Unable to Modify Active Directory User Attributes via Identity Manager Policy XPress

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

Active Directory (AD) user attributes cannot be modified directly in Symantec / CA Identity Manager when Policy Xpress rules fail to trigger due to missing account modification events. As a result, administrators require a manual method to update Active Directory attributes directly from the command line outside of the Policy XPress workflow engine.

Environment

Identity Manager 14.x

Resolution

Active Directory attributes can be updated directly from the command line using the ldapmodify utility provided with the Provisioning Server.

Step 1: Locate the Utility

The ldapmodify executable is located on the Provisioning Server at: C:\Program Files (x86)\CA\Identity Manager\Provisioning Server\bin\ldapmodify.exe

ldapmodify -x -D "<AD_Account_DN>" -w "<Account_Password>" -h <AD_Hostname> -p 389 -f <LDIF_File>.ldif

 

Step 2: Command Syntax and Parameters

Use the following syntax to execute updates against Active Directory via LDIF file:

ldapmodify -x -D "<AD_Account_DN>" -w "<Account_Password>" -h <AD_Hostname> -p 389 -f <LDIF_File>.ldif

 

Parameter Breakdown

• -D "<AD_Account_DN>": The Distinguished Name (DN) of the bind account used to connect to Active Directory (typically the Active Directory Endpoint service account configured in Identity Manager).

• -w "<Account_Password>": The password for the bind account specified in the -D parameter.

• -h <AD_Hostname>: The Hostname or Fully Qualified Domain Name (FQDN) of the Active Directory Domain Controller.

• -p 389: The standard LDAP port (use 636 for LDAPS).

• -f <LDIF_File>.ldif: Path to the LDIF file containing the target account DNs and attribute modifications.

 

Step 3: Example Usage

To apply changes defined in test.ldif using an Active Directory Domain Controller named dc01.domain.local:

ldapmodify -x -D "CN=ad_service_account,OU=Service Accounts,DC=domain,DC=local" -w "P@ssw0rd123!" -h dc01.domain.local -p 389 -f test.ldif