What is BundleProfileRelationServiceSynchronizer?

IdentityIQ (IIQ) IIQ Discussion and Questions
4

Hi Oleh,
Here’s a detailed breakdown of the BundleProfileRelationServiceSynchronizer, its origin, and purpose:

What is BundleProfileRelationServiceSynchronizer?

BundleProfileRelationServiceSynchronizer is a background thread introduced in IdentityIQ 8.3 as part of a new system component called the Bundle Profile Relation Service, under the Role Management & Analysis feature.

It is responsible for maintaining relationships between Roles (Bundles), their Profiles, and associated entitlements (ManagedAttributes). This service continuously synchronizes internal relationship tables that are used in role mining, analytics, and reporting.

When Was It Introduced?

  • Introduced in IIQ 8.3
  • Enabled by default in IdentityIQ 8.3 and above, including your version (8.4p2)
  • First invoked during upgrade via the Role-Entitlement Associations task, which runs automatically to initialize these mappings

What Does It Do?

The service supports and automates the following:

  1. Initial Mapping
  • On upgrade, the Role-Entitlement Associations task scans all Roles and builds the initial relationships between:
    • Bundle → Profile → Entitlements (ManagedAttributes)
  1. Ongoing Synchronization
  • After the upgrade, the BundleProfileRelationServiceSynchronizer thread runs continuously to:
    • Listen for role/profile change events
    • Incrementally update the relationship tables as bundles are created or modified
  1. Supports Role Analysis Features
  • Powers analytics such as:
    • “Which entitlements does this role include?”
    • “Which roles grant this entitlement?”
  • Enables faster querying and reporting for administrators and business users

Why Are You Seeing Log Messages?

You’re likely seeing INFO or DEBUG-level logs like:

INFO  BundleProfileRelationServiceSynchronizer – Processing X role events

These are expected and do not indicate an error. They simply reflect that the synchronizer is processing role updates in the background.

You would only need to investigate if you saw:

  • ERROR entries (e.g., Context already created for this thread!)
  • Stack traces or performance degradation

Optional Management

While typically no action is needed:

  • You can manually run the Role-Entitlement Associations task if needed (via UI or console)
  • The service can be disabled per server via:
    Go to Administrator Console->Environment, select the gear to the right of a server, on the Services tab, toggle “BundleProfileRelation” service off.

This is not recommended unless there’s a known issue or support request (e.g., ETN IIQSR-802), as disabling it may impact role reporting accuracy.