Can't create accounts from IDM to AD group

Question

Hi!
When I want to create an account in an AD (dc=rascal,dc=net), I wish create it in "GlobalADM" group.
I have defined the Account Attribute in Resource ( I have used "groups").
So, in the Attibutes section in User Form, it prints "groups" and the rest of AD attributes. In this textbox I write cn=GlobalADM,cn=Users,dc=rascal,dc=net
But it prints the following error:
Unable to set user info: 'SetInfo(): 0X8007200A: , 00000057: LdapErr: DSID-0C090B38, comment: Error in attribute conversion operation, data 0, vece, Attribute or directories services value specified doesn't exist.
In Idm Resource Reference document, I read that "groups" is the correct attribute. In AD I can create accounts manually in this group. And I have tried with other groups with the same error.
can anyone help me?
Thanks!!!

Answer 1

AD and all directories require a distinguished name for a user. Where the user actually lives in the directory. If you are doing this through a custom workflow and form you need to set the dn in the form. If you are using the tabbed user form and admin interface you need to set the identity template.
For the template:
cn=$lastname$\,$firstname$,ou=Domain Users,dc=yourcompany,dc=com Note:This string must match where the users will be created in the tree.
If doing this in a sync process or some type of workflow calling a form set the following:
<Field name ='accounts[AD].dn'>
<Expansion>
<concat>
<s>cn=</s>
<ref>accounts[Lighthouse].lastname</ref> (if doing a sync this would be activeSync.lastname)
<s>,</s>
<ref>accounts[Lighthouse].firstname</ref>
<s>,</s>
<s>,ou=Domain Users,dc=yourcompany,dc=com</s>
</concat>
</Expansion>
</Field>
If you are doing this through custom workflow don't forget to update waveset.resources:
<Field name='waveset.resources'>
<Expansion>
<filterdup>
<append>
<ref>waveset.resources</ref>
<s>AD</s>
</append>
</filterdup>
</Expansion>
</Field>