IdentityRequest stuck in "Pending" even after all ProvisioningPlan items show Finished/Committed (JDBC Connector, Custom Provisioning Rule)

IdentityIQ (IIQ) IIQ Discussion and Questions
, ,
1

Environment

Screenshot 2026-09-06 170634
Screenshot 2026-09-06 1706341857×212 33.8 KB

  • Product: SailPoint IdentityIQ
  • Connector: JDBC (Oracle)
  • Provisioning: Custom jdbcCreateProvisioningRule (Java rule) handling CREATE + PROFILE + GRANTED_ROLE

Issue Description

After provisioning an Oracle account (with role/entitlement grants) through a custom jdbcCreateProvisioningRule, the Access Request / Identity Request UI shows “Request Pending”, even though:

  1. All individual provisioning plan items show status Finished or Committed:
    • Create → Finished
    • Set PROFILE = Privileged → Committed
    • Add GRANTED_ROLE = AUDIT_ADMIN → Finished
  2. Custom rule logs (via log.error()) confirm successful execution end-to-end:

Rule returns ProvisioningResult with STATUS_COMMITTED set at the end (no exceptions thrown).

What I’ve Verified

  • Provisioning plan items: all Finished/Committed, no Failed items.

  • Rule-level logs: no errors, STATUS_COMMITTED returned.

  • SystemConfiguration: enableOptimisticProvisioning entry confirmed present after server restart.

  • Aggregation: ran manually post-provisioning, no change to request status.

  • Individual AttributeRequest-level status (in Access Request detail) shows Complete for some/all items, but the parent IdentityRequest object never transitions out of Pending.

    How will this status be completed ?

2

@uditsahntl01 could you please execute Perform Identity Request Maintenance task and see if it updates the status.

3

already done

no changes

4

image
image1872×363 57.7 KB

5

hi @uditsahntl01 , please use plan.getNativeidentity() for username in your code while creating the account. it will help the SailPoint to verify the status and complete the request.

6

Most possible reason is there is no proper connection between sailpoint and oracle.
Please try ping and telnet for that port and url.

7

Go to Life Cycle Manager see if check mark the box for “All Application”. If it uncheck IIQ may run provisioning but the request tracking will not be working right way.

8

no luck already did this

9

Hi @uditsahntl01 ,

There could be two cases, maybe check once.

1. Missing Native Identity in Provisioning Result / Plan (Most Common Cause) When creating an account through a custom jdbcCreateProvisioningRule, IdentityIQ anticipates that the returned ProvisioningResult (or ProvisioningPlan) will include the precise nativeIdentity (for instance, the primary key or username that has been inserted into the database). So, make sure that your rule explicitly assigns the nativeIdentity to both the AccountRequest and the ProvisioningResult to avoid any discrepancies and ensure proper functionality:

2. Configure Single Account Aggregation Query (Get Account Query) In order for IIQ to confirm that the provisioned attributes genuinely exist within the system, it will attempt an immediate target lookup or expects that a single account aggregation will align with the native identity. This process is crucial for maintaining the accuracy and integrity of the account provisioning workflow.