MX_RECONCILE in IdM 7.2 SP10

[Chenyang]

Hi experts,

I have recently upgraded an IdM system to 7.2 sp10. There is a message in the log says the parameter MX_RECONCILE is removed from the global constant.

The constant MX_RECONCILE was set to false before the upgrade, and we had a job to trigger the reconciliation. It was working as expected.

After the upgrade, I found that the dirty entry reconciliation becomes a job of the dispatcher house keeping activities. It is turned on automatically. Should I keep this setting in production system? Is there any pros and cons?

I also found the manual reconciliation does not work any more. It shows the log that adding/deleting privileges for the manual reconciliation, but it didn't trigger anything. On the other hand, the automatic reconciliation does trigger the provisioning/deprovisioning. Is this wrong?

I also noticed after a role re-structuring, the associated users are not dirty because of this auto reconciliation, but it didn't add the new privileges to the user and didn't trigger the provisioning.  what could be the problem please?

Best Regards

Chenyang

[Chenyang]

An example of this issue

A user has been assigned to a business role which is recently updated and added 50 child business roles. Each business role has a few context enabled privileges (less than 100 privileges). The auto reconciliation is turned on.

So after the role change, the user's assignment was not updated. It means auto reconciliation failed. Then I did the manual reconciliation. It restored the role structure correctly, but didn't trigger the provisioning. I found the pending values are all created correctly. But there is no records in the MXP_PROVISION table for this user. In the end, the user has got only 79 privilege assignments pending in the IdM UI, and it keeps pending.

Please help to identify what the problem could be? Or how to resolve this issue?

Thanks,

Chenyang

[former_member297605]

HI Chenyang

Hope all well with you. I found the below post which is a similar issue.

https://scn.sap.com/thread/3786421

You probably have seen this already. They were expecting a fix for this in SP10 patch 4.

cheers

Ran