Chatta subito con l'assistenza
Chat con il supporto

Identity Manager 9.1.1 - Release Notes

Resolved issues

The following is a list of issues addressed in this release.

Table 5: General

Resolved issue

Issue ID

If data imported via a CSV connector uses an application server connection, the default values of properties cannot be removed.

34584

In the Schema Extension, a summary of the changes is no longer shown.

35075

Using the emergency stop to halt the DBQueue Processor can result in a time delay if a lot of DBQueue Processor processes are being handled quickly.

35338

WebView2 is not installed on administrative workstation if only Workstation | Configuration or Workstation | Development & Testing machine roles are selected.

35709

The Form Editor generates an empty form definition when a new interface form is inserted in the form overview's root level.

35910

Permissions required on new tables are not granted for end users if the Database Transporter imports the schema extensions.

35934

The QBM_PTriggerDrop procedure logs entries in the system journal even though no triggers were deleted.

35949

An error occurs in the Manager using the context menu to run a task is run on an object.

35952

An error occurs updating statistics during maintenance tasks. Therefore, the statistics are not up-to-date.

Error message: User does not have permission to perform this action.

35960

The Manager does not reliably save the column selection in a filter.

35965

An error occurs when the Software Loader imports a new file.

Error message: Number of primary key columns does not match.

36006

An error occurs using OAuth2.0/OpenID Connect to log in to the application server or the Job server, to display the status, for example.

36018

The Job Queue Info does not display the change information for the CausingEntityPatch parameter correctly.

36103

Hierarchically structured changes labels are not displayed correctly in the Database Transporter when transporting by change label.

36115

If the functionality for read access distribution in a cluster is used, a message appears stating that the Database Agent Service is not running although it was started.

36120

Some SQL statements that only query data still require a database connection with write access. Under certain conditions, errors can occur when read access distribution is used in the cluster.

36137

The QBMColumnLimitedValue.KeyValue column is too short.

36146

The Process Editor cannot restore the default layout.

36149

Schema extensions do not populate existing data records with default values. This causes errors.

36176

Rule violations are not identified in the simulation.

36181

After ending a simulation, the data is not fully displayed in the report.

36182

Special change labels are not displayed when changes are committed in the Designer.

36190

An error occurs on saving in the Designer if a change label was selected that already contains references to objects.

36208

Running the ExecuteTemplates method on a multi-select object does not return a result.

36223

Entries in a list of permitted values may not be translated correctly.

36225

Error running the Check uniqueness of alternate keys consistency check.

36250

The ProcID parameter is not taken into account in triggered processes with the FireGenEvent process task of the HandleObjectComponent process component.

36255

The Database Transporter does not display each transport of a cumulative transport correctly.

36262

Multiple start times for a schedule are not taken into account correctly when calculating the run times and while running.

36263

The Schema Extension creates indexes for object keys (XObjectKey) whose names are more than 30 characters long and therefore do not comply with the naming convention.

36269

Machine roles are not correctly applied in the Docker container for the API Server.

36277

If the server function for a process step changes, the system does not notice that the process needs to be recompiled.

36281

If a schedule is supposed to run on a certain day of the week, an error occurs when calculating the next run.

36287, 36290

An error occurs loading collections with an empty where clause.

36304

An error occurs when an export definition that is saved in the user settings is deleted in the Manager.

36365

Filter queries for menu items that contain objects with certain starting characters are run too often.

36405

The Job Queue Info throws an error when the number of retries is set.

36462

Under certain conditions, such as when the network is interrupted, the Database Agent Service plugin stops and does not start again.

36469

Under certain conditions, the Database Transporter compiles web projects too often when it imports a cumulative update.

319014

Columns that do not exist in certain tables are queried in the transport condition.

35351

The Configuration Wizard does not process calculation tasks for the DBQueue Processor when a database is restored.

35876, 36428

Auxiliary tables are not included in consistency checks.

36186

The One Identity Manager Service status page is not always shown.

36381

Error running the QBM_PJobCreate_HOInsert procedure if a WhereClause property changes.

36062

Process steps in the Job queue sporadically have an inconsistent state and cannot be processed.

36382

Custom triggers might be deleted when the One Identity Manager database is updated from version 8.1.x to version 9.1.

36607

The import of custom schema extensions checks references to columns before the columns themselves are imported.

36326

If a column was marked for recording historical data in the source database but is removed again before it is transferred to the History Database, the History Database transfer fails.

36205

In certain cases, an error occurs sending subscribed reports.

36273

HTTP-HEAD requests to the One Identity Manager Service website cause the following error: "Bytes to be written to the stream exceed the Content-Length bytes size specified.".

36320

Processes on the DialogDatabase table can no longer be started manually. This also affects the ATT_DialogDatabase_Trigger_AttestationCase_VerificationMail process.

35572

In the database query with the Historical assignments query module, the user shown as the CreateUser is not the one that created the assignment.

35946

Permissions filters are modified by code processing.

36177

Error creating a generating condition or a script for a process using dollar ($) notation if a foreign key column is selected by double-clicking the right mouse button.

36434

The Database Transporter does not show data that causes a conflict correctly in the Merge conflict dialog box.

36637

Error saving requests if processes are already in the Job queue that can trigger events to send mail for other requests.

Error message: String or binary data would be truncated in table 'OneIM.sys.TT_QBM_YParameterList_6A941822', column 'Parameter1'.

36622

Under certain conditions, exporting to the History Database fails.

36516

It is only possible to install a module with the Configuration Wizard later if another module is selected for update at the same time.

36429

If parallelization of process handling is intensive, the Job queue can enter an inconsistent state when processes are restarted.

