Identity Manager 9.1.2 - Release Notes

If databases are restored from a database backup, the start of DBQueue processing and the delivery of Job queue processes are synchronized.

An error may occur if the user settings are saved when you close the Designer.

When installing or updating One Identity Manager, custom files were saved in the wrong subdirectory.

In the Script Editor of the Designer, the script list menu is too narrow.

Cumulative transport packages are not displayed correctly in the transport history.

Process collection via HttpJobProvider does not work if SSL is configured for use by the proxy server.

Inconsistencies in the definition of DBQueue Processor task dependencies.

Under certain conditions, the application server cannot be uninstalled completely without errors.

If the Common | TableRevision configuration parameter is set, operations on base tables may fail and degrade performance.

Under certain circumstances, when the DBQueue Processor replaces processes, entries are retained that reference processes that no longer exist.

When changing the parameter type from calculation to user query, the Table column (calc.) column for the parameter (DialogParameter.UID_DialogColumnCalculate) is not cleared.

Incorrect display of historical assignments in reports if a database view is used as table.

If the Database Agent Service stops when DBQueue Processor tasks are being compressed, data is lost.

The language code nb is missing.

Incorrect conversion of time values with a time of 00:00 and a date format of DateTime.

In the documentation about the Docker container for the One Identity Manager Service, the CONFIGFROMDB parameter is insufficiently described.

References to third-party components incorrect.

An error sometime occurs in the system configuration overview.

Error message: Divide by zero error encountered.

In the One Identity Manager Installation Guide, port 443 is missing from the list of communication ports.

Watch triggers are not created if a column for different database views is marked for logging data changes and the views are based on the same base table.

In rare cases, a schedule is triggered several times.

The Database Compiler stops responding when it is determining compiler tasks.

An error occurs in Designer when assigning permission groups to applications.

Error message: Object reference not set to an instance of an object.

An error occurs when calculating the display pattern if different data types are used.

Error message: Conversion failed when converting the nvarchar value '<value>' to data type int.

Users from time zones with UTC+00:00 are not able to log in to the Manager web application.

Transport by change label does not transfer the description and comment of change labels.

The comparison of columns with date and time values does not always work correctly.

When upgrading from One Identity Manager version 8.x to a newer version, an error may occur when compiling the type-safe database model.

Error message: Keyword is not valid as an identifier.

Error saving an object change as a planned operation in the Manager if the Manager was started via an application server.

Entries in the Job queue are often marked for recalculation. This block Job queue processing.

The DBQueue Processor task QBM-K-JobqueueOverviewInvalid has now been replaced by a trigger.

Performance issues testing for multi-column uniqueness if objects are added to the One Identity Manager database in bulk.

It is not possible to assign SAP roles to SAP user accounts in the Manager web application.

Error importing data into the QBMDBPrincipal table if it results in duplicate entries relating to database users or login names.

Under certain circumstances, recalculation tasks for the DBQueue Processor that relate to the Target System Base Module (TSB) are not automatically deleted.

Error displaying the QBM_TransportToHistoryDatabase process in the Process Editor if the server function (SQL processing server) is assigned to two Job servers or more.

Changes to templates or formatting scripts in the Designer are not always saved in the database.

Error if DialogDatabase.EditionDescription is marked as isBlobExternal.

The change history view of an object may exceed the IN clause limit of 8000 elements.

The log information from the database is not displayed in the correct order in the system journal.

In Report Editor, report queries and parameters are not assigned to change labels when they are saved.

In the Manager web application, an error sometimes occurs when you double click on an icon.

The definition file for view tables with foreign key relationships created with Schema Extension is missing the foreign key information.

The Docker container for the API Server does not log by Application Insights.

The index in the Web Portal enters into an endless loop.

User account main data cannot be edited in the Web Portal.

In the Web Portal, clicking outside the request parameter prompt cancels the request.

Under certain conditions, the Web Portal does not display the request history.

In the Web Portal, an error occurs when a custom approval policy is used for approving delegation.

In the German Web Portal an incorrect message is displayed when canceling a request process.

