Is there a way to create unique account attributes (not set as AccountID in account Schema) with a template array similar to this? The 'Create Unique LDAP Attribute' generator uses just one pattern. Could an array be passed to it to check against multiple patterns similar to this transform?
Currently only the Account Id attribute is supported to use the Username Generator for.
For other attributes where you might use the Create Unique LDAP Attribute Rule (like sAMAccountName or mail), please either continue to use that rule or create your own generator. Please see here for more assistance on Generator Rules.
I had the same issue when I was trying to create a username generator transform not too long ago. The issue I had though was that I was trying to create the transform in the wrong Postman call.
I was originally trying to do a POST to "{{url}}/api/transform/create". Instead, what's required here is to do a GET call to "{{url}}/api/accountProfile/list/{{source number}}". The source number here is from whichever connector you want to use the username generator transform for.
The result will come back, and you'll see in the JSON for each attribute a spot for a transform. This is where the username generator transform is applied. You place it in, configured as you want it, and then include everything else that came back from that previous GET call when you then make a POST to "{{url}}/api/accountProfile/bulkUpdate/{{same source number}}".
I would first backup whatever you had come back in that GET call before making this POST call. If successful, you should be able to go to the Create Profile tab for the connector and see that a custom transform is being applied to the attribute you placed the transform under.
Hi @Stephan_M , based on the error message, it looks like you are trying to create a transform from Example 1.
Please note the comments under Transform Structure. These examples are attribute configurations as part of an Account Profile (specifically, account create profile). These examples would be used for a source where the username is the Account Id rather than a source where the account Id is an internal system id (like Azure AD).
Also, you can use the beta APIs to handle updating the AccountProfiles (called Provisioning Policies in the APIs)
I tried the simplest version from gui and still got below error:
Error generating a unique value, the exception was: java.lang.Exception: Unable to contact connector to generate unique value and is not retry-able. Action:UniqueAccountIdValidator: Calling getObject for objectType 'account' using id 'AdaPrats' and options '{cloudConfigOverrides={aggregateTimeout=30, disablePooling=true, timeout=30}}' on source 'Prod AD (Prov) [source]'. Exception: sailpoint.connector.ConnectorException: [ InvalidConfigurationException ] [ Error details ] Required string attribute 'User' is not defined.It must have a valid value.
This is snippet for samaccountname (Account ID for AD source) from the ‘CREATE’ Provisioning policy
You should use "Create Unique LDAP Attribute". So, instead of using "name": "Create Unique Account ID" rather use "name": "Create Unique LDAP Attribute"
Also note that sAMAccountName has a limit of 20 characters, so you should set cloudMaxSize to 20. "cloudMaxSize": "20",
@Louwrens I'm use the "Create Unique LDAP Attribute" rule with cloudMaxSize set to 16, since we have downsteam systems that have this limitation. The issue is that the rule trims the value to 16 chars, after adding the uniqueCounter, hence provisioning fails with the following error;
sailpoint.tools.GeneralException: Error running rule transform:sailpoint.tools.GeneralException: The application script threw an exception: java.lang.IllegalStateException: Unable to generate a unique value for Source[Staging Corp AD [source]] Field [sAMAccountName] after 20 retries. BSF info: Create Unique LDAP Attribute at line: 0 column: columnNo
@rk-cyderes , If you have "cloudMaxUniqueChecks":"20", then the "$(uniqueCounter)" values could be 1-20. If you have " "cloudMaxSize": "16", then you only have 16 characters to work with.
This would mean that everything preceding "$(uniqueCounter)" should be 14 characters max, so that when you add one or two digits, that you don't exceed 16 characters.
"xxxxxsb.$(firstNameInitial)" = 9 characters
This would mean that "$(simplifiedLastname)" should be trimmed to max 5 characters.
Then the usernames would be anything from 10 - 16 characters long.
You are right, it works with a trimmed $(simplifiedLastname) to max 5 characters. However, I would have expected the rule to handle this. If I have to trim the input to manage the size, then the purpose of cloudMaxSize is not clear. Anyways, thanks for comfirming.
Also, can we set 2 digit numbers on the uniqueCounter, i.e., 01 instead of 1 and so on, until 09.
