ISC Identitynow how to reprocess failed access profile

Identity Security Cloud (ISC) ISC Discussion and Questions
, ,
1

Hi, can anyone please suggest me how can we reprocess automated user addition to access profile. Here is the scenario I have - I am using one web service connector where I am using rest api to connect to target system to create accounts. Sometimes due to network issue when Sailpoint is not able to establish connection, create account process from webservice source failed with following error:

[“com.sailpoint.connector.source.SourceNotReachableException: Source SP-sourcename [source] is not reachable, diagnostics: {“connector”:“web-services-angularsc”,“status”:“SOURCE_STATE_FAILURE_SOURCE”,“healthy”:false,“healthcheckDisabled”:false,“healthcheckCount”:32,“lastHealthcheck”:1784176978146,“statusChanged”:1784065688769}”]

in user profile event, we see these events as failed

Add Entitlement Failed
Create Account Failed
Request Access Started
Add Role Passed

could you please how to handle this scenario.

2

Hi @hranjan3

If this is just a temporary blip in connectivity, I would pursue the out of the box Retry Errors that are configurable on your web services connector.

Here is an example PATCH call that I would make to your web services source:

[
    {
        "op": "add",
        "path": "/connectorAttributes/retryableErrors",
        "value": [
            "SourceNotReachableException",
            "is not reachable",
            "Read time out",
            "Connection reset"
        ]
    },
    {
        "op": "add",
        "path": "/connectorAttributes/provisioningMaxRetries",
        "value": "5"
    },
    {
       "op": "add",
       "path": "/connectorAttributes/retryWaitTime",
       "value": "20000"
     }
3

Hi @hranjan3

I see the event you have mentioned states the access profile was assigned via role. If that is the case, you could try either process identity button or Run single account aggregation for that account (generally faster) , So ISC can do its automatic reprocessing of the role.

If the access is not assigned via role and was assigned by Access profiles , then it is bit tricky as i am not sure ISC will automatically retry it. May be you can try to request the access profile again if they are not assigned.

I hope this helps.

Regards

Vikas.

4

Hello Himanshu. Since the role assignment passed, the identity already has the role. ISC just never got to create the account because the source was unavailable at that moment.

You can try Process Identity after the source is healthy again, but I wouldn’t depend on it here. SailPoint’s identity processing docs confirm it recalculates identity data and role membership, but it doesn’t verify whether access from an existing role was actually provisioned successfully.

For the requests already marked Failed, the reliable option is to remove the role and assign it again. That creates a fresh provisioning request and should trigger the account creation properly.

For future failures, @trettkowski retryableErrors suggestion is the right fix. Once the connectivity error is configured as retryable, ISC will automatically retry it once per hour, up to three times.