An incorrect time period is used in certain cases when generating reports in the Web Portal.

In the Web Portal, adding products to the shopping cart does not work.

The Web Portal does not use the correct product names in the shopping cart.

The API Server creates a new session for each request if the same authorization token is used.

In the Web Portal, when creating report subscriptions, the values for the Dynamic time span parameter are not translated.

In the Web Portal, assignment analysis of identity assignments to stores cannot be displayed.

Under certain conditions, changing configuration keys in the Administration Portal cause errors.

In the Web Portal, certain predefined attestation policies cannot be copied.

The search does not work correctly in the Web Portal.

Request parameters of type query are handled correctly only if the query column is either XObjectKey or a primary key column.

The Web Portal allows delegations to be created without a time limit.

The My Direct Reports tile on the Web Portal's home page cannot always be seen by every manager.

Under certain conditions, the correct display names of objects are not shown in Web Portal.

If a user tries to log in to the Password Reset Portal with an expired passcode, they get the wrong information.

In the Web Portal, instead of the name of an object, the type of the object is displayed twice in the assignment analysis.

Registering a new user in the Password Reset Portal fails.

Under certain circumstances, local changes in the Administration Portal do not take effect.

In the Operations Support Web Portal, existing Job queue tasks are only displayed with a delay.

Testing API methods in the API documentation does not work.

Auto-completion is not available for API Server classes.

The process view in the Operations Support Web Portal displays all the process steps of a process with the same name.

Calculating the loss of entitlements when attestation cases are denied, takes too long.

Under certain circumstances, navigation controls are not displayed for pending attestations in the Web Portal.

Error testing request parameters in the shopping cart if the parameter contains a limiting condition with a variable.

Auditors are sent an error message in the Web Designer Web Portal when a session expires.

In the VI_Edit_Multiselect component of the Web Designer, values cannot be cleared.

In the Web Designer Web Portal, it is not possible to unsubscribe a product.

The Web Designer Web Portal does not correctly differentiate between time zones with identical times but different names.

After logging off from the Web Designer Web Portal, redirection to the configured URI does not work if Send redirect URI for the application is configured in the OAuth/OpenID Connect configuration.

The Web Designer Web Portal does not show translation values in some menus.

Under certain conditions, errors occur in the Web Portal when generating a report.

Under certain conditions, the Web Designer Web Portal goes into an infinite loop when an error message is displaying and closed.

The Web Designer Web Portal does not identify a rule violation when the shopping cart is checked even though mandatory parameters are not populated.

Decreased performance Web Designer Web Portal when using the Apply To All function in a shopping cart with a lot of items.

Error synchronizing against the generic database connector when the synchronization server is set up on a Linux server.

Error message: The time zone ID 'FLE Standard Time' was not found on the local computer.

When removing the Microsoft Exchange mailbox account definition, the Active Directory user account might get deleted.

The Legal age group property on the Azure Active Directory user account (AADUser.LegalAgeGroupClassification) has an undefined value.

Different OneLogin user account properties are changed by each synchronization.

Error reading data with the CSV connector when there is a remote connection to the CSV system.

Memberships in system entitlements that are marked as outstanding are in effect in the One Identity Manager. This means that the system entitlements in One Identity Manager cannot be deleted.

In the schema extension file of an SAP R/3 schema, if a function is defined with optional parameters, the properties of each single object are populated with empty values during synchronization. However, in the target system browser, the properties are provisioned correctly.

Insert operations take unexpectedly long if the SCIM provider does not support searching for endpoints with filters.

If the assignment of a BI analysis authorization to a BI user account is deleted in One Identity Manager, the provisioning process does not remove the assignment from the SAP R/3 system.

The One Identity Manager Password Capture Agent Administration Guide does not describe the DeleteJob parameter.

If several synchronization projects exist for a target system, the provisioning tasks might be generated incorrectly for the wrong (inactive) project.

If a Microsoft Teams team is archived, the associated SharePoint Online page can still be edited.

Employees' phone numbers are not mapped to Exchange Online mail users.

