AnsweredAssumed Answered

Attribute Synchronization does not updated in AD

Question asked by Zhaojun Xu on Mar 9, 2017
Latest reply on Oct 25, 2017 by Neus Samir

Like • Show 0 Likes0
Comment • 25

Hi all,

I am trying to synchronize an attribute (department) between a user and AD via the Attribute Synchronization feature. I have configured the Attribute Synchronization, set the Attribute Synchronization Workflow to be Default AFX Fulfillment.

After I modified the department for a user, a request is generated for this user. However, in the fulfillment phase, the workflow ended after Calculate Items to work on node. It seems that there are no changes to work on. Can I check what am i missing in this case for the changes in department value to be updated in AD?

Thanks.

Attachments

AFX Fulfillment.png92.4 KB

No one else has this question

Outcomes

25 Replies

Tim Willemstein Mar 9, 2017 6:13 AM
Mark Correct
Correct Answer
Could you show both your attribute sync configuration and the AFX connector for the Update command?
Like • Show 0 Likes0
Actions
Boris Lekumovich Mar 9, 2017 6:22 AM
Mark Correct
Correct Answer
I suggest you check your AD account and see if the attribute was synced.
The Default AFX Fulfillment workflow, has a loop in it.
After all changes are processed, it "skips" the right section and goes straight to stop.
As far as I understand, this is the reason why you will see the right section as greyed out.

If you check other completed change requests which are using default AFX workflow, most likely you will see the same image.

To make sure, you can place an Admin Error node or Delay node somewhere in the right section and in that manner you will know if the workflow is "passing" there.
Like • Show 0 Likes0
Actions
Zhaojun Xu Mar 9, 2017 10:06 PM
Mark Correct
Correct Answer
Hi Tim,
These are my configurations:
Attribute Synchronization
AFX Connector

Hi Boris, I have checked and the AD attribute is not updated.
I have also tried to create a workflow with a fulfillment handler and modified the AD Connector to use workflow variables (Custom.Dn and Custom.Acctdept).
Workflow
AFX Connector

The AD account is also not updated.

Thanks for your help.
Like • Show 0 Likes0
Actions
- Santiago Benavidez @ Zhaojun Xu on Mar 20, 2017 4:46 PM
  Mark Correct
  Correct Answer
  Hi, I'm facing quite the same issue as you, but I think I'm a step behind you. On the AFX Connector, who did you selected the ${Account.title} var? Did you create that attribute via the Admin/Attributes/Account menu?
  
  And finally did you get this working?
  Like • Show 0 Likes0
  Actions
  - Tim Willemstein @ Santiago Benavidez on Mar 21, 2017 2:54 AM
    Mark Correct
    Correct Answer
    The ${Account.title} is indeed a custom attribute you can add to the account object under Admin/Attributes/Account menu.
    Like • Show 0 Likes0
    Actions

Tim Willemstein Mar 10, 2017 1:44 AM

The settings seems to be correct, is there anything in the AFX log from the connector? You could try to put it in debug mode while triggering an attribute sync for more information.

Actions

Zhaojun Xu @ Tim Willemstein on Mar 13, 2017 2:49 AM

Hi Tim, I had set it to debug mode. However, no logs are being written to the file when I am triggering an attribute sync.

Actions

Tim Willemstein @ Zhaojun Xu on Mar 13, 2017 2:59 AM
Mark Correct
Correct Answer
Interesting, one would expect the sync action that is send by AFX to be logged here if send correctly. A wild guess, but there are some tables in the database T_AV_AFX% that contain the items that are send to the AFX Connector. Could you check these and look for your sync changes?
Like • Show 0 Likes0
Actions

Boris Lekumovich

@ Zhaojun Xu on Mar 14, 2017 4:56 AM

What version are you on?

I've tested on my local env (v7.0.1 P02) and it's working.

Have you enabled the debug mode by changing the log4j file?

/home/oracle/AFX/esb/apps/AFX-CONN-Active-Directory-adapter/classes/log4j/.xml?

Here is an example from the debug log:

You can see that the display name is being updated.

<Envelope xmlns="http://aveksa.com/afx/messages/primary">
    <Header>
        <version>1.0</version>
        <appid>ACM</appid>
        <crid>23328</crid>
        <type>response</type>
        <callback>NA</callback>
        <afxid>18aa8642-7f61-4236-87f6-5744db14e951</afxid>
        <async-callback>false</async-callback>
        <async-callback-url>http://localhost:8089/callback/18aa8642-7f61-4236-87f6-5744db14e951</async-callback-url>
        <testmessage>false</testmessage>
    </Header>
    <Body>
        <Request timestamp="2017-02-06T00:43:14.863-05:00" id="1">
            <epid>Active-Directory-adapter</epid>
            <verb name="UpdateAccount">
                <parameters>
                    <parameter name="sn"></parameter>
                    <parameter name="Account">CN=sblair,OU=Finance,OU=Corp,DC=company,DC=local</parameter>
                    <parameter name="givenName"></parameter>
                    <parameter name="displayName">Sean10 Blair10</parameter>
                    <parameter name="Title"></parameter>
                </parameters>
            </verb>
            <Response timestamp="2017-02-06T00:43:17.052-05:00">
                <status>
                    <code>0</code>
                    <brief>Success</brief>
                    <detailed>Request successfully processed</detailed>
                </status>
            </Response>
        </Request>
    </Body>
</Envelope>

Can you share a screenshot from your AD account collector - similar to what I've shared below? (Mapping for account and user account attributes screen)

1 person found this helpful

Actions

Amit Khatua @ Boris Lekumovich on May 10, 2017 5:34 AM
Mark Correct
Correct Answer
Hi Zhaojun Xu,

Were you able to solve this ?

