Synchronization Person Table to Active Directory

Hi Julien,

Welcome to the One Identity Manager community.

One Identity Manager uses something called account definitions to control the creation and the lifecylce of accounts assigned to the identities in the Person table. So the answer to your question is, you need to assign an account definition for an AD user to your newly created entry in the person table.

You will find more information in the documentation

Using account definitions to create user accounts

https://support.oneidentity.com/technical-documents/identity-manager/8.1.3/target-system-base-module-administration-guide#TOPIC-1484789

Account definitions for Active Directory user accounts

https://support.oneidentity.com/de-de/technical-documents/identity-manager/8.1.3/administration-guide-for-connecting-to-active-directory/6#TOPIC-1475462

For more information technical about One Identity Manager, you might want to take a look at our official YouTube channel as well.

One Identity Manager technical tutorials

https://www.youtube.com/c/OneIdentity/playlists?view=50&sort=dd&shelf_id=5

Hi Marcus, thanks for your quick response, I really appreciate this attention.

for now, none of my accounts are created in the ADSAccount table.

I assigned the account definition to a department that has seven users.

about these users, only four of them already existed in the ADSAcoount table. And in the account definition preview, I can see an orange bubble with these four users.

but the remaining three users are in a red bubble with a blue attention mark because none of them already existed in the ADSAccount table.

Is this mean that we have to create users firstly to the ADSAccount and then create them from WebPortal? 

Thank you again for your attention, 

Best regards.

The 3 new users, did you check that they are activated and that the flag No Inheritance is not set?

Hello Markus, 

In the Object browser, we have the IsNoInherite attribute equals 'false' and the IsInactive attribute equals 'false' as well...

I just create a new one, and now I have four users in the red bubble. 

Regards, 

Now it's getting into the details. I am unable to provide a complete walkthrough, but you need to check the Job Queue with the JobQueue Info tool, to see if there are any frozen jobs that have been triggered by the assignment of the Account Definition. I make a bet and think that you will see frozen jobs and the error message is something around empty or non-compliant passwords.

If so, you need to configure the password policy for the AD domain accordingly.

Hello Markus, 

thank a lot for your advice. 

What do you mean by "password policy for the AD domain"

In the password policies, the Default policy is set on "One Identity Manager Password policy"

I'm still working on it, and still get the same result for now. 

the fact is you're right with the concept of the active directory non-compliant password. I actually many frozen tasks in the job queue Info tool. 

I've checked the password policy configuration in the manager and in the designer and worked with the AD team, I have the same Enterprise password policy(Default Domain policy) in my One Identity Manager Password policy. 

I made the same implementation for the ADSContact table, and my users were created correctly in the table. 

Do you think that there is another way to solve this issue? maybe by adding a script in the script tab inside the policy?

Best regards, 

Hello Markus, 

thank a lot for your advice. 

What do you mean by "password policy for the AD domain"

In the password policies, the Default policy is set on "One Identity Manager Password policy"

I'm still working on it, and still get the same result for now. 

the fact is you're right with the concept of the active directory non-compliant password. I actually many frozen tasks in the job queue Info tool. 

I've checked the password policy configuration in the manager and in the designer and worked with the AD team, I have the same Enterprise password policy(Default Domain policy) in my One Identity Manager Password policy. 

I made the same implementation for the ADSContact table, and my users were created correctly in the table. 

Do you think that there is another way to solve this issue? maybe by adding a script in the script tab inside the policy?

Best regards, 

As outlined in the documentation the Active Directory Password policy is responsible for the AD user passwords.

https://support.oneidentity.com/de-de/technical-documents/identity-manager/8.1.3/administration-guide-for-connecting-to-active-directory/10#TOPIC-1475481

So, you just have to configure this policy accordingly.