D1IM v7 Role Inheritance

Question

This is probably a simple question but i'm having issues in D1IM v7. 
 I have a user with a corresponding Active Directory account that is Fully Managed. 
 I also have a Business Role with an AD Group assigned to it with no blocking of Inheritance or Hierarchy. 
 When I add the Business Role to the Employee either by a Direct Assignment or by a Dynamic Role, the AD Group does not get provisioned to the AD User. 
 I can see the Business Role assigned to the Person objects in PersonHasObject, but thats about it. 
 This works perfectly in 6.X and is a simple use case so i'm confused! Any thoughts?

oliver.paulzen · Accepted Answer

Hi Liamh613, 
 did you set the "Groups can be inherited" flag in the users' settings? 
 
 If you're creating accounts based on account definitions, you need to have an IT operating data mapping for this attribute, e.g. 
 
 HTH, 
 Oliver

Robert Byrne · Answer

Q: 'Why isn't Identity Manager provisioning?' 
 A: Power of the check-list: 
 
 Check the Sync Project Configuration:
 
 Is the Connector in write mode? 
 Does provisioning via the Target System browser work? 
 Are the Provisioning workflow steps enabled? 
 Are we doing provisioning operations in those steps (insert, update, delete)? 
 Does Direct assignment via Manager work? 
 Run a sync with AD to be sure 1IM is aligned with the Target System. 
 In 1IM in Manager, in AD->Target system synchronization: Active Directory are any items flagged as outstanding for ADSAccount, ADSGroup or ADSAccountInADSGroup? If so resolve these first.

Check DBQueue and Job Server state:
 
 In Job queue Info, is the Job Server instance in good shape? 
 Is SQL Agent running on the DB? 
 In Job Queue Info, are there any related outstanding frozen jobs? 
 Is the DB flagged for recompile?

Check the general state of the person and AD account:is the person active in 1IM?
 
 In 1IM and AD, are the accounts active? 
 Does the person have a CentralAccount set? (needed for initial account creation)

Check the 1IM account and linking configuration:
 
 In 1IM in Manager, is the AD account linked in Fully Managed mode to the Person? 
 Does the AD account have the 'Groups can be inherited' flag set?

For Role based provisioning, check the Role configuration:
 
 Does the role's class allow the provisioning of AD groups in both direct and assignment modes? . See Manager->Business Roles->Role Class->Task: 'Confgure Role assignments' 
 Is inheritance enabled on the Role (otherwise entitlements are not inherited)

hth, 
 Rob.

Endpoint Privilege Management

D1IM v7 Role Inheritance