I am trying to setup a synchronization from a target system into the UNS-B tables via the PowerShell connector in 8.1.4, and while I can import the user and group data into their respective tables, I'm not getting the group memberships to import into the UNSAccountBInUNSGroupB table. If I look at the other M:N table mappings for the UCI and UNX connectors, I see they utilize different methodologies. An external party setup our UCI M:N assignments via simple key resolution by reference look-ups. When I try that method, I receive the following error:
Issue
Workflow (QSR Account Sync) dependencies could not be resolved for synchronization in direction Target system.
Details
[1777309] Workflow (QSR Account Sync) dependencies could not be resolved automatically.
[1777340] The dependency resolution for 9 rules has failed.
[1777053] The rule () from mapping (QSR UIG (cfed6f46-69d5-4749-a0e0-fc8d2b551822)) describes the mandatory reference (UID_UNSGroupB@UNSAccountBInUNSGroupB). The referenced type (UNSGroupB) must be synchronized beforehand but there is no suitable mapping available for this type.
Solution
Create a mapping for type (UNSGroupB), which describes mandatory properties, the scope reference and contains at least one key rule.
I then looked at the UNX setup and it doesn't have a M:N mapping but rather utilizes the members of the group methodology with an M:N attribute on the group table. When I tried that route, I get this error:
Issue
Workflow (QSR Account Sync) dependencies could not be resolved for synchronization in direction One Identity Manager.
Details
[1777309] Workflow (QSR Account Sync) dependencies could not be resolved automatically.
[1777340] The dependency resolution for 9 rules has failed.
[1777053] The rule (Membership) from mapping (QSR Group (2e8ca2ca-9efc-488d-89c0-e2fecddfba73)) describes the mandatory reference (vrtMembers@UNSGroupB). The referenced type (UNSAccountB) must be synchronized beforehand but there is no suitable mapping available for this type.
Solution
Create a mapping for type (UNSAccountB), which describes mandatory properties, the scope reference and contains at least one key rule.
I also receive the following warning:
The property (vrtMembers@UNSGroupB) references objects of schema type (User accounts). There is no mapping for this schema type, which was defined for the many-to-many mapping.
The property (members@Group) references objects of schema type (User). There is no mapping for this schema type, which was defined for the many-to-many mapping.
I'm not understanding how I can map the account table when I'm performing a synchronization on the group tables. Looking at the various DPRSchema* tables it appears there are several reference mappings in play for the UNX tables, but I can't decipher how they interact, and I haven't found an automated way to do this.
Finally, I noticed that there is a MemberOf attribute on the UNSAccountB table, which the description states, "Use the group CN". I went that route, and while I don't receive any warnings or errors and the simulation indicates the expected deltas are found, when I execute the synchronization, the attribute is empty upon completion and nothing is triggered to insert the data into the UNSAccountBInUNSGroupB table.
I've setup the relevant target system type in Manager with the UNS-B tables and enabled merge on the UNSAccountBInUNSGroupB table, but I am unable to map and/or import M:N data into the UNSAccountBInUNSGroupB table. At this point I'd like to inquire on which of the various M:N setup methods is the 'correct' one for the UNS-B tables, and upon learning that, what am I missing from my setup that I am unable to import the M:N data from my target system?
Regards,
Mike
