What's new for Identity Manager

New Release Identity Manager 9.0 LTS   One Identity is excited to announce a new long term support (LTS) version of  Identity Manager  and...

This guide provides you with information about configuring and operating One Identity Manager web applications.

Identity Manager helps you simplify the access management process by leveraging an automated architecture. With Identity Manager, you can manage...

Several custom database triggers are defined in the Identity Manager database.  Following an upgrade to version 8.1 the custom triggers are...

Custom templates for synchronization projects can be created, but cannot be used in other projects.

Columns added to Identity Manager tables (e.g. Person) are visible in Designer, but are not visible via Object Browser/Manager, and are not...

After upgrading from version 5 to 6, custom process using the Update Mailbox task for Exchange target systems fail.

In the Manager within the tasks tab when selecting any object; the tasks drop down control is partially visible until the end user clicks on the...

After changing the default "Sign in logo" and "Sign in product symbol" in Web Designer with custom logos stored as a resource, the login screen now...

An enhancement request for a Custom GridView setting with additional columns as "default" when loading.

You are using custom groupings for Schema extensions, but the custom named tab does not appear.

* Steps to reproduce - Create an entry in QBMFileRevision with FileName = bin\CCC.CompositionApi.global.json - Assign the file to the machine...

Custom columns are not available for auto complete((Template Editor)..

You have configured custom column groups and after creating a group for this column it disappears completely in Manager.

The 'Approval workflows' boxes each show more entries then there should be. If you click each 'Approval by Attester' entry you are taken to each...

You want to synchronize, for example, locations from a csv file to D1IM. For this purpose you create a synchronization project with an object...

A new CSV Sync Project has been set up. The path to the CSV file has been specified as "Z:\Path\To\File.csv". Drive "Z:" is mapped with the path...

When matching user roles (multivalue) with "MemberOf" (also multivalue) the synchronization returns this error: "UNSAccountB: Write permission...

The CSV Connector ends the header line with < CR > instead of < CR >< LF > on writing a .csv file. :

Problems can occur if a custom Configuration Parameter with the same name is created under the default Configuration Parameters.  Thus, the...

Creation of CSV sync project causes error [1777171] This name () is not valid! It may only contain letters, underline and numbers. It may also...

The search index should be modified in such a way that the search for products for an Employee is only possible via the IT Shop(s) in which the...

When a user logs in to IT Shop and requests a New Active Directory security group, the approval goes to their manager, but the manager is unable to...

When creating or editing an Attestation policy in new API Server, the following error is thrown in the webserver log: "VI.Base.ViException...

Example: Today (08.08.2019) a schedule is to be defined, which runs from 01.09.2019 for the first time and then all three months in each case...

CreateITShopOrder method missing on AADUserInAADGroup table.

Using CreateITShopOrder on accounts (e.g. UNSAccount) creates an order for the account but does not remove the direct assignment for...

How to create a separate Password Policy (QBMPwdPolicy) for Employee passcodes.

CPUCount cannot be maintained in Manager for server and PC.

CP calculation for Delegation related PWO returns no deciders intermittently for bulk operations.

Corruption of ThumbnailPhoto if more than one VI_ADS_ADSAccount_Update_JPegPhoto processes run serially in the same stdioprocessor

Copying VI reports fails on Oracle

Customization code often uses product DLLs, in which sometimes only asynchronous method calls are possible. These calls have several problems: 1...

Changes to workflows should work similar to changes to processes.  For example, changes to processes do not affect running process instances...

These two database consistency checks return false positives for ReadOnly tables and an error when executing the repair method:     QBM...

A view definition has been created: select cn, uid_adsgroup from adsgroup where (cn like 'c%') The consistency check on this view results in...

Consistency check "Requested products that are not assigned" uses a query and returns valid requests of assignment resources as errors.

Synchronization basics - Build a CSV connection from scratch in version 7.0

Connector for REST API - Enhancement request.

In this video, we demonstrate how to setup a basic connection to Active Directory with the Synchronization Editor, a new feature in Identity...

Synchronization editor is a new feature in One Identity Manager (D1IM) version 7. The video will step through the synchronization editor basic...

Connection window does not come up on a local sync when the database is encrypted.

Connection to SAP fails with the following message: "RFC: SAP.Middleware.Connector.RfcInvalidParameterException: Element EX_FUNCTIONS of...

