Role Propagation Task Failed

[Bernardc (Bernard Chiew)]

Which IIQ version are you inquiring about?

8.4

Please share any images or screenshots, if relevant.

Please share any other relevant files that may be required (for example, logs).

[Please insert files here, otherwise delete this section]

Hi Experts,

Recently, I built a custom workflow that allows users to delete entitlements from a quicklink. Below is the high-level backend flow of the entitlement deletion workflow:

1. Gather entitlements to delete
2. Delete entitlements in AD/API application
3. Remove deleted entitlements from the identity cube
4. Run the role propagation task

However, when the workflow reaches the role propagation step, the following error occurs:

errors: [Error(s) reported back from the IQService - Error occurred while connecting to group CN=BernardTest4,CN=Builtin,DC=xxxdemo,DC=info. Failed to connect to the server for CN=BernardTest4,CN=Builtin,DC=xxxdemo,DC=info:There is no such object on the server. 0000208D: NameErr: DSID-03100241, problem 2001 (NO_OBJECT), data 0, best match of: 	'CN=Builtin,DC=xxxdemo,DC=info' . HRESULT:[0x80072030] Possible reasons for failure include a) The Domain Controller is currently not reachable b) The object has either been moved or renamed c) The object has been deleted 
 Please Ensure the data has been aggregated before performing the operation ]

Referring to the logs, it appears that the entitlement is not found. This is expected because provisioning to AD has already deleted the entitlement in AD. However, when testing entitlement deletion using the custom workflow for the API application, it works without any errors even the logic is same.

I am seeking your advice on what could be causing this issue in the workflow and how we can enhance it.

[ryan_toornburg]

H @Bernardc - Try doing a targeted aggregation in the Identity’s AD account before running the Role propagation. This may clear up that error since IIQ will know it has been removed.