Change Requests complete at a future date and time and/or Workflows become stuck in RSA Identity Governance & Lifecycle

[#1]

Article Number

000029596

Applies To

RSA Product Set: RSA Identity Governance & Lifecycle
RSA Product/Service Type: Appliance
RSA Version/Condition: 6.9.0, 6.9.1, 7.0.0, 7.0.1
 

Issue

Change Requests show a completion date and time in the future. (Requests > Requests > {Request name}).

For example, a change request created at 9:00 AM, completed at 9:30 AM and viewed at 11:00 AM may show as completed at 4:00 PM that day which is five hours ahead of the time the change request is actually being viewed, i.e. a time that has not yet occurred.

Another symptom seen are workflows getting stuck in the Approval phase even when there are no approvals to perform. (Requests > Requests > {Request name} > Workflow Jobs: Processing Workflow). If the processing workflow is edited and the approval nodes are removed, the workflow progresses to the Fulfillment phase and then gets stuck in the Fulfillment phase.

There may be other symptoms not yet observed/reported.
 

Cause

This is a known issue reported in engineering ticket ACM-52283.

The timezone on an RSA Identity Governance & Lifecycle appliance is defined in three places and must be the same in all three places.

1. The timezone in the Oracle grid timezone file on the Linux server where RSA Identity Governance & Lifecycle is installed.

$ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt

where $HOSTNAME is the node name where the Oracle database is installed

2. The system clock on the Linux server where RSA Identity Governance & Lifecycle is installed.

/etc/sysconfig/clock

3. The timezone stored in the Oracle database. Run the below query as avuser.

SQL> select dbtimezone from dual;

Incorrect change request completion dates and stuck workflows can be caused by a mismatch between any of the three places where the timezone is defined.
 

Resolution

Starting in RSA Identity Governance & Lifecycle 6.9, the timezone defined in the Oracle Timezone file needs to be modified from TZ=GMT+<some number> to TZ=<timezone> to be the same as the timezones specified in /etc/sysconfig/clock and select dbtimezone from dual.

This issue is resolved in the following RSA Identity Governance & Lifecycle versions and patch levels:

• RSA Identity Governance & Lifecycle 6.9.1 P10
• RSA Identity Governance & Lifecycle 7.0.1

Workaround

To workaround change request timing issues and stuck workflows, manually modify the value of TZ in $ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt from TZ=GMT+<some number> to TZ=<timezone> where timezone is the value of TIMEZONE defined in /etc/sysconfig/clock and the value returned from the query select dbtimezone from dual.

1. Determine the value of TIMEZONE in the Linux system clock.

Log into the Linux server as root and execute the following:

cat /etc/sysconfig/clock

Sample output:

cat /etc/sysconfig/clock
TIMEZONE="Australia/Melbourne"

2. Determine the value of the timezone stored in the Oracle database:

Using a tool such as SQL*Plus, SQL Developer or SQuirrel, connect to the Oracle database as avuser and execute the following:

select dbtimezone from dual;

Sample output:

select dbtimezone from dual;
Australia/Melbourne

This should report the same output as Step 1. If it does not, update the database to the same timezone. Login to the database as SYSDBA and execute the below ALTER DATABASE statement:

ALTER DATABASE SET TIME_ZONE=<timezone from Step 1>;

In this example, the command would be:

ALTER DATABASE SET TIME_ZONE='Australia/Melbourne'

3. Determine the value of TZ in the Oracle grid timezone file on the server where the Oracle database is installed:

Login to the database server as user oracle and execute the following where $HOSTNAME is the node name of your server:

cat  $ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt

Sample output:

cat  $ORACLE_GRID_HOME/crs/install/s_crsconfig_NODE1_env.txt
TZ=GMT+10:00

4. Backup $ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt and modify the value of TZ in $ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt to match the values from Steps 1 and 2.

1. Backup $ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt replacing $HOSTNAME with the node name on which the Oracle database resides:

mv $ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt - 
$ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt_backup

2. Edit $ORACLE_GRID_HOME/crs/install/s_crsconfig_$HOSTNAME_env.txt 

cd $ORACLE_GRID_HOME/crs/install/
vi s_crsconfig_$HOSTNAME_env.txt

3. Modify the value of TZ

FROM:

TZ=GMT+<some number>

TO:

TZ=<timezone value from steps 1 and 2>
 

For example, modify:
 

FROM:

TZ=GMT+10:00

TO:

TZ=Australia/Melbourne

4. Restart RSA Identity Governance & Lifecycle. As the oracle user:

acm restart

5. Reboot the Linux server to have the changes take effect. As the root user:

reboot