OIM 11.1.1.5 BP2 Roles removed from users automatically

Question

Hi All,
We are using OIM 11.1.1.5 BP02 and facing issues with event handlers, role membership and access policy. We have a custom post create user handler and a custom user post update event handler. We are creating users through trusted reconcilication by using EBS Employee Recon connector and provisioning users to AD & Exchange by using the 11.1.1.5 ICF connectors.
The issue we are seeing is with the Roles of the users, the behavior we are seeing is that, on user creates through trusted recon, the users are getting roles correctly and then the resources are assigned correctly, but after sometime, the roles are removed from the user. We donot have 'Revoke if no longer applies' on the access policy and thus the resources are appearing fine for the user, but we donot want roles to be removed from the user since the rule membership rules criteria is still holding good for the user.
We are seeing this issue only with trusted reconcilication and not when we create users through the UI. Our custom event handlers have the same logic for both the execute methods; with the difference that the bulk execute method is working on the array of identities received from trusted recon while the normal execute method working on just one identity through the UI.
We are doing complex computation in the event handlers (& setting multiple fields of the user) and are forced to use UserManager API to set the fields in the create user handler (Following article: 1469286.1); this we believe is effecting the ordering of the custom event handler and the OOTB Role ChangeCalculator event handler.
We have already checked the bugs(14075985 & 14221435) and wanted to confirm if we are hitting the same and/or how can we debug this more. We have already checked the UPA_USR table but that does not tell us as to why the role is revoked from the user.
Anyone faced similar issue?
Thanks,
Bikash

Answer 1

The patch we were given was 14226386, also called 11.1.1.5.2AK. The readme has the following overview:
This patch addresses the concurrency issues encountered in 11g R1 PS1 as described below
1. Unlike in OIM 11g R1 PS1, when a user's role membership changes policy evaluation doesn't
     kick off immediately. Instead the user is flagged for policy evaluation in the future.
     'Evaluate User Policies' scheduled task then triggers policy evaluation for such users.
     The scheduled task ensures that there is only one policy evaluation for a user at any
     given time. So, duplicate accounts or entitlements wouldn't be provisioned to a user.
     With this fix, access policy based provisioning events will be triggered only when
     'Evaluate User Policies' scheduled task runs. Hence, the frequency of this scheduled
     task needs to be tuned for the customer's deployment. The recommendation is to set it to
     10 minutes.
     In addition to binary changes, this fix involves data model and metadata changes as
     described below.
2. In a custom event handler, use Platform.getServiceForEventHandler() instead of
Platform.getService() to get a handle to a Service available in OIM before making an API
     call. This ensures that the API completes in its entirety (including any post processing)
     when it returns. Also, this brings in predicability in the order of execution of OIM
     events on the same entity created from one another.
3. When trusted source reconciliation brings in multiple events on the same user these events
are processed by OIM sequentially.
But since then BP03 and BP04 have been released, I would suggest you find out if BP04 has resolved this from support before applying anything.
-Kevin