Unable to login to IIQ console upon modifying the identity hbm file

IdentityIQ (IIQ) IIQ Discussion and Questions
1

I am using identity IQ 8.5 P1 I am trying to extend my identity object and want to add an extended attribute in my case it it extended12

I am able to login to iiq console before I am modifying the hbm file but I am unable to login the same upon modifying the hbm file.

It is giving me following error

java.lang.IllegalStateException: Authentication Failed
2

@atripathi7 As per error message “java.lang.IllegalStateException: Authentication Failed” is a generic error and may not be directly caused by adding extended12 to the Identity object. If the issue started immediately after modifying the Identity HBM file, You can check the mapping. Make sure extended12 is added correctly in both the Identity object definition and the corresponding HBM mapping.

3

are you able to login through the UI?

Regards
Ankush

4

Hi Abhishek,

Could you please share the steps you followed to extend the Identity object? It will help us better understand your implementation and identify what might be causing the issue.

5

Are you able to login to IIQ Console? This issue arises if the hbm file entries are not made properly, recheck the hbm file to ensure the added entry is as per format.

6

Hello @AbhishekTripathi

IdentityIQ already provides 20 extended attributes (extended1–extended20) out‑of‑the‑box.
You do not need to modify the HBM file to use extended12.
When you edit the HBM file, you break the Hibernate mapping for the Identity object.
During login, IIQ cannot load the Identity record, so authentication fails with java.lang.IllegalStateException: Authentication Failed.

  1. First remove the entry from HBM file
  2. Restart the server and try to login to verify that you can able to login.
  3. The correct approach is to use these extended attributes by adding a additional mapping through Identity Mapping in the UI.
    This automatically updates the Identity mapping internally and avoids any HBM changes. After this change , there is an entry added to the ObjectDefinition:Identity object.
7

Hi @atripathi7

Please provide your hbm file where you have made the changes. There might be a wrong entry in the hbm file.

8

I was able to fix this, the issue was that HBM file had the new attribute added but the entry was yet to be made in the database for the new extended attribute that we enabled from the HBM file.

I ran the following command to generate the database schema:

iiq extendedSchema

Once the database script generated I ran the query to update the database schema for identity attribute, and then tried login to iiq console again and it worked.

I was doing it wrong as I was thinking I need to login to the console first to launch the above command.

Thanks to everyone for their time and efforts in helping resolving this.

9

@MadduriAnil I guess You are wrong here as I can see in the attached link that by default SailPoint gives 10 extended attributes for identity and you can use more by uncommenting them from HBM file and making an entry in Sailpoint database but the maximum allowed is 20 extended attribute you can’t have 21 extended attributes.

If you want more attributes then you need to create named attributes. I am also sharing a community answer for your reference for the same topic. Also sharing a post for different types of attributes for the objects and their usage.