Access Policy not provisioning resource Accounts to the User

Asked Oct 07 '16 at 09:44

Active Oct 07 '16 at 09:44

Viewed 1,551 times

I have a role based access policy configured in OIM PS3 environment, Whenever user is provisioned Role 'A' user is entitled to get AD account and viceversa. But this is not happening even after running evaluate user policies job multiple time.

In database when I am checking on Role assignment if the USER_PROVISIONING_ATTRS.POLICY_EVAL_NEEDED is 1 then its showing it right for that user but its not provisioning the accounts to user.

scheduler is returning success all the time.

Post completing the scheduler the USER_PROVISIONING_ATTRS.POLICY_EVAL_NEEDED is 0 and USER_PROVISIONING_ATTRS.POLICY_EVAL_IN_PROGRESS is 0.

Any help will be appreciated.

asked Oct 07 '16 at 09:44

Chaitanya K

1,827
4
32
67

At any time the 'Evaluate User Policies' scheduler had been disabled/enabled? – Kunal Varpe Nov 23 '16 at 09:35
@varpekv No, but earlier it was stuck for few users on bulk load – Chaitanya K Nov 23 '16 at 09:42
Have you interrupted the scheduled job at that time? – Kunal Varpe Nov 23 '16 at 10:05
@varpekv No but as it was taking longer time I scheduled it to run manually instead of periodic. And then for long time we did not used it, but for those users it still not getting evaluated till now. :( – Chaitanya K Nov 23 '16 at 11:21
I was faced similar issue and it was resolved by restarting the OIM server. Can you try this and let me know. – Kunal Varpe Nov 23 '16 at 11:37
No restarting OIM did not resolve it for me :( – Chaitanya K Nov 23 '16 at 11:38
Let us [continue this discussion in chat](http://chat.stackoverflow.com/rooms/128809/discussion-between-varpekv-and-chaitanya-kurdukar). – Kunal Varpe Nov 23 '16 at 11:39
Is there any error in oim_server1-dignostic.log file – Kunal Varpe Nov 24 '16 at 14:59
No errors in the logs but the access policy needs eval in db remains 1 for these users – Chaitanya K Nov 25 '16 at 04:38
Could you please give the values set in your environment for below system properties 'Allows linking of access policies to reconciled and bulk loaded accounts' and 'Allows access policy based provisioning of multiple instances of a resource' – Kunal Varpe Nov 25 '16 at 08:53
Could you please also check the event handlers related to provisioning on the particular day. – Kunal Varpe Nov 25 '16 at 14:02
@varpekv Values set in My environment for below system properties `Allows linking of access policies to reconciled and bulk loaded accounts` and `Allows access policy based provisioning of multiple instances of a resource` has value `FALSE` – Chaitanya K Nov 28 '16 at 12:04
It seems all configurations looks correct, I don't know why it still not working. – Kunal Varpe Dec 07 '16 at 05:50
You should also check the process form attached in access policy,if the information is correct and it is saved properly. – ps2090 Jan 18 '17 at 12:02
@PriyaSharma yes it is there and saved properly :) – Chaitanya K Jan 19 '17 at 03:57
I am having the same issue – Mardin Yadegar Feb 22 '17 at 21:58
Facing same issue. If anyone got solution, please let me know? – Himanshu May 13 '17 at 10:26
Did you check to see if there was an organization conflict? (Is Ad published to the user?) – Berkley Lamb Jun 22 '17 at 19:51
Yes AD is published to the Organization user currently in – Chaitanya K Sep 16 '19 at 08:57

Access Policy not provisioning resource Accounts to the User

0 Answers0