Acquiring multiple instances of the same Endpoint System Not Recommended

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

Acquiring multiple instances of the same endpoint system is not recommended as it can lead to errors or unexpected/undesired results when accessing the endpoint objects or propagating values down to the provisioning user's associated endpoint accounts.

Environment

All versions of Identity Manager

Cause

In Identity Manager, managing an endpoint system involves acquiring and exploring the endpoint system in order to bring in the managed objects of that endpoint system (i.e. accounts, groups, etc). All of these objects will be created and stored in the Provisioning Repository datastore. Additional inclusion objects will also exist linking some of those objects to other objects (i.e. provisioning global users to endpoint accounts).

When there are multiple instances of the endpoint managed in the same IM installation or across different IM installations there could be times where objects are deleted/renamed/moved via one acquired endpoint instance which would cause other endpoint instances to be unaware of the changes. This can also happen if changes are done to an endpoint outside of the IM system managing the endpoint. The results could be errors related to No Such Object.

To counteract this you could run periodic Explore and Correlates of the managed endpoint systems in order to retrieve a new view of the objects on the endpoint in order to update the Provisioning Repository.

However if the same endpoint was acquired, explored, and correlated multiple times in the same IM installation this would also cause the provisioning global user to be linked to the same account multiple times. That would mean that data would get pushed down to the same account multiple times via each endpoint instance and this in turn could lead to errors or unexpected/undesired results as well.

Resolution

Clean up of the IM environment by removing any duplicated endpoints, endpoint objects (accounts, groups, etc), and/or inclusion objects referencing those objects.

Additional Information

https://knowledge.broadcom.com/external/article?articleId=36124