Troubleshooting Stale Account Property Information - Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

This article explains why Account Properties in Identity Manager may display stale information instead of real-time data from an endpoint, and provides a procedure to resolve this by clearing cached values from the Provisioning Repository.

Environment

Identity Manager 14.5 & 15

Cause

By default, the Provisioning Repository stores minimal information for account reference objects. When a user requests account properties, Identity Manager typically retrieves data in real-time from the endpoint.

However, if account attributes are configured in Custom Correlation Rules or Endpoint Attribute Mappings, these values are cached in the Provisioning Repository. When these mappings exist, the application displays the stored value rather than fetching data from the endpoint. Stale information persists until the next "Explore" operation updates the attribute, or until the cache is manually cleared.

Resolution

Prerequisites and Warnings

• Safety Warning: The following steps interact directly with the Directory Router DSA (port 20391) under the Provisioning Server. Improper use of these commands can cause data corruption. Always take a full backup of the Provisioning Directory before proceeding.
• Assessment: Removing Endpoint Attribute Mappings will stop new stale data from being cached but will not automatically clear existing values in the Provisioning Repository.

Procedure

1. Remove Mappings: Identify and remove the Custom Correlation Rules or Endpoint Attribute Mappings responsible for the cached data.

2. Locate Affected Accounts: Use ldapsearch to identify all account reference objects that contain a value for the specific attribute. Replace the placeholders (IMPS_HOST, PASSWORD, MyEndpoint, MyConnectorType, eTDYN-str-multi-01) with your specific environment details:

   ldapsearch -LLL -h IMPS_HOST -p 20391 -D "eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb" -w PASSWORD -b "eTDYNDirectoryName=MyEndpoint,eTNamespaceName=MyConnectorType,dc=im,dc=etadb" -s sub "(&(objectclass=eTDYNAccount)(eTDYN-str-multi-01=*))" dn > accountlist.ldif

3. Prepare Deletion LDIF: The generated accountlist.ldif file contains the DNs of the affected accounts. Create a new input.ldif file to delete the attribute values for these accounts:

   dn: eTDYNAccountName=user1,eTDYNContainerName=users,eTDYNDirectoryName=MyEndpoint,eTNamespaceName=MyConnectorType,dc=im,dc=etadbchangetype: modifydelete: eTDYN-str-multi-01

4. Apply Changes: Use the ldapmodify command to process the input.ldif file and clear the stale attributes:

   ldapmodify -F -h IMPS_HOST -p 20391 -D "eTDSAContainerName=DSAs,eTNamespaceName=CommonObjects,dc=etadb" -w PASSWORD -f input.ldif

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.