Identity Governance to Identity Manager Export Fails to Revoke Provisioning Roles

Products

• CA Identity Governance
• CA Identity Manager

Issue/Introduction

During an export process from Identity Governance to Identity Manager, Provisioning Roles may remain assigned to users in Identity Manager despite being successfully removed in Identity Governance. A key symptom of this issue is the absence of the "Revoke Provisioning role from user" task in the Identity Manager "View Submitted Tasks" console.

Environment

Identity Governance 14.x

Cause

In cluster deployments, export inconsistencies can occur if the Task Management System (TMS) adapter requests are not correctly routed or resolved by individual nodes. This results in the Identity Manager connector failing to trigger the appropriate revocation tasks.

Resolution

To ensure consistent role revocation in a cluster, configure each node to point to its local adapter service.

1. Modify Property: In Identity Governance, locate and update the tms.workflow.url property to the following format: http://[mygovernance-srv]:8082/tmsWPAdapter/xfire/TMSRequestsHandler?wsdl (Replace [mygovernance-srv] with a generic hostname used across the cluster).
2. Update Hosts File: On each Identity Governance node, edit the operating system hosts file. Add an entry for [mygovernance-srv] that points to the node's own local IP address (127.0.0.1 or the specific interface IP).
3. Restart Services: Restart the Identity Governance service on all nodes to apply the changes.