AnsweredAssumed Answered

How to manage empty attribute value to AFX

Question asked by Steve Alexandre on Feb 4, 2020
Latest reply on Feb 14, 2020 by Steve Alexandre

Like • Show 0 Likes0
Comment • 7

Hi,

I'm currently using the web service createChangeRequest for using the OOTB AFX for account actions(creation/activation/deactivation/etc...).

My logic is when adding a specific entitlement "Create Account", it will precalculate some attributes and push them through the API to generate create account request and It's working pretty well when I have all values defined. These attributes are mapped to the afx by the prefix "AFXCUSTOM_" and defined in the mapping of the capabitility. So for example manager dn attribute is map to ${Workflow.Managerdn}.

We have some case where for example, the manager is not defined or doesn't have an AD account so the value will be null. If it's null, the AFX seems trying to send "[]" to this attribute and on Active Directory, manager must be a DN or not set so I get an constraint violation and cannot create an account if no manager. (checked by setting the afx to debug)

How can I define the afx to not send this attribute if he is empty ?

You can find below the attribute of a current workflow running, the afx mapping and the afx log(critical and personnal infos has been hidden) :

Mostafa Helmy

Feb 12, 2020 10:07 AM

Correct Answer

Sorry for taking so long to get to you, but I would suggest you log this case a defect with support

Just for the sake of my testing, does the SQL statement you use to select AFXCUSTOM_WORKFLOW_MANAGERDN return one row with null value (Example: User does have a supervisor but the supervisor has no DN, so the join returns one row with null value) ?
Or does it return no rows at all (Example: User does not even have a supervisor, so join results in no rows)?

See the reply in context

No one else had this question

Outcomes

Steve Alexandre Feb 5, 2020 6:25 AM

Initial thread description updated with more informations and captures.

Someone to help please ?

Actions

Mostafa Helmy

Feb 5, 2020 7:53 AM

I think this was discussed in a few other community posts. Basically you'll need to create an additional input parameter called remove_<attribute-name> and pass the current value to that parameter.

Take a look at this KB article 000036921 - Clearing an Active Directory Account Attribute in RSA Identity Governance & Lifecycle

Actions

Steve Alexandre @ Mostafa Helmy on Feb 5, 2020 8:24 AM

Hi Mostafa,

Thanks for your answer but it's not about clear an existing attriubute but it's how to not provision an attribute if the mapping is null. We are in the creation phase at the moment.

Actions

Mostafa Helmy

@ Steve Alexandre on Feb 5, 2020 10:25 AM

Got it. So basically if you use an AFXCUSTOM_ attribute that is null, it gets replaced by [] which is not ok with AD.

Which version/patch is it? I was under the impression that passing an empty variable will just pass a Null value which shouldn't hurt.

Actions

Steve Alexandre @ Mostafa Helmy on Feb 5, 2020 10:40 AM

Yes this is what I was thinking about but nop.

I'm on the 7.1.1P3 at this moment.

Actions

Mostafa Helmy

@ Steve Alexandre on Feb 12, 2020 10:07 AM

Sorry for taking so long to get to you, but I would suggest you log this case a defect with support

Actions

Steve Alexandre @ Mostafa Helmy on Feb 14, 2020 9:03 AM

Sorry Mostafa for the delay too.

The value is empty and the variable is empty so it return a row but empty.

I will open a case so about that.

Actions

7 Replies

Steve Alexandre Feb 5, 2020 6:25 AM
Mark Correct
Correct Answer
Initial thread description updated with more informations and captures.
Someone to help please ?
Like • Show 0 Likes0
Actions
Mostafa Helmy Feb 5, 2020 7:53 AM
Mark Correct
Correct Answer
I think this was discussed in a few other community posts. Basically you'll need to create an additional input parameter called remove_<attribute-name> and pass the current value to that parameter.

Take a look at this KB article 000036921 - Clearing an Active Directory Account Attribute in RSA Identity Governance & Lifecycle
Like • Show 0 Likes0
Actions
- Steve Alexandre @ Mostafa Helmy on Feb 5, 2020 8:24 AM
  Mark Correct
  Correct Answer
  Hi Mostafa,
  Thanks for your answer but it's not about clear an existing attriubute but it's how to not provision an attribute if the mapping is null. We are in the creation phase at the moment.
  Like • Show 0 Likes0
  Actions
  - Mostafa Helmy @ Steve Alexandre on Feb 5, 2020 10:25 AM
    Mark Correct
    Correct Answer
    Got it. So basically if you use an AFXCUSTOM_ attribute that is null, it gets replaced by [] which is not ok with AD.
    
    Which version/patch is it? I was under the impression that passing an empty variable will just pass a Null value which shouldn't hurt.
    Like • Show 1 Like1
    Actions
    - Steve Alexandre @ Mostafa Helmy on Feb 5, 2020 10:40 AM
      Mark Correct
      Correct Answer
      Yes this is what I was thinking about but nop.
      I'm on the 7.1.1P3 at this moment.
      Like • Show 0 Likes0
      Actions
      - Mostafa Helmy @ Steve Alexandre on Feb 12, 2020 10:07 AM
        Unmark Correct
        Correct Answer
        Sorry for taking so long to get to you, but I would suggest you log this case a defect with support
        
        Just for the sake of my testing, does the SQL statement you use to select AFXCUSTOM_WORKFLOW_MANAGERDN return one row with null value (Example: User does have a supervisor but the supervisor has no DN, so the join returns one row with null value) ?
        Or does it return no rows at all (Example: User does not even have a supervisor, so join results in no rows)?
        Like • Show 0 Likes0
        Actions
        Steve Alexandre @ Mostafa Helmy on Feb 14, 2020 9:03 AM
        Mark Correct
        Correct Answer
        Sorry Mostafa for the delay too.
        The value is empty and the variable is empty so it return a row but empty.
        I will open a case so about that.
        Like • Show 0 Likes0
        Actions