Indirect Relationship Processing/Role Import Error
Currently on 7.1.1 P07. This issues manifested itself over 1 week after patch installation.
Indirect Relationship Processing fails after every collection. ADC or EDC, does not matter Collector type.
This started happening after a user on my team attempted to import a role to production. The role was originally export from production, and attempted to be re-imported. There was a removal of 1 entitlement after the role was exported. We have done this multiple times before to remove an entitlement that was associated to a Deleted collector.
During the Role Import run, the second step fails per attached screenshot. I also see an Admin error as pasted below:
Error while exploding and compute metrics of imported roles: java.sql.SQLException: ORA-30926: unable to get a stable set of rows in the source tables ORA-06512: at "AVUSER.ROLE_MANAGEMENT_PKG", line 5334 ORA-06512: at "AVUSER.ROLE_MANAGEMENT_PKG", line 4592 ORA-06512: at line 1
Has anyone seen this before? When collectors collect now, Indirect Relationship Processing fails. User accounts are no longer having entitlements mapped to them, therefore the access is not showing up on the user's identity records. Indirect Relationship Processing is also failing as it relates to orphan mapping. Attached picture of recent successful collection and failed Indirect Relationship Processing. The EDC says aborted, however a following collection had the collector succeed with the Indirect Relationship Processing failed again.
- Community Thread
- Data Collection
- export roles
- Forum Thread
- Identity G&L
- Identity Governance & Lifecycle
- import roles
- Indirect Relationship Processing
- RSA Identity
- RSA Identity G&L
- RSA Identity Governance & Lifecycle
- RSA Identity Governance and Lifecycle
- RSA IGL
Hi, please try to run this query
select * from t_ce_explicit_relations
where (entitled_id, entitled_type, entitlement_id, entitlement_type) in
(select entitled_id, entitled_type, entitlement_id, entitlement_type
group by entitled_id, entitled_type, entitlement_id, entitlement_type
having count(1) > 1)
order by entitled_type, entitled_id, entitlement_id;
if this will find anything it means that you have duplicated rows in t_ce_explicit_relations table
I believe this is one of the same queries found in this article correct?
When running the query provided and the 1st query in the article. 0 rows returned
2nd query, tons of rows returned
3rd query, 0 rows returned
4th query, tons of rows returned
I have referenced this in the case we opened, however we haven't been able to make further progress on a solution.
Yes we identified that there is commonality between your issue and that described in KB 000038826. The main difference is that this issue is resolved in your version and patch level. I confirmed that the data cleanup related to this KB was successfully completed as part of your migration to 7.1.1 P05.
I am monitoring your case 01634056 and JIRA ACM-106925.
Thanks Ian. It seems like this is a cumulative issue. Normally, Indirect Relationship Processing takes between 2-15 seconds. Looks like since this issue began, the length of time has increased roughly linearly. We are now at 2 min per run.
We have roughly 400 collectors that run overnight Monday. Normally takes between 4-6 hours to finish them all. Took almost 13 hours yesterday because each Indirect run took 2 min.
Doesn't seem like any of the actual collectors stalled, only delayed because of the Indirect runs.