Siebel Account Sync issue with Identity Manager

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

User Case

When an user is moved from one department to other, Provisioning Roles(Siebel entitlements)should be changed for the user.

Issue

When the user modification operation is performed, the Roles are successfully interchanged but the Account sync has some discrepancies.

1. Positions from Old Account Template of Siebel are not Removed

2. Organization from Old Account Template of Siebel are not Removed

3. Primary Responsibility,Position and Organization are not set as per the New Account Template (Provisioning Role).

Issue Identification

The provisioning server ETA logs do not record any failures but they do show items as unchanged (example below)

20190820:163525:TID=1fbb70:Modify    :E157:----:F:+d successfully: (accounts updated: 0, unchanged: 2, failures: 0)

Environment

Release : 14.x

Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

Cause

This is a Weak Sync issue (see the product documentation for more information - link below). 

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-manager/14-5/administrating/managed-endpoints-and-provisioning/managed-endpoint-accounts/synchronize-users-account-templates-and-roles/synchronize-user-with-account-templates.html

 

"Weak Synchronization" (extract).

 

Weak synchronization ensures that users have the minimum capability attributes for their accounts. Weak synchronization is the default in most endpoint types. If you update a template that uses weak synchronization, CA IdentityMinder updates capability attributes.

 

Note: When propagating from a weak synchronization account template, changes that would remove or lower capabilities could leave some accounts unsynchronized. Remember that with weak synchronization, capabilities are never removed or lowered. Without consulting other templates for an account, the propagation does not consider if weak synchronization is sufficient. 

Resolution

With strong sync, the positions are getting removed as intended.