Identity Manager: Revoked Access Roles Not Syncing Across Cluster Nodes

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

In clustered Identity Manager environments, removing a user role on one node may not reflect immediately on other cluster nodes. This results in the user profile displaying outdated role information, as the node that submitted the change fails to propagate the update to the rest of the cluster.

Environment

Identity Manager

Cause

The synchronization failure is typically caused by an improper network binding configuration. When the application server is bound to 0.0.0.0, it may fail to communicate the state changes correctly across the specific network interface designated for cluster traffic, leading to inconsistent user profiles.

Resolution

To ensure consistent role synchronization across all cluster nodes, update the BIND_ADDRESS configuration on every node:

1. Locate Configuration: Navigate to the appserver_home/bin/ directory on each cluster node.
2. Edit Configuration: Open the appropriate script for your operating system:
   • Linux: standalone.sh
   • Windows: standalone.bat
3. Update Binding: Locate the line BIND_ADDRESS=0.0.0.0 and update it to the specific IP address of the machine:
   • Example: BIND_ADDRESS=192.168.1.10
4. Configure Network Stack (Optional): If your environment requires specific IP protocols, uncomment one of the following lines based on your network architecture:
   • IPv6 Only: REM set "IDM_OPTS=%IDM_OPTS% -Djava.net.preferIPv6Addresses=true"
   • IPv6 and IPv4: REM set "IDM_OPTS=%IDM_OPTS% -Djava.net.preferIPv4Stack=true"
5. Restart Services: Save the file and restart your application server for the changes to take effect.