OnDiscarded table script

Question

I'm trying to update affiliations when a person is added/removed from PersonInOrg. The update is working correctly using a process with an Insert event. However, the delete event does not work - I believe it is firing the delete event, but it seems to update affiliations using the data before the deletion occurs. So now I'm trying to use an OnDiscarded table script in the PersonInOrg table, but it doesn't seem to be working either. I'm wondering if the user info is already gone by the time the OnDiscarded script runs? 
 Below is the script I'm using. Any suggestions? 
 Dim affiliation As String = "" Dim scopedAffiliation As String = "" Dim f As ISqlFormatter = Session.SqlFormatter Dim eLDAPAccountEnt As IEntity 
 affiliation = VI_Build_Affiliations( $UID_Person$, "CCC_scopedAffiliation", "0") scopedAffiliation = VI_Build_Affiliations( $UID_Person$, "CCC_scopedAffiliation", "1") If Not String.IsNullOrEmpty($UID_Person$) Then Dim qPerson = Query.From ("LDAPAccount") _ .Where(f.AndRelation(f.UidComparison("UID_Person", $UID_Person$), _ "UID_TSBAccountDef In (SELECT UID_TSBAccountDef FROM LDAPAccount INNER JOIN TSBAccountDef ON LDAPAccount.UID_TSBAccountDef = TSBAccountDef.UID_TSBAccountDef WHERE TSBAccountDef.Ident_TSBAccountDef = N'Enterprise Directory Account')")) _ .Select ("UID_LDAPAccount", "CCC_affiliation", "CCC_scopedAffiliation") eLDAPAccountEnt = Session.Source.GetCollection(qPerson).FirstOrDefault If Not eLDAPAccountEnt Is Nothing Then If Not affiliation = eLDAPAccountEnt.GetValue("CCC_affiliation").String Then eLDAPAccountEnt.PutValue("CCC_affiliation", affiliation) If Not scopedAffiliation = eLDAPAccountEnt.GetValue("CCC_scopedAffiliation").String Then eLDAPAccountEnt.PutValue("CCC_scopedAffiliation", scopedAffiliation) eLDAPAccountEnt.Save(Session) End If End If

Markus Weiss-Ehlers · Accepted Answer

You should use the System Debugger to debug the error. It allows you to do single step-debugging of your script in Visual Studio. 
 When you open the System Debugger, and created the script library you can open the file Tables.vb and set a breakpoint to your script PersonInOrg_OnSaved . 
 See my screenshot where I did it with the table script Person_OnSaved. 
 
 Then start the System Debugger, switch to the Tables tab, select your PersonInOrg table, choose one entry of your PersonInOrg table using the ComboBox modify the object as needed an press the save button. Visual Studio will then stop at your breakpoint and you can use single step debugging or any other toolset of Visual Studio to solve your error. 
 Please note that you might want to use the checkbox Transaction with rollback to avoid that any data is written to the One Identity Manager database. 
 Again a screenshot using the Person table. 
 
 HtH

Markus Weiss-Ehlers · Answer

Check that all your IMPORTS in your custom scripts are wrapped in the proper SCRIPTDEBUGGER condition like the following sample. 
 #If Not SCRIPTDEBUGGER Then
	IMPORTS MyNamespace.Sample
#End If

Markus Weiss-Ehlers · Answer

Bingo. Now after looking into your code again, I found the solution. 
 You are creating the IEntity directly out of the collection using the method FirstOrDefault . 
 The thing is, that your collection is loaded using the default collection load type and this leads to iEntity objects that are read-only. 
 
 The easiest way to create a writeable object for your eLDAPAccountEnt is to add the following line after you have created the entity. 
 eLDAPAccountEnt.Create(Session) 
 Another option would be to load the collection with the EntityCollectionLoadType.Bulk . 
 eLDAPAccountEnt = Session.Source.GetCollection(qPerson, EntityCollectionLoadType.Bulk).FirstOrDefault()

Markus Weiss-Ehlers · Answer

The type PhoneNumber is also defined in the QER.DefenderClient.dll . The complete namespace would be QER.DefenderClient.PhoneNumber but there is an IMPORTS statement that shortens this to PhoneNumber. 
 In regards to the documentation, as these are basic Visual Basic (.NET) solution behaviors this is documented as such in the documentation from Microsoft or in several other how-to documents you will find in the Internet. 
 Did you know that we have a whole video series on Youtube around Scripting? It is might worth a subscription. https://www.youtube.com/watch?v=UjZdOW8pbM4&list=PL242czeZwlAk0T2AcqpSFtBOXQfkP9f5J

Markus Weiss-Ehlers · Answer

Please take a look at the following community thread. 
 The events that will be fired for M:N tables are Assigned and Removed. 
 https://www.quest.com/community/products/one-identity/f/identity-manager/5224/resource-assignment-to-department-not-generating-insert-event-in-personhasqerresource

Markus Weiss-Ehlers · Answer

As described here in the documentation https://support.oneidentity.com/technical-documents/identity-manager/8.0/configuration-guide#TOPIC-860836 the mentioned events will be fired. 
 If you cannot see the events in Object Browser, you do not have a process assigned listening to those events.

Endpoint Privilege Management

OnDiscarded table script