Account names

An account in a directory has more than one name, and they are set in different places.

Name	What it is	Set by
Account name (uid)	Owl IDM's name for the account, and what it finds the account by	The account definition's prefix + the person's username
Sign-in name (sAMAccountName in Active Directory)	What the person signs in with	The synchronisation mapping — usually the account name
Display name (cn)	What the directory shows; in a directory also the start of the account's distinguished name	A computed field rule

The account definition's page shows the account name and display name your own account would get as you type the prefix.

The prefix

The prefix — for example adm- — is put in front of the person's username: victor.nikolov becomes adm-victor.nikolov. It is what makes two accounts for one person possible: sign-in names are unique across the whole domain, so without something to tell them apart the second account cannot be created.

Changing a prefix does not rename accounts that already exist.

The sign-in name

What reaches the target system is decided by the synchronisation mapping (Connectivity › Synchronisation, the project's user mapping). For Active Directory, map the account name to sAMAccountName, direction to the target system:

Owl IDM property	AD attribute	Direction
uid	uid	Both
uid	sAMAccountName	To the target system

Without this mapping

If nothing is mapped to sAMAccountName, Active Directory makes one up — a value such as $C3018905-FCFC953357A9B4E8 — and nobody can sign in with a name they know. After adding the mapping to an installation that already has accounts, use Push all on the accounts plan (Connectivity › Plans) so existing accounts get it too.

Active Directory limits sAMAccountName to 20 characters, prefix included.

The display name

Automation › Computed field rules

A computed field rule calculates a field from others whenever the object is saved. The demo environment has one for directory accounts, building cn as first name + last name, with the account definition's prefix in front:

(accountDefinition == null or accountDefinition.accountNamePrefix == null
    ? '' : accountDefinition.accountNamePrefix)
+ (givenName == null ? '' : givenName)
+ (givenName == null or surname == null ? '' : ' ')
+ (surname == null ? '' : surname)

giving Victor Nikolov and adm-Victor Nikolov.

The display name is part of the account's address

In a directory, cn starts the account's distinguished name. Changing the rule renames accounts the next time they are updated, and two people with the same name in one container collide — the second account is refused rather than quietly given another name.