Attribute Sync results in no activity

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Hello all,

I am trying to test attribute sync and it just does not seem to trigger any provisioning activities (nothing in search nor log) nor does it produce expected results.

I am manually syncing the attributes and have waited upwards of 2 hours but still nothing.

Pre-Conditions:

  • Active Directory account has been aggregated and correlated to an identity.
  • Identity attribute ’ city ’ has a different value than Active Directory attribute ’ l '.
  • Attribute sync is enabled on the Active Directory source, with identity attribute ‘city’ synced to account attribute ’ l ’

Test Steps:

  1. Look up the target identity in the admin user interface by going to Identities > Identity List .
  2. Verify that the identity attribute ’ city ’ has a value. Note its value.
  3. Under the Accounts tab, click the Active Directory account.
  4. Verify that the account attribute ’ l ’ has a value. Note its value.
  5. Compare values from Step 2 and Step 4; they should be different.
  6. Click Synchronize Attributes from the identity actions panel.
  7. Click Activities from on the identity.
  8. Observe that there are attribute sync activities sent out. (May have to wait / refresh the page a few times.)
  9. Under the Accounts tab, click the Active Directory account.
  10. Click Aggregate Account under the Active Directry account options.
  11. Verify that the account attribute ’ l ’ has a value. Note its value.
  12. Compare values from Step 2 and Step 11; they should be the same.

Expected Results:

An account attribute sync provisioning event should have been logged in the activities, and once aggregated, reflects the identity attribute which was sent.

2

Hi @spatil19

could you please check in postman if attribute sync operation is enabled please?

GET: {{api-url}}/cc/api/source/getAttributeSyncConfig/41838?page=1&start=0&limit=25```
3

Hi @gustavo_mariscal,

I enabled the attribute sync from the UI and saved it, but when I looked into the config using the below API call, I saw the value false on the “enabled” key.

GET: {{api-url}}/cc/api/source/getAttributeSyncConfig/{{sourceIdFromUI}}

I had to update the value from false to true in the “enabled” key by making the POST call then I was able to sync the attribute.

Enabling the attribute sync from the UI is not enough? Do we always need to enable the attribute sync via API going forward?

Thanks,
Sushant

4

Yes, I confirmed via postman that it is enabled before posting (UI checkbox did not work, I had explicitly make a post call to enable the sync on the attribute of my interest).

Anyways, the 8am attribute sync refresh ran fine and updated as expected but the manual sync as described in step 6 isn’t working and I retried it now with a different value and it still gives the same result.

5

Hi @Sushantmrj @spatil19

I’m not sure why it happen but if attribute sync is not getting triggered is better to check those settings on the API, not necessary to do an update on the operations every time, just check if is not working as troubleshooting step

6

My issue, is I can’t manually test my attribute sync on a single user as the documentation suggests. I have to wait until 8am the next day.

1 Like
7

Try running a refresh task but if it is dones’t work I recommend you to open a support ticket.

POST: {{api-url}}/cc/api/system/refreshIdentities
Body:
{
    "refreshArgs": {
        "correlateEntitlements": "true",
        "refreshManagerStatus": "true",
        "synchronizeAttributes": "true",
        "pruneIdentities": "true",
        "provision": "true",
        "promoteAttributes": "true"
    }
}
8

Did you get a resolution for this? I’m running into the same issue with an attribute on our connector.