Pending Value Problem / Attribute Not Being Read

[#1]

Hello fellow experts. I've written something about this problem before. I had hoped that by rebuilding the repository where I'm having my provisioning issue, the problem would be solved but I'm still having the same issue. This leads me to believe it's something inside the provisioning framework or maybe a bug inside IDM itself.

A little background on my environment, I am running IDM v7.2, patch 5 on top of an Oracle database.

I'm trying to write some attribute values back to HCM from IDM. To do this, I used a setup that has been covered in other discussions. Basically, I have a repository that was created as an AS ABAP Application Specific repository referring back to my HCM system and the hook tasks have been manually changed to use the Business Suite tasks.  I have a BAdI setup on HCM's side and ran the initial load to bring the HR_COMMUNICATION privilege over to IDM. This all worked. My test user has an account in HCM and the PRIV_XXX_ONLY and PRIV_SYSTEM_XXX privileges for this repository and has an email address attribute, MX_MAIL_PRIMARY, and an ACCOUNTXXX attribute.

When I attempt to assign the HR_COMMUNICATION privilege for this repository, the pending value that get created doesn't grab the MCVALUE from this person's record in the Identity Store.

This makes no sense to me. The value is clearly there. Why is it not being entered into the pending value entry type for the provisioning framework to process it? Here's the task in question:

I'm at a complete loss on this one. If anyone has any suggestions or paths I could go down to look into this, I'd be eternally grateful. Thanks.

[Steffi_Warnecke]

Hello Brandon,

are changes on the identity itself (like search term or things like this you'd find in the SU01) provisioned to this system? Am I understanding this correctly, that only provisioning of the privilege fails?

My next step would be to have a closer look at that script and test the sql-statements in it via my SQL developer to see, what results those give back.

Regards,

Steffi.

[Former Member]

Once the HR_COMMUNICATION privilege is added to the user, changes on that user's account, in this case an e-mail address, would be provisioned to HCM so that this user's HRIS record would reflect his/her e-mail address.

Problem is, when I attempt to assign the privilege via the UI, after doing all the processing, it comes back "Failed". When you assign a privilege, this creates a pending value and that pending value is the source of information for the job (actually a task) pictured in my last screen shot. When that pending value is created, it should grab the MCATTRNAME of ACCOUNTHCDE210 and the MCVALUE; in the case of my test user that would be TESTINCN (highlighted in the first screen shot).

I setup a task to capture the attributes stored in an MX_PENDING_VALUE entry type upon creation so I could see this for myself as, once a pending value is processed, it's deleted with no record of its existence, much less what it contained. And, exactly as the error messages show, the MCVALUE isn't being added to my pending value even though there clearly *IS* an MCVALUE for this attribute on my user record.

If you want a little more background on this unique IDM to HCM provisioning setup, check out this discussion entry as it's exactly what I'm using:

Also, I can't test the script's SQL statements as it contains none. It is simply checking the pending value to make sure the necessary information is in there so the framework can do it's job. Since it's finding a NULL value where my account name should be, it's skipping the job entirely and failing to add the privilege to my user.