AD User not provisioning Instantly after reconciliation

Hi,
I have created an access policy for 'ALL USERS' in OIM to assign AD User resource automatically to every OIM user that is created. However, when a new user is created after reconciliation, AD User is not provisioned instantly to the OIM user, but when I assign any other resource to the user it provisions AD User at that time. I want that AD User account should be provisioned instantly after reconciliation, the moment at which the user is created. Is there any property that needs to be set?
I am using OIM 11.1.1.5 and using DBAT for user trusted source reconciliation.
Urgent response will be very helpful.
Thanks.
UZ

You have to run "Evaluate User Policy" OOTB scheduled job to make it happen. There is no such property but you have to depend on this scheduled job. Do one thing schedule this job after trusted recon. or increase the frequency like hourly

Similar Messages

Users not provisioned from OIM to OID groups

I've created an Access policy such that when i create a user with role as consultant he is automatically provisioned to OID resource and OID group( cn=group1,cn=groups,dc=ad,dc=company,dc=com ).
The user is provisioned to OID users(cn=users) but not to cn=group1,cn=group....
What could be wrong?
i have run the OID group lookup tasks to generate freshly added group lookups. Theses lookups are populated in process form when i create an access policy.
For ex the lookup generated is cn=group1,cn=group,dc=ad,dc=company,dc=com and the decode value is group1
The user profile and process form are not linked. That means changes in process form are not reflected to user profile. Can this be possible reason for the hassle defined above
please help me resolve this issue.
Edited by: Chhavi Saluja on Feb 15, 2010 1:30 AM

Hi,
Today I have also done the same thing of auto provisioning of OID through access policy. Only difference is that for selecting "Container DN" and "User group" we have created two user defined fields(lookup)in the user form which will refer to the lookups "Lookup.OID.Organization" and "Lookup.OID.Group" for inputs.These lookups are already reconciled once from OID.
As far as "container DN" iam successful but while selecting "user group" iam able to select and when i click on "create user" user is getting provisioned to OID into Container DN i specified.But user is not going into that particular group i specified.Iam assuming the reason is that as User Group is a mutivalued attribute and if we observe the process form of group selection we will see the add button. But on user form we dont have the option of child form to ADD/REMOVE the groups.
Someone pls suggest how to proceed further on this.How do i push the user into particular group/groups from the create user form itself?

Users not provisioned to SAP

While creation we used to provision the user to AD and SAP resource. but now while creation through on screen or scheduler users are provisioned only to AD. We are unable to trace the cause.Can any one help me out.

There can be a number of reasons why you have this problem.
Lets start by trying to narrow things down a bit. Do you have debug level logs enabled? If so what does the logs say?
Best regards
/M

OIM 11gR2 user not provisioning to Active Directory (11.1.1.5 connector)

Hello all,
I'm trying to set up an OIM 11gR2 instance to work with Active Directory with the Active Directory 11.1.1.5.0 connector. I've full installed both OIM and AD on separate servers, and I've installed the AD 11.1.1.5 connector on OIM. I have configured Active Directory properly (connector on OIM and the connector server on the AD server-side), and have set up the two IT Resources on OIM. I can run, for example, the Active Directory Organization Lookup Recon job and have it return results in the Lookup window.
My problem is that I cannot get it to provision to a user. I've created an Application Instance and Form for Active Directory, attached the Form, associated them with the appropriate resources (AD User), and added them to the Catalog, and then gone through the process of adding an account to the user, selecting the Application Instance, adding it to the cart, checking out, filling out the fields (Password, User ID, UPN, First Name, Last Name, Common Name, and Organization Name), and then submitting the request. This is all done as the xelsysadm admin user, but it still results with the account stuck on "Provisioning" because the "Create User" task failed due to a Connector Error (the reason stated is just a repeat of "Create Object" failed).
Anyone know what I'm missing here?
Thank you!
Edited by: 939908 on Nov 12, 2012 6:36 AM

