Issues correlating accounts from a source after identity schema change

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hi all,

I’m having a weird issue with correlation on a source. I have a source with accounts in the following format:

login = SUSANO
userName = SUSAN ORTON
accountNumber = 12345

and an Identity schema in the following format (minus several attributes for brevity’s sake):

Username = susan.orton
Display Name = Susan Orton
Name = 2345678

The source has a correlation rule configured as:

Identity Display Name = Account userName

Which should match between Susan Orton and SUSAN ORTON (my understanding is that correlation rules are case-insensitive)

However, I have 79 accounts that come in as uncorrelated and 1 that comes in correlated properly.

From what I’ve read, there are only three reasons an account wouldn’t correlate:

  1. The account wasn’t correlated during a previous aggregation (which is typically resolved by running an unoptimized aggregation, which didn’t work in this case
  2. The account doesn’t match any identities (As shown above, this should not be the case)
  3. The account matches more than one identity

I have confirmed that we don’t have duplicate identities for this user, so #3 shouldn’t be a problem. However, there is something that may be throwing a wrench into this issue.

A few weeks ago, we changed the account schema for our authoritative source to use employeeID instead of preferredName for the Account Name attribute. It looks like this caused all of the “old” identities to get thrown out and new identities created. To that end, I’m trying to recorrelate all of the accounts for our sources so that entitlements are reflected properly. My gut tells me that something in this change is causing this issue, but when I look at it purely from a correlation/account schema/identity schema perspective, it looks correct.

I’ve also tried resetting the accounts for the source entirely and get the same results - 1 correlated account and 79 uncorrelated accounts. I don’t see anything special about the one correlated account, so I’m really at a loss.

I appreciate any pointers and will provide any other info that I can. Thanks!

2

@sbakeraci i think the default correlation which is by default there has cause this .You can try to remove the default correlation and add your correlation logic and re run the unoptimized aggregation

3

I believe just changing Account Name will not cause any problem until and unless we are changing Account ID.

Are you able to find the identities for 79 uncorrelated accounts?

Could you please add one or two more correlation logic with any unique account attributes and run unoptimized aggregation again? If you don’t have any other unique attributes, try with correlation rule.

4

Hello scott,
I had the same problem a few weeks ago, what i did to solvw it is to delete the prevous account correlation, put just the actual correlation config and run the disable optimization via API call

Hope it helps,
Pablo

5

Thanks for the reply! I don’t think I can delete the default correlation rule. My understanding is that the default rule is determined by the account schema and cannot be modified. If there’s a way to do that and you could point me to some documentation, I’ll absolutely give it a shot. Thanks again!

6

Thanks for the reply! I am able to find the other 79 identities that are correlated from our authoritative source. I tried deleting the existing correlation rules and recreating them before running an unoptimized aggregation, but got the same results. Unfortunately we don’t have any other unique attributes to work with for this source, so we’re limited to the user’s display name.

7

Thanks for the reply! I gave this a shot and got the same results as before, sadly, but I appreciate the suggestion!

8

Try this:

  1. From Identities, delete one of the identities that won’t correlate.
  2. Aggregate your authoritative source.
  3. Aggregate your application that wouldn’t correlate as “unoptimized”

This should fix the correlation.

9

Thanks for the reply! I gave this a shot and it’s still not correlating. I had tried deleting and reaggregating the source account, but hadn’t tried the identity itself. Thanks for the suggestion!

10

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.