PX Policy Fails to Get or Set Account Attributes for Uncorrelated Accounts

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

When configuring a Policy Xpress (PX) policy, attempting to retrieve or update account attributes using the Accounts category functions fails if the target endpoint account is not actively correlated to the Identity Manager / Provisioning user profile.

Environment

Identity Manager 14.x, 15.x

Cause

By design, the Data Elements and Actions under the Accounts category in Policy Xpress only operate on endpoint accounts that are already linked and correlated to the primary user object (the subject of the task). These functions cannot directly query or modify standalone, uncorrelated endpoint accounts.

Resolution

To interact with accounts that are not correlated to the target user, use an alternative data source strategy within your Policy Xpress policy:

1. Use LDAP Query Data Source: Create a Data Element using LDAP Query (located under the Data Sources category) to query the target directory or Provisioning Server directly for the required account information.

2. Use Custom Code / Web Services: If you need to perform write operations (SET actions) on an uncorrelated account, trigger a custom Java execution or invoke an external REST/SOAP endpoint from your PX policy to update the directory object directly.