Identity Governance Missing Essential Workpoint Process

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

When setting up the universe, to include IDM, I saw the following error in the connectivity tab: "The Workpoint adapter is not responding, perform a Workpoint checkup"

 I went to perform the Workpoint checkup and I get this error:

The following message was seen in the logs:

WARN  [com.arjuna.ats.jta] (default task-50) ARJUNA016061: TransactionImple.enlistResource - XAResource.start returned: XAException.XAER_RMERR for < formatId=131077, gtrid_length=29, bqual_length=36, tx_uid=0:ffff0a010097:-58741fa8:5e72d668:321, node_name=1, branch_uid=0:ffff0a010097:-58741fa8:5e72d668:35f, subordinatenodename=null, eis_name=java:/jdbc/WPDS >: javax.transaction.xa.XAException: com.microsoft.sqlserver.jdbc.SQLServerException: Failed to create the XA control connection. Error: "The connection is closed."

When reviewing the WPDS database, there were no tables.

Environment

Release : 14.X

Component : CA IDENTITY SUITE (VIRTUAL APPLIANCE)

Resolution

If you are using a SQL database server, XA Transactions must be enabled prior to installing Identity Governance. 

 

If XA transactions are enabled, but still no tables exists in the WPDS database, ensure you have the correct permissions on the user that is connecting to the database.  Once correct permissions are granted, restart Identity Governance and the tables will be created. 

 

The correct permissions are as follows:

• System Admin (SA) — Required during install if the installer is creating the database.
• Dbo — Required during install if the database administrator manually created the database before install.
• Datareader, Datawriter, BulkAdmin, DDLAdmin — minimum required privileges after installation. 

What if I didn't install with XA transactions and my permissions were incorrect?

 

Perform the following steps to correct the issue:

1. Configure XA transactions on the database side
2. Set the database user as SA. 
3. Once we set the user to SA the WPDS tables will be built successfully. I do recommend restarting Identity Governance.
4. Roll back database permissions to either DBO or datareader, datawriter, BulkAdmin, DDLAdmin

And also to grant permissions to a specific user to participate in distributed transactions with the JDBC driver, add the user to the SqlJDBCXAUser role. Please refers to https://learn.microsoft.com/en-us/sql/connect/jdbc/understanding-xa-transactions?view=sql-server-ver16

Additional Information

Enable XA Transactions: https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-governance/14-3/installing/Install-CA-Identity-Governance-with-JBoss-EAP.html#concept.dita_37b300c2-d957-4e8a-b940-b73ad2cdc359_ConfigureXATransactions

 

Database Permissions for SQL Server: https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-governance/14-3/installing/system-requirements.html#concept.dita_aa68acbff05849b7ec6bb40b4b87aa0ef598fcfc_DatabaseRequirements

 

Understanding XA Transactions: https://docs.microsoft.com/en-us/sql/connect/jdbc/understanding-xa-transactions?view=sql-server-ver15