SailPoint Identity Fusion Connector

[MattUribe]

I’ve run into an issue where the JavaScript heap ran out of memory during aggregation, and now the connector won’t successfully load accounts. Has anyone else run into this?

We tried re-uploading the connector, as well as just waiting. After 6 hours we still can’t load accounts.

[fernando_delosrios (Fernando de los Rios Sanchez)]

Hi Braden, is this on 1.3.2. or a previous version?

[ashokspi (Ashokvarma Betamcherla)]

@fernando_delosrios or @philip-ellis i am facing 2 issues while working with this connector.

• After requesting the “Fusion Reporter”, “secondsource Reviewer” entitlements access also , i am not getting the emails and even the forms for the duplicate account information from the second source. i have enabled the workflow came from this connector into the tenant. But still not getting emails for the Fusion reports and Form emails … do i need to make any changes on the workflow ?
• i have 2 different schema attribues from sourceA and sourceB and i have discovered everything in the Fusion connector , now in the merging section i have given the technical name of the identity attribute work email as email and account attributes as Email_Address from sourceA and email_address_home from sourceB.. no which one i should use to collect the work email in the Identity profile from fusion connector source attributes list (Email_Address or email_address_home) ?
• unable to find these anywhere in the documentation, this would really help in using this connect for my use case to use fusion connector source to merge and populate unique identities from 2 different sources with different schemas.

[MattUribe]

@ashokspi

I had an issue with the emails and forms not being sent to the reviewer. It turned out that moving from 1.2.x to 1.3.x resolved that for me.

Regarding the schema and the identity profile, if you want to prioritize the emails then you can use a transform with a firstValid to get the email account attribute from one source or the other. Otherwise you can just configure the Fusion connector for that attribute to use First Found, and then map the identity profile to the Identity Fusion account attribute for email.

Hope that helps.

[MattUribe]

I think this is directed to my post about the aggregation not running with error “Another connector instance is running…”

If so, I am using 1.3.0 at the moment. It looked like 1.3.1 resolved the issue with creating the Email Sender workflow, but didn’t add anything else I might need, and I wasn’t aware that there is a 1.3.2 - it looks like it has some interesting updates. (I’m now subscribed to the activity on that repo)

I thought this issue was related to the SaaS Connector framework, so I created a case with Support, and they pointed out the “Reset processing flag in case of unfinished processing” option in the configuration. This must be new in 1.3.x - I believe this is the piece I was missing, as I am now able to successfully aggregate accounts in the Fusion connector.

Thanks!

[ashokspi (Ashokvarma Betamcherla)]

Thanks for the Quick Reply !

i am using 1.3.1 and unable to get any email to the reviewer and also i see an issue that when i aggregated initially from both the sources it created identities and loaded accounts and merged identities directly and when i added duplicate account of source A in the source B and aggregated it generated an Identity Merging form for the user but no workflow execution and form is a drafted one and i am unable to submit it like how it was shown in the documentation or demo.

also when i added a brand-new user to the sourceB and aggregated and tried to aggerated the fusion connector also, but it did not loaded that brand-new identity and in the sourceB it is showing as uncorrelated.

Am i missing something or which version of the connector you want me to use

Thanks.

[MattUribe]

Unless you have a reason not to, I would suggest using the latest version.

As far as sending the review forms, the form gets sent to the person who has the “reviewer” entitlement. If no one has that entitlement, no review form will be sent. The workflow does not need to be enabled, it just gets sent using the test workflow API, is my understanding.

[ashokspi (Ashokvarma Betamcherla)]

@MattUribe Thanks for your response.

I have deleted the old connector and uploaded the latest version connector 1.3.2 version and started creating the source and i did not see the option to enable the provisioning in this new version connector (which i had in my previous version connecter when i installed 1.3.1 and configured the source and had an option on the configuration and it was mentioned like once you you enable it and it can not be reversed).

Also when i create access profiles for the reviewer and fusion report entitlements and submitted a request for my self and they are not going to completed and i an getting Task generated for completing the manual action to provision may be because the provisioning is Disabled.

Also i was not getting the source available in the Identity profile when trying to add the source to get Account enabled in the staging life cycle state created.

Could you please guide me, if i am missing any step after uploading the identity-fusion-1.3.2.zip file through CLI and while configuring the fusion connector.

@philip-ellis Really appreciate your efforts if you can look into this once.

[MattUribe]

Have you been through the livestream?

Duplicate Detection with the SaaS Fusion Connector

Description Can’t seem to eliminate all the duplicate identities in your ISC implementation? Watch @philip-ellis as he demonstrates the newly updated Fusion Connector for Identity Security Cloud. Originally created by @fernando_delosrios, the Fusion Connector utilizes a combination of Forms, Workflows, and Transforms as well as SaaS Connectivity to intelligently identify and resolve duplicate identities in your system. Phil will showcase different features of the connector and demo how to set …

It almost a year ago, but I believe the steps for setting up the connector remain the same. I’m not entirely following what you mean by “enable provisioning”, unless you are referring to the identity profile. I think the video should hopefully make it clear what steps are required, and in what order.

Matt

[MattUribe]

Hello,

I’m enjoying the new feature that allows us to set the batch size in the UI. I’ve set it to 1500 for now, and don’t seem to have any issues. Previously, I tried a larger number and ran into heap space limits. Is there a recommended batch size? Does the number of account attributes impact the recommended batch size?

Thanks

[fernando_delosrios (Fernando de los Rios Sanchez)]

Hi Matt,

This was added on request to allow for gradual ingestion of large numbers of pending accounts, like any live system after the baseline would produce over time. No particular batch size from our end other than whatever you’re comfortable in your situation. It’s more a usability than a performance option. I’d like we found the time to look into your heap space issues. We’d like to know how it could be improved.

Take care.

[ashokspi (Ashokvarma Betamcherla)]

Hi Fernando,

is there anyway i can use “filterString” inside the source to do only certain accounts aggregation instead of loading all of them due to our requirement while merging 2 sources accounts using fusion connector i tried to do it using “filterString”: “!(uniqueID == “SoloWorkday”)” but it loaded all the accounts and ignored the filter it seems. the similar filterstring worked with another source.

[fernando_delosrios (Fernando de los Rios Sanchez)]

Duly noted. I believe that was recently included but I don’t know if you need to implement it in the operation or not. I’ll add filters for the managed accounts sources anyway, because I don’t really know if it makes sense filtering the output, since an account may have been processed as a duplicate and therefore the account output skipped.

Stay tuned.