Identity Manager 9.2.1 - Release Notes

Error handling processes after a database was restored from a backup.

Error message: Script assembly WebServices_<...> not found in 'DialogScriptAssembly'.

The Configuration Wizard does not process calculation tasks for the DBQueue Processor when a database is restored.

An update migration from One Identity Manager versions 8.1.x or 8.2.x with granulated permissions to versions 9.0, 9.1, or 9.2 leaves behind permissions for the msdb database that are no longer required.

Using single sign-on to log in to the Manager does not work if the web application is connected via an application server.

Token authentication on the application server using OAuth2.0/OpenID Connect on the /api/script/... endpoint does not work.

In the Report Editor, report queries and parameters are not assigned to change labels when they are saved.

In the Manager web application, an error sometimes occurs when you double click on an icon.

The definition file for view tables with foreign key relationships created with Schema Extension is missing the foreign key information.

An error occurs logging in to the Launchpad via OAuth.

Errors can occur if a template is run on several objects at the same time.

If the Common | ProcessState | PropertyLog | AllDefaultPropertiesForModel configuration parameter is set, changes to account definition assignments to roles and organizations are now also logged.

Threshold values of predefined statistics definitions can now be configured by customers.

Errors can occur when process history records are transferred to the History Database.

Error message: Cannot insert duplicate key in object 'dbo.HistoryJob'.

An error sometimes occurs when a session is discarded in the application server client.

Error message: System.ObjectDisposedException: The session is already disposed.

Updating the database from One Identity Manager version 8.2.x to version 9.2.x fails.

Errors can occur selecting multiple processes in the Job Queue Info.

If the SQL Server name contains special characters (such as \, ?, or :), the Database Transporter generates an invalid name for the transport file. Special characters are now replaced with an underscore (_).

In certain constellations, schedules are started twice within a minute.

Errors sometimes occur in Job Queue Info if there are entries from History Database to be displayed.

Installing of the One Identity Manager schema in an empty database fails if the installation user used is not a member of the dbcreator server role.

Compilation error when updating the One Identity Manager database to version 9.2 if the QER | Policy configuration parameter was not set in the existing installation.

Incorrect calculation and evaluation of the effectiveness of historical assignments in reports.

An error occurs transporting change labels that contain delete operations on schema data.

Error message: Object of type Additional view definition does not exist in database or you do not have the relevant viewing permissions.

After reactivating process steps, warnings are recorded in the system journal.

If the Debug information level is used for logging, errors may occur when front-ends open.

In the Job Queue Info, filters in the process history are incorrect.

Clicking elements in the result list sometimes triggers a drag and drop event that might result in subsequent errors.

The DBQueue Processor task for creating database server permissions fails if the schema name contains a backslash (\).

If the Address parameter in a process that sends an email notification is empty, the process does not fail.

Incorrect calculation of the time zone for the database server.

If a failed process step is manually forwarded to the error branch or the success branch, the information is logged in the subsequent process step.

If the top process step in a process is moved, the necessity to compile is not detected.

Performance issues running the maintenance task to reduce the process history.

Data is missing in simple list reports that use the VI_Reporting_DefaultTemplate default report as a template.

In Job Queue Info, filters on the JobHistory table that were created in an older One Identity Manager version are no longer displayed.

Under certain conditions, deleting entries from the system journal causes performance problems or blocks the database.

Under certain conditions, an error occurs when running the SQL Clause Executable (QER) consistency check.

The English country code for the Republic of Türkiye has been corrected (Türkiye).

Entries for the Pwd_DeniedChars and Pwd_Quality translation keys are missing in the database. These are used in the description of the password rules.

Performance issues after updating a History Database.

If Change Data Capture (CDC) is enabled for the One Identity Manager database, the Missing tables in dialogtable (base) consistency check fails.

In the Web Portal, the search sometimes quits and shows an error.

An error occurs in the Web Portal if a report is made available for identities that have already been indirectly assigned.

The list of approvers and attestors in the Web Portal is not complete.

The system status is not displayed correctly in the Operations Support Web Portal.

When attesting PAM user accounts, the wrong times are displayed in the Web Portal in the date for the last login and the last use.

When a manager selects their employees' rule violations, queries can take a very long time.

The Web Portal search does not return the correct results if an asterisk (*) is included as a placeholder.

In the Web Portal, no service item can be created for an Active Directory group.