36367

Processes that are not run because the IsExclusivePerObject process task is enabled, can stop other processes from running.

35802

Replacing variables from the navigation in element descriptions on overview forms does not work.

36683

After reindexing tables as part of maintenance tasks, not all indexes may be released again.

36292

Table 6: General web applications

Resolved issue

Issue ID

You cannot upload a profile image in the Web Portal.

34425

In the Web Designer Web Portal, it is not possible to request a multi-requestable/unsubscribable resource for an identity more than once.

34743

The wrong information is shown when logging in to the Web Designer Web Portal.

35057

Under certain conditions, the scrollbars are missing in the Password Reset Portal.

35535

Under certain conditions, the Web Designer Web Portal always prompts that too many search results were found.

35759

Under certain conditions, the Web Portal search function does not return the expected result.

35826

In the Web Portal, the shopping cart implies you can send a subset of the requested items.

35898

The modified Display pattern property does not affect the request or request parameters in the Web Portal.

35899

If you enter a date for a product property in the Web Portal's shopping cart, under certain conditions the value is deleted when the shopping cart is submitted.

35995

The Web Designer Web Portal does not display all the tiles correctly.

36015

The Web Portal search does not return the correct results if an asterisk (*) is included as a placeholder.

36032

In the Web Designer Web Portal, you must enter a product's request parameters for each request recipient although the product is configured such that the request parameters only have to be entered once.

36066

Under certain conditions in the Web Designer Web Portal, you cannot export the request history data.

36095

Too many database connections are established in the Web Designer Web Portal for unauthorized queries.

36116

The Web Portal does not display new requests immediately in the respective tile.

36117

The Web Designer Web Portal does not check renewal requests and cancellations correctly in the shopping cart.

36131

Under certain conditions, dependencies of multiple request parameters to one another are not taken into account in the Web Portal.

36143

Code highlighting and auto completion of variables does not work in the Web Designer.

36145

An error can occur when the Manager web application is automatically updated.

36193

Under certain conditions, the Web Designer Web Portal does not show a change icon when values are added or changed.

36230

Under certain conditions, selecting requests and displaying the request history in the Web Portal, can lead to long response times for administrators of organizations and business roles.

36316, 36613

In the Web Portal, it is only possible to manage directly subordinate identities.

36325

Under certain conditions, the Web Portal's request history shows request properties with the incorrect values.

36357

Under certain conditions in the Web Portal, it is not possible to create service items for system entitlements.

36377

In a customized Web Portal, you cannot add a product renewal as a request to the shopping cart.

36616

In the Web Portal, the request workflow displays withdrawal of an additional approver incorrectly.

292577

In the Web Portal, the shopping cart uses the wrong product names.

317017

In the Web Portal, the Request details pane does not appear anymore once products are added to the shopping cart that require more information.

317218

The Web Portal displays some untranslatable text when the terms of use are being accepted.

318203

The Web Portal displays the wrong message when selecting requestable products if a product was already assigned.

319133

The Web Portal does not display memberships that were added or deleted in system roles in an identity's history.

319462

If you make a new request in the Web Portal using a peer group, the products selected by organizational structure are each put in their own shopping cart.

320891

Under certain conditions, installing the Web Portal fails.

320955

In the Operations Support Web Portal a column title is not translated correctly in the process overview.

321613

Under certain conditions, instead of the display name the Web Portal displays only the ID of the selected object when conditions for automatic membership are created.

321874

The Web Portal does not always show the correct results when grouping and filtering in tables at the same time.

322124

Under certain conditions, the Web Portal shows the splash screen all the time.

322907

Under certain conditions, the Password Reset Portal shows the splash screen all the time.

322939

In the Web Portal, when you reset objects to their previous state you can switch to the second step in the wizard without entering data. This causes an error.

322985

The Operations Support Web Portal leaves the queue list empty, and no data appears.

323845

In the Web Portal, it is not possible to search by compliance rules and to filter the respective search results.

323899

In the Web Portal, no recipient must be selected if requesting for others.

324118

In the Web Portal, no system role memberships are displayed.

324128, 36503

The Web Portal uses the wrong identifiers in the details of an attestation case.

324279

Under certain conditions, after clicking Assign/Change in the Web Portal, no objects can be selected for property fields.

324289

It is not possible to create new user accounts in the Password Reset Portal.

324290, 36034

The Web Portal shopping cart does not correctly display whether an identity is not entitled to request a product. The request can still be sent, but it has no effect.

324383

The Web Portal marks all pending requests as compliance violations the moment just one of the displayed pending requests causes a compliance violation.

326083

The Web Portal cannot display a compliance violation in the shopping cart and the respective shopping cart cannot be submitted.

326440

A report is not subscribable in the Web Portal if it is not configured for PDF format.

326723

It is not possible to edit identity main data in the Web Portal, even if you have all the necessary permissions.

330766, 36011

In the Web Portal, it is not possible to publish application entitlements.

332393

In the Web Portal, the Requests submitted by other users filter option in the request history does not work.

332423

If you change the title of a web application is causes follow-up problems.

352481, 36016

In the Web Portal, copying attestation policies causes an error.

358311, 36090

Under certain conditions, errors occur when displaying potential rule violations in the shopping cart.

366940

In the Web Portal, requesting a product causes an error if the product cannot be requested for at least one request recipient.

367180

In the Web Portal, it is possible to add products in the shopping cart although the recipient does not have request authorization.

367187

In the Web Portal, approval decisions about policy violations can only be made once.

367251

The Web Designer Web Portal does not display all the tiles on the request page correctly.

367316

The Web Portal does not translate the descriptions of the corresponding company policies correctly when it displays policy violations.

