Cannot synchronize Email Quota in Exchange provisioning connector

Products

• CA Identity Manager

Issue/Introduction

We want email quota values from Active Directory account template to be propagated to AD/exchange account during synchronization.

We have the following values in the account template:

eTADSmDBUseDefaults: FALSE
eTADSmDBStorageQuota: 102456
eTADSmDBOverQuotaLimit: 102456
eTADSmDBOverHardQuotaLimit: 102456

When we use this account template to create a new user, it works fine.

However, when we try to assign this account template (via a provisioning role) to existing account and synchronize, that account still have default quota values.

Environment

Release : 12.x, 14.x

Component : IDENTITY MANAGER, IDENTITY SUITE

Cause

When synchronizing an account template with an account using weak synchronization, IM provisioning server considers which value is "better": template value or account value.

"Better" value then is assigned to account attribute.

An account has eTADSmDBUseDefaults=TRUE (it has default quota values). Other quota attributes have 0 value.

eTADSmDBUseDefaults attribute is boolean, and TRUE value is considered to be "better".

For integer values like eTADSmDBStorageQuota bigger value is "better".

So resulting values for account will be:

eTADSmDBUseDefaults: TRUE  (it's better than FALSE)
eTADSmDBStorageQuota: 102456  (it's better than 0)
eTADSmDBOverQuotaLimit: 102456
eTADSmDBOverHardQuotaLimit: 102456

When those values are sent to AD/Exchange system eTADSmDBUseDefaults=TRUE prevails over other quota values, and the result is default quotas for AD/Exchange account.

Resolution

Use strong synchronization in account template.

Please note that if a provisioning role has more than one account template associated with the same AD endpoint, you need to ensure that all such account templates have eTADSmDBUseDefaults=FALSE value, otherwise even strong sync won't work.