Privileges stuck in "Pending" state, created users not flowing to ABAP clients.

[Former Member]

Hello all,

I’m running IDM 7.2 SP4. I have some assigned privileges that are stuck in status “pending” and “Not allowed” UI. When I try to delete them with the hope of reassigning, I cannot. Also when I try to create a user via UI, I see the user in the UI with status "Pending" for privileges but not in the ABAP clients.Below are the errors and warnings i'm getting.

Pass: UpdateABAPUser

IniFile.getSectionValues

java.io.FileNotFoundException: /usr/sap/IDM/identitycenter/KEY/Keys.ini (No
such file or directory)

Executing
sap_abap_handlePasswordDisabled(!!{DES3CBC}1:fa384ff6ba2b375f-df28d351366a7a59e5da0347e60b86ff)
got RuntimeException - undefined: Cannot convert null to an object. HINT: Check
line 7 in the script sap_abap_handlePasswordDisabled

Failed running function in string

"$FUNCTION.sap_abap_handlePasswordDisabled(!!{DES3CBC}1:fa384ff6ba2b375f-df28d351366a7a59e5da0347e60b86ff)$$".

Marking entry as failed. Exception was: undefined: Cannot convert null to an object.

Pass: Trigger notification: assignment failure

Executing sap_core_getSkippedOK() got RuntimeException -
org.mozilla.javascript.EvaluatorException: uSelect(select avalue from
idmv_value_basic_active where attrname='MX_ATTRIBUTE_VALUE' and
mskey=not-existing-mskey and rownum<=1) got exception
java.sql.SQLSyntaxErrorException: ORA-00936: missing expression HINT: Check line
20 in the script sap_core_getSkippedOK

The keys.ini is in the only defined location. Any ideas/help

[Former Member · Accepted solution]

Hi,

Quite a few different issues here, but i'll focus on the "stuck in pending" state first.  This is a common issue we have had, it can be caused by many different reasons, and has various methods to fix it. 

In order to have the dispatcher "re-check" the link to see if you can force it to retry

UPDATE mxi_link

SET mcCheckLink = GETDATE()

WHERE mcUniqueID = <put the unique id of the mxi_link entry here>

If that doesn't work, you'll have to have support send you a stored procedure to get them out of pending.  Sorry, but i can't distribute it.

[Former Member · Accepted solution]

For your other problem, re-generate the keys.ini file.  It should be located at /usr/sap/IdM/Identity Center/Keys.  To re-generate the keys.ini, open up the MMC > right click the top level > re-generate keys.ini.

[Former Member · Accepted solution]

Hello Sir,

Thanks for your response. I would really appreciate if you give a little more detail about this approach.

[Former Member · Accepted solution]

Well, Well, Well,

Thanks for your answer. I didn't have to regen Keys.ini. It turns out that somehow Keys.ini became KEys.ini and Unix threw a feat. That part of headache appears resolved. Much appreciated.

[former_member2987 · Accepted solution]

Been stuck there myself.

http://idm-thoughtplace.blogspot.com/2012/03/doing-linux-based-victory-lap.html

[Former Member · Accepted solution]

Hi,

I don't have the specifics on how the dispatcher checks links in the mxi_link table, but what I do understand is that the runtime engine will scan the mxi_link table and look for entries where the mcCheckLink column is less than the current date/time.

This is not a fix/all by any means.  If you have this issue, i'd recommend you open up an SAP message and they will provide you with a stored procedure that automitically fixes these usres stuck in pending state.  Sorry I don't have additional info on the specifics.

Regards,

Chris