367441

Under certain conditions, the View Settings menu in the Web Designer Web Portal is shown twice.

367741, 35722

If you try to log in to the Web Portal with the wrong credentials, an empty page is displayed instead of an error message.

384912

In the Administration Portal, the links to some of the web applications are incorrect.

386166

Under certain conditions, the Operations Support Web Portal does not display provisioning processes.

386554

Under certain conditions, it is not possible to add products to request templates in the Web Portal.

386663

Under certain conditions the Web Portal does not load data correctly when requests for products with additional information are made.

386868

Under certain conditions, an error occurs editing the date fields.

387324, 36166

In the Web Portal, you cannot display the details of request templates.

388710

The Web Designer Web Portal header is displayed incorrectly.

389051

The Operations Support Web Portal does not translate all the user interface captions of the Pending provisioning processes function correctly.

389068, 36362

In the Web Portal, it is not possible to assign new attestation policies to policy collections.

390235, 36414

Renewed login to a web application again does not change the imx_sessiongroup cookie.

393075, 36317

In the Administration Portal, it is not possible to disable the Service items without image inherit the image of the assigned service category configuration key.

393570

Grouping attestation cases in an attestation run's details in the Web Portal causes an error.

393864, 36359

Under certain conditions, password questions cannot be edited in the Web Portal.

395047

Under certain conditions, the numerical values of the following configuration parameters are not read in correctly.

  • QER\ITShop\Recommendation\ApprovalRateThreshold

  • QER\ITShop\Recommendation\PeerGroupThreshold

  • QER\ITShop\Recommendation\RiskIndexThreshold

  • QER\ITShop\PeerGroupAnalysis\ApprovalThreshold

400775

The API Server sometimes uses invalid connections to the application server.

36495

It is not possible to log in to the Administration Portal using OAUTH authentication.

36360

In the Web Portal, attestation cases offered to identities for approval although their approval is not required anymore.

36505, 405092

The Web Portal displays a number instead of a string for the Gender property in the details of an attestation run.

36529

In certain cases in the Web Portal, issues with business roles that conflict with each other are not found when the shopping cart is checked.

36533

Table 7: Target system connection

Resolved issue

Issue ID

The SCIM connector sets boolean and numerical properties to null if they do not contain a value. Error message: Cannot convert null to 'bool' because it is a non-nullable value type.

34609

On Windows Server 2012, the Exchange Online connection fails to connect to the target system.

34807

On the Define search criteria for employee assignment form in the Manager, the Google Workspace user accounts are not shown when a new search criterion is defined.

34853

Error editing the endpoint configuration of a system connection to a cloud application.

34957

The display values of multi-value properties are not shown properly in the target system browser.

34959

Azure Active Directory synchronization generates too many processes.

35018

An error occurs when an Azure Active Directory group is created without an alias.

35180

Error connecting to a database via the generic database connector if the password for the database login contains double quotes.

35409

Error copying synchronization projects.

35453

Error creating a synchronization project for synchronizing Oracle E-Business Suite. Error message: An item with the same key has already been added.

35541

Microsoft Exchange remote mailboxes are not included when determining the origin of entitlements.

35589

The Active Directory connector writes structural objects classes for domains (ADSDomain.StructuralObjectClass) at every synchronization.

A patch with the patch ID VPR#35808 is available for synchronization projects.

35808

User accounts (UNSAccount) without containers (UNSContainer) are ignored even if there are not any containers in the target system.

35823

If Active Directory is synchronized using a special variable set, an error occurs when Active Directory SIDs are updated by the MaintainOtherSid process task.

35824

Under certain conditions, an error occurs simulating synchronization:

  • Simulation is run over a remote connection.

  • Simulation is started several times for the same start up configuration.

35857

Error saving a synchronization project if the connection goes through the application server and the target system connection has high network latency.

Error message: Application server returned an error.

35871

If an object filter was defined for a root entry in the scope definition, there might not be an object in the scope.

35880

Synchronization with OneLogin fails if there are self-registered users.

Error: Null object cannot be converted to a value type.

35889

The target system alignment uses an incorrect formatter option.

35907

If there are several redundant entries in SAP R/3 for an authorization object, only one authorization definition is read into the One Identity Manager database when SAP authorization objects are synchronized. All other instances are ignored. In particular, the instance with the highest value is missing.

A patch with the patch ID VPR#35944 is available for synchronization projects.

35944

Error loading SharePoint Online objects if an object filter is defined.

35947

Access to the RemoteConnectPlugin does not work across machines.

The HTTP server registration has been adjusted and can be set up using the HttpAuthentication and HttpBindAddress parameters in the plugin's configuration.

35950

An error occurs loading the list of all Active Directory user accounts with the Active Directory connector if one of the user accounts contains a mistake.

35953

Synchronization with OneLogin might possibly report ambiguous keys in the reference resolution to the OLGUserHasOLGCustomAttribute table.

35962

References that cannot be allocated because the OneLogin objects no longer exist, are saved in the synchronization buffer.

A patch with the patch ID VPR#35969 is available for synchronization projects.

35969

You cannot select an account definition on the OneLogin user account's master data form.

35983

Processing conflicts between synchronization and other system processes (for example, provisioning) are not always reliably detected.

In the StdioProcessor configuration file, the rate of updating the processing information can now be configured. By default, the data remains in the cache for 60 seconds. Only change this value if there is an issue.

If you are affected by the issue, add the following entries to the StdioProcessor.exe.config file:

<configSections>

...

<section name="synchronization" type="System.Configuration.NameValueSectionHandler" />

...

