Assignment OK, but assignment status failed.

[Former Member]

Hello experts,

I have implemented the approval workflow which was working smooth. But today when I have done an assignment, it went for approval and after the approver has approved the assignment request, it triggered a mail saying assignment has approve( as we configured). But the status of the assignment is Failed. I am confused here. This happened in production. Can you please tell me were to check the root cause of this assignment failure. Please find below the relavant screenshots.

[ChrisPS]

Hello Krishna,

                     check if any of the privileges assigned to the role have failed. Look up the users

role/privilege assignments in the web UI and run an advanced search and look for all assignments. There maybe a failed privilege assignment causing this.

Thanks,

Chris

[Former Member]

Hi Christopher,

I have checked as you suggested. Yes there is one privilege assignment that got failed. We are doing assignment of 7 privileges together separated with | . out of 7, first 4 got assigned, 5th one (the PRIV:CSAD:ONLY) failed and the other two are in pending state.

How can I find why this privilege assignment has failed.  Can you please provide the pointers on the same.

[Former Member]

Hi Christopher.

I have checked the system. There is  privilege <PRIV:CHCSAD:ONLY> when assigned, it will run the AD provisioning jobs and user will be created in Active directory. But for the User I have created. there is already an entry in active directory. So this privilege assignment has failed.

How can I assign this privilege in IDM now, without triggering the create AD user task ( since this particular ID is already existing). Can you please help. I have to assign this privilege as this is a master privilege for the other privielges.

Thanks,

Krishna.

[ChrisPS]

Hello Krishnu,

                      check the create user hook task job log and see if there are any failures for this assignment. You maybe able to run a force restart however you say that the user already exists on the AD directory which suggests that the master privilege assignment created the user in the AD before it failed.

In SP8 there will be a new tool to allow retry of privileges if you cannot do this via the UI.

Thanks,

Chris

[Former Member]

Hi Christopher,

If I remove the privilege and re-assign, now the create user task fails with an error "Entry already exists" and the privilege assignment goes to failed status. How can I make the status of this privilege as OK, so that the child privileges can get processed. Since this privilege PRIV:CHCSAD:ONLY is the master privilege of other two privileges, they are in pending status. Could you please suggest how can I make the status of the privilege PRIV:CHCSAD:ONLY to Success/OK.

Thanks,

Krishna.

[ChrisPS]

Hi Krishna,

                which release are you currently running in this case ?

Thanks,

Chris

[Former Member]

Hi Chris,

We are currently on 7.2 SP7

Thanks,

Krishna.

[ChrisPS]

Hi Krishna - can you open an OSS ticket and I will pick it up.

Thanks,

Chris

[Former Member]

Hi,

If the users will always exist in Active Directory, and IdM should not create them, but know about them, then you can use the Inital Load jobs as templates to build update jobs to load the AD users into identities in IdM, either new identities or link them to an existing one based on matching and AD attribute to MSKEYVALUE in IdM.

Hope that helps, if not I'm sure will look after you via an OSS message.

Good luck,

Ian

[Former Member]

Hi Chris,

Have raised a OSS. 0000586868 2013. Please take it up.

Thanks,

Krishna.

[Former Member]

Hello Chris,

Thanks for providing the objects for Repairing failed assignments feature. Intially when I tried with that I was not able to resolve.

But finally this weekend I was able to fix this with the solution you have suggested.

Thanks,

Krishna.