Account Request stuck at Pending state even after Provisioning

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

IIQ version : 8.4p1

We have 2 AD applications.

When an account request is submitted and provisioned, for one of the application the request shows Execution Status: Completed but for other application request it shows Execution Status: Verifying and is stuck there even after we run “Perform Identity Maintenance” task.

I have checked docs and community and found few articles where this is happening because pwdLastSet attribute is stuck at committed and not changing Finished or Not Verifiable.

Weird thing is both are AD apps and its happening for only 1 app and other one is working fine.

we are setting value pwdLastSet to true in both apps.

I could have resolved it by removing the pwdLastSet value from prov policy but we need user to reset password on next logon so we have to set this value during account creation.

anyone faced this??

2

the links I used to refer this problem: https://community.sailpoint.com/t5/IdentityIQ-Forum/AD-account-created-but-access-request-shows-pending-status/m-p/163701#M133380

3

@aakashpandita .

Can you try removing pwdLastSet from the policy for both accounts and update it in the After Provisioning Rule?

Your question is valid; it should behave the same for both accounts.

4

I can do all the customization I want and it will work I know that, but my concern right now is why its working for 1 AD app and not other.

5

@aakashpandita
Can you compare plan for both account? there must be something slight difference.

Also compare “Type Settings” and “Validation” for pwdlastset attribute from policy.

6

I ended up creating a task which checks and verifies pending requests once every day.

7

does this mean the execution status is gone now for the other application?

8

@aakashpandita You should not be needing a custom task to do that, IIQ should do it automatically for you.

IIQ needs to validate the values of provisioned attribute against the schema attributes after aggregation. If there is a mismatch, then IIq will keep the request in Verifying state and eventually end with Not Verifiable state.

So in your case, could you please confirm what is the value in provisioning vs after aggregation for both apps.

9

The pwdLastSet value gets changed as soon as it is set in AD. From prov form we are setting it to 0 and as soon as account gets created AD sets it to its Windows timestamp. That is why Perform Identity Request Maintenance is not able to verify this attribute, sue to this mismatch. So I created a separate task to mark IdentityRequest as verified.

10

Thanks @aakashpandita for the details.