</configSections>

<synchronization>

<add key="SysConcurrenceCacheLifeTime" value="60" />

</synchronization>

35992

The OLG_4_NAMESPACEADMIN_ONELOGIN permissions group has too many edit permissions on OneLogin applications (OLGApplication table) and OneLogin roles (OLGRole table).

35994

An error occurs if a synchronization project is created for Azure Active Directory and provisioning of subscription assignments (AADUserHasSubSku table) is disabled.

35997

The schema provided by the Domino connector might be incomplete or individual properties might not have the correct data type.

35644, 35999, 36142

There is no recalculation of the effective assignments of target system-specific system entitlements if the inheritance settings defined in the manage level are overwritten. The following assignments are affected:

  • Subscription assignments to Azure Active Directory user accounts (AADUserHasSubSku table)

  • Entitlement assignments to Oracle E-Business Suite user accounts (EBSUserInResp table)

  • Role assignments to SAP R/3 user accounts (SAPUserInSAPRole table)

  • Structural profile assignments to SAP R/3 user account (SAPUserInSAPHRP table)

36014

There is no recalculation of the effective assignments of system entitlements for cloud target systems if the inheritance settings defined in the manage level are changed.

36020

The O3SWeb.Description column is too short.

36025

Provisioning processes in a target system go into a Frozen state if a password containing special characters is transferred with encryption.

36043

There is no recalculation of the effective assignments of system entitlements for custom target systems if the inheritance settings defined in the manage level are changed.

36045

An error occurs in the One Identity Safeguard connector if tags are used in object filters.

36063

Error changing an employee's default email address if they have an Azure Active Directory user account with an Exchange Online mailbox.

36088

When a synchronization project is created over a remote connection, an error can occur during deserialization.

36089

A synchronization simulation quits unexpectedly if a remote connection is used.

36092

PATCH operations generated for schema extension properties cause an error in the SCIM connector.

A patch with the patch ID VPR#36108 is available for synchronization projects.

36108

In the Synchronization Editor, the timeout for a remote connection is too short. For example, this can cause errors when creating a synchronization project over a remote connection.

The timeout has been increased to 3 minutes to solve the issue. If this timeout is not sufficient, you can adjust the following value in the SynchronizationEditor.exe.config file.

<remoting>

<add key="RequestTimeout" value="180" />

</remoting>

36112

When a synchronization project is created over a remote connection, an error can occur if the volume of data is too big.

36123

If the One Identity Manager database is encrypted, the system mistakenly encrypts the ExpirePassword connection parameter in synchronization projects with the LDAP connector for IBM RACF.

36136

A scope filter configured hierarchically in a connected LDAP target system with a Microsoft implementation (Active Directory Lightweight Directory Service (AD LDS) or Active Directory) has no effect.

36141

Ineffective memberships in cloud groups or system entitlements are provisioned.

A patch with the patch ID VPR#36150 is available for synchronization projects.

36150

The Manager does not display the menu item for user accounts and groups of cloud target systems correctly.

36155

In the UNSAccount proxy table, the AccountName column for the EX0MailBox, EX0MailContact, and EX0MailUser tables is empty.

36163

An error occurs when the Synchronization Editor performs a consistency check on schedules with multiple start times.

36164

Errors can occur when writing the synchronization log.

36168

Connecting to an Azure Active Directory tenant with schema extensions for types that are not currently supported by the Azure Active Directory connector ("device" for example) causes an error.

Error message: Object reference not set to an instance of an object.

36170

Dynamic memberships of Azure Active Directory user accounts in Office 365 groups that are marked as outstanding cannot be deleted by target system synchronization.

36180

A conversion error occurs for Oracle.ManagedDataAccess.Types.OracleDecimal' when objects in a table are added in a sequence.

36195

If a scope file was defined, an error occurs adding new objects with the SCIM connector because of an incorrect query.

36211

Single roles contained in collective roles cause errors with double entries in the One Identity Manager database when synchronizing SAP role assignments to user accounts in a CUA.

36218

In the Synchronization Editor, the start up configuration list that can be assigned to a start up sequence is empty.

36226

It is not possible to select an account definition for the Active Directory domain on the Microsoft Exchange mailbox or the Exchange hybrid remote mailbox forms.

36228, 36257

It is not possible to delete a SharePoint Online site collection with an assigned administrator (O3SSite.UID_O3SUserPrimaryAdmin).

36232

No OneLogin user accounts can be assigned to employees.

36241

Certain SAP communication data such as preferred telephone numbers or preferred email addresses that are marked as outstanding, cannot be deleted during target system synchronization.

36264

Error displaying schema types in the target system browser of a SAP HCM system's synchronization project if a hierarchy is defined that contains a circular reference.

36270

No passwords are transferred to the LDAP target system if the LDAP connector V2 is being used.

A patch with the patch ID VPR#36271 is available for synchronization projects.

36271

It is possible that new objects do not display meaningful values if they were incompletely mapped.

36283

An error occurs updating LDAP synchronization projects.

Error message: Error running the Apply' script of patch (VPR#33513 - Support multiple domains with the same DN)!

36286

The ADS_PersonHasTSBAccountDef_Autocreate_ADSAccount/Contact process goes into a Frozen state in the Wait until dependent objects recalled process step.

36298

If errors occur loading target system objects, synchronization quits even though the workflow has the Continue on error option enabled.

36311

Using the O3S_CreateO3SSite script to add SharePoint Online site collections does not work if modern authentication with a certificate is used.

36322

The DBQueue Processor removes Active Directory user accounts from Active Directory groups that have the Read-only memberships property (ADSGroup.HasReadOnlyMemberships).

36327

The target system browser for Exchange Online objects sometimes displays GUIDs instead of readable values.