Calculating the loss of entitlements when attestation cases are denied, takes too long.

In the Web Portal, request properties for products in a service category are not inherited correctly by the products in the child service categories.

In the Web Portal, responsibility of the current identity for another identity is not determined correctly.

In the Web Portal, the Sponsor column is not displayed when approving attestation cases for new self-registered users.

In the Operations Support Web Portal, the Passwords tab in the identity overview is empty.

In the Web Portal, under certain conditions, the selected recipients displayed for a new request do not match the actual selection.

The Password Reset Portal does not allow password questions to be edited.

Certain reports cannot be created in the Web Portal.

The API Server does not start under Linux.

In the Web Portal, displaying user accounts (UNSAccount) in the Data Explorer takes too long.

The Web Portal does not update the number of pending requests, attestations, and rule violations.

In the Web Portal, it is possible to create a delegation although the Valid until mandatory value is empty.

The search and filter for product bundles does not work in the Web Portal and causes other errors.

Under certain conditions, it is not possible to use password questions to log in to the Password Reset Portal because the incorrect function is used to find the current user.

The API Server sometimes does not extract/process the HTML5 web applications correctly.

The Web Portal does not transfer all the request parameters for products to the shopping cart.

In the Web Portal, the scrollbar is missing on the list of attestors for an attestation run.

In the Web Portal, opening the Compliance Rules page causes an error if you have previously saved a custom view.

If you call up a URL that opens the Web Portal requests page with a predefined search query, the search field is not filled out correctly and the search is not run.

Although the configuration parameters for peer group analysis have been disabled (QER | ITShop | PeerGroupAnalysis | CheckCrossfunctionalAssignment, QER | Attestation | PeerGroupAnalysis | CheckCrossfunctionalAssignment, QER | ITShop | PeerGroupAnalysis, QER | Attestation | PeerGroupAnalysis), the associated approval recommendations are still calculated and displayed to Web Portal users.

Installation of the API Server with an account-based system user fails.

In the Operations Support Web Portal, process steps that are not at root level cannot be run again.

Under certain conditions, the Web Portal is not displayed completely in the correct language.

In the Web Portal, an error occurs if you open the shopping cart containing a product that is not assigned to a service category.

A product is placed in the Web Portal shopping cart even though the action was canceled.

When exporting attestation cases from the Web Portal, the names of the objects involved are not displayed correctly.

The script for determining the value is not run correctly. This means that no initial values for request properties are displayed in the Web Portal.

Some configuration settings of API Servers are not loaded correctly from the configuration files.

Error creating an attestation policy in the Web Portal if an attestation procedure is assigned that was copied from a default attestation procedure.

Error: The SQL statement in the field 'Condition' is not correct. (4373909)

In the Web Portal, no more than 20 child service categories of a service category can be displayed when requesting products.

In the Web Portal, the list of products is not reloaded on the requests page after the recipient has been changed.

The Web Portal does not always display all the entries in a drop-down.

The color of the header bar in HTML5 web applications cannot be completely changed using a custom theme.

The Log in button in the web applications hardly differentiates from the background and is therefore barely visible.

In the Web Portal, not all associated entitlements are displayed in the requestable product details.

The Web Portal does not display a scroll bar in the identity organization chart.

In the Web Portal, product owners cannot unsubscribe requests for membership in system entitlements they manage.

If the RISKINDEX preprocessor condition is not set, the API cannot be compiled.

In the Web Portal, it is not always possible to change the format of the reports to be displayed.

In the Web Portal, an error occurs if a pending attestation is opened.

The Web Portal does not show the history of identities without user accounts if the user accounts have been deleted in the meantime.

Under certain conditions, the View Settings menu in the Web Designer Web Portal is shown twice.

Variables in code are no longer detected in the Web Designer.

Under certain conditions, the Web Designer Web Portal goes into an infinite loop whilst displaying and closing an error message.

The Web Designer Web Portal does not correctly differentiate between time zones with identical times but different names.

Under certain conditions, you can display logs in the Web Designer Monitor.

In the Web Designer, it is possible to select the Extended properties options on a Warning node.

Decreased performance Web Designer Web Portal when using the Apply To All function in a shopping cart with a lot of items.

Hyperviews of system entitlements cannot be displayed in the Web Designer Web Portal.

The Web Designer Web Portal incorrectly displays a time picker for the Disable until property in identity main data.

