IBM Security Verify

Expand all | Collapse all

Running an add account operation a modify operation is triggered

Jump to Best Answer
  • 1.  Running an add account operation a modify operation is triggered

    Posted Wed March 17, 2021 01:09 PM
      |   view attached
    Hi ISIM colleagues,
    I would like to share with you an ISIM odd behaviour instead of opening an PMR due to I am sure it is a configuration issue but I am not able to find out what the reason is.

    Summary: running an add account operation a modify operation is triggered, although the workflow design there is just one CREATEACCOUNT extension.

    Reason: it happens when the AD account provisioning policy is modified to manage the 'Proxy Address' field. This attribute it used to define the primary and secundaries email address. In the attached document you can find the details of the issue, and the provisioning policy definition. The idea is to set Excluded fixed values which are overwritten by the result of the Mandatory javascript. The javacript result is working fine as it can be shown in the add request, indead it is working in modify account operation.

    Any clue?

    ------------------------------
    Felipe Risalde Serrano
    Security Expert
    Banco de España
    ------------------------------

    Attachment(s)



  • 2.  RE: Running an add account operation a modify operation is triggered

    Posted Thu March 18, 2021 10:18 AM
    Edited by Felipe Risalde Serrano Thu March 25, 2021 03:27 PM

    I have seen that the error didn't came from provisioning policy if not how the adapter is managing this attribute. I have seen in the adapter log next entries:

    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 Collection<PSObject> po:
    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 SMTP:q31830@correo.interno
    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 sip:pablo.mateo@mydomain.com
    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 Invoking: $8116 = (get-mailbox 'q31830@mydomain.com' -DomainController 'snt0051').EmailAddresses
    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 Invoking: $8116.Add( 'SMTP:q31830@correo.interno' )
    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 Invoking: $8116.Add( 'sip:pablo.mateo@mydomain.com' )
    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 Invoking: set-mailbox -Identity 'q31830@mydomain.com' -EmailAddresses $8116 -DomainController 'snt0051'
    DTL:21/03/18 10:31:16 Thread:008116 EXCH 1004 10:31:16 Cannot process argument transformation on parameter 'EmailAddresses'. Cannot convert value "System.Collections.ArrayList" to type "Microsoft.Exchange.Data.ProxyAddressCollection". Error: "The value 'SMTP:q31830@correo.interno' is already present in the collection."

    Moreover, ones the account is created and conciliated by ISIM, next operations for modifying this attribute will work fine, it maybe because Exchange has created the ProxyAddress by itself.

    We have to find out the differences with the adapter in our testing enviroment due to it wasn't happended there.

    On the other side, I don't understnad why onces the former operation failt, the server (or the adapter) run a second operation for modifying the atributtes which are wrong provisioning during the add account.




    ------------------------------
    Felipe Risalde Serrano
    Security Expert
    Banco de España
    ------------------------------



  • 3.  RE: Running an add account operation a modify operation is triggered

    Posted Fri March 26, 2021 02:56 AM
    The behavior you are seeing is due to the specific way AD works. I hope you are aware that when you add exchange functionality to an account then what really happens is that the schema for the user is extended (additional objectclasses are added). This means you cannot create an exchange user in one go - first it must be created as a regular user - then extended. The extension is only triggered by a subset of attributes in the adapter (and is btw done via a remote exchange operation) - so if you try to add data that is not available on a standard account it may fail.

    I have at some PMR handling discussed this with the actual developer of the adapter - and there are pros and cons of the way it works. In older times the adapter was actually split into two serviceprofiles - one for AD and one for Exchange - I would like to have that option back (with additional ones for Lync and the cloud things to cover hybrid scenarios) but I do not  believe this is coming...

    I hope this gives you some background to find and understand what is happening...

    ------------------------------
    Franz Wolfhagen
    IAM Technical Architect for Europe - Certified Consulting IT Specialist
    IBM Security Expert Labs
    ------------------------------



  • 4.  RE: Running an add account operation a modify operation is triggered

    Posted Fri March 26, 2021 05:24 AM

    Hi Franz,
    from our point of view it is not linked with if the operation has to be done in one or two steps due to same operation is working in our test enviroment (of course our production and test adapters releases are the same)

    DTL:21/03/24 14:09:39 Thread:003972 EXCH 35 02:09:39 Collection<PSObject> po:
    DTL:21/03/24 14:09:39 Thread:003972 EXCH 35 02:09:39 SMTP:qrisald@correo.interno2
    DTL:21/03/24 14:09:39 Thread:003972 EXCH 35 02:09:39 Invoking: $3972 = (get-mailbox 'qrisald@mydomain.com' -DomainController 'svm0613').EmailAddresses
    DTL:21/03/24 14:09:39 Thread:003972 EXCH 35 02:09:39 Invoking: $3972.Add( 'sip:felipe.risalde@mydomain.com' )
    DTL:21/03/24 14:09:39 Thread:003972 EXCH 35 02:09:39 Invoking: $3972.Add( 'SMTP:qrisald@correo.interno' )
    DTL:21/03/24 14:09:40 Thread:003972 EXCH 35 02:09:39 Invoking: set-mailbox -Identity 'qrisald@mydomain.com' -EmailAddresses $3972 -DomainController 'svm0613'
    DTL:21/03/24 14:09:40 Thread:003972 EXCH 35 02:09:40 Invoking: Remove-variable -name 3972

    We are looking in depth if there is relation with Lync attributes management, although again, our PROD and TEST enviroments look like to be configured the same way (we have to certifiy this point)

    Thanks for your support. I keep you posted.

