CA Identity Manager: Cannot create AD accounts due to "Duplicate account name" error
Article ID: 93674
Updated On:
Products
Issue/Introduction
Active Directory (AD) account provisioning fails in CA Identity Manager when multiple AD roles are applied simultaneously via a TEWS call. Because TEWS cannot dictate role application order, group roles may apply before the primary AD role. This results in accounts being created in the "lost and found" Organizational Unit (OU) rather than the intended destination, triggering a duplicate account error when the primary role subsequently attempts to move the user.
Environment
Product: CA Identity Manager, CA Identity Governance, CA Identity Portal
Cause
The error occurs when multiple Active Directory roles are applied simultaneously via a Task Execution Web Service (TEWS) call.
- Role Application Order: TEWS does not have a mechanism to dictate the sequence in which roles are processed.
- OU Placement Logic: Typically, only the primary AD role contains the placement rules for the target Organizational Unit (OU).
- Conflict: If group-based roles are applied before the primary role, the system creates the account in the "lost and found" OU by default. When the primary role then attempts to create or move the user to the correct OU, the process fails because the account already exists in the directory
Resolution
To ensure accounts are created in the correct OU and avoid duplicate name conflicts, split the role application into two sequential calls:
- Primary Role Call: Submit a single call that applies only the primary AD role. This ensures the account is created in the correct OU based on the primary role's placement rules.
- Group Roles Call: Submit a second call to apply all additional AD group roles to the existing account
Feedback
