Sub-groups resolution is rejected and Member Type is set to "Account" instead of "Group" for Account Collectors in RSA Identity Governance and Lifecycle

[#1]

Article Number

000035604

Applies To

RSA Product Set: RSA Identity Governance and Lifecycle
RSA Version/Condition: 6.9.1 P15- P19, 7.0.0 P04, 7.0.1
 

Issue

When configuring an Account Collector to collect groups to sub-groups membership, the resolution fails and the subgroups are collected with type "Account" under the "Member Type" field.

In the following example, we are using groups and sub-groups collected from Active Directory.

1. We have two groups in AD as below
Image description

2.Sub-Group is the member of Top-Group.
Image description

3. Account Collector with the below configuration for the groups.

Image description

4. Following is the subgroup resolution.

Image description

5. Collect data, then check the monitoring >> raw data >> Group Membership tab, you will find that the Top-Group to Sub-Group resolution is failing and the Sub-Group is collected as an "Account", not as a "group":
Image description

Cause

This is a bug which is fixed in 6.9.1 P20 and above for version 6.9.1.
For version 7.0.0 and 7.0.1 this is fixed in 7.0.0 P05 and 7.0.1 P02 respectively.

Resolution

Deploy patch 6.9.1 P20 and above to have this issue fixed in version 6.9.1. Deploy patch 7.0.0 P05 and 7.0.1 P02 to have this issue fixed in versions 7.0.0 and 7.0.1 respectively.