36330

The Azure Active Directory connector sends unnecessary (empty) patches after a group is updated where only members or owners have changed.

36345

The filters generated in the SCIM connector for resolving references are not formatted correctly.

36347

LDAP user accounts and groups cannot be deleted if they are connected to a SharePoint user account.

36354

Active Directory user accounts and groups cannot be deleted if they are connected to a SharePoint user account.

36354

Unnecessary updates are triggered by the LDAP connector if there are empty values.

36372

Filters in the SCIM connector may not contain sufficient data to query objects in the target system.

36379

Virtual properties for resolving references attempt to use the synchronization buffer in target systems.

36392

Error provisioning object changes if the DPRProjectionObjectState table contains object references with the System.Byte[] object type. Error message: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.

36399

It is not possible to enter multiple lines of encrypted data in the Synchronization Editor.

36440

The User account is disabled property for user accounts (LDAPAccount.AccountDisabled) is not taken into account in the LDAP connector V2.

A patch with the patch ID VPR#36450 is available for synchronization projects.

36450

Process steps for setting permissions and publishing are not carried out if the home directory of Active Directory user accounts with unknown home directory paths is moved.

36470

Provisioning assignments of SAP BI user account to BI analysis authorizations takes a very long time and sends a lot of RFC queries to the SAP application server.

36474

An error occurs creating the Send as and Full access mailbox permissions for Microsoft Exchange remote mailboxes.

36456

An error occurs when multiple custom target system user accounts or groups are selected in the Manager.

36512

Authentication via WindowsHttpAuthentication does not work in the One Identity Manager Service.

36552

Under certain conditions, processes that should be exported together to a History Database are not grouped into a process group.

36438

Error during delta synchronization of Azure Active Directory group memberships.

36481

The target system's own cross-site scripting tokens are not sent to the SCIM provider in the header of a write operation.

34554

If the InternetAddress schema property is empty, a warning is written in the system journal when HCL Domino is synchronized (not initial synchronization).

A patch with the patch ID VPR#35816 is available for synchronization projects.

35816

The value in the AADUser.ThumbnailPhoto column is not provisioned in the target system.

36586

Changes to the Microsoft Exchange mailbox databases in One Identity Manager are overwritten by old values.

A patch with the patch ID VPR#36151 is available for synchronization projects.

36151

Error synchronizing a cloud application with the SCIM connector when filters are defined in the synchronization project.

36590

Error loading objects if a schema extension for an SAP R/3 synchronization project has a key property defined that is longer that 70 characters.

36491

Error provisioning assignments of SAP BI analysis authorizations to BI user accounts if assignment is across clients.

36518

Sometime the calculation of assignment from cloud user accounts to cloud groups fails.

36404

Error generating the synchronization log if a new value contains a very long string.

36630

Error loading objects lists via remote connections.

36128

Error provisioning a new Microsoft Teams team.

36682

When memberships are removed from Unix groups, other memberships that should not be removed are deleted.

36679

Table 8: Identity and Access Governance

Resolved issue

Issue ID

Under certain conditions, entries in the PWOHelperPWO table are not recalculated.

35972

Duplicate entries in the AttestationHelper table. Sporadically, entries are created twice in the auxiliary table for attestation cases (AttestationHelper). This means the number of email notifications is doubled. If the approval workflow contains an approval step for external approval, the process for external approval is generated twice.

36000

Permissions missing from the vi_4_ITSHOPADMIN_OWNER permissions group for the columns ADSGroup.HasReadOnlyMemberships and AADGroup.HasReadOnlyMemberships.

36078

Application entitlements that are created automatically might not have a display name.

36094

The CreateITShopOrder method for creating assignment requests for memberships in Exchange Online mail-enabled distribution groups is missing.

36160

The TSBVPersonAndGroups view can contain duplicates. For example, this can cause errors generating reports about the origin of entitlements.

36187

If the display pattern for the Person table is customized such that the InternalName column is not used anymore, errors occur when generating email notifications for the next approver.

36214

Office 365 groups are not taken included when determining the origin of entitlements.

36217

The Analyzer cannot run an analysis after the database connection has changed.

36253

If the QER | ITShop | ExceededValidUntilUnsubscribe configuration parameter is set, unsubscribing processes quit unexpectedly with an error.

36274

Under certain conditions, those responsible for organizations are not deleted.

  • An application role is assigned to a department as an additional manager.

  • An employee becomes a member of this application role by assignment request.

  • The assignment is canceled.

However, the employee remains manager of the department (entries in the HelperHeadOrg table with XOrigin = 8 are not deleted).

36301

End users are missing edit permissions for the AttestationHistory table.

36302

If an approval decision is made when a request is created, no email notification is sent to the requester.

36318

Error attesting objects with properties that are disabled by a pre-processor conditions.

36370

Too many recalculation tasks are generated by removing the mutually exclusive entry from Active Directory groups.

36079

The Analyzer does not run without an error.

36197

Attestation procedures are loaded too often if users have limited permissions.

35862

An error occurs if multiple attestation runs are created simultaneously for an attestation policy. Only one attestation run is created. The processes to generate further attestation runs fail.

36364

Error attesting if the attestation was delegated and the length of the text in the reason for the approval decision is longer than 400 characters.

36267

If identifiers were issued manually in the working copy of a rule, incorrect identifiers are formed for compliance rules and subrules (UID_ComplianceRule and UID_ComplianceSubRule) when compliance rules are enabled.

36266

DBQueue Processor requests CPL-K-ComplianceSubRuleFillPersonS block each other, are reset repeatedly, and are not processed.

36297

An error occurs running the System entitlement ownership attestation default attestation policy.

