SP10: IDM Provisioning issue

[Former Member]

Hello All,

IDM 7.2 SP10

We newly upgraded to SP10 and now we see an issue in provisioning to ABAP and Java systems form IDM.

Provisioning works fine when Business Role(with inherited privileges) is assigned to the user then all inherited privileges are provisioning to SAP systems and mcexecstate in IDM DB get updated to 1 (in IDM UI as OK).

But when new privileges are added to this business role, automatic reconcile happens on the user(which already has this business role).

This triggers assignment of new privilege to user as inherited privilege via business role but provisioning does not happen and new privilege get stuck to pending status (mcexecstate = 512). This has been tried with lot of data.

We do not have this issue in SP8.

New privilege has no issue because if new privilege is already of business role and the business role is added to user then privilege get assigned successfully via provisioning.

Dispatcher settings and other configurations are good to best of my knowledge.

Dispatcher restart was also tried.

As only provisioning of new privileges due to structural changes on User's business role is having issue, it has become difficult to find out the root cause.

We have raised OSS to SAP but still awaiting for resolution since more than a week.

Any help in this forum is highly appreciated.

Thank you very much.

Regards,

Pradeep

[ChrisPS]

Hi Pradeep,
                  just to update the thread in case anyone else has the same issue - SAP development will release fix for this issue with designtime SP10 patch 4.

Thanks Pradeep for raising this with SAP and helping in finding a solution.

Regards,

Chris

SAP Global Support

[former_member297605]

Hi Chris

My client is on Idm 7.2 SP10 patch 14 and has the same issue. Please could you advise if this was resolved in patch 4 and subsequent patches.

Thanks

Ranjit

[jaisuryan]

Hi Pradeep,

So know already but still, is the corresponding PRIV:<rep>:ONLY privilege is added to or already available in the business role? Or you have set up "No master task"?

Kind regards,

Jai

[Former Member]

Hi Jai,

Thank you for the reply.

'No Master Task' is used for assigning ONLY privilege to the user.

User already has ONLY privilege and other privileges for the repository in OK status (mcexecstate = 1)  but if new privilege of same repository(or other repositories) is assigned to the business role then assignment of new privilege to the user gets triggered due to automatic reconcile process but it just get stuck into pending status (mcexecstate = 512).

Tracing on the user shows that stored procedure mxp_prov_basic is not triggered after automatic reconcile.

Regards,

Pradeep

[former_member297605]

Hi Pradeep

Did this issue get resolved with SP10 patch 4?

Please advise as I seem to be facing a similar issue.

Thanks

Ranjit