Fix Correlation Logic NERM

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

Hello,

We are using NERM and I am testing out creating multiple users with the same name. This should evaluate to separate identity cubes in ISC as we only correlate on the unique id (correlation attribute). But it is instead correlating on name natively and all (3) accounts are correlated to a single identity…

image
image1323×582 22.1 KB

correlation logic is simply just id ==

image
image943×498 15.6 KB

I’m guessing the default correlation is the tricky part here as account name on schema == name

image
image784×441 11 KB

I can’t, however, change this setup as it throws the following error:

image
image1271×556 19.2 KB

2

Hi,

Can you try to reset the source and then try to change the correlation logic ?

3

Is this error persistent when changing the Account Name to id?

If you do a reset on the accounts for the NERM connector, does that help to be able to set the account name, then do another non-optimized aggregation…

4

Yea it’s same with id, will test reset.

5

Resetting throws this error:

image
image464×114 4.47 KB

I have changed source-owner..

6

Can you try to manual remove the account from the source and then try to reset ?

7

Hi @Swegmann

You need to appreciate that Correlation from an Authoritative Source has different implications than correlation from a Target Source. An Auth Source has an Identity Profile associated with it to create Identities for un-correlated accounts.

Those Identities (and associated IdentityNow Accounts) take the Name attribute from the Attribute Value marked as Name in the Auth Source and that becomes the default Correlation Rule. This means that the Name Attribute in the Source has a greater requirement for Uniqueness than Target Sources.

If you modify the Name attribute in the Source that will then not match the existing Identity Profile correlation, hence why you can’t just update it.

If this is a Sandbox environment, I recommend creating a new Source Connector having taken this into consideration.

8

Did not work either..

9

Hello Jeremy, thanks for your reply!

The NERM connector is automatically generated via NERM when enabling sync to ISC. I can’t really therefore recreate the connector, as it will just end up with the same schema again, I’m assuming.

10

Hi @Swegmann I’m pretty sure you can create a new one, it will pick the default settings from the template. You should then be able to update the account schema before creating the Identity Profile.

11

Hello Jeremy,

Both identity profile and connector are automatically generatd via NERM

12

If it does (I haven’t experienced that, but NERM does move forward pretty quick; maybe something to do with being marked as an Auth Source) then you should be able to either update the schema before processing the identity profile or delete the identity profile. Potentially, you might just be able to update the schema whenever (I think your connector might have got into a corrupted state) I’m just trying to get you to a clean state, coz your use case should be supported.

13

Thanks Jeremy,

I’ll probably try deleting the source and the idp and start over!

14

Can do, but I would just try adding another one first. Bear in mind NERM is a completely separate product