Why Outstandings AD objects are created in Dell one.What is the cause for creating object.

we are using Dell one Idm and we have AD target.When i go to Manager tool->target synchronization;Active directory ,i can see many user and their AD groups .Why these user listed as Outstanding object.

These user are member of respectice AD groups in LIAM but in Actual AD target they are not part of that AD group.

Is there any reason listing these user under outstanding object list.Please help me...

Top Replies

Mikko Majander over 3 years ago in reply to Trevor Pike +1

Hi,

Thank you for your response. I was looking at that, but thought that the vrtMembersSIDArr configuration could be used to override that. Actually in this case the membership was direct, either created…

Parents

0 Barry Jackson over 5 years ago

Hi,

At some point in time, the group membership was sync'd to 1IM. At a later point somebody changed the group membership in native AD. At the next sync, 1IM will mark the removed memberships as outstanding - leaving you the choice what to do with them. This is the default behaviour of an OOB AD sync project. If you want to change this you have to edit the 'Group' mapping in the AD sync project. Double click the vrtMembersSIDArr object on the LHS of the mapping and uncheck the 'Try to mark the object for deletion (outstanding)' checkbox.

Future syncs will then delete the membership from 1IM rather than mark it as outstanding.

But you will still have process the existing objects that are marked.

HTH, Barry.
Cancel
Up 0 Down

Reply

Verify Answer

Reject Answer

Cancel
0 Mikko Majander over 3 years ago in reply to Barry Jackson

Hi,

Is this functionality still in 8.1.2? We have a similar case, where the AD memberships are left in outstanding state when the membership is removed from AD even though we have unchecked the 'Try to mark the object for deletion (outstanding)' from vrtMembersSIDArr in the group-mapping of synchronization.

Thank you.

Br,

Mikko
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 Trevor Pike over 3 years ago in reply to Mikko Majander

Hello,

The functionality is the same. There could be other reasons for this behaviour. Are the group memberships inherited, for example?

https://support.oneidentity.com/technical-documents/identity-manager/8.1.2/target-system-synchronization-reference-guide/37#TOPIC-1364771

Trevor
Cancel
Up 0 Down

Reply

Verify Answer

Cancel
0 Mikko Majander over 3 years ago in reply to Trevor Pike

Hi,

Thank you for your response. I was looking at that, but thought that the vrtMembersSIDArr configuration could be used to override that. Actually in this case the membership was direct, either created directly in AD or via 1IM, but now I'm suspecting some cache-issue (at least I've heard that might be the case sometimes when changes are not reflecting).

I think I will see, if I can achieve the desired outcome by having update-event from ADSAccountInADSGroup-table when the synchronization changes the xMarkedForDeletion so that we can send a notification when a membership is removed.

Br,

Mikko
Cancel
Up +1 Down

Reply

Verify Answer

Cancel

Reply

0 Mikko Majander over 3 years ago in reply to Trevor Pike

Hi,

Thank you for your response. I was looking at that, but thought that the vrtMembersSIDArr configuration could be used to override that. Actually in this case the membership was direct, either created directly in AD or via 1IM, but now I'm suspecting some cache-issue (at least I've heard that might be the case sometimes when changes are not reflecting).

I think I will see, if I can achieve the desired outcome by having update-event from ADSAccountInADSGroup-table when the synchronization changes the xMarkedForDeletion so that we can send a notification when a membership is removed.

Br,

Mikko
Cancel
Up +1 Down

Reply

Verify Answer

Cancel

Children

No Data

Endpoint Privilege Management

Why Outstandings AD objects are created in Dell one.What is the cause for creating object.

Top Replies