Hey @pradeep.bhalla,
I have enabled the logging as you requested. I have also reverted the changes made to the connector.ps1 and azureoiam.ps1m scripts. Here is what I am getting (and you’ll see why I started making changes):
It indicates that it can’t connect to mggraph because we haven’t called connect-mggraph. If you examine the ps1 scripts (at least that came with my installation) they use connect-azuread and not connect-mggraph. I suspect I am getting this error because my search command is using get-mguser (as detailed in the documentation: Microsoft Graph PowerShell connector). So the obvious question is, if no changes are necessary to the script from the connector, am I somehow using the wrong connector or not the latest version?
I downloaded AzureAD - Graph v5 from the OpenIAM site:
Are there maybe updated versions of the script that I am unaware of?
For fun,
here is the response in the log it is sending back to OpenIAM with my rewritten script:
{
“status”: “SUCCESS”,
“errorCode”: null,
“errorText”: “”,
“fieldMappings”: null,
“stacktraceText”: null,
“responseValue”: null,
“errorTokenList”: null,
“failure”: false,
“success”: true,
“identity”: “”,
“managedSystemId”: “AZURE_GRAPH_MS”,
“objectType”: “USER”,
“applicationId”: “REDACTED@REDACTED_IP”,
“userList”: [
{
“originalIdentityValue”: null,
“identityName”: “UserPrincipalName”,
“attributes”: [
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: true
}
],
“name”: “AccountEnabled”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: {
“DisabledPlans”: ,
“SkuId”: “REDACTED-SKUID-1”
}
},
{
“operation”: “NO_CHANGE”,
“value”: {
“DisabledPlans”: ,
“SkuId”: “REDACTED-SKUID-2”
}
},
{
“operation”: “NO_CHANGE”,
“value”: {
“DisabledPlans”: [
“REDACTED-PLAN-ID-1”,
“REDACTED-PLAN-ID-2”,
“REDACTED-PLAN-ID-3”,
“REDACTED-PLAN-ID-4”,
“REDACTED-PLAN-ID-5”,
“REDACTED-PLAN-ID-6”,
“REDACTED-PLAN-ID-7”,
“REDACTED-PLAN-ID-8”,
“REDACTED-PLAN-ID-9”,
“REDACTED-PLAN-ID-10”,
“REDACTED-PLAN-ID-11”
],
“SkuId”: “REDACTED-SKUID-3”
}
}
],
“name”: “AssignedLicenses”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_NAME”
}
],
“name”: “DisplayName”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_FIRST_NAME”
}
],
“name”: “GivenName”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_GUID”
}
],
“name”: “Id”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_JOB_TITLE”
}
],
“name”: “JobTitle”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_EMAIL”
}
],
“name”: “Mail”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_NICKNAME”
}
],
“name”: “MailNickName”,
“isPrimaryKey”: false
},
{
“values”: ,
“name”: “MemberOf”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_LAST_NAME”
}
],
“name”: “Surname”,
“isPrimaryKey”: false
},
{
“values”: ,
“name”: “UsageLocation”,
“isPrimaryKey”: false
},
{
“values”: [
{
“operation”: “NO_CHANGE”,
“value”: “REDACTED_UPN”
}
],
“name”: “UserPrincipalName”,
“isPrimaryKey”: false
}
],
“identityValue”: “REDACTED_UPN”
}
],
“groupList”: null,
“passwordExpirationDate”: null,
“daysToExpiration”: null,
“passwordChangeNeeded”: false,
“accountEnabled”: false,
“accountFound”: false,
“communicationException”: false,
“parentAuditLogId”: “REDACTED_LOG_ID”,
“provisionRequestId”: “MS_GRAPH_CONNECTOR”,
“requestCreatedForSyncId”: “SYNC_AZURE_GRAPH_USER”
}
EDIT:
I was able to get this working now with my modified script by ADDING Object Primary Key for User in the connector configuration. I set it to MailNickName in the Managed System configuration and changed the Source Attribute Name in the Azure Auth Assignments synchronization config to MailNickName as well. I tried UserPrincipalName first (as that was the default in the Source Attribute field) but it created an orphan account in the system. Keep in mind, this is all with my modified connector.ps1 and azureoiam.ps1m scripts using MS Graph.
I should also mention I had to edit the AzureTransformation.groovy script as the default one was was generating an error. I couldn’t even save a copy of it to edit.