When a wildcard certificate is used in IIS for HTTPS web access, connecting to the application server via the web portal will fail with the...

Getting an error from IT Shop: "Connection Error An error occurred while trying to connect to the server. (4,HTTP 12015)"

Currently, it is possible to open, change and save the same shell several times without the user getting any feedback that changes made by another...

Running the configuration wizard during an upgrade results in the following error: "You are not the owner of at least one agent job.  This may...

The full error as reported by the configuration wizard: Processing step 'QBM DBQueueProcessing (install and start dbqueue processors)' failed...

When upgrading the Identity Manager database to 6.1.3, the upgrade fails with the following error: "An error occurred updating the database...

Since the discontinuation of SNC version 1.0 (31.12.2017) and the introduction of SNC 2.0, the connection of SAP clients via SNC and Single Sign...

The configuration of indexing M:N/M:All tables was never intended and does not produce useful results in the current implementation of the search...

The function of having a manager approval automatically happen in a workflow, if the manager is the one making the request on behalf of the...

Configurability whether only effective assignments should be displayed in HistoryReports.

Config key VI_ITShop_OrderHistory_Filter causes no visible orders in the History

ConfigEncryptor (VI.Config.Encryptor.exe) could not be launched to encrypt the SQL connection string.

Trying to import BAPI transports from Redistributables\SAP directory fails in the BAPI transport loader with error "XT216 - 1 of 1 requests do not...

The detail view VI_ObjectView_AttestationCase shows links which: 1. Are not working, because the value of TargetUrl is "zero". 2. Shouldn't...

Compiling the database with separate rights is not possible. A migration from version 8.1.4 to version 8.2.1 has been performed.  Following the...

Compiler error where string contains the dollar ($) symbol.

The following error message occurs when compiling client scripts: "computer is not member of my"

When trying to compile a Webshop in the Web Designer, objects are compiled until the message 'Compiling VI_ITShop_ShoppingCartPatternAddOrMerge ok...

When running the configuration wizard to upgrade or add additional modules, an error is displayed: "The Job queue and/or the DBQueue is not...

When attempting to compile the Identity Manager database, the following error occurs: "Decrypt' is not a member of 'Encryption - QBM...

When launching a front-end tool, the following error message appears: "The Database has no templates or table scripts. Compile the database or...

One Identity Manager has been awarded a Common Criteria Certification by the National Information Assurance Partnership ( NIAP ). The...

After opening an AD Synchronization project, you change the value of a system variable (such as AD Server). Click “Commit to database” without...

The Identity Manager's GUI version of the Compiler, DBCompiler.exe, requests for a new Database ID to be generated if the compiler detects that...

Code snippets for commit script for generic ADO.Net connector

Pending attestation cases must still be processed even if they have been permanently deactivated in the meantime.  This is not required very often...

The NDO Connector should be able to access IBM Notes servers and address books via the IBM Notes Client version 10.0 or higher, in addition to the...

The consistency check shows error for mandatory properties in Employee mapping of Cloud HR Systems (CHS) Synchronization Project due to unwanted...

If an additional decision maker has been added for a DecisionLevel, the decision of a ChiefApprover has no effect.

Checking Org assignment order in shopping cart fails if Compliance Check is disabled

Check shopping cart delivers unclear/incorrect results. If several products in the shopping cart are tested for requestability and there is a...

Open check data consistency within Designer and select only warning. Expand DatabaseModel, then expand NamingConventions and place a check mark...

We would like to check the dimension of files added to the column Person.JPegPhoto before saving to the DB.

Scenario: 1. Open Launchpad with a dialogue User whose password has expired. A popup window appears, that the password must be changed. 2...

Changing LDAP Domain distinguished name causes template error. VI.DB.Implementation.SingleDbObject.Save () at VI.DB.Implementation.SingleDbObject...

When approval workflows are changed a decision must be made as to whether these changes should be applied to pending requests.  Configuration...

Direct changes are prevented by the projector. However, special requirements make it necessary that the field can be changed via sync. E.g...

If a salutation of a SAPUser is configured, it always appears in the language of the logged-in user when the SAPUser is displayed. This also...

Changes to the body of a mail template in Designer are not stored into the database.