32864

The permissions to edit a dynamic role's role/organization in the Manager are wrong. 36106

Given values are not in permitted in the approval sequence for the affected approval's type (PWODecisionHistory.DecisionType).

35015

If there is no employee assigned to the product owner application roles, they will be deleted even if they are assigned to a service item or service category.

36421

If a shopping cart with request parameters is sent off and the request is automatically approved because the QER | ITShop | DecisionOnInsert configuration parameter is set, the request parameters are missing from the request procedure.

34993

If request parameters are given for a request, the UIDs are displayed in the request history instead of the parameters' display names.

36207

When requests are canceled because the requested product has been removed from the IT Shop, the request recipients are not notified, although a mail template, Cancel, is stored with the approval policy.

35616

Sporadically, there are double entries in the auxiliary table for request procedures (PWOHelperPWO).

36139

Error assigning service items to Azure Active Directory groups marked with the Read-only memberships property(ADSGroup.HasReadOnlyMemberships).

36528

Approval procedures stop responding when the number of approvers is set to -1.

36443

In the Manager, multiple pending requests cannot be canceled at the same time.

36490

Error calculating memberships in dynamic roles: The current transaction cannot be committed and cannot support operations that write to the log file.

36531

If the product owner of a service item in an Azure Active Directory group changes, the members of the originally assigned application role remain as group owners. If the product owner of a service item in an Exchange Online e-mail enabled distribution group changes, the members of the originally assigned application role remain administrators of the distribution group.

35064

Events on the Person base object are not generated properly if management of an employee's role memberships (like the primary department) is automated via IT Shop requests.

36614

If a customer is removed from a shop in which they have requests and this customer is authorized to request the same product in another shop, then the changes are not illustrated clearly in the approval history.

35058

See also:

Known issues

The following is a list of issues, including those attributed to third-party products, known to exist at the time of release.

Table 9: General
Known Issue Issue ID

Error in the Report Editor if columns are used that are defined as keywords in the Report Editor.

Workaround: Create the data query as an SQL query and use aliases for the affected columns.

23521

Access errors can occur if several instances of the Web Installer are started at the same time.

24198

Headers in reports saved as CSV do not contain corresponding names.

24657

Invalid module combinations can be selected in the Configuration Wizard. This causes errors at the start of the schema installation.

Cause: The Configuration Wizard was started directly.

Solution: Always use autorun.exe for installing One Identity Manager components. This ensures that you do not select any invalid modules.

25315

Error connecting via an application server if the certificate's private key, used by the VI.DB to try and encrypt its session data, cannot be exported and the private key is therefore not available to the VI.DB.

Solution: Mark the private key as exportable if exporting or importing the certificate.

27793

Error resolving events on a view that does not have a UID column as a primary key.

Primary keys for objects in One Identity Manager always consist of one, or in the case of M:N tables, two UID columns. This is basic functionality in the system.

The definition of a view that uses the XObjectKey as primary key, is not permitted and would result in more errors in a lot of other places.

The consistency check Table of type U or R with wrong PK definition is provided for testing the schema.

29535

If the One Identity Manager database is installed in an SQL cluster (High Availability Group) and the option DTC_SUPPORT = PER_DB is set, replication between the server is done by Distributed Transaction. If a Save Transaction is run in the process, an error occurs: Cannot use SAVE TRANSACTION within a distributed transaction.

Solution: Disable the option DTC_SUPPORT = PER_DB.

30972

If no date is given, the date 12/30/1899 is used internally. Take this into account when values are compared, for example, when used in reports. For detailed information about displaying dates and time, see the One Identity Manager Configuration Guide.

31322

Variables are used in a report and there are customized translations given for these variables in the Report Editor. However, the variables are not translated in the report that is generated.

Cause: When reports are generated, the translations of default variables as displayed in the Report Designer dictionary below the Quest category are overwritten with the values from the One Identity Manager database.

Solution: Create your own variables and store them outside of the Quest category in the Report Designer dictionary. These variables can be translated.

36686

Table 10: Web applications

Known Issue

Issue ID

The error message This access control list is not in canonical form and therefore cannot be modified sometimes occurs when installing the Web Portal with the Web Installer. The error occurs frequently after a Windows 10 Anniversary Update.

Solution: Change the permissions for the users on the web application's parent folder (by default C:\inetpub\wwwroot) and apply the changes. Then revoke the changes again.

26739

In the Web Portal, a product’s request properties are not transferred from the original request to the shopping cart if the request is renewed or canceled.

Cause: Request properties are saved in separate custom columns.

Solution: Create a template for (custom) columns in the ShoppingCartItem table that stores the request properties when the request is made. This template must load the request properties from the identical (custom) columns in the PersonWantsOrg table relating to this request.

32364

It is not possible to use the Web Designer to place a link in the header of the Web Portal next to the company name/logo.

32830

In the Web Portal, it is possible to subscribe to a report without selecting a schedule.

Workaround:

  • Create an extension to the respective form, which displays a text message under the menu explaining the problem.
  • Add a default schedule to the subscribable report.
  • In the Web Designer, change the Filter for subscribable reports configuration key (VI_Reporting_Subscription_FilterRPSSubscription) and set the schedule's Minimum character count value (UID_DialogSchedule) to 1.

32938

If the application is supplemented with custom DLL files, an incorrect version of the Newtonsoft.Json.dll file might be loaded. This can cause the following error when running the application:

System.InvalidOperationException: Method may only be called on a Type for which Type.IsGenericParameter is true.
at System.RuntimeType.get_DeclaringMethod()

There are two possible solutions to the problem:

  • The custom DLLs are compiled against the same version of the Newtonsoft.Json.dll to resolve the version conflict.

