How to provision all assignments in OK status to backend(ABAP, JAVA)

[Former Member]

Hi Experts,

SAP IDM 7.2, SP8

Sometimes due to inconsistencies, users have assignments (inherited privileges (part of role)) with OK status in IDM but missing in backend systems.

Question 1: Is there any standard way to provision such user's all assignments (with OK status)?

1. I have tried uIS_RepairEntry internal function but it does not touch assignments in OK status if there are no structural changes required.

2. uPrivReconcile only reconcile failed/declined assignments.

3. I have tried uIS_SetDirty internal function but it does not trigger any assignment which is in OK status.

Infact it says that If an MX_PERSON entry is set dirty, this entry is marked dirty and all assignments will be reconciled but assignments in OK status are not provisioned.

Question 2: What does "all assignments will be reconciled" means here if it does not provision all assignments in OK status (mcExecState = 0 or 1).

4. I have created a job and created a script to use uProvision internal function to implement logic to trigger hook task 4 of repo(ABAP/JAVA) for the user.

for ABAP it works fine but for JAVA repo ,  stored procedure “mxpt_get_privilege_type” checks for audit id and pending privilege mskey and so check fails.

so, executing task  “SetJavaRoleForUser&Group” directly via script works fine.

Question 3:

I am interested to know if anyone has implemented anything better than this (point 4) to provision all assignments (with OK status) of user from IDM to backend system.

Kindly assist.

Thanks a lot in advance.

Regards,

Pradeep

[jaisuryan]

Hi Pradeep,

Or we can create a job to find the mskey's of privileges (either all or only failed ones) assigned to the user and pass to function uRetryPrivilegeAdd to retry assignments.

BR, Jai

[Former Member]

Hello

We have developed a Re-provisioning task and liked it to a UI tab and job for handling the users in bulk with this issue.

This can be an alternative to manually removing and re-assigning the privileges back.

Regards,

Khushboo

[Former Member]

Hi Khushboo,

Thank you for your reply.

Could you please share the logic you implemented ?

Is it the same as I have done (mentioned my point 4) ?

Regards,

Pradeep

[siarhei_pisarenka3]

What about removing the assigment and then adding it back ?

[jaisuryan]

Thanks for posting this Pradeep. I was also looking for solution for the same issue.

Hi Siarhei,

I did IDM support for 2 customers and both had this issue and we resolved by re-adding the roles to the user. Its a cumbersome process as we have to remove the role, wait for de-provisioning tasks finish for all corresponding repositories and then add it back. If the user has only one role in IDM and removing them triggers user deletion in back-end which is a nightmare for support consultants and we have to answer alot of audit questions for manual operation on a user in a fully automated landscape (Priv:$rep:only can be added to avoid user deletion but the visibility was not allowed for us as it was considered as internal IDM system privilege).

Currently in my new assignment, we have no change access in production. Hence we cannot re-add the access. so we need to develop a solution for this issue before we go-live fully. Pradeep's 4th point is a good starting point for us.

Kind regards,

Jaisuryan

[Former Member]

Hi Siarhei,

Thank you for your reply.

Removing atleast one existing role and adding again will trigger the provisioning but it is not a good custom solution .

I am interested to know any standard or good custom way to handle this issue for n number of affected users.

I have implemented solution for this as mentioned in point 4 in my problem description but looking for standard or better custom  solution if any.

It is great to have internal function which can handle such issues.

Regards,

Pradeep