If a SAPUser is currently not active due to Gltgv and Gltgb, the PersonHasObject entries (e.g. for SAPRole) must also not be present. "The...

Passwords should appear in the log with the value = "<hidden>". But because OldValue and NewValue have the same text they are filtered out. The...

The function "_BuildWhereClauseRecursively()" which is called in script "AAD_PersonAuto_Mapping_AADUser" has been changed in 8.1.3. Before 8.1...

When synchronizing a large dynamic group the changelimit average for the database calculation is lowered to a level which can cause the task to...

In Identity Manager 6.X you might have been accustomed to use the method below to get a value for a specific property: Connection...

Is it possible to change the logo on the Single Sign On screen when employees enter the IT Shop?

The date check of the fields PersonwantsOrg ValidUntil, ValidUntilUnsubscribe and ValidUntilProlongation should be simplified. Currently, the date...

In Designer | Change Management multiple objects are added in the wrong order when adding to a change label.

Change label created in Designer is not showing up in Schema Extension tool.

Following a transport of custom columns from one environment to another, changes to fields in front end tools (i.e., Manager) result in a "change...

In an environment with several Active Directory (AD) domains, an Employee object can only be updated from the same AD domain it was initially...

You are trying to use ObjectWalker()-function in WebSQL to follow the reference of multiple FKs. Example: from ADSGroup select current...

It is not possible to create or modify SAP accounts with the following name in SAP: “sap*" "sapcpic" "sapjsf" "ddic" "j2ee_admin" "j2ee...

When a new Employee account is generated in Manager, the central account value is being appended with a '1'. For example, employee John Smith...

 The UID's for CCCEditRole and CCCViewRole are created with different UID's across installations, this means that schema extensions that use them...

Cannot transport changes to QERReuse. Error during execution of 'CheckValues' in logic module 'QER.Customizer.ITShopProductCustomizer'. ---> VI...

Cannot simulate synchronisation on encrypted database even though mapping does not contain encrypted property.

When attempting to provision an Exchange mailbox the following error is seen: " [1777124] Error executing projection step (Mailbox) of projection...

Cannot pass boolean type parameters to powershell scripts using Param_x for "Execute CommandLine" task of PowerShellComponent

When attempting to log in to the web portal (IT Shop) with Employee (role based) Authentication the following error is received: "An exception...

When attempting to copy any report using the Report Editor application in One Identity Manager (1IM) 7.1 the following error message is received...

Cannot connect to SCIM services that no longer support TLS 1.0.

The configuration parameter “TargetSystem\ADS\AuthenticationDomains\AuthenticationDomains" is already configured with two domains, e.g.: "domain1...

When trying to add a parameter to web project menu item so it can pass values to a module, the selection to insert/edit an identifier is empty...

Identity Manager manages a parent domain and 3 child domains. The 3 child domains are synchronized, but the parent is not. The service account...

In Manager, the CanEdit right of a column that has been removed by a format script is taken away directly if the connection is directly to the...

Can't provision objects with the Native Database Connector.  

Can the ServiceNow connector create Service requests instead of Incidents?

Can the private key for database encryption be protected with a passphrase?

Can the Job Server logs web site, i.e. http://localhost:1880, be locked down to only work with SSL? Currently the site is locked down so a user...

Can the Identity Manager Front Ends be run on Citrix or Terminal Server?

When attempting to setup the Starling Connect connector within the synchronization editor the 'Next' button does not light up after clicking on...

Can Role Based authentication be used for both Manager and Designer?

Insert operations are not recorded in DialogWatchOperation for M:N tables in 7.0.2 (MSSQL only).

When first logging into IT Shop the main login page will take around 60 seconds to load, and then subsequent load times are fine. Sometimes the...

Situation: One decision level has 2 sub levels.  A specific Employee is the decider on both levels. The current behaviour is:  When that...

The reference scope is currently defined as follows: UID_ADSForest in (Select UID_ADSForest from ADSForest where DistinguishedName = '$CP...

Incorrect parameter sequence in a BAPI - Function call to delete an SAP object.

If an external schema type is defined that uses a function call to delete SAP objects, the parameters for this function are only populated from...

PDF documents in the webshop can be delivered with mime type as text/html. Every browser accepts this except Safari. Mime type for pdf documents...

