Attributes are being sent to 'Offline' endpoints

Products

• CA Identity Suite

Issue/Introduction

After enabling Manage Offline Endpoints and marking an endpoint as "Offline", attribute updates, such as First Name, are being sent through Provisioning and making it to the Offline endpoint.    

Environment

Identity Manager 14.x

Resolution

This is working as designed.   

"Offline" endpoint configuration will only prevent updates from being sent to Provisioning and ultimately to the endpoints when all of an Accounts Endpoints are marked as "Offline"

When a users account has more than one endpoint, and at least one of them remains Online in Identity Manager any account changes are pushed from Identity Manager into Provisioning to ensure the Online endpoints are updated.   The Provisioning Server does not have an Offline endpoint option, and will attempt to send updates to all defined endpoints. 

Per the Documentation on Offline Endpoints:

If all the Provisioning Role's endpoints are marked offline, the Provisioning Role's actions will not be sent to the Provisioning Server. A Manual Activity Event is generated for a resubmission action when the endpoints come back online.

If at least one of the Provisioning Role’s endpoint is online, the Provisioning Role's action will be sent to the Provisioning Server. This action allows you to create Accounts on reachable endpoints, but causes a failure for endpoints that are unreachable

 

This means if an Account has an Endpoint that has been manually marked as Offline, but has other Endpoints that are not marked Offline, changes to that account will be sent from Identity Manager to the Provisioning Server which will attempt to update all Endpoints.  If the manually marked 'offline' endpoint is reachable from Provisioning, change will be sent through successfully. 

Additional Information

This is due to the where the "Offline Endpoint" feature lives in a Tasks process Flow.   "Offline Endpoints" are only a concept at the Identity Manager level.   The Provisioning Server does not have an understanding of an endpoint being 'offline' and will attempt to send any changes submitted to it to all endpoints.