Global User to Active Directory Account Correlation via etautil

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article provides the steps to manually correlate an existing Active Directory (ADS) account with a Global User in Identity Manager using the etautil command-line utility. This procedure is required when an account exists on an endpoint but is not yet associated with an Identity Manager Global User, often resulting in "Entry does not exist" or correlation failure errors during provisioning operations.

Environment

Identity Manager

Cause

The account exists on the target endpoint but has not been correlated to the Global User in Identity Manager. This is typically a standard administrative requirement rather than a software defect.

Resolution

1. Prepare the Command: Use the following etautil command structure. Ensure all placeholders are replaced with your environment-specific values:

   etautil -u [etaadmin_username] -p [password] add 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects' eTGlobalUser eTGlobalUserName='[GlobalUserName]' in 'eTADSContainerName=[ContainerName],eTADSDirectoryName=[EndpointName],eTNamespaceName=ActiveDirectory' eTADSAccount eTADSAccountName='[ADSAccountName]' relationship=USERACCOUNT;

2. Example Command: For an Active Directory account named testuser100 in the Users container:

   etautil -u etaadmin -p Password01 add 'eTGlobalUserContainerName=Global Users,eTNamespaceName=CommonObjects' eTGlobalUser eTGlobalUserName=testuser100 in 'eTADSContainerName=Users,eTADSDirectoryName=ADEndpoint,eTNamespaceName=ActiveDirectory' eTADSAccount eTADSAccountName=testuser100 relationship=USERACCOUNT;

3. Verification:

   • Upon successful execution, the output will confirm the correlation: :ETA_S_0029, Inclusion between Active Dir. Account '[AccountName]' and Global User '[UserName]' created successfully.
   • Check your provisioning logs to ensure no ETA_E error codes were returned during the operation.