The Web Designer Web Portal does not display all information in a hyperview.

In the Web Designer Web Portal, editing properties of multiple products in the shopping cart does not work properly.

Color settings in the Web Designer Web Portal are not applied correctly.

In the Web Designer Web Portal hyperviews, there are no more forwarding links.

In the Web Designer Web Portal, pressing the Enter key in the filter dialog does not always work.

The Web Designer Web Portal does not correctly identify all time zones. This causes an error.

In the Web Designer, translations cannot be customized manually.

In the Web Designer Web Portal, errors occur in the group count and in pagination when data is grouped.

The Web Designer Web Portal does not show the history of identities without user accounts if the user accounts have been deleted in the meantime.

When removing a Microsoft Exchange mailbox account definition, the Active Directory user account might get deleted.

Error provisioning outstanding cloud user accounts.

Changes to an identity's telephone numbers are not forwarded to Exchange Online mail users with the Full managed manage level.

Performance issues when loading SAP user account overview forms.

If a connection parameter is deleted in the connector definition of a synchronization project for connecting a target system via the Windows PowerShell connector and then the target system schema is reloaded, the connection parameter is not updated in the One Identity Manager database (DPRSystemConnection.ConnectionParameter).

The Domino connector does not recognize users or person documents that were newly created in Domino only shortly before synchronizing with the One Identity Manager database.

When testing the connection settings in the project wizard, the SCIM connector cannot establish a connection to the cloud application if OAuth authentication is used and the connection parameter contains special characters.

Write protection for a synchronization project opened by multiple users at the same time in Synchronization Editor does not work correctly.

Possible errors when synchronizing a SharePoint Online environment

Error message: Duplicate key (reference resolution)

A patch with the patch ID VPR#37272 is available for synchronization projects.

An error sometimes sporadically occurs when evaluating a synchronization simulation.

Error message: Object not set to a reference of an object.

User accounts that are automatically created via account definitions are not enabled because the account expiry date is set to a value in the past if the last working day entry for associated identities is not given.

Memberships in Azure Active Directory administrator roles cannot be loaded.

Memberships in application roles are not written when synchronizing with the CSV connector if the primary key of the Person table is used as the key property in the mapping.

An error occurs loading LDAP groups with a lot of members.

Error message: Invalid data. Data of type (System.Object[]) is not supported.

Error loading a PostgreSQL database schema.

Error message: [System.OverflowException] Arithmetic operation resulted in an overflow.

After changing the membership in a system entitlement, the DBQueue Processor task for updating the XDateSubItem column is not reset, even though there are processing tasks for the same object in the Job queue.

Group memberships of Azure Active Directory user accounts are deleted when the corresponding memberships in Exchange Online are enabled.

When synchronizing SAP authorization objects, not all objects in the USOBHASH table are read into the One Identity Manager database if SAP BASIS version 7.57 (SAP S/4HANA 2022) or later is used in the synchronized SAP R/3 environment.

Import the current SAPTRANSPORT_70.ZIP transport into the SAP R/3 system you want to synchronize. This uses the /VIAENET/LISTUSOBHASH function module instead of the AUTH_TRACE_GET_USOBHASH SAP module. When accessing SAP R/3, the SAP R/3 connector checks whether the /VIAENET/LISTUSOBHASH function module is available and uses it. This synchronizes all objects in the USOBHASH table. The synchronization log records whether the /VIAENET/LISTUSOBHASH function module is used.

Error establishing a remote connection in the Synchronization Editor.

Error message: An existing connection was forcibly closed by the remote host.

Some of the PAM asset group and PAM account group columns are too short.

Error writing data to tables in a PostgreSQL database if the table contains a column whose value is incremented automatically.

Under certain conditions, an error occurs when synchronizing Exchange Online.

Error message: You must call Connect-ExchangeOnline before calling any other cmdlet.

If the token directory for the Azure Active Directory delta synchronization is not configured correctly, a more meaningful error is displayed.

System users who have read-only permissions were able to delete, reset, and publish objects on the form for target system synchronization objects.

An error occurs loading LDAP synchronization projects from older One Identity Manager versions.

Error setting up synchronization with the generic database connector for the generic ADO.NET provider, SAP HANA databases, and DB2 (LUW) databases if the connection configuration is loaded from a UDL file.

Error message: DistributionConnector: Error connecting the system. Unable to load the UDL file.