Hey 833249, thanks for your reply
The organization field attribute is filled in correctly, in that the OU I selected exists in AD.
These are the errors listed in the connector server log:
+11/9/2012 9:07:07 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception occured during the creation of directory entry.+
+11/9/2012 9:07:07 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception Message : Logon failure: unknown user name or bad password.+
+11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception Stack Trace : at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)+
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_NativeObject()
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.GetDirectoryEntry(String path, ActiveDirectoryConfiguration configuration) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1423
+11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryConnector Method -> Create, Message -> Encountered Excetion: Unable to get the Directory Entry+
+11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryConnector Method -> Create, Message -> Stack Trace: at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.GetDirectoryEntry(String path, ActiveDirectoryConfiguration configuration) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1456+
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.DirectoryEntryExists(String path) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1512
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryConnector.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryConnector.cs:line 219
ConnectorServer.exe Error: 0 : Org.IdentityConnectors.Framework.Common.Exceptions.ConnectorException: Unable to get the Directory Entry
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryConnector.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryConnector.cs:line 368
at Org.IdentityConnectors.Framework.Impl.Api.Local.Operations.CreateImpl.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\ApiLocalOperations.cs:line 388
at Org.IdentityConnectors.Framework.Impl.Api.Local.Operations.ConnectorAPIOperationRunnerProxy.Invoke(Object proxy, MethodInfo method, Object[] args) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\ApiLocalOperations.cs:line 244
at ___proxy1.Create(ObjectClass , ICollection`1 , OperationOptions )
at Org.IdentityConnectors.Framework.Impl.Server.ConnectionProcessor.ProcessOperationRequest(OperationRequest request) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\Server.cs:line 609
I'm not sure why the username/password error could be occurring, as those fields in the AD IT Resource are correct (I've run AD recon jobs that have connected properly). Is there something I'm missing?

Migrated user not showing up after migration assistant.

I had to reformat my hardrive on iMac. When I did I installed Mountain Lion instead of Lion which was on it previously. I migrated all files/user id from Time Machine using the Migration Assistant. But now I can't see my old user at login or in User's and Groups. The files are there but I can't access them without being able to login or at least give my new user permission.
How can I get to the old user?
I enabled Root User and there seems to be an "unknown user". After this an option to log into "other" user came up at log in, but my attempts at a password and name to log in failed. This "other" user and the "unknown user" are NOT showing in Users and Groups.
Please help!

We don't recommend to use Migration Assistant because it sometimes fails, like in this case.
If you don't want problems, go with the long way: erase the drive, reinstall OS X and restore the backup during Setup Assistant:
1. Hold Command and R keys while your Mac is starting to start up into Recovery, and open Disk Utility.
2. Select Macintosh HD in the sidebar (or your OS X partition), go to Erase tab and erase the drive.
3. Close Disk Utility and reinstall OS X.
4. When the installation finishes, Setup Assistant will show up, so follow its steps. It will ask you to restore data from a backup or another backup, so plug your Time Machine backup to the Mac (or a Mac) and follow the steps. The only user will contain the transferred data.
If you want more information about Setup Assistant > http://pondini.org/OSX/SetupLion.html

Users not provisioned from OIM to OID user group child form

I have created 3 fields in UserForm named Application1, Application2 and Application3.All are textfield. Now I have a field in Process form in child table name Applications which is a lookup type and a multivalue attribute. Now the requirement is that whenever a user gets some value in UF for any application (Application 1, 2 or 3), the field Applications in PF should get auto populated by that application value.
Applications lookup in Process Form has already all the applications1, 2 and 3 in the lookup code and decode value.

