Can't Update Attribute Sync Target Value (Field Name) for JDBC connector

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

I have a JDBC Direct Connector that I am trying to reconfigure up Attribute Sync on and am getting an error when I try to enable the Attribute Sync for the first name:

{"messages":[{"localeOrigin":"DEFAULT","text":"A target account attribute \"firstName\" is missing from the sources account schema.","locale":"en-US"},{"localeOrigin":"REQUEST","text":"A target account attribute \"firstName\" is missing from the sources account schema.","locale":"en-US"}],"detailCode":"400.1 Bad request content","trackingId":"<REMOVED>"}

Backgroud:
The connector was originally configured with a direct SQL statement, but was recently swpped over to use an View. This changed the names of the fields we were bringing back in, so firstName became FIRST_NAME and lastName became LAST_NAME, etc.

Investigating:
The first thing I realized is that it was referencing the old name of the Account Attribute.

My first thought was to just delete the Attribute Sync values and create new ones. When I looked in the UI, there is no method to remove/delete the existing reference.

My second thought was that I would use the API and either remove or update the Attribute Sync Configuation from the Beta API.

I used the GET to return the correct configuration then I copied it to the body of the Update and set the new values for the Target, and removed one unnecessary Attribute Config value. I then submitted it. However, the response I got had the original, existing values still. I went back to review the API documentation and found this note in the Description of it:

Replaces the attribute synchronization configuration for the source specified by the given ID with the configuration provided in the request body. Only the “enabled” field of the values in the “attributes” array is mutable. Attempting to change other attributes or add new values to the “attributes” array will result in an error.

So it looks like this method will not work. Looking further at the APIs and the UP, I do not see a method to update/remove from the Attribute Sync Config.

Has anyone successfully updated this? Or am I stuck deleting and rebuilding my source connector from scratch?

2

Based on my finding, I think I know the cause of the issue in this closed ticket.

They created the Attribute Sync Config with “state” first, as they mentioned, and then added the “st” one, but both are attempting to be updated during attribute sync process for them.

3

ok, I figured out the issue myself:

So, the Attribute Sync Documentation calls out that the field needs to be in the Create Policy and set to an IdentityAttribute. In my system, I had the field “firstName” configured to the identityAttribute “firstname”, which added the “Given Name” IdentityAttribute to “firstName” account attribute mapping option for Attribute Sync. When trying to click this I was getting the error in the first post, which referenced not finding the Account Attribute with “firstName”.

So what the issue was is that when the Account Schema were updated to match the source fields, the Create Provisioning Policy was not updated. This worked fine prior to attempting Attribute Sync because the provisioning was taking place in the JDBC Provisioning Rule, so we were able to read the attribute from the Provisioning Plan provided by the Create Policy, and then use that for the SQL/Stored Procedure used for updating the Database. However, it looks like there is validation for the “target”/Account Attibute value in the Attribute Sync to the Account Schema record, which was throwing the error.

So the solution for this issue will be the following:

  • Update the field names in the Create Policy to match the Account Schema
  • Remove the old fields
  • Update the JDBC Provisioning Rule. If you have any other JDBC Rules (BuildMap, Before/After Prov, etc, then update those also)
  • retry setting Attribute Sync.

The need for the Create Policy Field Names to Match exactly the Account Schema does not appear to be in the documentation that I found for Attribute Sync or the Connector.

4

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.