Domain name does not populate when manually adding Active Directory users

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When manually adding an Active Directory (AD) user to VMware Identity Manager (vIDM), the domain name field may remain blank even if directory synchronization for groups is functioning correctly. This behavior prevents the user from being correctly identified within the identity provider scope.

You may notice below symptoms:

• Users are added manually via Identity & Access Management > Sync Settings > Users using their Distinguished Name (DN).
• The sync completes successfully, but the Domain column in the Users & Groups tab is empty for the new user.
• Log files (connector-dir-sync.log) may show successful sync but missing attributes for the specific user object.

Environment

VMware Identity Manager 3.3.7
Active Directory (LDAP/IWA)

Cause

This issue occurs if the domain attribute in vIDM is not correctly mapped to the canonicalName attribute in Active Directory, or if the AD user object lacks a value for canonicalName. vIDM uses this mapping to populate the domain field during the synchronization process.

Resolution

1. Log in to the vIDM Administrator Console.
2. Navigate to Identity & Access Management > Setup > User Attributes.
3. Ensure the domain attribute is mapped to canonicalName.
4. Navigate to Identity & Access Management > Directories > [Your Directory] > Sync Settings > Users.
5. Add the user's distinguishedName (DN) manually.
6. Click Save and Sync.
7. Verify in Active Directory that the user object has a valid canonicalName attribute.