  • Define a rerouting of the assembly in the corresponding configuration file (for example, web.config).

    Example:

    <assemblyBinding >
    <dependentAssembly>
    <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30AD4FE6B2A6AEED" culture="neutral"/>
    <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0"/>
    </dependentAssembly>
    </assemblyBinding>

33867

In the Web Portal, the details pane of a pending attestation case does not show the expected fields if the default attestation procedure is not used, but a copy of it is.

Solution:

  • The object-dependent references of the default attestation procedure must also be adopted for the custom attestation procedure.

34110

Table 11: Target system connection
Known Issue Issue ID

Memory leaks occur with Windows PowerShell connections, which use Import-PSSession internally.

23795

By default, the building block HR_ENTRY_DATE of an SAP HCM system cannot be called remotely.

Solution: Make it possible to access the building block HR_ENTRY_DATE remotely in your SAP HCM system. Create a mapping for the schema property EntryDate in the Synchronization Editor.

25401

Any existing secondary SIP addresses are converted into primary email addresses when Microsoft Exchange mailboxes are added, providing that no primary SIP addresses are stored until now. 27042

Error in Domino connector (Error getting revision of schema type ((Server))).

Probable cause: The HCL Domino environment was rebuilt, or numerous entries have been made in the Domino Directory.

Solution: Update the Domino Directory indexes manually in the HCL Domino environment.

27126

The SAP connector does not provide a schema property to establish whether a user has a productive password in SAP R/3.

If this information is meant to be in One Identity Manager, extend the schema and the synchronization configuration.

  • Add a custom column to the table SAPUser.
  • Extend the SAP schema in the synchronization project by a new schema type that supplies the required information.
  • Modify the synchronization configuration as required.

27359

Error provisioning licenses in a central user administration's child system.

Message: No company is assigned.

Cause: No company name could be found for the user account.

Solution: Ensure that either:

  • A company, which exists in the central system, is assigned to user account.

    - OR -

  • A company is assigned to the central system.

29253

Certain data is not loaded during synchronization of SAP R/3 personnel planning data that will come into effect later.

Cause: The BAPI_EMPLOYEE_GETDATA function is always run with the current date. Therefore, changes are taken into account on the exact day.

Solution: To synchronize personnel data in advance that comes into effect later, use a schema extension and load the data from the table PA0001 directly.

29556

Target system synchronization does not show any information in the Manager web application.

Workaround: Use Manager to run the target system synchronization.

30271

The following error occurs in One Identity Safeguard if you request access to an asset from the access request policy section and it is configured for asset-based session access of type User Supplied:

400: Bad Request -- 60639: A valid account must be identified in the request.

The request is denied in One Identity Manager and the error in the request is displayed as the reason.

796028, 30963

Inconsistencies in SharePoint can cause errors by simply accessing a property. The error also appears if the affected schema properties mapping is disabled.

Cause: The SharePoint connector loads all object properties into cache by default.

Solution:

  • Correct the error in the target system.

    - OR -

  • Disable the cache in the file VI.Projector.SharePoint.<Version>.Host.exe.config.

31017

If a SharePoint site collection only has read access, the server farm account cannot read the schema properties Owner, SecondaryContact, and UserCodeEnabled.

Workaround: The properties UID_SPSUserOwner and UID_SPSUserOwnerSecondary are given empty values in the One Identity Manager database. This way, no load error is written to the synchronization log.

31904

If date fields in an SAP R/3 environment contain values that are not in a valid date or time formats, the SAP connector cannot read these values because type conversion fails.

Solution: Clean up the data.

Workaround: Type conversion can be disabled. For this, SAP .Net Connector for .Net 4.0 on x64, version 3.0.15.0 or later must be installed on the synchronization server.

IMPORTANT: The solution should only be used if there is no alternative because the workaround skips date and time validation entirely.

To disable type conversion

  • In the StdioProcessor.exe.config file, add the following settings.
    • In the existing <configSections>:

      <sectionGroup name="SAP.Middleware.Connector">

      <section name="GeneralSettings" type="SAP.Middleware.Connector.RfcGeneralConfiguration, sapnco, Version=3.0.0.42, Culture=neutral, PublicKeyToken=50436dca5c7f7d23" />

      </sectionGroup>

    • In the new section:

      <SAP.Middleware.Connector>

      <GeneralSettings anyDateTimeValueAllowed="true" />

      </SAP.Middleware.Connector>

32149

There are no error messages in the file that is generated in the PowershellComponentNet4 process component, in OutputFile parameter.

Cause:

No messages are collected in the file (parameter OutputFile). The file serves as an export file for objects returned in the pipeline.

Solution:

Messages in the script can be outputted using the *> operator to a file specified in the script.

Example:

Write-Warning "I am a message" *> "messages.txt"

Furthermore, messages that are generated using Write-Warning are also written to the One Identity Manager Service log file. If you want to force a stop on error in the script, you throw an Exception. This message then appears in the One Identity Manager Service's log file.

32945

The Google Workspace connector cannot successfully transfer Google applications user data to another Google Workspace user account before the initial user account is deleted. The transfer fails because of the Rocket application's user data.

Workaround: In the system connection's advance settings for Google Workspace, save a user data transfer XML. In this XML document, limit the list to the user data to be transferred. Only run the Google applications that have user data you still need. For more information and an example XML, see One Identity Manager Administration Guide for Connecting to Google Workspace.

33104

In the schema type definition of a schema extension file for the SAP R/3 schema, if a DisplayPattern is defined that has another name in the SAP R/3 schema as in the One Identity Manager schema, performance issue may occur.

