Forum - Recent Threads

RE: Salesforce Integration Using Starling Connect Connector

Troy Grandy — Fri, 06 Nov 2026 16:30:30 GMT

I would start here - docs.oneidentity.com/.../salesforce.htm

Salesforce Integration Using Starling Connect Connector

manu — Fri, 06 Nov 2026 12:28:48 GMT

We are planning to integrate Salesforce with One Identity Manager 9.3.1 using the Starling Connect Connector.

Could anyone share:

Documentation or KB articles for this integration?
The initial setup and configuration steps required to get started.
Any prerequisites, best practices, or lessons learned from previous implementations.

Any guidance would be greatly appreciated.

Thank you.

Security concern: Users can renew or edit other users' requests through shared shopping carts

rune hystad — Fri, 23 Oct 2026 07:05:31 GMT

When a user renews their own request, they are added as PersonHead in pwohelperpwo. According to One Identity Support, this can make other requests in the same shopping cart visible in the request history, through the standard functions QER_FTPWOVisibleForPerson and QER_FGIPWOVisibleForPerson.

We have experienced incidents where users unintentionally renewed or edited requests belonging to other people as a result.

One Identity Support has confirmed that this is working as designed, not a defect. There is no setting or hotfix to disable this behavior. The suggested solution is to implement a custom viewing condition, which must be carefully tested due to its security implications.

We find it concerning that sharing a shopping cart can expose other people's requests and potentially allow them to be modified, particularly during renewal, and that this is concidered intentional.

Has anyone else encountered this behavior? Have you found a supported way to prevent users from viewing and modifying other people's requests without breaking legitimate approval or delegation workflows?

I'd appreciate hearing about your experiences and any recommended solutions.

Note, the above happens in both the new web portal and the legacy one, but is of course easier to spot in the new web portal.

Regards

Rune Hystad

RE: Security concern: Users can renew or edit other users' requests through shared shopping carts

rune hystad — Fri, 06 Nov 2026 12:19:10 GMT

Thank you for testing this!

In our approval workflows, we almost always have an approval level using the predefined approval procedure BR Back to recipient. We use this procedure to check whether a product has Terms of Use that must be accepted by the recipient. If Terms of Use exist, the request is sent back to PersonOrdered for acceptance.

This appears to be the key to reproducing the behavior. When the request goes through this approval procedure, an entry is created in PWOHelperPWO where PersonHead = PersonOrdered.

Consequently, when Person A subsequently renews their own request (OrderState = OrderProlongation), Person A is also present as PersonHead in PWOHelperPWO. This seems to contribute to the visibility issue with other requests belonging to the same shopping cart.

I suppose we could use a different renewal workflow without this approval level/procedure, but I still don't understand why identities added as PersonHead in PWOHelperPWO should be able to access other requests simply because those requests share the same shopping cart.

During further testing, I also discovered that this behavior is not limited to renewals. It also applies to ordinary requests, before they have been approved or assigned.

Since PersonOrdered is already added as PersonHead in PWOHelperPWO, Person A can see other requests belonging to the same shopping cart in the request history, even at this stage. However, I was not able to edit these requests.

This suggests that the visibility issue is not specifically related to OrderState = OrderProlongation, but rather to the presence of PersonOrdered as PersonHead in PWOHelperPWO, combined with requests sharing the same shopping cart.

Regards
Rune

RE: ExitDate read from SAP HR is not set to 23:59:59

kastenhuber marco — Fri, 06 Nov 2026 09:57:23 GMT

Hi gianluca villalba,

From my perspective, I would model this as follows:

- Intermediate table: first sync the data into a customer-specific table, and then into the 'Person' table. This allows you to transform the data—for example, by mapping it to a different attribute—before it reaches the 'Person' entity.

- Alternatively, you could define a derivation rule (calculation rule) for the attribute to ensure the time value is set correctly. (Note: You must ensure that the sync process is configured to trigger this derivation rule—this is controlled by a checkbox within the workflow.)