Hi Boris Lekumovich,

I was working on this but getting the same thing as Zhaojun Xu is getting. The workflow is is getting completed without any action (exact same screenshot of the workflow my case as well). Followed your workaround as well, not getting any log/ no payload in AFX table as well.

Just wondering, the operation type is Synchronize in this case, then will RSA trigger update account capability ? Can this be a reason not to trigger the proper capability ?

Thanks !!!
Like • Show 0 Likes0
Actions

Shlomo Katz May 15, 2017 3:58 PM
Mark Correct
Correct Answer
I am experiencing a similar issue.
I created an AttribSync using the documented procedure (search for the video in this forum), and it works for collected changes such as HR information.
What is not working is the self-edit changes. It says completed, but there is no data in the workflow other than "Self"
Like • Show 0 Likes0
Actions
subhrajit das May 16, 2017 6:57 AM
Mark Correct
Correct Answer
It works OOTB way without any customisation. I did it for firstName and LastName for accounts.

Below what I got in AD log:

2017-05-16 06:54:18.905 [INFO] org.mule.transport.service.DefaultTransportServiceDescriptor:193 - Loading default outbound transformer: org.mule.transport.jms.transformers.ObjectToJMSMessage
2017-05-16 06:54:18.906 [INFO] org.mule.transport.service.DefaultTransportServiceDescriptor:193 - Loading default response transformer: org.mule.transport.jms.transformers.ObjectToJMSMessage
2017-05-16 06:54:18.906 [WARN] com.mulesoft.mule.transport.jms.EeJmsMessageDispatcher:265 - Starting patched JmsMessageReceiver
2017-05-16 06:54:18.907 [INFO] org.mule.lifecycle.AbstractLifecycleManager:193 - Initialising: 'fulfillmentStateJmsConnector.dispatcher.1444476897'. Object is: EeJmsMessageDispatcher
2017-05-16 06:54:18.908 [INFO] org.mule.lifecycle.AbstractLifecycleManager:193 - Starting: 'fulfillmentStateJmsConnector.dispatcher.1444476897'. Object is: EeJmsMessageDispatcher
2017-05-16 06:54:19.320 [INFO] org.mule.lifecycle.AbstractLifecycleManager:193 - Initialising: 'MTG-AD-QA.LDAP.connector.dispatcher.993422054'. Object is: LdapxMessageDispatcher
2017-05-16 06:54:19.327 [WARN] org.mule.transport.service.DefaultTransportServiceDescriptor:265 - Couldn't not find org.mule.transport.ldapx.LdapxMuleMessageFactory empty constructor. org.mule.transport.ldapx.LdapxMuleMessageFactory must be updated to have an empty constructor in order to work properly within domains.
2017-05-16 06:54:19.329 [INFO] org.mule.lifecycle.AbstractLifecycleManager:193 - Starting: 'MTG-AD-QA.LDAP.connector.dispatcher.993422054'. Object is: LdapxMessageDispatcher
2017-05-16 06:54:19.486 [INFO] org.mule.api.processor.LoggerMessageProcessor:193 - Exchange UpdateAccount not required
2017-05-16 06:54:19.488 [INFO] org.mule.api.processor.LoggerMessageProcessor:193 - AFX_OUT redirect flow invoked...
2017-05-16 06:54:19.560 [INFO] org.mule.transport.service.DefaultTransportServiceDescriptor:193 - Loading default outbound transformer: org.mule.transport.jms.transformers.ObjectToJMSMessage
2017-05-16 06:54:19.569 [INFO] org.mule.transport.service.DefaultTransportServiceDescriptor:193 - Loading default response transformer: org.mule.transport.jms.transformers.ObjectToJMSMessage
2017-05-16 06:54:19.572 [WARN] com.mulesoft.mule.transport.jms.EeJmsMessageDispatcher:265 - Starting patched JmsMessageReceiver
2017-05-16 06:54:19.574 [INFO] org.mule.lifecycle.AbstractLifecycleManager:193 - Initialising: 'jmsConnector.dispatcher.1711892506'. Object is: EeJmsMessageDispatcher
2017-05-16 06:54:19.581 [INFO] org.mule.lifecycle.AbstractLifecycleManager:193 - Starting: 'jmsConnector.dispatcher.1711892506'. Object is: EeJmsMessageDispatcher
Like • Show 0 Likes0
Actions
- Amit Khatua @ subhrajit das on May 16, 2017 7:00 AM
  Mark Correct
  Correct Answer
  Hi,
  Have you used attribute change rule to trigger the workflow ?
  Thanks, Amit
  Like • Show 0 Likes0
  Actions
  - subhrajit das @ Amit Khatua on May 16, 2017 7:09 AM
    Mark Correct
    Correct Answer
    Nope. No separate rule. Just defined the attribute synchronisation.
    
