Role Assignment NativeIdentity is not getting changed in Identity xml file once the user account native Identity Updated

Which IIQ version are you inquiring about?

Version 8.4

Share all details related to your problem, including any error messages you may have received.

User is getting the access on the application through role request, once the account is created, we can see the user native identity inside roleAssignments tag and roleDetections.
There is scenario where user native identity is getting changed form IIQ, the native identity changed successfully on target in IIQ.
But we are not seeing the account native identity is not updated roleAssignments tag and roleDetections tag.
After Aggregation / refresh roleDetections native identity is updated with correct native identity.
roleAssignments native identity is not updated, it is having the old value only.
Is anyone see the same behavior, then please let us know what the solution for this ?
Thanks for your help in advance.

Hi @rushi_ambatkar

what is the connector you are using for this requirement ?

Is the native identity getting updated after running aggregation task ?

Thanks
Krish

Hi @KRM7 Thanks for your response, The Connector that i am using is Active Directory.

After Aggregation it is updating the roleDetections native identity but not for the roleAssignments native identity
roleAssignments nativeIdentity is having the old value only.
Value is not getting update.

@rushi_ambatkar

If you are at 8.3p + , you will have a request object with name " Native Identity Change Propagation Request"

Please make sure you have below propagator under accountPropagators , if this is present when you run Account aggregation your Roletarget level Native Identity will be automatically updated

        <Propagator className="sailpoint.api.nativeidentitychange.AccountNativeIdentityChangeIdentityPropagator"/>

Please check below articles for more information

Supporting Active Directory Native Move / Rename (sailpoint.com)

1 Like

@rushi_ambatkar

did you try this, are you able to resolve your issue?

If you try to do this change directly on AD with SP connector user, it works?

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.