SAP user account assignments to SAP roles are not updated correctly if the structure of the SAP roles changes.

The handling of outstanding Exchange Online email users generates unnecessary provisioning tasks for Azure Active Directory groups.

When using PowerShell module v3, an error may occur during synchronization with Exchange Online.

Error message: You must call Connect-ExchangeOnline before calling any other cmdlet.

When templates for mail-enabled Azure Active Directory groups are reused, it changes the AADGroup.IsSecurityEnabled and AADGroup.IsMailEnabled columns.

The communication data of SAP user accounts is not read correctly from systems with business partner functionality. This happens if the user account is linked to an HCM person (identical personnel number) and separate address and communication data exist.

Error accessing schema properties in the central database of synchronization projects for system synchronization that map M:N schema types or key resolutions.

Error message: The system (...) does not have a data store.

A patch with the patch ID VPR#36755 is available for synchronization projects.

Sometimes the object properties of certain types of SAP R/3 schema extensions are all read correctly in the target system browser, but during synchronization not all properties are accessed.

Missing customizer for OneLogin user accounts (OLGUser table).

An error occurs if the value $null is returned when running a script with the ExecuteScript process task of the PowerShellComponentNet4 process component.

Error message: Object reference not set to an instance of an object.

The OLG_PersonAuto_Mapping_OLGUser script references a non-existing column.

Error message: Column UID_TSBAccountDefUser does not exist.

Assigning group membership fails in an AIX system if there is no permission to use the bin/mv command.

Error synchronizing owners of Azure Active Directory app registration if the owner is a service principal.

A patch with the patch ID VPR#36799 is available for synchronization projects.

Error loading a synchronization project.

Error message: [System.TypeLoadException] Method 'TryConvertFromString' not found.

On the overview form for an SAP composite role, the status of an assigned single role marked as pending is not displayed correctly.

Delta synchronization does not enter the group type of Azure Active Directory groups correctly.

Provisioning of Active Directory groups sporadically fails when memberships and the member are deleted at the same time.

Error synchronizing an SAP R/3 environment if the synchronization configuration contains a schema extension that uses a Where clause longer than 72 characters in the table definition.

Connection error in the SCIM connector when using authentication based on a client certificate, even though the certificate has been validated as correct.

The overview form for Azure Active Directory user account displays disabled group memberships.

In Azure Active Directory, loading user accounts without a picture can cause an ImageNotFound error.

When loading faulty SAP user accounts, the synchronization quits instead of logging the faulty objects and continuing the synchronization.

Under certain conditions, Active Directory synchronization fails with the error: Value cannot be null.

Performance issues when loading SAP user account overview forms.

If booking permissions are processed for an object that still has an element in Microsoft Exchange that is no longer a recipient itself, the error You cannot call a method on a null-valued expression occurs.

Reading the Tenant.AllowedDomainListForSyncClient fails if the data for this property exist in SharePoint Online.

Error message: Object cannot be stored in an array of this type.

Error synchronizing SharePoint Online when a site collection contains a large number of sites.

Error message: The request uses too many resources.

A patch with the patch ID VPR#36961 is available for synchronization projects.

When synchronizing an SAP R/3 environment with revision filtering, not just the changed user accounts are loaded, all of them are.

Error message: Object list of type USER is not able to read property BAPIUCLASS~SYSID. Subsequent loading of all single objects will affect performance.

A patch with the patch ID VPR#36970 is available for synchronization projects.

When loading a SCIM schema with schema extensions, the list of names of the schema extensions included is empty.

A patch with the patch ID VPR#36985 is available for synchronization projects.

Error in the generic database connector for Oracle Database when reading large numerical values from a table column of type NUMBER(20).

Error message: Arithmetic operation resulted in an overflow

Error loading objects of the ExternalEmail schema type when the entire Google Workspace customer assigned as a member to a Google Workspace group.

Error starting provisioning if there are object references for the changed object that were ignored during synchronization.

Error message: Unable to cast object of type 'System.Byte[]' to type 'System.IComparable'.

Incorrect conversion of date values in the generic database connector.