We opted for the intermediate table approach because it allows us to distinguish between the raw data coming from SAP and the internal logic we apply or the subsequent processing we perform. This also tends to make analysis a bit easier.

Does that help?

Cheers,

Marco

ExitDate read from SAP HR is not set to 23:59:59

gianluca villalba — Tue, 20 Oct 2026 07:16:41 GMT

Hello,

We are struggling mapping the HR_LEAVING_DATE date to Person.ExitDate (value comparison rule) from the SAP connector. SAP sends only a date, so ExitDate is stored at 00:00:00.

The standard process VI_Person_Deactive_ExitDate_Expired (schedule “Lock accounts of identities that have left the company”, event CHECK_EXITDATE) selects identities with IsInActive = False and ExitDate < UTCNow, so identities are deactivated on their last working day instead of after it.

When we create an identity manually in OIM, ExitDate is stored as 23:59:59 and deactivation occurs only after the day ends. We want the same result for connector data.

Attempts (virtual schema property HR_LEAVING_DATE_CLEAN; standard process not modified):

- Script returning val.Date: ExitDate = 12:00:00 AM
- val.AddDays(1).AddSeconds(-1): ExitDate = 01:59:59 AM (unexplained 2h shift)
- Version converting with TimeZoneInfo (Europe/Rome/UTC): identity with leaving date 16/10 was deactivated on 16/10 before end of day

Questions:

Recommended way to get ExitDate = 23:59:59 local time from the connector, consistent with manual entry?
How does OIM treat time zones for a DateTime returned by a virtual property or mapping rule (interpreted as UTC)?
Is a mapping-side fix preferable to adjusting the standard process condition?

We are using OIM 9.3.1 hosted, on demand starling edition.

Thank you in advance!

Editing Request Recipients in the Web Portal.

Thu, 15 Oct 2026 11:52:09 GMT

Hi all,

I’d like to change the request recipients in my webportal to a specific group. Ideally, I’d like a solution where I can select different recipients for each IT shop.

Background:

I have multiple IT shops for different usecases. For each IT shop, only a few people have access to place orders, but, for example, in one IT shop only internal employees should appear as recipients, in another shop only external recipients, and in another shop all users, and so on.

My question is, where can I configure this setting, or is there even a solution for this?

P.S. Unfortunately, I couldn’t find anything relevant on this topic in the OneIdentity Manager documentation.

thx

RE: Editing Request Recipients in the Web Portal.

kastenhuber marco — Fri, 06 Nov 2026 09:51:06 GMT

Hi L,

This should actually be possible using the standard functionality. For example, if you have two "shops" (catalogs/stores):

- one for individual users (natural persons)
- one for service accounts

...and different products are assigned to each, then only those identities that are members of a given shop can order the products from that shop. If you select an individual user as the recipient, you will only see the products available to individual users. However, if you select both a service account and an individual user as recipients, you will see products from both shops—which means you could potentially order a product intended for an individual user on behalf of a service account. That said, the system should perform a check in the shopping cart before the order is submitted. In such a case, OIM will flag an issue—stating something like "cannot order" or "error in the order"—because you are attempting to order an item for an entity that is not eligible to receive it.

Does that help?

Cheers,
Marco

RE: Escalating Page missing on API Server Web Portal

kastenhuber marco — Fri, 06 Nov 2026 09:41:34 GMT

Hello Enrico,
apologies for the delayed response. Unfortunately, I was no longer able to reply in the support forum.

Feel free to send me your email address, and I can send everything to you via email. You can also reach me on LinkedIn.

Cheers,
Marco

Escalating Page missing on API Server Web Portal

Enrico Baffa — Fri, 19 Jun 2026 09:08:39 GMT

Hi,

I'm using OneIM 9.2.2 and I cannot find the Escalation Page like it was present on the old portal. Customer used to navigate this page to filter for requests that needed to approved by a specific user and was able to easily escalate these to the defined escalation approval step, especially in case the Manager was on a leave period and users needed to have rapid access to the requested entitlements.