Scenario in Manager : 1. Employee M is the master identity and Employee S is the sub-identity (select Employee S in Manager and enter...

You may have noticed that after upgrading to 6.1.3, there is no pagination shown anymore on recursive grids. Only 10 items are shown in the grid...

The following error occurred during the installation of the Data Governance Server: "Caught exception while install the MSI. Error code: 1603"

After customising the IT Shop to use custom icons, a Quest Identity Manager Favourite icon is briefly visible.

The subject line for the mail template "Attestation- Approval by Mail" has the code: ATTESTATION APPROVAL - Policy: '$FK(UID_AttestationCase...

Lucene/index search does not return a result with the English language setting, but the ACCProduct is found in a German-language web portal

VI_Common_SqlSearch_PrefixLike ("Use this property to select whether the SqlSearch function will return matches where the search string is found...

Lucene index does not work in Windows FIPS mode. Error message in app server log: "ERROR (Indexing ) : Error during index initialization in...

Lotus Notes Templates remove special characters such as Umlauts in Firstname and LastName

When creating a user account in Lotus Notes with the mail system type "Other Internet Mail", no mail domain may be provisioned because Lotus Notes...

If the LDAP login password for the domain has been updated without making the appropriate changes to the Domain configuration in Manager, users...

Login to WebManager fails if SSL 3.0 is disabled on IIS.

Logging in to the web portal results in the following error message: " Error while loading the collection User in VI_Session. Could not load...

During login to One Identity Manager we are getting the below error: "There are no Active Directory domains activated for authentication."

When logging in to IT shop, the following error may be received: "You are not authorized to use this database"

Scenario: Configure at least 2 properties for rogue detection. Change object in target system and run sync. With each additional property...

The logged in user session did not time out and appeared to remain logged in indefinitely. Referencing the KB article to modify the timeout value...

The web portal is configured to use "Active Directory user account (role based)" as the Authentication module, with "Employee (role based)" as a...

In the case of a CUA, the template would have to calculate "32" in the case of a locking. However, "64" is set for SAPUser.U_Flag.

When you lock a user in Identity Manager, it performs the following actions: D1IM changes the type of the person document in the target system...

When a user attempts to load request history in the web portal the results are slow to load.

Loading open requests to be approved in the web frontend takes a long time due to the view QER_VITShopDecisionPerson being slow.

All SQL jobs created by QBM_PjobCreate, are for the master SQL Server. It would be useful if these jobs could be executed by a multitude of job...

After clicking the "Switch to Policy View" button and then clicking on a policy, the list of cases associated with an Attestation policy is...

Link to view system entitlements from Pending attestations - Security group attestation page on the portal doesn't work  

lineProvider.GetLines() Timeout exception from object layer script

Scenario: Connect the LDAP accounts, read in with an LDAP sync,  with persons. Activate the CP for Search and Create accordingly. The script LDP...

In the Identity Manager Database, the maximum size of the default column 'EmployeeType', in the table 'LDAPAccount', is 20 characters. In LDAP...

There is no consistency on column lengths for Room and LDAPAccount with greater than 20 characters.  Room identifier doesn't fit because...

When selecting a property in the Mapping Editor, additional information/details are always displayed below. The description is already displayed...

LDAP insert job is causing the studio processor to take a lot of CPU and Memory

When locating an application, e.g. Web Designer, when using the Search option in Launchpad , the context menu will show "Remove from Favorites...

After right-clicking on an item in Launchpad and selecting the option to add to favorites, items are saved to favorites, however, once Launchpad is...

For Identity Manager 8.2 and 8.2.x the current language pack that is available on the web portal is for 8.1.x but can be used for these versions as...

When trying to add a language pack in Designer the following error appears: "Document (Base Data) could not be opened! Column reference...

Error "[1025314] Document (Base Data) could not be opened!" is reported when importing language files into One Identity Manager.  Error message...

With S/4 for HANA 2.0, the use of business partners instead of debtors and creditors is mandatory.  In this context, the users of SU01 can also be...

Merge conflicts only occur when changes are transported, and these changes do not fit in the target. Data may be (unintentionally) overwritten...

The GUIFLAG on the SAPUser is currently described as "Insecure communication allowed". In the mapping, the description is "user login using GUI...

When setting up Exchange 2016 connector and selecting the checkbox marked "Use SSL", the connection fails and displays the following error in the...

