Identity Center MMC Crash - Missing SAP Provisioning Framework Folder

[paul_abrahamson_sap]

Hi,

While working in the MMC it crashed and upon restarting it, the SAP Provisioning Framework Folder is missing.

However Jobs from this folder are still running successfully and appearing in the Job Log. Web Enabled UI Tasks from this folder are also still accessible in the UI.

I've tried refreshing the MMC tree, but it still doesn't come back.

I've tried removing the SAP NetWeaver Identity Management Snap-in and re-adding it.

IdM 7.1 SP5

Any suggestions?

Thanks

Paul

Edited by: Paul Abrahamson on Mar 12, 2011 6:34 PM

[thomas_groth2 · Accepted solution]

Hello,

did you try "Lost and Found"-folder. You could also try to "jump to job" from job logs.

If that doesnt work you could watch at the tables MC_JOBS and MC_GROUP.

BR,

Thomas

[paul_abrahamson_sap · Accepted solution]

Hi Thomas,

Thanks for this, but no they're not in Lost and Found nor in MX-Pending Delete. Jump to job and also 'Find' doesn't find them.

Querying mxp_tasks - it seems that a whole batch of tasks from the SAP Provisioning Framework folder were 'changed' at the same time in very quick succession, (in descing order just before the crash)

TaskId, Task Name, Changed

6	DummyLinkScriptJob	2011-03-12 17:26:20.703
12	ModifyCompanyAddress	2011-03-12 17:26:10.090
195	Modify Personnel Number	2011-03-12 17:26:10.060
16	CheckRemoveCompanyAddressAssignment	2011-03-12 17:26:10.030
15	CheckEntryTypeIsMxPerson	2011-03-12 17:26:10.000
14	ModifyBasicAddressData	2011-03-12 17:26:09.963
196	ModifyAcademicTitle	2011-03-12 17:26:09.933
9	ModifyUser	2011-03-12 17:26:09.903
194	ModifySalutation	2011-03-12 17:26:09.870
11	HandleModifiedUserCompanyAddressAssignment	2011-03-12 17:26:09.840
10	HandleModifiedUserCompanyAddressAssignment	2011-03-12 17:26:09.810
8	UnLink group	2011-03-12 17:26:09.733
7	Link group	2011-03-12 17:26:09.703
13	AddCompanyAddress	2011-03-12 17:26:09.673

This does imply a mass change i.e. drag-drop bug!

However many of these tasks don't appear in the mxp_tasklnk table.

I think I've got no choice now but to revert to a DB backup and reimplement our changes since.

Any advice on what we need to do before we restore the DB in terms of stopping jobs / services etc?

Edited by: Paul Abrahamson on Mar 14, 2011 11:58 AM

Edited by: Paul Abrahamson on Mar 14, 2011 11:59 AM

[Former Member]

Hi,

Same thing to happen to us with SAP IDM 7.20. We couldn't find Provisioning Framework Folder but Provisioning was working.

Restoring the IDM Database from the last available backup fixed this issue.

I can see this post was posted in March, 2011. Can't believe 2 years later, it's still not fixed.

Thank you,

Kautilya

[Former Member]

Had this problem some minutes ago. Again. Doh!

Easiest way to fix (in my situation and I guess in general, too):

• SQL Queries on the mxp_tasks table to find out the missing tasks/folders. Take one as example
• Note the GroupId from the Folder from which the tasks/subfolders are missing.
• SQL Queries on the mc_group table with altering between group_id and parent_group column to find out where the missing tasks/folders could be.
• If you find a valid one, search the tree in the Identity Center and then Cut&Paste it where it belongs (and yes, it's the action with THAT message)
• If you find a loop take the Id of the tasks/folder (a folder makes it easier) which should be the topmost
• Run an update query on mxp_tasks for tasks and mc_group for groups (oper user rights needed) and correct the taskgroup / parent_group of the topmost missing tasks/folder

Took me more time to write this then to correct the problem (well, ok, not if you count the time I tried restarting my computer). I hope this helps until 7.2 SP9 arrives.

Best regards

Dominik Trui

[terovirta]

Dominik, were you doing something specific when this happened?

[Former Member]

No, just the "everday clicking" combined with tough luck.

[Former Member]

I had the same problem. Just "the every day clicking" and boom - the config was gone. I was wondering why the a huge part of my configuration was not showing in the identity center anymore, since I still was able to find it in the database.

Somehow a loop-reference appeared in the PARENT_GROUP column of table MC_GROUP..changing it back to how it made sense it appeared back in the identity center again.

THANKS!

[paul_abrahamson_sap]

SAP responded to our support ticket and also advised to check the mc_group table. However due to the time pressures on our project and also thinking along Holger's lines, we had already decided to export our tasks and ID Stores, restore the database and then re-import the 'lost' config.

We did this, however were then unable to re-import the config. Various import errors occured. So that left us having to re-apply the changes manually.

SAP Note: [1436169|https://service.sap.com/sap/support/notes/1436169] provides useful info on how to get more details on Import and Export errors. We'll do this next time we encounter this.

The response from SAP was "The reason for the MMC crash is a non-compatible change Microsoft did to their MMC framework causing a memory overwrite during a cut/paste or drag/drop operation in our application. This we probalby will have

to live with until we release a new Amdmin UI."

No timescales were given for this. We work with many other MMC consoles in our environment and none of them crash when a drag-drop operation is performed.

Thanks for all your input and sympathies...

[Former Member]

Hi Paul,

the SAP Import has failed in our infrastructure several times as well. Typically it helps to assign db_owner rights to the mxmc_admin user.

Best regards

Holger

[former_member2987]

Sounds like you've become a victim of the "Drag and Drop" bug. I'd follow Thomas' reccomendation about the jump to job. Since everything is still running, the folder has most likely been moved. I don't think it would be deleted since everything is still running and delete requires a confirmation.

One day there will be a non-mmc interface. I've been waiting for one for about 5 years now,

I'm sure whatever replaces the MMC based admin console will have its own personality which will have issues as well.

[paul_abrahamson_sap]

Fingers crossed - we hope a better change controlled configuration tool will become available soon. I miss the concept of Transport Requests like you have in an ABAP system!!!

[Former Member]

Hi Paul,

Nothing constructive to add, but you do have my sympathies, that sounds like a nightmare!

Ian

[Former Member]

Hi

I agree with Thomas: Look for SAP Provisioning Framework in table MC_GROUP, especially at the values in Parent_Group, Provision_Group and idstore. Maybe setting them manually to a valid value makes the folder visible again.

BR

Michael

[Former Member]

No matter whether you will be able to see the SAP Provisioning Folder or not, your database seems to be corrupt. If that is possible, I would not continue using that database. I would rather export all the configuration, create a new database schema and import everything into the new database scheme.