Multiple values for MX_ADMIN_UNIT added to a user

[laurent_vandenbemden]

Hello All,

First of all best wishes for 2016 🙂

We recently have upgraded our IDM to the 8 SP1 version and are running on an Oracle database.

While doing some maintenance I've noticed an issue in my user database and more specifically with the MX_ADMIN_UNIT attribute.

Some user mskey's have for some reason which I have not been able to find, several MX_ADMIN_UNIT entries added to their user.

The MX_ADMIN_UNIT entries assigned to the same mskey's have the same "VALKEY" but a different "VALLOCAL" .

This results in errors when trying to modify the usergroup in the UI (Could not execute task Change Identity for entry Enny Bostijn) and also when trying to create the users in ABAP systems.

There are only a small amount of users impacted till now but it is necessary to find out how to clean the entries.

Can anyone give me some help on this?

Thanks a lot,

Laurent

[former_member2987]

Hi Laurent,

Not to sure about this attribute... My guess is that somehow multiple initial loads came from the source system that caused IDM to keep adding the value. You can fix this in the future by adding the "." prefix in the initial load for the system. For those reading this unfamiliar with this prefix, it prevents the value from being written to the Identity Store unless it is a new entry being written.

As to how to fix it, that could be a tough one.  Is there a way you can tell what value is authoritative? If it's always the first or last you could write a quick job to clean it up, or you could write a job to clear the attribute and then reload the values (you'll have to reverse my previous idea temporarily though)

Just some quick thoughts to start the discussion.  Hope it is helpful to you!

Regards,

Matt

[laurent_vandenbemden]

Hello Mat,

Really seems a weird one.

I verified the initial load attribute prefix parameters but the "." is added for all attributes in the initial load job. So I don't think it comes from there but I will verify the logs in detail as updates for all users have been performed on the same date.

Also the update job is not willing to update the attribute. I tried to force to clear the attribute with a job, but even with that I receive an error message stating that the system is not expecting multiple values to be retrieved for that parameter. So I tried to modify the attribute with "multiple value" parameter but doesn't change anything, still receiving the error.

Even deleting the user via the UI is enging with the same error.

Thanks a lot for your ideas

Krz,

Laurent

[former_member2987]

Hi Laurent,

Then you probably have another task doing the update to the attribute.  Can you replicate the issue?  Run the trace while it happens.

Matt