Now he can escalate requests on the pending request page but he cannot filter and there is no attribute on the view that displays the next approver. Due to this he cannot filter in any way which requests should be escalated. The Approver attribute on the view (UID_PersonHead) contains only the last approver but not the future approver(s). He needs to filter by user's manager to find all the requests that need to be approved by a specific manager.

Is there a easy way (no angular code changes) that could make customer achieve this purpose? I was thinking on a possible custom attribute on PersonWantsOrg, used on the view and filterable, filled with next approver but would be really difficult and challenging to change the value at every time an approval step is completed.

Thank You,

Enrico.

RE: Security concern: Users can renew or edit other users' requests through shared shopping carts

Niels de Groot — Fri, 06 Nov 2026 08:39:24 GMT

Hello Rune,

I went through this scenario in my 9.2.2 testlab, but I did not encounter the PWOHelperPWO entry (where Person A is added as PersonHead)
when Person A renews their own request (OrderState = OrderProlongation).

Were you able to reproduce it on a clean 9.2.2 install, without any customizations?

Regards,
Niels

RE: Is possible to use One Identity Manager's SAP SuccessFactors HR connector through SAP BTP/CPI?

alexandre gorian — Thu, 05 Nov 2026 12:28:33 GMT

Thank you Troy. Once the customer realized they need to take ownership of the implementation, they changed their mind, and a direct connection will be established instead. I will update this record if there are any further developments

Is possible to use One Identity Manager's SAP SuccessFactors HR connector through SAP BTP/CPI?

alexandre gorian — Thu, 29 Oct 2026 17:51:49 GMT

A customer is asking whether it is possible to use the native One Identity Manager connector with SAP SuccessFactors through SAP BTP/CPI. The company's internal policy prohibits direct application-to-application connections; all integrations must be routed through CPI.

Has anyone successfully implemented this type of integration without requiring any customization? Is that supported?

SAP HANA Integration

wzwerch — Thu, 13 Feb 2014 14:55:20 GMT

We have all of our SAP systems connected to Identity Manager 6.0. Means the BAPI is installed on every system.

Now we want to use SAP HANA technology as the database for the SAP systems.

Are there any experiance in this community with SAP HANA ?

Some of my questions:

Is Identity Manager able to manage directly SAP HANA users/permissions
How to connect?
Could we still use the standard BAPI for connecting a SAP system based on HANA?

Thanks a lot for any useful comment :-)

RE: SAP HANA Integration

Anonymous — Thu, 05 Nov 2026 10:50:17 GMT

You need to install HANA client on job server.

2. Install DSI module in OIM database.

3. Create synchronization using generic database connector and select.

4. UNS objects will be used for provisioning and de-provisioning

You can see all details in document.

Generic database connector for SAP HANA databases

RE: Angular Request Properties - alternate to %UserUID%

barry jackson — Thu, 05 Nov 2026 09:14:35 GMT

Hi,

Only just seen this due to Veronique replying to the thread.

Take a look at: this

Where you will find an example of how to access UID_PersonOrdered.

HTH, B

Angular Request Properties - alternate to %UserUID%

Ben — Tue, 11 Nov 2025 00:03:53 GMT

v9.0 LTS - jumping to v10 LTS early next year

I was using '%UserUID%' in the condition query for a table lookup, but I noticed that this is always the authenticated user even if they are requesting on behalf of someone else.

Is there an equivalent %% parameter that can be used in SQL conditions that represents the user requested for?

At the moment I have another hidden field that is populated based on "If Provider.Contains("UID_PersonOrdered") Then ", and then reference via $PC(name)$ in the SQL condition but it has poor performance and is just plain nasty.

