• State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 93 subscribers
  • Views 6455 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

D1IM v7 Role Inheritance

liamh613
over 8 years ago

This is probably a simple question but i'm having issues in D1IM v7.

I have a user with a corresponding Active Directory account that is Fully Managed.

I also have a Business Role with an AD Group assigned to it with no blocking of Inheritance or Hierarchy.

When I add the Business Role to the Employee either by a Direct Assignment or by a Dynamic Role, the AD Group does not get provisioned to the AD User.

I can see the Business Role assigned to the Person objects in PersonHasObject, but thats about it.

This works perfectly in 6.X and is a simple use case so i'm confused! Any thoughts?

  • 0 over 8 years ago

    Hi Liamh613,

    did you set the "Groups can be inherited" flag in the users' settings?

    If you're creating accounts based on account definitions, you need to have an IT operating data mapping for this attribute, e.g.

    HTH,

     Oliver

  • 0 over 8 years ago

    Thanks Oliver

    I eventually found that option and all is well :)

  • 0 over 6 years ago
    We have the options above checked, however for some reason, membership is not flowing down to AD, although membership is updated in D1IM based on business role. Any suggestions on what could be missing?
  • +1 over 6 years ago

    Q: 'Why isn't Identity Manager provisioning?'

    A:  Power of the check-list:

    1. Check the Sync Project Configuration:
      1. Is the Connector in write mode?
      2. Does provisioning via the Target System browser work?
      3. Are the Provisioning workflow steps enabled?
      4. Are we doing provisioning operations in those steps (insert, update, delete)?
      5. Does Direct assignment via Manager work?
      6. Run a sync with AD to be sure 1IM is aligned with the Target System.
      7. In 1IM in Manager, in AD->Target system synchronization: Active Directory are any items flagged as outstanding for ADSAccount, ADSGroup or ADSAccountInADSGroup? If so resolve these first.
    2. Check DBQueue and Job Server state:
      1. In Job queue Info, is the Job Server instance in good shape?
      2. Is SQL Agent running on the DB?
      3. In Job Queue Info, are there any related outstanding frozen jobs?
      4. Is the DB flagged for recompile?
    3. Check the general state of the person and AD account:is the person active in 1IM?
      1. In 1IM and AD, are the accounts active?
      2. Does the person have a CentralAccount set? (needed for initial account creation)
    4. Check the 1IM account and linking configuration:
      1. In 1IM in Manager, is the AD account linked in Fully Managed mode to the Person?
      2. Does the AD account have the 'Groups can be inherited' flag set?
    5. For Role based provisioning, check the Role configuration:
      1. Does the role's class allow the provisioning of AD groups in both direct and assignment modes? . See Manager->Business Roles->Role Class->Task: 'Confgure Role assignments'
      2. Is inheritance enabled on the Role (otherwise entitlements are not inherited)

    hth,

    Rob.