Explaining Provisioning Server Stored Object Associations (Inclusions)

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

This article explains how the Provisioning Server stores associations between objects internally in the Provisioning Repository. Every object in the Provisioning Repository contains a UUID stored in the eTID attribute. These eTID values serve as references to link objects. As objects are deleted and recreated, new UUIDs are generated. Moving data between installations requires accounting for these eTID values, as they may become invalid.

Environment

• Product: Identity Suite (Identity Manager) 14.x, 15.x
• Component: Provisioning Server
• Repository Type: Provisioning Repository

Cause

Object associations are categorized into two methods:

• Non-Inclusion Associations: Relationships stored directly on the object itself (e.g., Global Users, Endpoints, Accounts).
• Inclusion Object Associations: Relationships stored in a distinct third-party "Inclusion Object," which maps a SuperiorClass object to a SubordinateClass object using eTPID and eTCID attributes.

Resolution

Managing Object Associations

Non-Inclusion Associations
The following relationships are managed directly on the object attributes:

• Global Users <-> Provisioning Roles: Managed via the eTRoleDN attribute on the Global User.
• Endpoint <-> Default Account Template: Managed via the eTDefaultPolicyDN attribute on the Endpoint.
• Account <-> Account Template: Managed via the eTPolicyDN attribute on the Account.

Inclusion Object Associations

Inclusion Objects are named using the format eTPID_Value@eTCID_Value. The following relationships utilize this method:

• Account Templates <-> Endpoints
• Global Groups <-> Global Groups
• Global Groups <-> Global Users
• Global Users <-> Accounts
• Provisioning Roles <-> Account Templates
• Provisioning Roles <-> Provisioning Roles

Troubleshooting and FAQ

1. Data Migration Direct export and import are not supported due to dependency on existing eTID values. Before importing objects into a new Provisioning Server, strip existing eTID values. The system will then generate new UUIDs and rebuild the required associations.

2. Decommissioning an Endpoint The correct procedure is to delete the acquired Endpoint object to trigger automatic cleanup. If an endpoint was decommissioned without following this procedure:
   
   

   • Manually delete the endpoint from the Provisioning Repository.
   • Remove any references to the Endpoint from Templates.
   • Remove any "Global Users <-> Accounts" inclusions pointing to that specific endpoint.

 

      3.  Troubleshooting Inaccessible Accounts If accounts cannot be accessed when listing accounts for a Provisioning Global            User, ensure they still exist on the native endpoint system. Run an Explore/Correlate to synchronize the data and      resolve discrepancies.

4. Resolving Orphaned Inclusion Objects If duplicate accounts persist or if Explore/Correlate fails to clear listings, orphaned inclusions referencing invalid eTPID or eTCID values may exist. Manual cleanup is required to locate and delete these specific inclusion objects in the Inclusions container branch of the DIT structure.

Additional Information

4. nclusions reference invalid eTPID or eTCID values. This will require manual clean up to find and delete those inclusion objects.