MX_COMPANY_ADDRESS causing provisioning problem

[Former Member]

Hello,

I've run into a provisioning problem after having recently setup a new ABAP system, that has left me puzzled.

The initial load for this new ABAP system completed successfully, after I resolved a few issues. But when I tested provisioning a single privilege I'm getting the following warning related to the Company address. After the warning is displayed the job log states the provisioning was successful but the role does not get provisioned to the ABAP system.

The warning states:

MSKEYVALUE '!ERROR: No such attribute' does not start with MX_COMPANY_ADDRESS prefix 'COMPANY:'. Cannot remove it for provisioning. Provisioning of the company address assignment might fail.

What I should also add, is that while researching this error I came across a post that suggested adding the MXREF_MX_COMPANY_ADDRESS to the MX_PERSON entry type. While I tried that and it didn't work, what followed was a number of entries in the system log showing a large number of schema changes I did not make or try to save. Any ideas on this?

What I need help with is understanding (1) how to understand this issue, and (2) how to resolve it.

Appreciate that help.

Paul

[Steffi_Warnecke · Accepted solution]

Don't use the "Find" function. It's not really helpful. ^^

But you can right-click on the job in the Status overview and there choose "Jump to job". That's how I find things I don't need to look at that often.

Regards,

Steffi.

[Former Member · Accepted solution]

Thanks for the tip Steffi, the jump to job works very well. With it I was able to locate some jobs, but for the one I had the error with the application hung and eventually I had to restart it.

[terovirta]

Hi Paul,

you shouldn't have to add the reference between company address and person, it should be there by default.

The first error sounds like the pass has tried to query for non-exisiting attribute, was this before you added the reference between company address and person?

If the reference exists in schema but the company address for the user is empty then same error probably would appear in the log but it would be without the '!ERROR: No such attribute' .

Does the user in question have valid company address? Does IdM UI show it? Can you find the user from the target system? And with what company address?

regards, Tero

[Former Member]

Thanks Tero.

I agree, I shouldn't have to add the company address reference, it should be there.

As I take a closer look at what's going on, I'm trying to rely on the logs to provide some insight. In looking through the global logs, and status I see something that doesn't make sense to me. I'll explain.

1) I'm testing provisioning using an identity store(#4) that I also used to test and complete the initial load with.

2) This identity store has much higher numbers assigned to the web enabled and provisioning tasks (7 digit task numbers) than the identity store (#2) I used previously (4 digit task numbers).

3) When I filter the status records to see which jobs were recently triggered, I see that the jobs from both identity stores were triggered, and it's the previous identity store's job for creating an ABAP Company Address that shows the error.

4) I've searched but I can't seem to find where this job is? Also, I'm not sure why identity store #2 tasks are being executed through the browser. I did check which web enabled task is opened in the browser when I try to provision a new role and it's for identity store #4 with the 7 digit task numbers.

Do you know if there's an easy way to locate a specific job? How would I ensure that only the provisioning tasks of the current identity store (#4) are being used?

Thanks,

Paul

[terovirta]

Hi Paul,

unless you have modified the SAP Provisioning Frameword, the PF tasks are run against the Id Store referred in global constant "SAP_MASTER_IDS_ID". Just state 4 in your constant.

You can double check/fix the provisioning tasks by navigating through the Provisioning/Deprovisioning/Modify workflows (under SAP PF / Core) and the plugin/hook tasks (under SAP PF / Connectors) to the repository types you're provisioning to. This sounds tedious but it'll only take maybe 10-15 minutes.

There's a find-function, just right click, I am not sure how well that works. As sad it may sound ( ), I spent quite a lot of time in MMC, so I remember most of the stuff by heart.

regards, Tero

[Former Member]

Thanks again Tero.

On further investigation I've ensured that for the repository I'm working with, I've set the 'add' and 'remove' tasks to the PF tasks of identity center #4.

I then tested the Modify task and it works as expected.

But when I test the provisioning task none of the underlying task for provisioning are called (update context info, check syncronous, etc).

