How to set user object name ?

Question

Hello

Active Directory does not accept users with the same name, in the same OU. Surprisingly, in real life to employees may have the same name, like John Smith, in the same department.

In our current IDM system, we format the "name" by adding the samAccount property to givenName and sn, before creating the user account.
Like:
- John Smith (JS)
- John Smith (JSM)

Adaxes
However, I cannot format the "name" property in a Property pattern, as "name" is not selectable from the properties list.

Then I could format the "name" by running a script before the user is created, but I do not know how I get- and reference the values entered in the Create User form ?

If I change "name" after the user is created by a script, Adaxes also changes "Full Name" and Distinguished Name.
This must be an Adaxes thing, as these names does not change if I do the same thing on our production AD.
This is unwanted, as we only make the change to the "name" property, to overrule the limitation in Active Directory.

- Thanks in advance

Answer 1

Hello,

If I change "name" after the user is created by a script, Adaxes also changes "Full Name" and Distinguished Name.
This must be an Adaxes thing, as these names does not change if I do the same thing on our production AD.

No, this is not an Adaxes thing. Because of AD design, when you change the Name of a user, you also change the Full Name and the Distinguished Name.

This occurs because in Active Directory, the name attribute of user objects is always equal to their cn attribute (displayed as Full Name). Further, the cn attribute makes a part of the distinguishedName (Distinguished Name). A Distinguished Name of an AD object consists of the name of the object itself (that is, full name for users) and names of all its ancestors up to the root domain level. You cannot change a part of the attribute (full name) without changing the whole of it.

A Distinguished Name (DN) allows distinguishing an AD object from other objects, thus there is a requirement for all objects to have unique DNs.

Thus, you won't be able to resolve your issue without changing all the 3 attributes.

Comments

A Distinguished Name (DN) allows distinguishing an AD object from other objects, thus there is a requirement for all objects to have unique DNs.
Thus, you won't be able to resolve your issue without changing all the 3 attributes.

You are absolutly right :oops:

SOLVED..... I just set/edit property "CN" of the user, instead of property "name".

Thanks