Siteminder Error " Required parent missing" when running XPSTools

Products

• SITEMINDER

Issue/Introduction

When running XPS Tools (e.g. XPSSweeper, XPSExport, XPSImport, XPSExplorer, etc)  the XPS tools all do validation on the Policy Store data.  In the case of XPSImport, validation is run against the target policy store data and the data in the exported <policystore>.xml file. 

You may encounter an error indicating that one or more objects have become orphaned and is missing its parent

<Parent>.<ID>.<ObjectClass>@<RID> (<Object_Name>): Required parent missing.

EXAMPLE:

CA.SM::UserPolicy@xx-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx(<Object_Name>): Required parent missing.

Environment

PRODUCT: Siteminder

COMPONENT: Policy Server

VERSION: Any

OPERATING SYSTEM: Any

POLICY STORE: Any

Cause

The object referenced in the error has become orphaned.   Either the value of the Parent attribute is empty, or it's pointing to an XML Identifier (XID) which does not exist in the Policy Store.  

If you run XPSExplorer and search for the XID.  It will likely return an object similar to this (below).

==============================================================

------------------------- Object Meta Data ------------------------
         XID: CA.SM::UserPolicy@xx-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
Actual Class: CA.SM::UserPolicy
Base Class: CA.SM::UserPolicy
Parent: <***> [CA.SM::Policy]
In Cache: yes 4
     Created: 2024-08-07 22:19:54 GMT
Last Updated: 2024-08-07 22:19:54 GMT
         By: XPSDictionary::Import (via Internal)

 HidingMask:1(0x1): GUI
---------------- Attributes from CA.SM::UserPolicy ----------------
    DomainLink                      = CA.SM::Domain@xx-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
    FilterClass                     = "organizationalUnit"
    FilterPath                      = "ou=<OU_Name>,o=<Domain>,c=<top>"
    PolicyFlags                     = 0(0x0): Default
    PolicyResolution                = <Org>
    UserDirectoryLink               = CA.SM::UserDirectory@xx-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

==============================================================

 

When the Policy Server detects a corrupt object, it marks it with HidingMask = 1.  This will prevent it from being displayed in the Siteminder AdminUI.  The validation process for XPSExport will also prevent orphaned objects from being exported.  The export will likely complete, however the orphaned objects will not be copied into the policy store export .xml file.

The 'Parent' attribute would normally be populated with the XID of the parent object along with the object class the parent object should be.  In the case of a UserPolicy object, then parent is a member of the  'Policy' Object Class.

XPSSweeper -a does not typically have a solution for this issue, therefore it needs to be fixed manually.

Resolution

Determine if the parent object exists in the Policy Store.  Often, the parent object has been re-created.  In the case of our example, we may find a new Policy and User Policy created in the system.  The object may be one that belongs to a Domain or EPM application is known to be removed from the system.

You cannot add the parent XID to the orphaned object using XPSExplorer.  

Most likely the solution is to delete the orphaned object from the Policy Store using XPSExplorer.