Compare AD attribute to calculate the next value

[MuzammilK]

Hi,

We've a requirement where we need to set the description of AD accounts in the format "AB012345", so the process is to retrieve the latest value, increment it and set it. I've set a custom account attribute to collect this attribute during account collection, and I've written a query which will fetch and increment the value in the workflow.

This works, but the issue after successfully creating an account in AD with say "AB000010", this account is not collected and hence not available in DB after the request is completed. So if another request is made before the next scheduled collection it will create the next account with "AB000010" instead of "AB000011".

Is there a way to run an account collector after a provisioning node is completed in workflow to fix this issue?

The other workaround would be to create a custom table and use that to get the updated value, but I'm not sure if that's advisable keeping upgrading in mind.

Else, is there a way to fetch values directly from AD using Javascript using naming policies?

[BorisLekumovich · Accepted solution]

Here is one approach to consider

Create a custom managed user attribute.

After the calculation of a unique value, store it in that attribute (not ideal, but you will have to update an internal table - T_MASTER_ENTERPRISE_USERS)

During you calculations, add additional source of information to take into account (from pv_users)

With regards to custom table, see the following post - https://community.rsa.com/thread/194188 

[MuzammilK]

Thanks for the reply Boris

[JaydeepMehta]

Hi Boris,

I too have similar use-case, Cannot we run the adHoc account collector post provisioning node for a single entity.

The desired approach in my use case is to run a collection post provisioning for the provisioned entity.

Thanks,

Jaydeep Mehta

[PradeepKadambar]

The cost of running too many collections is high. Think about a scenario where this update is triggered 50 times a day, so you will have 50 ADC runs and if you have (50) Rules configured to run after any collection then you will have the rules run 2500 in a day.

It is not a recommended practice to run collections from workflows for end user requests.

[JaydeepMehta]

Hi Pradeep,

I agree cost of running full recon/ collection will be high & also yes if rules are configured post collections it will be more resource utilization. 

I was checking if the recon with filter is available rather than full recon, like in case of OIM. I mean recon with user filter will not cause resource util & also will allow for faster validation of account provisioning. 

Thanks,
Jaydeep 

[PradeepKadambar]

Sure, if you think you would like to see a feature in the product, do submit the idea here https://community.rsa.com/community/products/governance-and-lifecycle/ideas