Identity Correlation Issue

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Hello Community,

I’ve encountered an issue that involves an extra space in the “displayname” attribute of an identity. This problem originated from an SQL statement error in the configuration of the HR system application.After fixing the statement, I ran both the HR and AD account aggregation tasks, followed by the identity refresh cube task.

Now, the situation is that I have two identity cubes. One is linked to HR, and the other is associated with AD. Strangely, the identity linked to AD contains only the “displayname” attribute, still retaining the extra space. What I want is to merge these two identities into one.Before discovering the issue with the extra space, the identities were correctly correlated and seamlessly linked to both AD and HR systems, using an attribute-based correlation between AD and the cube “sAMAccountName” = “username”. However, I’m faced with the challenge of merging these identities, and manual consolidation is not feasible, as there are around 1000 identities involved.

Any insights or similar experiences with this issue? I can provide more details on the aggregation options used.

Thank you everyone!

2

I guess you have not enabled the below option in AD Aggregation Task

Only Create links if they can be correlated to an existing identity

That’s why Identities are created from the AD source.

I guess AD app is not Authoritative source, you can run Prune Identity cube Task to remove all the identities that doesn’t have any Authoritative source account.

1 Like
3

It seems that the issue occurred when I ran the HR account aggregation task after correcting the SQL statement, resulting in the creation of new identities, as confirmed in the task results. Surprisingly, running the ‘Prune Identity Cube’ task did not remove the identities with only AD links, even though the HR system is designated as the Authoritative source.
It’s worth mentioning that the option ‘Only create links if they can be correlated to an existing identity’ was enabled when I ran the AD aggregation task.

4

Is it possible to share both your valid identity and wrong identity xmls by removing sensitive information.

1 Like
5

Ok, What is the identity attribute you used in your HR application schema config ? Was the space in that attribute only you correct in SQL ?

1 Like
6

If you change the correlation of the AD Application to the correct one, you can run the Aggregation task again, but than with the option ‘Disable optimization of unchanged accounts’ enabled.
This will process the AD accounts as being new by running all the rules and correlations.

Thereafter you might run the task 'Prune Identity Cubes to clean up the ‘empty’ cubes.

– Remold

2 Likes
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.