Journal error generated: "8134 0 detected in (SRV = XXXX\XXXX, DB = XXXX) Procedure QBM_PDBQueueCalcBulkFactor, Line xx 8134 0 Divide by zero...

IT Shop request approval MakeDecision jobs fail sporadically with the following error:  "Database error 50000: re-throw in Procedure QBM...

In the job service log the following errors appear: "Database error 50000: detected in ...Procedure vid_JobInitQueue..." "Database error...

Two Application Servers are used behind a Load Balancer with Cookie Session Stickiness configured on Load Balancer. The Application Server uses...

JobQueueInfo is displaying warnings that a system user failed to login to the job service. The error will look similar to the following: "Login...

Job service jobs fail with an error message resembling: "[810143] Database error 916: The server principal "NT Authority\System" is not able to...

JobQueueInfo crashes after applying a filter on the Message column in the DialogJournal view when there are a large number of entries.

The job service web interface (when viewed from JobQueueInfo) returns HTTP header "Server" with the content "Microsoft-HTTPAPI/2.0", e.g...

Job Queue processing stops because 'QBM_PJobUpdateState_Bulk' is unable to update the status.

Using Quick Connect with Identity Manager to manage Oracle database accounts (provision, update, de-provision, password resets, set privileges, etc...

The job server stops processing jobs in the queue and an error is generated: "[810143] Database error 50000: Processing is disabled (queues...

After setting the configuration parameters under Common\ProcessState to delete job history when the lifetime is past its threshold, the job...

With mass operations (approx. 1000 processes) it happens sporadically (approx. 3 processes per 1000) that several non-consecutive jobs have been...

JavaScript library vulnerability: Update of AngularJS to v1.7.9. and Bootstrap to v3.4.1 is necessary.

The ClientLogService does not check a RuntimeFormID token and can thus be misused by an attacker for XSRF scenarios to generate log entries under...

The scenario: A new IT Shop setup on version 8.x.  A form has been configured with request properties, permissions assigned to a role with new...

Is there a way to remove the "Address Book" link under the person icon on the top right of the screen in IT Shop? In version 7.1.x this was...

If the Configuration Parameter "GroupAutoPublish" is enabled, several entries may be created in ITShopOrg for each assignment of an ADSGroup to an...

When browsing through the pages with the products that can be ordered in the web portal (IT Shop), there are retries which lead to severe delays...

After searching from the top navigation header within IT Shop, and navigating to a product in the search result (product overview), clicking the...

Role constraint violation is triggered for role which is not failing compliance check after submitting the shopping cart in ITShop. Scenario...

Search option in IT Shop returns the following error: "One or more errors occurred. Error while loading the Collection Results in VI_Session...

When submitting an item in the shopping cart by clicking Check & submit shopping cart , then clicking "Yes" to confirm the request, an error page...

After creating a custom permissions group, based on a default permissions group, and assigning this new group to an existing application role...

If an order is searched for and found in IT Shop by full-text search, the corresponding master data is visible in the screen pop-up. Especially...

When a user performs a search within IT Shop, a result appears. When the user then tries to search for another user the same result keeps showing...

When trying to log in to IT Shop with a role-based account, the following error message appears: "An exception has occurred while executing the...

The issue is regarding the behavior of Identity Manager (1IM) when trying to change an attribute of Linked Mailbox. SCENARIO: Two domains, one...

It is not possible to set "Send As"/ "Full Access" on Exchange Online Shared Mailboxes

Attempting to connect GitHub via SCIM.  All 'GET' calls fail because the Synchronization Editor does not set a "User-Agent" and GitHub rejects the...

It can happen that processes, that should not be executed in parallel, sometimes are if a dedicated server is not specified.   This is a possible...

It is not possible to book more than one change on a change label.

It is not possible to change the mailbox type (RecipientTypeDetails) of existing mailboxes. For example: Change from UserMailbox to...

In Base Data -> Configuration Parameters -> TargetSystem -> ADS -> PersonAutoFullSync, the value was switched from "SEARCH" to "SEARCH AND CREATE...

The date format in client applications (e.g., Manager, JobQueueInfo etc.) is in English (United States) format (mm/dd/yyyy), but the regional...

A MaxValidDays is defined on the AccProduct. The product is ordered and approved, ValidUntil is automatically set to the date which corresponds...

