When provisioning to AD, IQService returns the error: Length cannot be less than zero

[#1]

• Symptoms
• Diagnosis
• Solution

Symptoms

When provisioning to Active Directory, IQService returns the error "Errors returned from IQService. Length cannot be less than zero. Parameter name: length"

Diagnosis

This error typically occurs when provisioning to AD while the identity attribute is set to a non-standard attribute in the Account Schema.

Solution

When provisioning to an AD application, the Identity Attribute must be set to "distinguishedName" in the Account Schema. This should be the default when defining at AD application and should not be changed.

If the setting has changed, it can be restored by completing the following steps:

1. From IdentityIQ, select Applications > Application Definitions.
2. Select the correct application from the list.
3. Swith to the Configuration tab.
4. Open the Schema settings.
5. Ensure the Identity Attribute is configured to be distinguishedName, as seen in the following image:
   

   

6. Save the changes.
7. Repeat your provisioning attempt.