Error importing identity profile

Identity Security Cloud (ISC) ISC Discussion and Questions
1

I’m using SP import/export API. I have the orchestration working, all objects exported. I can import most objects however IDENTITY_PROFILE objects which returns an error (also having problem with TRIGGER_SUBSCRIPTION objects, but that looks like a different syndrome).

When I try to import an identity profile on its own (as the only object in the import), I get an error saying it couldn’t resolve the corresponding SOURCE objects. But when I add the corresponding SOURCE object to the import (ie two objects in the import), I get an error like:
An error occurred while importing Identity Profile with name 'UoN-HR-Source
That’s all the info I’m getting, so it doesn’t tell me much about what went wrong.

A few things:

  • This is only happening for IDENTITY_PROFILE objects, all the other object types seem to be importing ok, including the corresponding SOURCE object…
  • It’s happening identically with all my SOURCE/IDENTITY_PROFILE pairs.
  • If I just import the IDENTITY_PROFILE, I get an error saying it cannot resolve the SOURCE.
  • If I either import the corresponding SOURCE in the same import, or include a defaultReferences stanza, it doesn’t give the unresolved reference error, but does give this (rather less helpful) error. That is, both those mechanisms seem to resolve the reference, but still get this error.
  • In preview mode, importing just the IDENTITY_PROFILE gives the unresolved reference error, but when I import the SOURCE as well, it doesn’t return any error. That is, preview mode works, but non-preview doesn’t for the same configuration.

The full error response looks like:

{
  "results": {
    "SOURCE": {
      "infos": [],
      "warnings": [],
      "errors": [],
      "importedObjects": [
        {
          "name": "XXX-HR-Source",
          "id": "2c9180848222e8fc01825d17f9d84bed",
          "type": "SOURCE"
        }
      ]
    },
    "IDENTITY_PROFILE": {
      "infos": [],
      "warnings": [],
      "errors": [
        {
          "key": "IDENTITY_PROFILE_IMPORT_FAILED",
          "text": "An error occurred while importing Identity Profile with name 'XXX-HR-Source'",
          "detail": {
            "exceptionMessage": null
          }
        }
      ],
      "importedObjects": []
    }
  }

Is there any way of getting better debugging info? Is there anything different I have to do to import IDENTITY_PROFILE objects?

3

Welcome to the developer community David.

There’s a possible bug at work here, but can you try something first to help narrow down the issue? Try exporting the sources and the identity profiles into separate files. Then, import the sources file first. Once that is complete, then import the identity profile file. See if that produces any errors.

4

Hi Colin. Thanks for the response.

That’s what has been done already, The SOURCE objects have been imported (not operational, haven’t given them passwords yet). When I import just a single corresponding IDENTITY_PROFILE object I get the error:

Unable to resolve reference for object [type: SOURCE, id: XXX, name: UoN-HR-Source [source]]

If I either include the source in the import, or add the defaultReferences stanza then that goes away and I get the error I documented.

The export is from our dev environment into our UAT environment. I have a framework that does a bunch of processing in the middle (environment-specific data, etc), but for testing this issue I’m ensuring that I just export/import essentially the same file (filter the export using the includeTypes then just fix up the tenancy for import).

5

I had the same problem, it turned out that I had an attribute reference from another source which had the old ID in it, I changed that and it processed the import correctly. Maybe resolution errors on attribute sources are not captured correctly.

6

Thanks Jothin.

Yes, I found that my IDENTITY_PROFILE has references to two SOURCE objects. So I tried importing that SOURCE object in the same import as well (so my import now contains one IDENTITY_PROFILE and two SOURCE objects), but same result.

Just to be clear though, the import file contains ids of the source system from which it was exported, not the target that I’m importing into. This seems weird to me, and my first inclination was to strip them out (so we’re not saving env specific data in our VCS) but was told to not do so.

7

@davidloone I believe this to be a bug. I tried exporting and importing a simple identity profile and also get an error. I’m going to raise this to the engineering team for investigation.

8

Thanks Colin. We’re eagerly awaiting some news on this as our deadline to get these imported is nigh.

I notice the v3 import and beta individual create of identity profiles are broken as well (v3 import with an error that looks he same, and beta individual create POST with a HTTP 500 error), is that the same root cause?

9

This all appears to be related, with the root issue being something with the Identity Profiles API and not the SP-Config API. I have alerted the PM and hope to have a response soon.

10

@davidloone This bug is now being tracked by engineering. Work will start later this week.

11

Confirming I also have the exact same issue and tried various things (like stripping IDs etc).

Curiously @davidloone you will find that changing the authoritativeSource reference from (for example)

"authoritativeSource": {
                    "type": "SOURCE",
                    "id": "<id>",
                    "name": "SNOW Role Based Account **[source]**"
                }

to

"authoritativeSource": {
                    "type": "SOURCE",
                    "id": "<id>",
                    "name": "SNOW Role Based Account"
                }

Will remove the misleading SOURCE resolution error. Then you’re just left with the unhelpful null error message.

Very keen @colin_mckibben to hear progress on this as we have 7 profiles with a hundred or so attributes (not all used for each profile, but a lot to configure) and a deadline of yesterday to release our config. I’ll need to manually re-create our profiles which is quite error prone.

Glen.

12

A post was split to a new topic: 403 Error when Importing Identity Profile

13

Hello Colin,

Im facing the same error when I try to import the Identity Profiles in a new tenant. Is the bug fixed?

14

According to the ticket, it should be fixed. If you are still facing issues, please open a support ticket with steps to reproduce the issue.