Troubleshooting Intermittent Policy Xpress (PX) Execution with 'Run Once' Configuration - Identity Manager

Products

• CA Identity Suite
• CA Identity Manager

Issue/Introduction

This article addresses scenarios where Policy Xpress (PX) policies appear to fail or execute intermittently. This behavior is typically related to the "Run Once" configuration option, which prevents a policy from re-executing if it has already triggered for a specific user object.

Environment

Identity Manager 14.5 & 15

Cause

Identity Manager tracks the execution history of PX policies using the imIdentityPolicies (or %IDENTITY_POLICY%) user attribute. This attribute stores a unique reference to each applied policy and action rule in the format: PX.RULE.identityEnv;XX;YY.

• XX: The unique identifier for the PX Policy (mapped from the PX_POLICY table).
• YY: The unique identifier for the specific Action Rule (mapped from the PX_RULE table).

When a policy is configured with "Run Once" enabled, Identity Manager checks this attribute before execution. If the reference exists, the policy is skipped.

Resolution

Troubleshooting Steps

1. Verify Configuration: Confirm if the PX Policy has the Run Once checkbox enabled on the Profile tab. If policies must trigger every time criteria are met, this setting should be disabled.

2. Evaluate Current Attribute Values: If you must force re-execution for a user without changing the global policy, you can modify the user's %IDENTITY_POLICY% value. Remove the specific PX.RULE.identityEnv;XX;YY entry corresponding to the policy in question.

3. Strategic Policy Design:

   • Policy Types: When possible, utilize PX Policy types UI or Submitted Task.
   • Constraint: Only utilize the Event policy type if the business requirement cannot be satisfied by the UI or Submitted Task types, as Event policies can have complex execution lifecycles.

Understanding "Run Once"

The "Run Once" configuration determines whether action rules that have previously executed are permitted to run again.

• Scenario A (Run Once Enabled): Use for tasks that should only occur once (e.g., adding a specific department-based role to a user).
• Scenario B (Run Once Disabled): Use for tasks where data accuracy is critical (e.g., setting a salary level based on a job title), ensuring the policy triggers every time the underlying data changes.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.