Create Active Directory user with comma in CN

[Waldy]

I'm trying to use the Active Directory connector to create users.  It's really odd that you are expected to pass in the DN for a creation function.  I would expect that as output.  Aside from that, I can't create any new users, as the format for CN is LastName, FirstName.  I'm passing in the CN with the required backslash to escape the comma, but the action fails with an invalid name error.  The backslash is not shown in the output of the error.  I'm guessing this has been lost at some point.  Do I need to double escape it?

[Waldy]

I tried double backslash, but now I get the error: LDAP: error code 21 - 00000057: LdapErr: DSID-0C0913EC, comment: Error in attribute conversion operation, data 0, v4563]

[Waldy]

The Workato documentation for the AD connector is woefully lacking.  For example, do I need to convert accountExpires to FileTime format or does the connector do that for me?  Do I need to set samAccountType to 0x30000 to signify User object, or does the connector do that already?

[Waldy]

I've worked through the various issues and I'm now at the point where I am getting a WILL_NOT_PERFORM error returned from LDAP which I suspect is due to the fact the Workato connector Add User action does not expose the userPassword attribute.  So it seems that you cannot actually use the Add User action to create a user.  Somebody please prove me wrong!

[Waldy · Accepted solution]

I managed to get this working.  You need to add the Password Not Required flag to the User Account Control, then use the Set Password action to set a password and then an Update User action to remove the Password Not Required flag.  This of course is dependent on the Password Not Required flag being allowed in the security policy.