When adding a subscriber for a report the error 'Viewing permission denied for value "DefaultEmailaddress"' is displayed.

Issue when creating custom approval procedure, DBScheduler job QER-K-PWODecisionRuleMakeProc throws error resembling the message 50000 0 re...

When creating a custom rule, is there a way to add more detail instead of using the out of the box options?

Is there a way in the Manager front end to display reports for Attestation Cases?

When synchronizing SAP HR data, manager positions for org units (HROrgUnitManager) are selected incorrectly.

Steps to Reproduce: Given are job J1 in frozen (and thus Retry=0) and J2 the successor job with Retry>0. If one switches in the JobQueueInfo...

The web-based Identity Manager tool is installed on IIS8 with SSO enabled. When opening the URL in Internet Explorer (IE) 11, the error "Token...

Scenario: In Exchange there is one object with identity="sales". In addition, there are other objects with a different identity, but alias...

When an end user requests a report which is not a simple list report but the request is for a CSV format in the Web Portal, and they select...

When setting a date in the ITShop filter assistant, the newly set date will not be transferred to the filter.

When running a custom full sync on UNS*B, creating M:N relations  such as UNSAccountBINUNSGroupB always create an entry in...

When renaming a group in Notes, the wrong name is written in the AdminP request document. Define a person X as the admin/owner of a group.  The...

Example scenario: There is a Shelf A with 3 products and several active orders for each of these products.  All products are marked with...

When removing modules, DynFK references to module data remain.

When provisioning a new Lotus Notes mailbox, the “user type” value is set to “Unspecified”.

When logging in with Active Directory (AD) Account to an Identity Manager Front-end tool (Manager, Designer, etc.), the following error is...

When importing a schema changing transport, Database Transporter reports the error "The DB queue processor is not running. Pending operations will...

When importing a sync project via the DBTransporterCmd, the ShadowCopy is not emptied. This means that after the import, the old status of the...

A modified shell has both a deletion in an existing mapping (DPRSystemMap) and a deletion of the schema class (DPRSchemaClass). Since the...

A changed synchronization shell has both a deletion in an existing mapping (DPRSystemMap) and a deletion of the schema class (DPRSchemaClass...

When exporting RPSReports as CSV (IsListReport=1), the parameters of the ParameterSet used in the ReportDefinition are not replaced.

When an Employee is added to a business role it may trigger a recalculation for all open IT Shop orders. A large number of  'QER-K...

When editing a Synchronisation Project in the Synchronisation Manager, changing the order of certain values may not be saved to the database.

When deleting an LDAPAccount, the membership in LDAP is not removed if Merge Mode is active for LDAPAccountInLDAPGroup.

Following error was thrown when trying to add a deferred operation to an object (e.g. ADSAccount Deletion) 2022-01-20 07:40:00.8514 DEBUG...

When creating a new view (R table) with the SchemaExtensionWizard, the validity of the PK-definition should be checked immediately.

When copying a process step, PriorityDefinition is not carried over as well.

Scenario: Use of an SAP function that can return both an object list and an individual object. Definition of at least one fixed parameter in...

When calculating history periods no XIsInEffect of still existing allocations (XIsInEffect=0) is considered and therefore allocations that are...

After starting a synchronization job, it quickly freezes with the following error: "The synchronization step (user - Phase #2) cannot be...

After copying the file "VI.SPMLTestFrontend.exe" from the installation files directory: QBM\dvd\AddOn\SPML\Testfrontend and creating the...

When assigning a system role (Eset), which would potentially lead to a rule violation, to a business role (Org), a rule violation is misleadingly...

When assigning a system role (Eset), which would potentially lead to a rule violation, to a business role (Org), a compliance violation is...

When a SAPUser that was marked for deletion is recalled, the XMarkedForDeletion column in SAPUserInSAPRole is not reset to "0"

An Employee requests a service item via the web portal and selects a valid until date in the future and the shopping cart is submitted. The same...

When a request is being approved in the Web Portal , it is possible to set the end of the validity period before the beginning of the validity...

When a "remote mailbox" exists, the options "Create mail user" and "Create mailbox" are still both available. Selecting one of these options...

What's new in Web Designer - Extensions and some other features

What's new in Web Designer - The new Start page