RE: Angular Request Properties - alternate to %UserUID%

veronique blanchet — Thu, 05 Nov 2026 04:12:10 GMT

Did you figure out a solution?

RE: Security concern: Users can renew or edit other users' requests through shared shopping carts

rune hystad — Wed, 04 Nov 2026 13:43:54 GMT

Hi Niels!

Thank you for investigating this.

The key to reproducing this behavior is that multiple requests must belong to the same shopping cart, typically created by a manager ordering access for several employees at the same time.

Here is a simplified reproduction scenario:

A manager creates a shopping cart containing access requests for multiple employees (Person A, Person B, Person C, etc.).
These requests are submitted together and belong to the same shopping cart.
At a later point, Person A renews their own existing request from this shopping cart.
During the renewal, Person A's own request has OrderState = 'OrderProlongation', and Person A is added as PersonHead in PWOHelperPWO.
Person A can now see, and in some cases edit, other requests belonging to the same shopping cart, even though those requests belong to Person B, Person C, etc.

The important detail is that the visibility issue occurs when a recipient renews their own request (OrderProlongation), not simply because multiple requests were originally submitted in the same shopping cart.

According to One Identity Support, this behavior is related to the standard visibility functions QER_FTPWOVisibleForPerson and QER_FGIPWOVisibleForPerson.

I hope this helps you reproduce it.

Regards
Rune

RE: 9.3.1 / Angular Portal / Users can trigger duplicate “Add to cart” actions due to missing loading indicator

martin ehlert — Wed, 04 Nov 2026 10:38:32 GMT

We found the solution or more likely found the bug.

The source of this problem is the responsible view for groups. If in this view multiple members are added at once and at the same time no ShoppingCartOrder exist is this the result.

Workaround: Add members only one by one

Workaround2: Fix the code in imxweb\projects\tsb\src\lib\groups\group-sidesheet\group-members\new-membership\new-membership.service.ts and build a custom version

replace this

==================

const promises: Promise<any>[] = [];

for (const item of items) {

if (item.UidITShopOrg && item.UidPerson) {

const entity = this.qerClient.typedClient.PortalCartitem.createEntity();

entity.UID_ITShopOrg.value = item.UidITShopOrg;

entity.UID_PersonOrdered.value = item.UidPerson;

promises.push(this.qerClient.typedClient.PortalCartitem.Post(entity));

}

await Promise.all(promises);

==================

with this

==================

const promises: Promise<any>[] = [];

let first : boolean = true; // Prüfvariable für ersten aufruf

for (const item of items) {

if (item.UidITShopOrg && item.UidPerson) {

const entity = this.qerClient.typedClient.PortalCartitem.createEntity();

entity.UID_ITShopOrg.value = item.UidITShopOrg;

entity.UID_PersonOrdered.value = item.UidPerson;

//promises.push(this.qerClient.typedClient.PortalCartitem.Post(entity)); // auskommentiert

if (first) { // erster Aufruf sequentiell das nicht mehrere Warenkörbe parallel angelegt werden

await this.qerClient.typedClient.PortalCartitem.Post(entity);

first = false;

}

else{ // Folgeaufrufe parallel

promises.push(this.qerClient.typedClient.PortalCartitem.Post(entity));

}

await Promise.all(promises); // warte auf alle parallelen Aufrufe

==================

9.3.1 / Angular Portal / Users can trigger duplicate “Add to cart” actions due to missing loading indicator

Paul — Tue, 31 Mar 2026 10:09:34 GMT

We are facing issues in the Angular Portal that make the ordering functionality almost completely unusable. The situation is as follows:

A user logs in, selects several service items, and clicks “Add to cart”. The loading spinner appears for a very short time and then disappears again. However, the process in the background is not finished yet, because the confirmation that the items have been added to the cart only appears several seconds later.

Some users assume that nothing happened and click “Add to cart” again.

