General troubleshooting steps for Active Roles (4352052)

When working within Active Roles and you run into issues, there are many areas to check to help get to the root of the problem.

Permissions

• Verify if the issue occurs if you perform the same test with a Active Roles (AKA DS Administrator) Admin account. The Active Roles Admin account has complete and full access within Active Roles. Confirming if this account does not have a problem would confirm if it's a permissions issue.
• The Active Roles Admin group is defined in the Active Roles Configuration Center.
• If it's confirmed that the Active Roles Admin is not having the issue, you could then start looking at Access Templates that are applied. It's possible you may be missing an ACE within one of the templates.
• You may also have introduced restricted permissions via a Group Policy Object that could be preventing access.
• Verify if the issue occurs within the MMC and the Web Interface (WI). If it's working in the MMC but not the WI, it's possible there may be more permissions required so you can confirm this by seeing if the issue occurs in the WI when logged on as the Active Roles Admin.
• Always record the error and search for the error within the Knowledge base to see if there is solution already available.

Scripting

• If the script was provided by Professional Services or Custom Development, please refer to the following solution for support for such scripts.
  • https://support.oneidentity.com/kb/32863/

• If it's a customer based script, ensure you post your question on our forums or check the wiki as per the following solution.
  • https://support.oneidentity.com/kb/32863/

• You can find example solutions within the SDK that is pre-installed. From here you can test the examples in your environment to assist with confirming if it's a problem with the logic or a problem with the actual code pieces.
  • https://support.oneidentity.com/kb/124747

MMC

• Confirm if issue occurs with a Active Roles Admin - if it does, confirm permissions as per any Access Templates applied.

Web Interface

• When working within the WI, a good practice would be to create your own sites based on the built-in sites. This way if you need to troubleshoot site issues, you could confirm if issues occur within the built-in ones as opposed to working within your sites which may have a lot of customizations.
• With the WI being a customizable as it is, you could run into issues where it's related to tabs being removed or added to the pages or attributes being removed or added as well so referring back to the first bullet, you can confirm by seeing if issues occur in the built-in sites as well.
• It has been found that the WI may require more permissions than the MMC to perform the same task so verify if issues occur in the MMC as well, then confirm if the issue occurs when logged on as an Active Roles Admin.

Policies

• If you are having issues with policies, you can help troubleshoot this by blocking all policies except built-in ones to confirm if it's a product issue or an issue with your policies. You can then enable policies one at a time to see if you can catch the error which could help indicate if a specific policy is the problem. If this is the case, you can then remove rules within the policies to see if it's a specific rule.

General

• There will be times when you may see inconsistent behavior with running scripts, missing permissions on Access Templates, Missing objects within Publisher/Subscribers, and general issues around cached information within Active Roles. It could be possible that the ADSI Cache files are corrupted and need to be rebuilt.
• Please review Solution 100421 on how to clear the ADSI Cache files.
  • https://support.oneidentity.com/kb/100421/