    PS I remembered when Exchange and AD were 2 differents adapters. 



    ------------------------------
    Felipe Risalde Serrano
    Security Expert
    Banco de España
    ------------------------------



  • 5.  RE: Running an add account operation a modify operation is triggered

    Posted Fri March 26, 2021 05:45 AM
    You should consider an IBM Security Essential contract for consultancy - that way you can get help from people like me on ad hoc basis. I believe this reasonable priced (this is a replacement to AVP contracts and much more granular the AVP. 

    And you know that you need to include certificates from Lync Server to make it work - this is not completely obvious in the documentation and you need to run the adapter in CLI mode to trace the Lync operations ?

    I did not find the formal documentation on that - but I can try to look it up if that is needed :-)

    Another thing I do when I hit this kind of problems is to dumb the Access360 registry entries and compare them using eg. Winmerge or Notepad++ - some of the settings can be difficult to see straight away...

    Good luck :-)

    ------------------------------
    Franz Wolfhagen
    IAM Technical Architect for Europe - Certified Consulting IT Specialist
    IBM Security Expert Labs
    ------------------------------



  • 6.  RE: Running an add account operation a modify operation is triggered
    Best Answer

    Posted Tue July 13, 2021 04:44 AM

    Hi ISIM colleages,

    once we have found out the issue, we would like to share with you.

    It is important to stress that the error came from how the ProxyAddress attribute is managed in AD and it is only important if the ProxyAddress values have to be enforced.

     When a personal mailbox is generated to the user or when a Lync/skype account is created, Exchange provisions automatically new values in the ProxyAddress. In other words, when some values are provisioned into the "SMTP Address" or/and "SIP Address" AD attributes, Exchange includes the same values in the "ProxyAddress" attribute.

     If the provisioning policies define some values in the ProxyAddress, when the ISIM adapter tries to incorporate those values after the mailbox/Lync creation, an error is risen since those values are already existed: "The value 'SMTP:xxx@mail.com' is already present in the collection."

     How to fix it.

    • Don't provisioning those values in the ProxyAddress attribute the first time you are creating the mailbox/lync account. Once, those are created, the ProxyAddress values can be enforced. Here you have a proposal of provisioning policy javascript for setting the ProxyAddress.

     var SIPAddress=null;

    var myAccount = (new AccountSearch()).searchByUidAndService(parameters.eruid[0],service.name);

    if ((myAccount != null) && (myAccount.length > 0))

             if ((myAccount[0].getProperty("eradlyncsipadr") != null) && (myAccount[0].getProperty("eradlyncsipadr").length > 0))     

                       SIPAddress=myAccount[0].getProperty("eradlyncsipadr")[0];

    return SIPAddress;

    •  Change how the ISIM adapter manages the ProxyAddress attribute to remove the previous values before adding new ones. If you don't do that, you will have the same error until ISIM doesn't realize that new values have been provisioned (by Exchange) in the ProxyAddress attribute, ie, until next service reconciliation.

     dn: erobjectprofilename=ADprofile,ou=serviceProfile,ou=itim,ou=xxx,DC=COM

    changetype: modify

    replace: eropmultireplace

    eropmultireplace: modify=st,postofficebox,mail,telephonenumber,homephone,mobile,description,cn,title,l,pager,postalcode,street,givenname,sn,erADLoginWorkst ations,erADEProxyddresses

     In the adapter log can be seen how a Clear() is done before the Add() of values in the ProxyAddress

     DBG:21/06/08 14:46:19 Thread:006688 Attribute operation type is replace so clearing the idlist to fill new set of values

    DTL:21/06/08 14:46:19 Thread:006688 EXCH 32 02:46:19 Invoking: $6688.Clear()

     I hope it could be interesting for you.



    ------------------------------
    Felipe Risalde Serrano
    Security Expert
    Banco de España
    ------------------------------



  • 7.  RE: Running an add account operation a modify operation is triggered

    Posted Tue July 13, 2021 04:57 AM
    Felipe,

    Thank you for following up with the solution to your issue.  This kind of post is what makes a forum like this valuable to everyone involved.

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 8.  RE: Running an add account operation a modify operation is triggered

    Posted Fri July 23, 2021 08:36 AM
    Thanks for giving this solution (I have been on vacation and just returned - that is why I am late to the party)  - I believe most ISIM professionals that has worked with Exchange have struggled with the problem of handling primary and alias SMTP addresses. 
    I would guess some improvements could make it easier - but on the other hand the way it is handled in the adapter goes back a long time and backwards compatibility is very important - you would not be happy if you logic is suddenly not working after an adapter upgrade because of "simplifications".
    One thing though that I recognize a very often used pattern that irritates me - and that is to get the current account  values. I looked into this many years ago and was looking into adding this the "parameters" extension - but I realized that it was not a good idea due to some technical reasons - so adding an object to the JavaScript environment like we have for the owner ("subject") would be a better solution - but somebody have to convince our Product Management that this is a good idea :-)
    If you can find a better way the adapter can handle the SMTP addresses and keeping the backwards compatibility I am pretty sure our development would be interested as this is really a pain...

    ------------------------------
    Franz Wolfhagen
    IAM Technical Architect for Europe - Certified Consulting IT Specialist
    IBM Security Expert Labs
    ------------------------------