How to retry provisioning for pending values ?

[Former Member]

Hi,

Our environment is IDM 7.2 SP7.

And we have couple of users whose master privilege (PRIV:ADLDS:ONLY) is in pending state for quite a long time.

I could filter those entries using mcExecState=512 in idmv_link_ext. It looks to me the reason for pending state is it's referring to some of the old notification tasks previously we had. Now those tasks are replaced by new one but i could see the old notification task is still under MX:Pending_Delete folder.

I tried using some of the internal functions (uRetry_Privilege/uIs_PrivReconcile) but that doesn't seems to fix the problem. So is there anyother way available to clean up those  mcExecState=512 entries or retry provsioning with new tasks linked ?

Thanks,

Karthik

[Former Member]

Thanks Steffi & Krishna for reverting back 🙂

Actually we raised a ticket with SAP and they have recommended similar steps as in Repair failed/stuck pending assignments

Currently we are waiting for the DB team to prepare the environment for us to try it and see. I will keep you posted in this thread how it goes.

[mabujan]

Hi Karthik,

Can you share the recommendations from SAP?

I am running into the same situation.

Appreciated

Manuel

[Steffi_Warnecke]

Hello Manuel,

did you check the blog Karthik mentioned in his last post?

[mabujan]

Yes, but with no luck.

As we are running SP9, I've create an small task to repair the entry by running uIS_RepairEntry(mskey).

It doesn't work.

M.

[Former Member]

Hello Karthik,

You may also have a look @

~ Krishna.

[Steffi_Warnecke]

Hello Karthik,

I'm sorry, I wanted to check your query in my system and completly forgot about the whole thing.

Did you try the update of the provstatus to 1100 yet? What were the results?

Did you re-try the adapted provisioning task (where you changed the conditional task) by running it again with one of the stuck mskeyvalues? You can do that via "Test provisioning" in the right-click menu.

Regards,

Steffi.

[Former Member]

It's Ok steffi

I have also noticed that corresponding old provisioning tasks are in queue still. The task is now at MX:Pending_Delete folder and i tried to disable/enable to make it somehow completed but nothing works.

Not sure whether deleting the provisioning queue is a good idea here.

I will wait for some other expert advice if they have faced such situation before.

[Steffi_Warnecke]

Hmm, the "MX:Pending_Delete" - folder is something like the wastebasket of the management console. If you delete something, it will be moved there. But this should not influence the normal workflows.

You could try the following sql statements (e.g. in the SQL developer) to see, what the pending value might be waiting for:

select * from mxp_provision where msg like 'Wait for%'
> checks for tasks, that wait for the successful state of other tasks. The MSG gives you an Auditid for the next sql-statement

Select * From Mxp_Audit Where Auditid=<auditid>
> MSG now shows information about the state (e.g. failed) and the reason and for which user and which assigment

update mxp_audit set provstatus=1100 where auditid = <auditid>
> This sets the blocking tasks to state "OK" and therefor the waiting task can finally start

Regards,

Steffi.

[Former Member]

Thanks for reverting back immediately.

I executed the shared query and following are my observation

select * from mxp_provision where msg like 'Wait for%'

Output : No Result

So there are no tasks with msg 'Wait for%' exist in our environment.

1. Select * from mxp_provision where AuditRef=381162 (Considering 1 affected user flow)

Output: Returned 3 rows (as the old provisioning task had 2 ordered task group and a Conditional task)

Here It looks to me the provisioning flow is stuck at Conditional Task and MSG value is 'FALSE' so i tried to modify false branch in the condition and tried to make it 'skip entry' for completion but that doesn't seem to get triggered.

2. Select * From Mxp_Audit Where AuditID=381162

Output: 1 Row with ProvStatus as 1 (does ProvStatus=1 implies blocking here ?)

Do you think executing below query will remove the blocking state and can get completed ?

update mxp_audit set provstatus=1100 where auditid = 381162

[Steffi_Warnecke]

Hello Karthik,

we have a script, that uses the "uRetryPrivilegeAdd"-function. You'll find it in the IdM help.

Regards,

Steffi.

[Former Member]

Typo error.. I already tried with uRetryPrivilegeAdd function.

That works only for failed privileges ( mcExecState=4) but here the problem is pending assignments. It doesn't seem to trigger provisioning again.

[Steffi_Warnecke]

Hmm, we have it also in use for "Mcexecstate =  1536", meaning pending values that should get removed.

And "uIS_PrivReconcile" (which you already tried, as you wrote) did the trick, too, for me to work through some pending privileges.

Sorry, but I don't know any more ways to push them.

Regards,

Steffi.