IAM,OU=Servers,DC=devretail,DC=test_dev,DC=co,DC=uk"/>
      <AttributeRequest name="GroupScope" op="Set" value="Global"/>
      <ProvisioningResult status="failed">
        <Errors>
          <Message key="Errors returned from IQService. Failed to update attributes for identity CN=TestDomainMove14Feb,OU=IAM,OU=Servers,DC=devadmin,DC=test_dev,DC=co,DC=uk. An unknown error occurred." type="Error"/>
        </Errors>
      </ProvisioningResult>
    </ObjectRequest>
    <Requesters>
      <Reference class="sailpoint.object.Identity" id="2c9c07c16aa09cc3016aa09d39bb0113" name="spadmin"/>
    </Requesters>
  </ProvisioningPlan>

Any help appreciated.

Thanks

sarthak_chawla_87 · ‎Mar 22, 2020

Hi,

We are creating an account request where we are doing 3 things

Disabling an account, using attribute requests to remove group membership and using ac_newparent to move the account. Can doing these 3 operations in one account request cause any issues at anytime with the provisioning process?

The above post shows its possible to move the account and enable it at the same time. So am guessing modifing the groups in the same account request shouldn't be a problem too?

gaurav_jain · ‎Mar 23, 2020

This should work without any issue.

Thanks,

Gaurav

kitho9 · ‎Apr 15, 2020

Hi @mpoddar456 - were you able to find a solution for the issue you mentioned above? I'm currently encountering the same error.

Nitish_Raina · ‎Jun 12, 2020

Hi All,

In my current setup, we are passing the Exchange attribute in Provisioning Policy of a Primary AD application which is working fine.

I have requirement to fetch the value of Exchange Attribute before doing the provisioning so that I can set the value of exchange attribute correctly.

Firstly , I wanted to know Can we fetch the exchange attributes values ?
If yes , Can someone share how can I achieve this

Your responses are highly appreciable.

Thanks,

Nitish

sagar_madaan · ‎Nov 16, 2020

@mpoddar456 , @kitho9

Any luck ?