dependencyValue beteween applications error

IdentityIQ (IIQ) IIQ Discussion and Questions
, , ,
1

Which IIQ version are you inquiring about?

Version 8.1

Share all details related to your problem, including any error messages you may have received.

Hello all,

If the ServiceNow app. has included Active Directory app. as “Application Dependencies” in Provisioning Policies and the Identity Attribute is different, in one hand identificator in another one the SAMA from Active Directory. The error of dependency when I try to refresh an identity is explanied with this differencies in both Identity Attribute?

ServiceNow dependecy:
imagen

Error when I try to refresh the Identity who has ServiceNow and Active Directory:

imagen
imagen1280×71 26.9 KB

Thank you.

2

Hi Luis,
I believe we would need to do some more troubleshooting in order to solve the problem. First let’s try with this questions:

  1. You said exception is thrown by Identity Refresh task:
    1a - Is it failing on all identities or some specific one?
    1b - Which options do you have selected in Refresh Task?
    1c - Did you try to identifiy which part of Identity Refresh process is causing this error? is it provision assignments? is it attribute sync?
  2. Can you please share XMLs of both ServiceNowProd app and Active Directory? (or at least their provisioning policies?)
  3. Do you have any target mappings that might be causing this error?

Br,
Kamil

3 
You said exception is thrown by Identity Refresh task:
1a - Is it failing on all identities or some specific one?

Sometimes works and do not. Not exits a specific identity.

1b - Which options do you have selected in Refresh Task?

<Attributes>
    <Map>
      <entry key="TaskDefinition.runLengthAverage" value="50"/>
      <entry key="checkHistory" value="false"/>
      <entry key="checkPolicies" value="false"/>
      <entry key="correlateEntitlements" value="true"/>
      <entry key="correlateScope" value="false"/>
      <entry key="deleteDormantGroups" value="true"/>
      <entry key="disableManagerLookup" value="false"/>
      <entry key="doManualActions" value="false"/>
      <entry key="enableManualAccountSelection" value="false"/>
      <entry key="enablePartitioning" value="false"/>
      <entry key="excludeInactive" value="false"/>
      <entry key="filterNeedsRefresh" value="false"/>
      <entry key="forceWorkflow" value="false"/>
      <entry key="includeWindowModified" value="false"/>
      <entry key="keepInactiveViolations" value="false"/>
      <entry key="markDormantScopes" value="true"/>
      <entry key="noAutoCreateScopes" value="false"/>
      <entry key="noMaintenanceWindowRetry" value="false"/>
      <entry key="noResetNeedsRefresh" value="false"/>
      <entry key="noRoleDeprovisioning" value="false"/>
      <entry key="processTriggers" value="true"/>
      <entry key="promoteAttributes" value="true"/>
      <entry key="promoteManagedAttributes" value="true"/>
      <entry key="provision" value="true"/>
      <entry key="refreshCompositeApplications" value="true"/>
      <entry key="refreshGroups" value="false"/>
      <entry key="refreshIdentityEntitlements" value="true"/>
      <entry key="refreshManagerStatus" value="true"/>
      <entry key="refreshRoleMetadata" value="true"/>
      <entry key="refreshScorecard" value="true"/>
      <entry key="synchronizeAttributes" value="true"/>
      <entry key="taskCompletionEmailNotify" value="Disabled"/>
      <entry key="taskCompletionEmailRecipients"/>
      <entry key="taskCompletionEmailTemplate"/>
    </Map>

1c - Did you try to identifiy which part of Identity Refresh process is causing this error? is it    provision assignments? is it attribute sync?

It’s full refresh. In a provisioning happen too.

Can you please share XMLs of both ServiceNowProd app and Active Directory? (or at least their provisioning policies?)

I can’t. Isn’t a personal project.

Do you have any target mappings that might be causing this error?

No one can cause dependency error.

Many thanks.

4

Ok so we see you have both provision and synchronizeAttributes set to true - please set one of them to false and check if it happens again. With this we will exclude one part of potential problems.

5

The error happen with “Provision assignments” to true.

6

Ok, then do you have any references in the provisioning policy to other applications?

7

Yes, in SNOW application, I have this:

 <Field displayName="con_prov_policy_servicenow_userID" name="user_name" type="string">
          <AppDependency applicationName="Active Directory" schemaAttributeName="sAMAccountName"/>
 </Field>
8

I’ve been able to reproduce your error in my lab environment and it seems it is thrown whenever AD Provisioning policy is not able to generate sAMAccountName attribute.

Is it possible you have an identity (or more than one) where you try to create SNOW account but the identity does not have some data you use in sAMAccountName field value rule?

9

The SAMA value comes from Identity name field. So isn’t clear why this dependency is a error for some identities.