6.9 Making Distinguished Name References Portable

When you use a DN in an expression in a provisioning request definition, the expression might fail if you the provisioning request definition to an Identity Vault with a different structure. You typically specify DNs in:

Some expressions, such as recipient, are portable. The following expressions, which are used by default in the User activity, are also portable:


To ensure that your DN expressions are portable across Identity Vaults, you can use one of the following variables:

These variables are defined during installation of the user application and are resolved at runtime by the ECMAScript engine. You can find them in the ECMA expression builder under the process node. Suppose you wanted to reference an entitlement at the following DN:


You could use the following expression to make the DN portable to any identity vault:

‘’cn=MyEntitlement,’ + PROVISIONING_DRIVER

You can use this technique for users and groups also.

NOTE:Trustees are not expressions so you cannot use this technique with Trustees.