Symantec VIP Users are not being deleted from the VIP manager cloud during an LDAP SYNC

Products

• VIP Service

Issue/Introduction

During a VIP Enterprise Gateway LDAP sync, users that do not satisfy the LDAP filters are not being removed from the user store in the cloud.

 

Environment

VIP Enterprise Gateway

Resolution

An LDAP sync job deletes users from the VIP Cloud when:

• The user belongs to a Synchronization Cluster group that matches the VIP Enterprise Gateway performing the LDAP Sync.
• The user is no longer a member of any user store. 

Warning: Always run an LDAP simulation when making user store adjustments. The simulation.log will reveal what changes would have happened had it been an actual LDAP sync. 

Example 1:  JOHN_DOE logs into your organization's VIP self-service portal and is automatically created in the VIP Cloud after satisfying the user store filter settings. When the next LDAP Sync occurs, JOHN_DOE is UPDATED in the cloud with the Synchronization Cluster name of that VIP EG instance. Later, JOHN_DOE is removed from AD and no longer a member of any of the VIP EG user store(s). During the next LDAP Sync, JOHN_DOE is seen in the cloud with the same Synchronization Cluster name, and JOHN_DOE is deleted because he is not a member of any user store on that VIP EG.

Example 2:  JANE_DOE is created manually in VIP Manager by your helpdesk. When the next LDAP Sync occurs, JANE_DOE is seen in the VIP cloud but not in LDAP because she isn't a member of any User Store filters. JANE_DOE will not be UPDATED with a Synchronization Cluster group attribute, and therefore cannot be DELETED by future LDAP syncs. JANE_DOE is referred to as an 'orphan' VIP user. To delete this user through LDAP sync, the User Store filters need to be adjusted so the LDAP sync can UPDATE her with a Synchronization Cluster attribute. When JANE_DOE is no longer satisfies the LDAP filter, she will be DELETED (when she no longer satisfies the filter), or manually deleted from VIP Manager. Alternatively, the user can be deleted manually from VIP Manager or by VIP support. 

The VIP Synchronization Cluster for each user in the cloud can be seen in the \VIP_Enterprise_Gateway\LdapSync\services\ldapSync\logs\service.log and \VIP_Enterprise_Gateway\LdapSync\services\ldapSync\logs\simulation.log when the LDAP service log level is set to DEBUG. The Synchronization Cluster attribute name is _guid.