Fix EnsureAttributes: null attribute values fail with MethodArguments binding error

[Copilot]

Using EnsureAttributes with $null attribute values (e.g., to clear mobile or telephoneNumber via AD's -Clear) throws Cannot bind argument to parameter 'MethodArguments' because it is null. — even when the array itself is non-null.

Root cause

PowerShell's [Mandatory] parameter binding rejects any [object[]] array that contains any $null element. In the EnsureAttributes fallback path, a typed [object[]] is constructed with $attrValue as the third element; when that value is $null, passing the array to Invoke-IdleProviderMethod -MethodArguments fails at the binder — before ever reaching the AD adapter.

Changes

• Invoke-IdleProviderMethod.ps1 — Add [AllowNull()] to $MethodArguments alongside the existing [AllowEmptyCollection()], permitting arrays that carry $null elements through parameter binding. An explicit null-reference guard is added inside the function body to distinguish the two cases: the array reference itself must never be $null (that would be a caller bug and throws a clear error), but elements within the array can be $null (valid — used to signal "clear this attribute"):

[Parameter(Mandatory)]
[AllowNull()]
[AllowEmptyCollection()]
[object[]] $MethodArguments

• Invoke-IdleStepEnsureAttributes.Tests.ps1 — Regression test covering the all-null attribute case (mobile = $null, telephoneNumber = $null) through the fallback path.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>EnsureAttributes with Provider.AD does not allow to unset attributes</issue_title>
<issue_description>## Description

If attributes are only unset with EnsureAttributes on Provider.AD (maybe others as well?) you'll receive an error about method $null

Steps to Reproduce

1. Create Step with

@{
            Name = 'AD - Remove phone number attributes'
            Type = 'IdLE.Step.EnsureAttributes'
            With = @{
                AuthSessionName = 'AD'
                IdentityKey = '{{Request.IdentityKeys.sAMAccountName}}'
                Provider = 'AD'
                Attributes = @{
                    mobile = $null
                    telephoneNumber = $null
                }
            }
        }

2. Plan + Execute
3. Get Error

Expected Behavior

Attributes are set to $null

Actual Behavior

Error

Cannot bind argument to parameter 'MethodArguments' because it is null.

Environment

• PowerShell version: 7.5.4
• OS: Windows Server 2019
• IdLE version / commit: main branch

Additional Context

Not sure what is breaking it here. It seems that the defined supported / unsupported Attributes of EnsureAttributes is somehow in the way as well. Althought the error message with using

telephoneNumber = '' references to the old EnsureAttribute and not to the new plural one.
Also it refers to "CreateIdentity" not to "EnsureAttributes", what we use here?

Exception calling "EnsureAttribute" with "4" argument(s): "AD Provider: Unsupported attribute in EnsureAttribute operation. 
               Attribute: OtherAttributes

               Supported attributes for EnsureAttribute:
                 - Department
                 - Description
                 - DisplayName
                 - EmailAddress 
                 - GivenName 
                 - Manager
                 - Surname
                 - Title
                 - UserPrincipalName

               Note: Custom LDAP attributes and password attributes are not supported in EnsureAttribute. 
               For custom attributes, use CreateIdentity with OtherAttributes."

We need to find a clear pathway for attribute handling for CreateIdentity Attributes and EnsureAttributes Attributes. They seem to use in AD different set of supported attributes that can be set directly as -AttributeName parameter and via -OtherAttributes for New-ADUser, while Set-ADUser doesn't have this, but -Add, -Replace and -Remove parameters.

But basic conclusion is:

• any string for attributes in EnsureAttributes (with supported parameter in Set-ADUser, but not in list of supported attributes from CreateIdentity) leads to an error on supported attributes
• OtherAttributes, although pointed out also dont work and gives same error
• any $null value on any value to unset a value results in MethodArguments error</issue_description>

<agent_instructions>ich bekomme noch immer beim Step "IdLE.Step.EnsureAttributes" den Fehler "Cannot bind argument to parameter 'MethodArguments' because it is null." obwohl der Fehler gefixt sein sollte im branch main in #file:IdentityLifecycleEngine (git pull gerade gemacht und Module von dort re-importiert)?
Und zwar grundsätzlich sobald ein Attribute mit $null im Step ist? Selbst wenn meine Authentifizierung falsch ist. Normale strings setzen funktioniert.

Sobald ich leere Strings anwende (attribute = '') kommt der Fehler nicht, dafür aber, was wiederum Sinn macht, denn -Replace kann keine leeren Strings setzen, nur hinzufügen oder überschreiben. Für leere Strings (sind ja $null) muss man -Clear nutzen.</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes EnsureAttributes with Provider.AD does not allow to unset attributes #202

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

Fixes a PowerShell parameter-binding edge case in IdLE’s provider invocation helper so EnsureAttributes can pass $null attribute values (used to clear/unset attributes) through the fallback path without failing before the provider is invoked.

Changes:

• Allow $null elements in Invoke-IdleProviderMethod’s -MethodArguments array by adding [AllowNull()], while still rejecting a null array reference via an explicit guard.
• Add a regression Pester test ensuring Invoke-IdleStepEnsureAttributes fallback mode can process attributes whose desired values are $null.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/IdLE.Core/Public/Invoke-IdleProviderMethod.ps1	Adjusts parameter binding to permit argument arrays containing $null elements and adds a clearer runtime guard for a null array reference.
tests/Steps/Invoke-IdleStepEnsureAttributes.Tests.ps1	Adds a regression test for $null attribute values flowing through the fallback (EnsureAttribute) invocation path.

Comments suppressed due to low confidence (1)

tests/Steps/Invoke-IdleStepEnsureAttributes.Tests.ps1:355

• The test comment says the provider should be called with a $null value, but the assertions use Should -BeNullOrEmpty, which will also pass for empty strings. To properly regression-test the original binder issue (null elements in the arguments array), assert the logged Value is exactly $null (e.g., Should -Be $null) for both attributes.

            $callsByName['mobile'].Value | Should -BeNullOrEmpty
            $callsByName['telephoneNumber'].Value | Should -BeNullOrEmpty

[github-actions]

Code Coverage Report

Overall Project	72.18%	🍏

There is no coverage information present for the Files changed