In your adapter, read all the values from UDF (User Form)
If value is not equal to NULL then use tcFormInstanceOpetaionsIntf API to add values in Process Form.
http://otndnld.oracle.co.jp/document/products/id_mgmt/idm_903/doc_cd/javadocs/operations/Thor/API/Operations/tcFormInstanceOperationsIntf.html#addProcessFormChildData%28long,%20long,%20java.util.Map%29

When i sign out of imessage, and then sign back in, all the messages i received during my time away, are not there instantly. help?

when i sign out of imessage, and then sign back in, all the messages i received during my time away, are not there instantly after i sign back in. help?

hi,
Mac, iPhone, iPad, iPod Touch ?
Do they appear eventually ?
The iMessages are "pushed" to the devices which means there can be small delays between the server recognising the device went Off Line and coming back.
10:19 pm Thursday; July 10, 2014
 iMac 2.5Ghz i5 2011 (Mavericks 10.9)
 G4/1GhzDual MDD (Leopard 10.5.8)
 MacBookPro 2Gb (Snow Leopard 10.6.8)
 Mac OS X (10.6.8),
 Couple of iPhones and an iPad

Access Policy is not getting trigggered after creation of user through GTC

Hi,
I have an access policy for ALL USER role and that provision users to an RO after getting created in oim. I have a trusted source flat file reconciliation GTC for user creation. I am facing issue when user is getting created through GTC, access policy is not getting triggered. But while creating an user through web console the same access policy is working fine and user is getting provisioned with RO.
If anybody have any idea how to resolve this, please help me in this regards.
Regards,
Avijit

Hi ,
its good to know that its working. As per my experience it works for once (through reconciliation) but then stops working. Now to confirm try to revoke the user by changing the group member-ship through reconciliation and see if the resource is revoked or not (repeat it for 2 -3 times). Note that don't do it form within IDM web admin console, do it through reconciliation.
do post your results.......
Regards.

Reconciliation does not provision??

According to what I have read from a doc:
Reconciliation only updates Identity Manager
users and the account index; it does not fetch or
provision other resource accounts for
performance reasons.
I don't quite get it. If I have an authoritative resource A, and I have a manage resource B. During the reconciliation, if user1 is detected in resource A, and that that user1 does not exist in resource B, I surely want reconciliation to create a user1 in resource B for me, apart from creation in Lighthouse.
I thought IDM is a provisioning application, why does it not provision in the above case?
And what should I do to overcome the problem above?

There is a way to solve your problem.
You have to modify the user form you use to have as default value for the assigned resources - roles the resources - roles you want to assign the user, in order to make the provision.
Create a demo administrator and attach that form to the demo administrator in order to be able to test the form.
Then you have two options, either you can use the load from resource method and then you have first to specify to use the form you just modified and then the "Update Accounts" checkbox to be checked and it will work for you fine.
/the second way to do automatic provision is vi reconciliation but you have to modify the reconciliation policy ( general or resource specific it depentds from your needs ) to use as proxy user the administrator you just created, then your forms will be used and again the automatic provision will be fine.
For more details on how to modify - create forms you can read the apropriate documentation.

LiveLinkException [HR#10049]: User is not provisioned for this operation

Hi,
I installed EAL 11.1.1.4.000 on win2008 R2 64bit Japanese OS.
But I met an issue after successful added Analytics Link Server node.
When Adding bridge components to an Analytics Link Server, the error message said as:
"Financial Management Server cannot be added: User is not provisioned for this operation"
and the EAL.log shows:
"LiveLinkException [HR#10049]: User is not provisioned for this operation"
Does it means I did the wrong setting when configure EAL?
Thanks

Have you set up the correct provisioning for the user in Shared Services?
Cheers
John
http://john-goodwin.blogspot.com/

Why can I not disable the guest user in the 10.8.2 update? I have never enabled the guest user, but after the update, it was automatically enabled with a "managed" tag. It is not selectable even after entering my admin password to unlock the options.

Why can I not disable the guest user in the 10.8.2 update? I have never enabled the guest user, but after the update, it was automatically enabled with a "managed" tag. It is not selectable even after entering my admin password to unlock the options. I was able to select the account under "parental controls", but again, could not delete it. Why Apple? Why?!!????

