Default Provisioning Attributes Reference

The following generators create required information for a new Active Directory account. You may need to edit the contents.

The AC_NewName and AC_NewParent are special attributes to handle the move and rename operations and can be sent in Attributes Map and AccountRequest instead of AttributeRequest.

For example:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE ProvisioningPlan PUBLIC "sailpoint.dtd" "sailpoint.dtd">
<ProvisioningPlan>
   <AccountRequest application="AD App" nativeIdentity="CN=SampleUser,CN=Users,DC=Example,DC=Com" op="Disable">
    <Attributes>
     <Map>
         <entry key="AC_NewParent" value="OU=DsiabledUsers,DC=Example,DC=Com"/>
     </Map>
    </Attributes>
   </AccountRequest>
</ProvisioningPlan>

Note the following when working with mailbox attributes:

• If you send an email address in the mail attribute, the exchange may not use it, if the E-mail Policy in the exchange is set to create it differently. The email address is not taken and sent back to Active Directory after it is created, based on the policy.

• For the Active Directory source, the mailNickname, homeMBD, and msExchHideFromAddressLists attributes are case insensitive when processed by the IQService.

• The Active Directory source sets the MS-Exchange attributes - homeMDB and mailNickname as AD attributes, if MS-Exchange is not enabled.

The following are additional attributes required to create a mailbox:

Updating Exchange Mailbox Attributes

The Active Directory connector supports updating any Exchange mailbox attributes supported by set-mailbox cmdlet, using the following methods:

1. Add the attribute in the provisioning policy with Exch_ as a prefix. For example, to set the HiddenFromAddressListsEnabled exchange attribute, add the attribute name as Exch_HiddenFromAddressListsEnabled in the provisioning policy.

2. Provide a comma separated list of exchange attributes for exchangeAttributes. For example, for the HiddenFromAddressListsEnabled provisioning policy attribute, use the IdentityNow REST API. Set up the exchangeAttributes attribute with a value such as HiddenFromAddressListsEnabled.

   Note
   For more information on IdentityNow APIs, refer to Best Practices: IdentityNow REST API Authentication and IdentityNow REST API - Update Source (Partial) in the SailPoint Developer Community.

The msRTCSIP-UserEnabled attribute must be updated as part of the Create Profile section.

By default, provisioning of the following attributes is supported:

For the provisioning of the following gMSA attributes, you must add them manually for the existing sources. By default, they are available for new sources.

Add the displayAttributeForContacts attribute as additional parameter for Contacts. CN is used as the default value for display name of Contact objects. The Display attribute can be set using the connector_displayAttributeForContact config attribute.

For example, to set it to firstName use the IdentityNow REST API and set value of connector_displayAttributeForContact to firstName.

Note
For more information on IdentityNow APIs, refer to Best Practices: IdentityNow REST API Authentication and IdentityNow REST API - Update Source (Partial) in the SailPoint Developer Community.

The following String-type attribute required for creating Linked Mailbox, is available by default, for the new sources. For existing sources, add manually in the Create Profile section.

accountExpires Attribute

For the Active Directory source, the accountExpires attribute must be defined as a string. The value of the accountExpires attribute can be set in the Microsoft defined timestamp that represents the number of 100-nanosecond intervals since January 1, 1601 (UTC).

The value can also be entered in a human readable format: MM/DD/YYYY HH:MM:SS AM TimeZone. For example, 05/11/2019 12:00:00 AM IST. A value of 0, never, or 9223372036854775807 indicates that the account never expires.

The value of the accountExpires attribute is displayed in the MM/DD/YYYY hh:mm:ss aa Z format. For example, if previously the time of account expiry was displayed as 5/14/2019 12:0:0 AM IST, it will now be displayed as 05/14/2019 12:00:00 AM IST.

'Never' as a Value of accountExpires Attribute

The Active Directory source supports never as a value of the accountExpires attribute in provisioning, when the timeZone attribute is present in the source configuration.

Note
SailPoint recommends that the accountExpires attribute must be defined as a string. However, the Active Directory source accepts an integer value for the accountExpires attribute in account provisioning if it is not a string.

timeZone Attribute

The Active directory source supports the timeZone attribute.

The timeZone attribute defines a time zone that you want to provision accounts in or change in the default setting of the accountExpires attribute and display.

The timeZone attribute accepts values in the string format.

Valid values are:

• epoch - use if you want to provision and see the accountExpires attribute in Active Directory epoch format.

• Continent/City - this format is similar to standard format that Java supports. For example, if you want to provision accounts and see the accountExpires attribute in Indian Standard Time then timeZone must be set as Asia/Kolkata.

Rollback of Created Account

The Active Directory source supports rollback of created account in case provisioning of one or more requested attributes fails during the provisioning operation. Set the rollbackCreatedAccountOnError attribute to True.