Solution: Leave the DisplayPattern empty in the schema type definition. Then the object's distinguished name is used automatically.

33812

If target system data contains appended spaces, they go missing during synchronization in One Identity Manager. Every subsequent synchronization identifies the data changes and repeatedly writes the affected values or adds new objects if this property is part of the object matching rule.

Solution:

Avoid appending spaces in the target system.

33448

The process of provisioning object changes starts before the synchronization project has been updated.

Solution:

Reactivate the process for provisioning object changes after the DPR_Migrate_Shell process has been processed.

 

After an update from SAP_BASIS 7.40 SP 0023 to SP 0026 or SAP_BASIS 7.50 SP 0019 to SP 0022, the SAP R/3 connector can no longer connect to the target system.

34650

Table 12: Identity and Access Governance

Known Issue

Issue ID

During approval of a request with self-service, the Granted event of the approval step is not triggered. In custom processes, you can use the OrderGranted event instead.

31997

If an assignment is inherited through a role hierarchy, bit 1 is set on the inherited assignment. Inherited assignments are consequently always indirectly assigned, even if they were originally created directly by a dynamic role or an assignment request.

35193

If a service item has its Max. days valid option reduced such that approved requests are already expired, these requests cannot be unsubscribes anymore.

Solution:

Create a process for the AccProduct base object that is triggered when changes are made to AccProduct.MaxValidDays. The process calculates the 'valid until' date for these requests (PersonWantsOrg.ValidUntil) from PersonWantsOrg.ValidFrom and AccProduct.MaxValidDays.

After which, you can unsubscribe the requests.

36349

Table 13: Third party contributions
Known Issue Issue ID

Installing the One Identity Manager Service with the Server Installer on a Windows Server does not work if the setting File and Printer sharing is not set on the server. This option is not set on domain controllers on the grounds of security.

24784

An error, TNS-12516, TNS-12519 or ORA-12520, sporadically occurs when connecting with an Oracle Database. Reconnecting normally solves this.

Possible cause: The number of processes started has reached the limit configured on the server.

27830

Cannot navigate with mouse or arrow keys in a synchronization log with multiple pages.

Cause: The StimulReport.Net component from Stimulsoft handles the report as one page.

29051

Valid CSS code causes an error under Mono if duplicate keys are used. For more information, see https://github.com/mono/mono/issues/7455.

762534, 762548, 29607

Memberships in Active Directory groups of type Universal in a subdomain are not removed from the target system if one of the following Windows updates is installed:

  • Windows Server 2016: KB4462928

  • Windows Server 2012 R2: KB4462926, KB4462921

  • Windows Server 2008 R2: KB4462926

One Identity does not know whether other Windows updates also cause this error.

The Active Directory connector corrects this behavior with a workaround by updating the membership list. This workaround may deteriorate the performance of Active Directory group provisioning and will be removed from future versions of One Identity Manager once Microsoft has resolved the problem.

30575

Under certain conditions, the wrong language is used in the Stimulsoft controls in the Report Editor.

31155

When connecting an external web service using the web service integration wizard, the web service supplies the data in a WSDL file. This data is converted into Visual Basic .NET code with the Microsoft WSDL tools. If, in code generated in this way, default data types are overwritten (for example, if the boolean data type is redefined), it can lead to various problems in One Identity Manager.

31998

In certain Active Directory/Microsoft Exchange topologies, the Set-Mailbox Cmdlet fails with the following error:

Error on proxy command 'Set-Mailbox...'

The operation couldn't be performed because object '...' couldn't be found on '...'.

For more information, see https://support.microsoft.com/en-us/help/4295103.

Possible workarounds:

  • Connect to the Microsoft Exchange server that the user mailbox is on. Use a custom process to do this. Use the OverrideVariables parameter (ProjectorComponent process component) to overwrite the server (CP_ExchangeServerFqdn variable).

  • Because this problem only occurs with a few schema properties, you should consider protecting these schema properties in the synchronization project against write operations. You can set the schema properties in a custom process using the PowershellCompomentNet4 process component through a user-defined Windows PowerShell call.

33026

Schema changes

The following provides an overview of schema changes from version 9.1 up to version 9.1.1.

Configuration Module
  • The QBMColumnLimitedValue.KeyValue column was extended to nvarchar(256).

Target System Base Module
  • The data type of the UNSAccountInUNSGroup.XIsInEffect column was changed to bit.

Active Directory Module
  • The data type of the ADSVAccountInADSGroup.IsMembership, ADSVAccountInADSGroup.IsPrimary, and ADSVAccountInADSGroup.XIsInEffect columns was changed to bit.

  • The data type of the ADSVMachineInADSGroup.IsMembership, ADSVMachineInADSGroup.IsPrimary, and ADSVMachineInADSGroup.XIsInEffect columns was changed to bit.

SharePoint Online Module
  • The O3SWeb.Description column was extended to nvarchar(max).

SAP R/3 User Management module Module
  • The data type of the SAPVSAPUserInSAPRoleAll.XIsInEffect column was changed to bit.

Identity Management Base Module
  • The data type of the QERVPersonHasElement.XIsInEffectOfPersonAssignment column was changed to bit.

Compliance Rules Module
  • New columns ComplianceRule.RiskDescription, ComplianceRule.RiskObjectives, ComplianceRule.RiskOrgMitigationCtrl, and ComplianceRule.RiskScope for extending compliance rules.

Changes to system connectors

The following provides an overview of the modified synchronization templates and an overview of all patches supplied by One Identity Manager version 9.1 up to version 9.1.1. Apply the patches to existing synchronization projects. For more information, see Applying patches to synchronization projects.

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione