uprovison fails at prepare provisioning

[Amarnath]

Hello Experts,

We are trying to implement a scenario for HANA user provisioning via a pass(to generic) called from a repository job.

The idea is to fetch all userid’s associated to a business role and provision to HANA system as soon as we connect it to IDM.

So, by default all users associated to particular role will already be created as soon as we connect the same to IDM system. To fulfil this we are using uProvision function to trigger provisioning tasks. But, we see uProvision task is failing in Prepare Provisioning step with below error,

Here is the script what we are trying to use inside a pass,

Source,

SELECT DISTINCT[Auto_Priv].[MSKEY]

FROM

[idmv_vallink_ext_active] AS [Rep_Name]

INNER JOIN [idmv_vallink_ext_active] AS [Entry_Type]

ON (

[Rep_Name].[MSKEY]=[Entry_Type].[MSKEY]

AND [Rep_Name].[mcAttrName]='MX_REPOSITORYNAME'

AND [Rep_Name].[mcSearchValue]='$FUNCTION.uGetRepositoryName()$$'

AND [Entry_Type].[mcAttrName]='MX_ENTRYTYPE'

AND [Entry_Type].[mcSearchValue]='MX_PRIVILEGE')

INNER JOIN [idmv_vallink_ext_active] AS [Auto_Priv]

ON (

CAST([Rep_Name].[MSKEY] AS varchar(10))=[Auto_Priv].[mcSearchValue]

AND [Auto_Priv].[mcAttrName]in ('MX_AUTOPRIVILEGE','MXREF_MX_PRIVILEGE'))

Destination,

Next data entry – provisionIMDBUser

MSKEY %mskey%

function rmda_provisionIMDBUser(userEntry) {

var mskey = userEntry.get("MSKEY");

var idStore = "%$pck.SAP_MASTER_IDS_ID%";

var mskeyvalue = UserFunc.uIS_GetValue(mskey, idStore, "MSKEYVALUE");

var repositoryName = UserFunc.uGetRepositoryName();

var repositoryID = UserFunc.uGetRepositoryID();

var AuditID = uGetAuditID();

var provisionTask = uGetConstant("pck.RMDA_MX_PROVISIONTASK");

uWarning("provisionTask: " + provisionTask);

if (provisionTask == null || provisionTask == "") {

UserFunc.uErrMsg(2, "No 'MX_PROVISIONTASK' defined in repository '" + repositoryName + "'. " + "Cannot initially provision privilege assignments of user '" + mskeyvalue + "' to the repository.");

} else {

// Call the IMDB provisioning task.

UserFunc.uSleep(1);

UserFunc.uWarning("Provisioning privilege assignments of MX_PERSON '" + mskeyvalue + "' (" + mskey + ") to repository '" + repositoryName + "'...");

var result = UserFunc.uProvision(mskey, provisionTask, 0, repositoryID, "INITIALLY PROVISIONED MX_PERSON PRIVILEGES", 0);

//uWarning(result);

return;

}

return "";

}

We are calling standard SAP provided “provision” trigger using “var provisionTask = uGetConstant("pck.RMDA_MX_PROVISIONTASK");” in the job.

Please help me to know if I am doing something wrong or suggest me if there is any better approach to carry out this task.

Regards,

Amarnath

[former_member358098]

We have seen communication with HANA as a huge pain, so if we need to force provision to HANA system we simply use next for attributes

MXREF_MX_PRIVILEGE and MX_AUTOPRIVILEGE

to remove all needed privileges from person

{e}{BYPASS_MEMBER_TASK=1}<%mcothermskeyvalue%>

After privileges are cleared, we run job with uIS_RepairEntry for needed person, and all privileges are assigned according to roles they have.

[Amarnath]

Hello Artem,

Can you please help me with more details for this.

Regards,

Amarnath

[former_member358098]

We have all assignments done via roles, which contain privileges. After role is assigned, person starting to have all privileges of this role (attributes MXREF_MX_PRIVILEGE and MX_AUTOPRIVILEGE). After you will remove privileges directly from person with

{BYPASS_MEMBER_TASK=1} they will not be removed from backend system, but IDM will consider them broken, and if you run uIS_RepairEntry for them they will assign privileges in backend system following the full and correct provisioning rules, which for hana repositories turns out to be very critical.