CAIM 14.2 Build 387 - JNDI Endpoint Account Deletion/Deprovisioning Failure

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal

Issue/Introduction

When attempting to delete and/or deprovision an endpoint account via a custom JNDI connector, we are experiencing an issue where the connector returns an error "JNDI: badly behaved endpoint: no response controls returned for support SimplePaging".
When this occurs, the account on the endpoint is actually deleted but the endpoint account reference object in the IMPD remains..
After having encountered this issue, we have deployed the JNDI override 'connector.xml' with ' false ' added to the file, (connector.xml attached).
Testing with this configuration has resulted in a different error:
'(AssocAttributeOpProcessorProxy.java:404) ERROR - class com.ca.jcs.jndi.JNDIMetaConnector: CA ISD [eTDYNDirectoryName=## ISD,eTNamespaceName=## ISD,dc=###,dc=etasa]: class com.ca.jcs.assoc.AssocAttributeOpProcessorProxy: failed proxy call on public abstract void com.ca.jcs.processor.OpProcessor.doDelete(com.ca.jcs.ObjectInfo) throws javax.naming.NamingException DELETE operation was skipped java.lang.ArrayIndexOutOfBoundsException: 1'. Unlike the previous issue, the endpoint account is not deleted.

Environment

Release: 14.x
Component: IDMGR

Cause

This is due to an undocumented change between 12.6 SP2 and 14.2 which added a new parameter to connector.xml.

Resolution

In order for this use case to be configured correctly the following has to be performed:
1. We require a connector.xml file (copy the sample to connector.xml)
2. Due to the directory's usage of dynamic groups we needed to add the property forcePagedResults = false. This allows the dynamic groups to be seen.
3. In order to overcome the delete error, the disableDeleteAssociations block in the (new) connector.xml should be commented out all together.

Additional Information