AnsweredAssumed Answered

Unification Join during identity collection

Question asked by Pankaj Rana on Aug 1, 2020
Latest reply on Aug 7, 2020 by Craig Ramsay

Like • Show 0 Likes0
Comment • 7

Hello everone,

I have 2 directory to create uses into RSA HRMS and AD. in AD users have different logic for sAMaccountName (due to migrated users from other company)

HRMS for Employee creation and AD for Vendor creation.

I have created different ID to store different userID in the RSA e.g. User ID, Login ID. Also I have done below mapping in the unification for join.

For example in RSA one user has user ID is like RS12345AD and login ID is 12345 and in AD user sAMAccoutname (mapped to user ID in collector) is like 12345

When I collect identities using below join, it is creating new user in RSA, Kindly let me know if I am missing anything.

And is it possible to have multiple join criteria for one collector ?

Note: When I use only 1 join criteria HRMS_IDC.Loign ID = AD Attribute IDC.User Id, it works

Regards,

Pankaj

Craig Ramsay

Aug 7, 2020 3:44 AM

Correct Answer

OK - I would strongly recommend revisiting that as an option if possible. The root cause here is inconsistent AD data so remediating this with a new attribute would be easiest. However….

With regards to the different user types, is there a way to distinguish them easily within your HRMS feed?

If so, you could set up 2 IDC pointing to HRMS. One collecting all staff that will match on Login ID and one that will match on User Id.

If this is an option you would need to be certain that:

Between both collectors ALL users are still collected
No duplicate users; users cannot meet the criteria to be collected in both IDCs

Your unification could then match on HRMS_IDC1.Login ID = AD User Id and HRMS_IDC2.User Id = AD User Id

See the reply in context

No one else had this question

Outcomes

Clive Morrish

Aug 3, 2020 5:14 AM

Hi Pankaj,

To confirm, you have 2 Identity Collectors as follows:

HMRS_IDC
AD Attributes IDC

Both of these IDCs are configured to 'Create Users', is that correct? Or is the AD Attributes IDC only for enriching data?

You're then looking the link the AD Account to the Identity on either the User ID or the Login ID?

Thanks,

Clive

Actions

Pankaj Rana @ Clive Morrish on Aug 4, 2020 4:39 AM

Yes , correct and also create additional users (external) from AD

Actions

Ahmed Nofal

Aug 3, 2020 9:09 AM

Can you try removing the second join :

HRMS_IDC.User id = AD Attributes IDC.User id

As the user id from HRMS is always not the same as user id from AD Attributes IDC

(HRMS) RS12345AD ≠ (AD Atrributes IDC) 12345

The reason why I'm suggesting the removal is because maybe the two joins on the same connectors and AND'ed and not OR'ed; meaning that the 2 join conditions must be fulfilled in order for the unification to take place.

1 person found this helpful

Actions

Pankaj Rana @ Ahmed Nofal on Aug 4, 2020 4:42 AM

yes Ahmed, it seems it assumes AND'ed filter for join. with 1 join it is working.

but removing join will not fulfill my requirement. is there any other way to achieve this ?

Actions

Craig Ramsay

Aug 4, 2020 10:06 AM

Hey Pankaj,

Would it be possible to update your AD domain to store the HRMS ID in a separate attribute such as employeeNumber?

This way you would only need a single Join configured and if a decision is ever made to standardise the sAMAccount naming policy across the combined organisation it would have no impact on your unification settings.

Kind regards,

Craig

1 person found this helpful

Actions

Pankaj Rana @ Craig Ramsay on Aug 7, 2020 3:17 AM

no that option is not available.

Actions

Craig Ramsay

@ Pankaj Rana on Aug 7, 2020 3:44 AM

OK - I would strongly recommend revisiting that as an option if possible. The root cause here is inconsistent AD data so remediating this with a new attribute would be easiest. However….

With regards to the different user types, is there a way to distinguish them easily within your HRMS feed?

If so, you could set up 2 IDC pointing to HRMS. One collecting all staff that will match on Login ID and one that will match on User Id.

If this is an option you would need to be certain that:

Between both collectors ALL users are still collected
No duplicate users; users cannot meet the criteria to be collected in both IDCs

Your unification could then match on HRMS_IDC1.Login ID = AD User Id and HRMS_IDC2.User Id = AD User Id

1 person found this helpful

Actions

7 Replies

Clive Morrish Aug 3, 2020 5:14 AM
Mark Correct
Correct Answer
Hi Pankaj,

To confirm, you have 2 Identity Collectors as follows:
- HMRS_IDC
- AD Attributes IDC
Both of these IDCs are configured to 'Create Users', is that correct? Or is the AD Attributes IDC only for enriching data?

You're then looking the link the AD Account to the Identity on either the User ID or the Login ID?

Thanks,
Clive
Like • Show 0 Likes0
Actions
- Pankaj Rana @ Clive Morrish on Aug 4, 2020 4:39 AM
  Mark Correct
  Correct Answer
  Yes , correct and also create additional users (external) from AD
  Like • Show 0 Likes0
  Actions
Ahmed Nofal Aug 3, 2020 9:09 AM
Mark Correct
Correct Answer
Can you try removing the second join :
HRMS_IDC.User id = AD Attributes IDC.User id

As the user id from HRMS is always not the same as user id from AD Attributes IDC
(HRMS) RS12345AD ≠ (AD Atrributes IDC) 12345

The reason why I'm suggesting the removal is because maybe the two joins on the same connectors and AND'ed and not OR'ed; meaning that the 2 join conditions must be fulfilled in order for the unification to take place.
1 person found this helpful
Like • Show 1 Like1
Actions
- Pankaj Rana @ Ahmed Nofal on Aug 4, 2020 4:42 AM
  Mark Correct
  Correct Answer
  yes Ahmed, it seems it assumes AND'ed filter for join. with 1 join it is working.
  but removing join will not fulfill my requirement. is there any other way to achieve this ?
  Like • Show 0 Likes0
  Actions
Craig Ramsay Aug 4, 2020 10:06 AM
Mark Correct
Correct Answer
Hey Pankaj,

Would it be possible to update your AD domain to store the HRMS ID in a separate attribute such as employeeNumber?

This way you would only need a single Join configured and if a decision is ever made to standardise the sAMAccount naming policy across the combined organisation it would have no impact on your unification settings.

Kind regards,
Craig
1 person found this helpful
Like • Show 0 Likes0
Actions
- Pankaj Rana @ Craig Ramsay on Aug 7, 2020 3:17 AM
  Mark Correct
  Correct Answer
  no that option is not available.
  Like • Show 0 Likes0
  Actions
  - Craig Ramsay @ Pankaj Rana on Aug 7, 2020 3:44 AM
    Unmark Correct
    Correct Answer
    OK - I would strongly recommend revisiting that as an option if possible. The root cause here is inconsistent AD data so remediating this with a new attribute would be easiest. However….
    
    With regards to the different user types, is there a way to distinguish them easily within your HRMS feed?
    
    If so, you could set up 2 IDC pointing to HRMS. One collecting all staff that will match on Login ID and one that will match on User Id.
    
    If this is an option you would need to be certain that:
    
    Between both collectors ALL users are still collected
    No duplicate users; users cannot meet the criteria to be collected in both IDCs
    
    Your unification could then match on HRMS_IDC1.Login ID = AD User Id and HRMS_IDC2.User Id = AD User Id
    1 person found this helpful
    Like • Show 1 Like1
    Actions

Unification Join during identity collection

Outcomes

Related Content

Recommended Content