Active Directory Account Template Group Removal Restrictions in User Console

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

This article addresses an issue where Active Directory (AD) groups assigned to an Account Template cannot be removed using the Identity Manager (IM) User Console. This behavior occurs when the group was initially added via the Provisioning Manager using a specific domain search, creating a configuration format that the User Console cannot modify.

Environment

Identity Manager

Cause

This is a product limitation. When a group is added via the Provisioning Manager using a "Specific Domain" search, the group value is stored with a specific domain identifier (e.g., CN=Administrators,CN=Builtin,DC=XXX,DC=YYY;DC_HOST). The User Console expects a different format (e.g., CN=Administrators,CN=Builtin,DC=?) to allow for modification. The IM User Console does not support the removal of values with the explicit domain format, resulting in a JIAMOperationException (Error code 16).

Resolution

To manage groups successfully, follow these guidelines based on how the template was originally configured:

• If the group was added via Provisioning Manager (Specific Domain):

  • You must continue to use the Provisioning Manager to maintain or remove this value.
  • Attempting to remove it via the User Console will consistently result in failure.

• If the group was added via User Console or Provisioning Manager (DOMAIN=ALL):

  • The group value is stored in a compatible format (DC=?).
  • These groups can be successfully managed or removed via the User Console.

Best Practices

• To ensure maximum compatibility and flexibility for future modifications, it is recommended to perform group assignments using DOMAIN=ALL when configuring templates in the Provisioning Manager.
• If you encounter this restriction, you do not need to open a support case, as this is documented product behavior.