If several synchronizations are run in parallel from a start up sequence and at least two synchronizations are completed at the same time, it is possible that the start up sequence never completes.

Error connecting to a cloud application using the SCIM connector if authenticating via the OAuth protocol 2.0.

A patch with the patch ID ADO#444262 is available for synchronization projects.

In the Manager, an account definition cannot be selected on the main data form when creating a new Active Directory contact.

Error creating a synchronization project with the One Identity Manager connector if the connected database is older than version 9.0.

Error in the One Identity Manager connector when connecting to a version 8.2 database.

Error message: Invalid column name 'SyncInfo'.

Assignments of cloud user accounts to cloud groups are not deleted from the One Identity Manager database during synchronization under the following conditions:

• Synchronization is configured so that objects are deleted immediately if they only exist in the database.

• These are direct assignments.

• Assign by event is enabled for the CSMUserInGroup table.

Target system objects that are loaded in the One Identity Manager database via a remote connection sometimes have incorrect display names.

Some steps are missing in the report on simulating a synchronization with revision filtering.

One Identity Safeguard users who use Active Directory as their identity provider cannot be removed from local One Identity Safeguard user groups.

The O3EMailbox.AdditionalResponse column is too short.

Occasionally, when re-enabling a failed process for creating Active Directory user accounts, a user account might be created without a password although the password was originally set.

Performance issues when loading Azure Active Directory role eligibilities.

The Exchange Online mailbox permissions for full access are not synchronized correctly.

Error simulating a synchronization if a remote connection is used to reach the target system.

In the setup for the system connection to an Oracle Database with the generic database connector, columns that allow NULL values are selected as unique keys.

When configuring synchronization with the generic database connector, columns with the data type Integer cannot be selected as the preferred key.

The virtual property for data conversion causes an error when converting dates if the time zone of the base value differs from the local time zone.

Objects that are not modified but contain unresolvable memberships still add to the quota defined in the synchronization step. This can cause synchronization to quit.

Outstanding Azure Active Directory objects are not shown in the target system synchronization in the Manager.

Poor performance loading the list of attestation cases.

A manager's permissions for creating new departments, locations, cost centers, or business roles are too extensive.

When delegating responsibilities for hierarchical roles, the value for role/organization (PersonWantsOrg.ObjectKeyOrgUsedInAssign) is not formatted correctly in the request process.

A delegator receives notifications about the request approvals that are irrelevant.

Poor performance deleting an IT Shop shelf.

If an identity can approve a request when they are a regular approver as well as being a member of the chief approval team, the approval history sometimes logs the chief approval team as approver rather than the regular approver.

Under certain conditions, email notifications about a request approval are not sent, even though email notifications are configured correctly.

If a product is canceled while the request renewal process is running, the renewal workflow is run instead of the cancellation workflow.

For the XM, CM, and PW approval procedures, attestors are not recalculated if an attestor has delegated the approval.

In a multi-step approval process with automatic approval, a request is denied even though the DecisionOnInsert configuration parameter is set. The error occurs if, after approval is denied for the approval level, the requester is an approver for further approval levels.

Not enough information is displayed to product owners about a service item.

The SAC_FTProfileInSAPFunction function returns incorrect results if an SAP function consists of more than one transaction. This leads to unexpected results, depending on the order of the transactions within the SAP function.

Incorrect recalculation of the attestors if a regular attestor is initially also a member of the chief approval team and is later removed from this group.

The Customizer prevents assignment of Azure Active Directory groups, disabled Azure Active Directory service plans, and Azure Active Directory subscriptions to the IT Shop.

Sometimes IT Shop requests are canceled if a shelf is moved to another shop, even though the Retain service item assignment on relocation option is enabled on the service item.

If an approval step is escalated, the request is automatically canceled under the following conditions (and not submitted to the escalation approvers):

• An approver from the next escalation approval step escalates the request manually.

• The QER | ITShop | AutoDecision configuration parameter is set.

The product owners of system roles, subscribable reports, and software cannot see the overview forms of the responsible product.

Error requesting a cloud group if a cloud permissions control is assigned to this group.

Occasional performance problems when processing the DBQueue Processor QER-K-PWOHelperFillMakeProc task.

On the main data form for policy violations the links to object and policy do not work anymore.

The CreateITShopOrder method is missing from various assignment tables.

Performance issues when assigning identities to application roles.