SOLVED Ok. I actually was able to disable it. I had to actually log in as the guest user to make it accessible in the preference window. Then I disabled it and logged out. Apologies if this was obvious for some people, but I have had some sort of issue with something every update since Snow Leopard.

Sql Query To Find Out list of users not having a particular resource provisioned

Hi,
I know the query for all the resources tagged to user with their account status.
Can anybody help me with a query to fetch just the user details for the following scenario:
1)Active users having having no instance of a particular resource.
Condition: Exclude Active users having one provisioned instance of the resource and fetch user details having no provisioned account for that resource .
it is just for report purposes.So format is not of concern.Just need the list of users not having a single provisioned account for a particular resource.

Hi,
Please try the below query :
select distinct usr.usr_login from USR,OIU where USR.USR_KEY not in (select OIU.USR_KEY from OIU)
and OIU.APP_INSTANCE_KEY= (select APP_INSTANCE_KEY from APP_INSTANCE where APP_INSTANCE_NAME='ADResource');
Change the app instance name acording to you need.
-Saurabh

Sim Not Provisioned after doing iOS6 update

I recently restored my iPhone 3GS to factory settings and updated my phone to iOS6. All my data/apps/etc came over just fine after syncing but now my phone shows No Service and 'SIM Not Provisioned' when I went into Settings > General > About > Network. It was working normally previously. Data/3G was working just fine. Not sure If I need to contact AT&T to get them to adjust some account settings or verify somehow but it's odd that It'd do that after the update when I had done nothing different with the phone. I've gone though the standard troubleshooting (restarting, removing sim & reinserting, resetting network settings,etc) Any help/insite/suggestions would be appreciated.

It's possible the SIM failed during the update. It's not common, but it's not unheard of. Stop in an AT&T store and get a replacement SIM.

Users are created but Roles are not Provisioned in the Target System

Hi,
It would be great if somebody would provided solution to my problem. The problem is when I try to create the Users in Identity Managment UI then the Users are created in the Target systems but the Roles are not provisioned to the Users.
In the provisioning job SetABAPRole&ProfileForUser,
It is says In the Error putNextEntry failed storing
Exception from Modify operation:com.sap.idm.ic.ToPassException: User does not exist
MSKEY 58437
Please note the When we create the User, the user is created however the Roles is not provisioned to the user.
Regards,
Hakim

Hello Nits,
since this thread is from 2010 and the OP was logged on last in 2012 (as you can see in the profile), I don't think you'll get an answer here.
Please create a new thread to explain your problem (with version and SP numbers, logs etc). You can add a link to this thread to show, that the problem is similar.
Regards,
Steffi.

After Effects warning: Could not create the file '/Users/Library/Preferences/Adobe/After Effects/13.0/dummy

I have just downloaded the trial After Effects CC. I'm running Mavericks 10.9.4 on my Macbook Pro.
When I try to launch After Effects, this message appears:
"After Effects warning: Could not create the file '/Users/Library/Preferences/Adobe/After Effects/13.0/dummy'"
I have followed the advice from other posts on this issue regarding resetting all of the permissions in the Adobe folder in my library to read and write , but it doesn't change anything. I still get the same message when I try to launch the program. Moreover, there is no After Effects folder in my Adobe folder, even though it's clearly in my Applications folder.
I also uninstalled After Effects and tried to reinstall it, but to no avail.
I sure would like to give it a try, as I was planning on purchasing it, but this is just one more issue in a long irritating line of issues that have arisen since trying to download it from CC.
Any help is much appreciated.
Thanks.

I am having this problem and this response does not make sense. I made the "Preferences" ,"Adobe" & "After Effects" folder along with the 10.0,11.0,13.0,13.2 folders all read/write. Can't seem to find an answer.

AD User not provisioning Instantly after reconciliation

Similar Messages

Maybe you are looking for