Steps to reproduce the issue

1. Setup an Active Directory as a directory.
2. Under Requests link any simple Account template with a pending parameter Name and choose Entitlements require an Account.
3. Setup an AD AFX connector.
4. Under Create Account capability, add a command output parameter to read the distinguishedName and map it to any attribute that has spaces in its name (for example: External ID):

5. Now in the capability Add Account to Group, use the same attribute used above as the "Account" Parameter.

6. Create a change request to add an AD Group to any user that does not yet have an AD account.

Expected behavior

• CR created with two items, create account then add group to account. Both items are fulfilled by AFX and then wait for verification

Actual behavior

• CR created with two items, create account then add group to account. Create account is successful, but Add group to account fails.

Access the RSA Identity Governance and LIfecycle portal.  Go to Admin > Attributes and remove the space in the attribute name used in the AFX output parameter or use the parameter that doesn't contain any spaces.

An example of a scenario where attribute name has no space follows:

1. Choose another attribute that does not have any spaces in its name and use it as the output parameter (for example, DN).

2. Create another similar CR. This time changes will be fulfilled as expected.