Prevent Duplicate User Creation

Question

I would like to have a business rule check before a new user is created to see if the ExtensionAttribute4 value(we use this like a primary key across our 3 domains) of the new user matches any existing user across the Org(3 domains, not in same forest, all in Adaxes), including expired/disabled accounts. If it does match an existing ExtensionAttribute4 do not create the user and display an error stating a duplicate user has been found. I'm assuming I can do this with a Business Rule set to before new user account is created, using the PowerShell Script return true option, I just don't know what to put in the PowerShell script.

Comments

Hello,

Please confirm that we've got you right:

If it does match an existing ExtensionAttribute4 do not create the user and display an error stating a duplicate user has been found.

That is, a user is considered to be a duplicate if a match has been found, is that correct? That is, ExtensionAttribute4 must be non-unique?

---

Correct, a user would be a duplicate if a matching EA4 has been found in any directory, active or expired, and the create user process should not take place. EA4 needs to be a unique value, there should only be 1 EA4 anywhere across the 3 domains for a user. So if any account attempts to be created with a EA4 value that already exists we want the creation process to stop and an error to be displayed saying the EA4 already exists.

---

OK, got you. That's possible. We've asked our script guys to write a script that will do the job. We'll update this topic as soon as they come up with something.

---

Any update on this? Thank you.

Answer 1

Hello,

The necessary script is ready. To create a Business Rule that will cancel creation of a new user if a user account with the same ExtensionAttribute4 already exists:

1. Create a new Business Rule.

2. On step 2 of the Create Business Rule wizard, select User and Before Creating a User.
   

3. On step 3, add the Cancel this operation action. Specify a reason for canceling, if necessary.
   

4. Click OK.

5. Now, you need to specify when the Business Rule will cancel user creation. Double-click Always.

6. Select If PowerShell script returns true.

7. In the Script field, paste the following script that will return True if a user with the same ExtensionAttribute4 already exists:
   

    $value = $Context.GetModifiedPropertyValue("extensionAttribute4")
   
    $Context.ConditionIsMet = $False
    if ([System.String]::IsNullOrEmpty($value))
    {
        return
    }
   
    $searcher = $Context.BindToObject("Adaxes://rootDSE")
    $searcher.SearchFilter = "(&(sAMAccountType=805306368)(extensionAttribute4=$value))"
    $searcher.PageSize = 500
    $searcher.SearchScope = "ADS_SCOPE_ONELEVEL"
    $searcher.SizeLimit = 1
    $searcher.VirtualRoot = $True
   
    try
    {
        $searchResult = $searcher.ExecuteSearch()
        $objects = $searchResult.FetchAll()
   
        $Context.ConditionIsMet = !($objects.Count -eq 0)
    }
    finally
    {
        $searchResult.Dispose()
    }

8. Enter a short description for the script and click OK.

9. Finish creation of the Business Rule.