In the log, the following entries appear (for every combination that is being ordered):

AccountDependencyProvider: account exists or is being requested for person *UID_Person* and service item *UID_AccProduct*: True

We cannot yet determine exactly when it happens, but at some point this person is no longer able to submit any orders. After some time, no user at all can place new orders anymore.

In my opinion, this is caused by the loading spinner disappearing too early. The spinner should remain visible until the confirmation message (“Items added to cart”) is returned. While the spinner is shown, the user cannot click “Add to cart” again, which would prevent this issue. The processing time is not an issue when adding 1–2 products. However, when 20 products are added, it already takes about 7–10 seconds until they appear in the cart. With 50 products, it takes around 30 seconds. During this entire time, the loading spinner is not displayed, which is unacceptable from a usability perspective.

Has anyone already implemented a solution that disables the button until the process is fully completed?

RE: 9.3.1 / Angular Portal / Users can trigger duplicate “Add to cart” actions due to missing loading indicator

Anonymous — Wed, 04 Nov 2026 10:36:42 GMT

it was me Martin Ehlert...

RE: 9.3.1 / Angular Portal / Users can trigger duplicate “Add to cart” actions due to missing loading indicator

Anonymous — Wed, 04 Nov 2026 10:35:55 GMT

We found the solution or more likely found the bug.

The source of this problem is the responsible view for groups. If in this view multiple members are added at once and at the same time no ShoppingCartOrder exist is this the result.

Workaround: Add members only one by one

Workaround2: Fix the code in imxweb\projects\tsb\src\lib\groups\group-sidesheet\group-members\new-membership\new-membership.service.ts and build a custom version

replace this

==================

const promises: Promise<any>[] = [];

for (const item of items) {

if (item.UidITShopOrg && item.UidPerson) {

const entity = this.qerClient.typedClient.PortalCartitem.createEntity();

entity.UID_ITShopOrg.value = item.UidITShopOrg;

entity.UID_PersonOrdered.value = item.UidPerson;

promises.push(this.qerClient.typedClient.PortalCartitem.Post(entity));

}

await Promise.all(promises);

==================

with this

==================

const promises: Promise<any>[] = [];

let first : boolean = true; // Prüfvariable für ersten aufruf

for (const item of items) {

if (item.UidITShopOrg && item.UidPerson) {

const entity = this.qerClient.typedClient.PortalCartitem.createEntity();

entity.UID_ITShopOrg.value = item.UidITShopOrg;

entity.UID_PersonOrdered.value = item.UidPerson;

//promises.push(this.qerClient.typedClient.PortalCartitem.Post(entity)); // auskommentiert

if (first) { // erster Aufruf sequentiell das nicht mehrere Warenkörbe parallel angelegt werden

await this.qerClient.typedClient.PortalCartitem.Post(entity);

first = false;

}

else{ // Folgeaufrufe parallel

promises.push(this.qerClient.typedClient.PortalCartitem.Post(entity));

}

await Promise.all(promises); // warte auf alle parallelen Aufrufe

==================

RE: 9.3.1 / Angular Portal / Users can trigger duplicate “Add to cart” actions due to missing loading indicator

martin ehlert — Wed, 04 Nov 2026 03:23:07 GMT

We are experiencing the same problem in the web portal 10.1. Did you ever found a solution ?

RE: Is possible to use One Identity Manager's SAP SuccessFactors HR connector through SAP BTP/CPI?

Troy Grandy — Tue, 03 Nov 2026 20:24:48 GMT

The Starling connector is built against SuccessFactors OData v2 behaviour. That includes the OData URL field, the OAuth token flow, and paging and filtering.
A CPI iFlow in the middle would have to pass all of that through unchanged.
Starling traffic originates from the Starling cloud, so CPI would need to be reachable from the internet.
This has never been tested by us based on what I could find and I have never heard of or worked with any customers using this method, based on that I would consider this unsupported
Feel free to try but if you contact support the first ask maybe to confirm that it works via a direct connection first.