Error in CSV connector when handling object references.

Synchronizing memberships does not clean the synchronization buffer if Ignore case is enabled on the value comparison rule.

On the main data forms of user accounts the values in the Category property are not displayed correctly.

Delta synchronization of Azure Active Directory user accounts without a manager fails.

In the attributes parameter of an HTTP GET request, the names of properties defined in an overlay file are not formatted according to RFC.

Error in the RACF connector if the RemoteConnectPlugin is used.

Filters generated in the SCIM connector may have an unnecessary bracket level. Some SCIM providers return a Bad request status due to these filters.

Error in the template for OLGUser.status.

SAP schema extensions with nested Where clauses in the table definition do not return the expected data sets.

Arbitrary changes to the SAPComSMTP.SMTPAddr column definition cause an error.

If a connection parameter is deleted in the connector definition of a synchronization project for connecting a target system via the Windows PowerShell connector and then the target system schema is reloaded, the connection parameter is not updated in the One Identity Manager database (DPRSystemConnection.ConnectionParameter).

Write protection for a synchronization project opened by multiple users at the same time in Synchronization Editor does not work correctly.

Possible errors when synchronizing a SharePoint Online environment

Error message: Duplicate key (reference resolution)

A patch with the patch ID VPR#37272 is available for synchronization projects.

A process stops responding during provisioning if a new Notes user account has a password longer than 63 characters.

If an approver can approve several approval steps at the same approval level, approval that is granted is not accepted although the QER | ... | ReuseDecision configuration parameter is set.

Base objects for events on PersonWantsOrg and AttestationCase are not correct.

If a product is moved to another shelf, renewal requests are not reset.

In some cases, an error occurs when transporting approval workflows.

Error message: PWODecisionStep: Write permission denied for value "CountApprover".

Product owners of Exchange Online distribution groups are not removed from the application role.

Poor performance loading the list of attestation cases.

In the Manager, the date for creating user accounts (Person.TechnicalEntryDate) cannot be set to the person's start date (Person.EntryDate).

Permissions for the product owner vi_4_ITSHOPADMIN_OWNER missing for various tables.

In the Manager, employees cannot be deleted or inserted in the results list of inactive employees.

The auxiliary table for request procedures (PWOHelperPWO) sporadically contains duplicate entries.

Performance issues when processing DBQueue Processor tasks.

If exception approval is not permitted for a company policy, the Checked (IsDecisionMade), Decision on (DecisionDate), and the reason (DecisionReason) properties are no longer automatically set when policy violations are calculated.

If products with a validity period (Max. days valid) are requested and the valid-until date is earlier than the end of the validity period, the valid-until date is automatically extended to match the length of the validity period.

The VI_MassDeleteDelegate script fails with an error message if one of the requests has the status Canceled.

Error in the QER_PSlotResetOnInvalidRoot procedure.

Sporadic error in the Created by QBMDBQueueProcess: handle object update for object type ITShopOrg process. After being re-enabled, the process runs without errors.

If the QER | Attestation | ReuseDecision configuration parameter is set, approval granted by a previous approval step is not accepted if an intermediate approval step was denied approval.

The compliance check in the shopping cart causes a rule violation for a subidentity although the subidentity did not break the rule.

Calculation tasks are set for the compliance check when identities are added if the rule condition applies to all identities.

Error importing enabled company policies with the Database Transporter.

Error message: QERPolicy: Write permission denied for value "IsWorkingCopy".

When calculating the risk index for an object, # is entered as Changed by (XUserUpdated).

Incorrect sort order in the Request History report in the Manager.

Error in the formatting script for AOBApplication.NextRunDate when determining a valid date value.

Typo in the German version of the IT Shop request - expires mail template.

If an employee can approve a request when they are a regular approver as well as being a member of the chief approval team, the approval history sometimes logs the chief approval team as approver rather than the regular approver.

In a multi-step approval process with automatic approval, a request is denied even though the DecisionOnInsert configuration parameter is set. The error occurs if, after approval is denied for the approval level, the requester is an approver for further approval levels.