    And in Request Workflow->Fulfilment phase node just mapped deffault AFX fulfilment to "fulfil Directory and Application Attributes".
    Like • Show 0 Likes0
    Actions
    - Amit Khatua @ subhrajit das on May 16, 2017 7:33 AM
      Mark Correct
      Correct Answer
      Thanks Subhrajit. I defined synchronization as you mentioned and regarding workflow I hope you are pointing to below screenshot to point default fulfillment workflow in fulfillment phase of synchronization request workflow -
      
      Did that. still the workflow get stuck here and gets completed. No changes in target application.
      
      Are you pointing to a custom fulfillment workflow to take care of the update account capabilities and mapped that in "fulfil Directory and Application Attributes" ?
      
      Thanks !!!
      Like • Show 0 Likes0
      Actions
      - subhrajit das @ Amit Khatua on May 16, 2017 7:44 AM
        Mark Correct
        Correct Answer
        No. What you did, I did same as well.
        
        Does your AFX connector configuration look like below? Account_ID is a custom user attribute which contains accountname of AD in my case.
        
        Like • Show 0 Likes0
        Actions
        Amit Khatua @ subhrajit das on May 16, 2017 8:09 AM
        Mark Correct
        Correct Answer
        Active Directory capabilities shows like below (accounts are being collected as distinguishedName only)-
        
        Just to know how come RSA is calling update account capabilities when the operation type is Synchronization (below screenshot) ?
        
        Thanks !!!
        Like • Show 0 Likes0
        Actions
Gunpreet Singh Sep 26, 2017 7:25 AM
Mark Correct
Correct Answer
Check your Account attribute type , it should be Collected not Managed. Only collected type account attributes will be processed by the Default AFX Fulfillment Wf from the java node.
Like • Show 0 Likes0
Actions
Neus Samir Oct 24, 2017 8:04 AM
Mark Correct
Correct Answer
Hi!

I've been tryng the syncronization attributes config and when I modify an attribute from RSA it launches a syncronazitation attribute request to AD:
And I understand that the request that executes the fullfillment is not well configured.

I don't know if the default request is executing or I have to assign an specific one.
Can you help me please?

Thanks and regards.
Like • Show 0 Likes0
Actions
- Boris Lekumovich @ Neus Samir on Oct 24, 2017 8:39 AM
  Mark Correct
  Correct Answer
  You can configure the attr sync workflow under the Requests tab (in application configuration)
  (screenshot below)
  
  Under Requests -> Workflow -> Overview, you can configure the request workflow which will be used in attr sync change request
  Like • Show 0 Likes0
  Actions
  - Neus Samir @ Boris Lekumovich on Oct 24, 2017 10:03 AM
    Mark Correct
    Correct Answer
    Hi Boris,
    
    As you can see on the attached images I think the configuration si correct but is still not working, even the field you are suggesting:
    - Default request sync:
    - Request phase fullfillment:
    - Attribute sync workflow:
    And the default AFX fullfillment flow:
    Do you have any other idea?
    
    Thank you very much.
    Like • Show 0 Likes0
    Actions
    - Boris Lekumovich @ Neus Samir on Oct 25, 2017 8:16 AM
      Mark Correct
      Correct Answer
      In your screenshot, I see the change item in an open state. I suggest you start by following the request workflow and check if and where it's stuck.
      Like • Show 0 Likes0
      Actions
      - Neus Samir @ Boris Lekumovich on Oct 25, 2017 8:30 AM
        Mark Correct
        Correct Answer
        Hi Boris,
        
        It doesnt even reach the request. Thats why I am confused, because Im not able to found where I have to configure the request flow or if there is in fact a default one. I atach you a screenshot:
        As you can se the request flow is absolutely empty... An as I told you on the last message the request config is well done. So I'm not understanding w'hats happening.
        
        Thanks for the help!
        Like • Show 0 Likes0
        Actions
        Boris Lekumovich @ Neus Samir on Oct 25, 2017 8:40 AM
        Mark Correct
        Correct Answer
        Under Requests -> Workflow -> Overview try changing the attr sync workflow from Request phase fullfillment to the out of the box workflow, Delegation Only
        
        I'm assuming that all other requests are functioning properly in system and the problem is only with the attr sync requests
        Like • Show 0 Likes0
        Actions
        Neus Samir @ Boris Lekumovich on Oct 25, 2017 8:53 AM
        Mark Correct
        Correct Answer
        Yes, all the other requests are working correctly. And I tried with all in delegation only but the request remains empty.
        Like • Show 0 Likes0
        Actions

Attribute Synchronization does not updated in AD

Attachments

Outcomes

Related Content

Recommended Content