Under the web enabled tasks, the 'assign' task is enabled as a UI task. From here is where I test the provisioning of an ABAP privilege.

After I tested the provisioning and look in the job log, all that shows is the 'assign' task as being OK. So, what's missing here? Is it the 'provisioning' task that should be the UI enabled task? I don't think so.

Thanks again.

Paul

[terovirta]

Hi Paul,

What is the status of the privilege assignment for your test user in UI? If it's pending then the assignment is "pending" for the account privilege (just assign the "priv:[rep_name]:only") but if it's "OK" then the assignment went through without any provisioning-task processing.

As the UI is asynchronous all it does is submit your form and then the tasks configured in IdM will start to execute. If privileges have correct tasks and repository set the provisioning should start.

If the tasks are enabled, they have dispatcher selected and are set to execute against correct Id Store, the next things to check would be that the privileges have correct tasks:

For normal privileges the modify task should be set to "none" (mx_modifytask=-1 if you look it from DB), all other tasks set to "inherited", so that they're inherited from repository. Correct repository should also be visible in the "member events tasks"

Your repository should look similar to below. I am using the SAP PF version 2 here so the Provisioning/Deprovisioning/Modify tasks in "PF\Core" have different task ids than for the earlier Provisioning Framework.

regards, Tero

[Former Member]

Hi Tero,

Thanks again. The status of the privilege assignment is 'OK', which as you mentioned means it went through without any provisioning tasks being executed.

I've just been testing provisioning with a privileges, which are all alike. The tasks aren't set to inherited but that shouldn't matter should it?

Also here are the constant values for the repository I'm testing. Seems that I've got all the same entries as you do.

When I test the modify ABAP user this works and as you can see from the screenshot below, it does successfully execute subsequent tasks, but the assignment does not? Still puzzled.

[Former Member]

Hello Paul,

In your screenshot, I do not see value of MX_ADD_MEMBER_TASK (it should have provisioning task) and MX_MODIFYTASK (it should have Modify task).

SYSTEM_PRIVILEGE should be updated (ex. PRIV:SYSTEM:R3D120) .

At Privilege properties -> Tab Task should have prov, de-prov and modify task as inherited. This config will trigger provisioning task to do provisioning in backend system.

At member events tab, also it is good to keep everything as inherited.

Let me know in case of further questions.

Regards,

Pradeep

[terovirta]

Hi Paul,

in your screenshots the Provisioning and Deprovisioning tasks should be set to inherited and the Modify task should remain as it is.

Only the system privilege should have a modify-task. If you set the modify task for all privileges then all of the assigned privileges will trigger separate Modify-task execution for the user.

Can you show also the "Member Events" tab?

You could test with this privilege and if it works then we can figure out how to adapt the Initial Load job to fix the rest of the privileges for you.

regards, Tero

[Former Member]

Hi Tero,

I've made two changes:

1) Set the provisioning and deprovisioning tasks to 'inherited.

2) Set the repository system privilege to: PRIV:SYSTEM:R3D120 (as mentioned by Pradeep above)

After these changes were made the next test did trigger the provisioning task to execute, although it failed with a new error. Can you advise what these mean and how to resolve them?

[Former Member]

Thanks Pradeep,

I've made the two changes and while provisioning did get triggered I get a new error (see below). Any ideas on how to resolve this error?

Paul

[jaisuryan]

Hi Paul,

Please check the task "SetABAPRole&ProfileForUser" in the provisioning framework for potential issue in provisioning to ABAP systems.

UpdateABAPUser task is for updating modify user attributes in the ABAP system and as the warning says it would just skip updating the company address for that user whilst rest of the attributes would be updated. let us know if you are looking for more information on provisioning company address.

Kind regards,

Jai

[Former Member]

Hello Jai,

I've checked the task 'SetABAPRole&ProfileForUser', but I don't see anything in this task that might cause an issue with provisioning. Can you make any suggestions as to what I should be looking for?

Here's how the task is currently setup:

Do you have other suggestions on provisioning the company address?

Cheers,

Paul