Cloud Application Gateway version
Import worker: 16.0.0.102
Provisioning worker: 16.0.0.50

Resolved bugs and issues ​

SAP HCM failing import​

There was an issue with the SAP HCM import failing during the adaptation stage. As a result, all following scheduled imports were aborted. The issue was caused by the EsAdapter service user's group losing access to the Systems entity, so it could not retrieve export mappings for the Omada Identity system.

The issue has been resolved by restoring the EsAdapter service user's group access to the Systems entity.

INC-317432

Import timeout related to AccountJoin​

There was an issue with imports failing due to timeouts. The issue was caused by the AccountJoin duplicate-key conflict. When an identity was deleted in the source system and later re-created with a new business key, the original AccountJoin record, which was retained in a deleted state, conflicted with the unique index on AccountId. The new AccountJoin could not be created

The AccountJoin behavior was corrected to mitigate the import timeout issue.

INC-314030

Actual Direct assignments lost after import adapting-phase failures​

There was an issue where Actual Direct assignments for identities imported from the Active Directory source system became unconfirmed following import adapting-phase failures.

The missing resource assignments were recalculated and manually restored. Additionally, terminated identities were remapped using the useridWH extension attribute to join accounts correctly. The repopulation process has been extended to also be triggered by the AccountJoin changes.

INC-314133

Cloud Application Gateway version
Import worker: 16.0.0.102
Provisioning worker: 16.0.0.50

Resolved bugs and issues ​

Incorrect import status​

There was an issue with the import reported as successful, even though the import failed during the adaptation stage. The import status logic was fixed, and the issue has been resolved.

INC-310706

Import timing out​

There was an issue where imports were failing with the The import process was stopped because it took too long to process all messages error when an identity deleted in a source system was later re-created with a new business key. The conflicting AccountId index prevented the new AccountJoin record from being created, causing affected messages to retry until reaching the processing threshold. The behavior has been improved to handle re-created identities correctly.

INC-314030

Attempts to create account assignments for terminated identities​

There was an issue in which the system attempted to create account assignments for terminated identities, resulting in warnings. The issue has been resolved, and terminated identities are now correctly excluded from the creation of account assignments.

INC-311754

Cloud Application Gateway version
Import worker: 15.0.0.2418
Provisioning worker: 15.0.0.1149

Changes ​

Improved context handling and CBK alignment​

As part of ongoing data model alignment, we have improved how contexts are identified to ensure consistency between legacy and current formats. Contexts generated using different identifier formats are now merged, with the latest value from Enterprise Server used as the authoritative source.

Additionally, ContextAssignment and ContextOwner data are now included in the migration, ensuring consistent context relationships across the platform.

These changes eliminate duplicate contexts, improve data consistency, and ensure accurate reporting and relationship mapping across analytics.

Added resource status to data model​

We have enhanced the resource dimension in the Data Warehouse (and, as the next step, in Omada Identity Analytics), with the Resource Status derived from the Enterprise Server. Resources are still included in reports even if deleted, but their status is now available to support filtering and analysis.

This approach ensures transparency while allowing customers to filter out deleted resources without introducing inconsistencies in assignment data.

Resolved bugs and issues ​

Preview, provisioning, and import non-functional​

There was an issue where despite the Cloud Application Gateway being operational, the preview, provisioning, and import processes were non-functional. The appsettings.customer.json configuration file had a mismatch. The dedicated instance name was set to a different value than Default causing the issue.

Correcting the configuration resolved the problem, and the preview, provisioning, and import capabilities have been restored.

INC-313169

Connectivity issues due to proxySettings ignored​

The proxySettings configured in the appsettings.customer.json file were being ignored, resulting in connectivity failure.

The issue was resolved by reconfiguring the Cloud Application Gateway services to make them operate under a Service account. This allowed proper proxy usage and restored connectivity.

INC-312866

HR import not working​

There was an issue with the HR import not working correctly. The issue was caused by faulty expression handling the Corporate_mobile_number field. Some identities had values shorter than expected resulting in the StartIndex cannot be less than zero error.

The issue was resolved by correcting the data causing errors or by adding validation logic allowing to handle shorter values correctly.

INC-313028

Calculation warning for terminated identities​

There was an issue with calculating terminated identities. The system continuously attempted to create account assignments for terminated identities.

The assignment handling for terminated identities has been corrected, preventing unnecessary calculations and errors.

INC-311754

Initial import error after the migration to Horizons​

There was an issue with the initial import after the migration to Horizons. The problem was caused by an initialization flaw in the migration process, resulting in a GraphQL-related database object being created before the required table existed.

The issue was self-corrected with export mapping initiation that created the necessary table.

INC-312875

Effective time handling after enabling Horizons​

We identified an issue where the EffectiveTime could be incorrectly set when enabling Horizons. This occurred because the system updated the effective date before a valid creation timestamp was available for the identity.

We have updated the process to wait until the identity is delivered with a valid creation timestamp before setting the EffectiveTime, ensuring inconsistencies are resolved automatically.

INC-309375

SSIS: improved performance for long-running imports​

We have resolved an issue where long-running SSIS imports could experience performance degradation, with execution times exceeding historical baselines and impacting overall system responsiveness. The issue was caused by sustained resource pressure and data inefficiencies, including duplicate data and continuous identity calculation backlogs.

We have optimized import performance to restore expected execution times and improve overall system stability.

INC-309621

Cloud Application Gateway version
Import worker: 15.0.0.2336
Provisioning worker: 15.0.0.1087

Resolved bugs and issues ​

Unwarranted resets​

There was an issue with the existing accounts being treated as missing due to an exceeded AD import threshold. It initiated job recreation and caused a password reset for a substantial number of users.

The issue was resolved by reverting to a stable state, and while the import was halted, threshold values were increased to prevent repeated violations. To contain the risk of recurrence, the system state inconsistencies were corrected.

INC-310805

HR import failure​

The HR import failed due to a timeout after the Horizons update. The root cause was an identity missing a required internal business key, which caused the import to stall at the IdentityJoin step.

The issue was resolved by updating the identity with the unique business key, unblocking the import process.

INC-308354

Missing DeletionTime​

Following the Horizons update (23.03), there was an issue with identities marked as deleted, missing the DeletionTime attribute. As a result, the ExpirationTime field values were not populated, causing failures in identity lifecycle processing, including import failures.

The issue was resolved by correcting the handling of missing fields, related to deletion, in the identity data. Affected records were reprocessed to ensure the DeletionTime attribute and ExpirationTime fields were correctly populated.

INC-311099 INC-311599

Cloud Application Gateway version
Import worker: 15.0.0.2185
Provisioning worker: 15.0.0.976

Resolved bugs and issues ​

Service disruption​

There was a failure of scheduled import for all active systems caused by a duplicated initiation of the import process. It was a result of infrastructure performance degradation leading to API timeouts and delays in communication between staging and processing components.

The issue has been resolved to prevent duplicate processing and ensure correct handling of such edge cases in the future.

INC-307488

System import not initiated​

There was a recurring issue with the all systems import not being initiated. After a specific import has timed out, subsequent processes become stale, and full import attempts have not started correctly.

The issue was resolved by correcting the configuration of the system that was the root cause of the issue.

INC-307573

Deactivated users handling​

There was an issue with deactivated users. Instead of disabling existing accounts, the system misinterpreted the actual state and initiated a new account request, leading to failures, since the account already existed.

The issue was resolved, ensuring that the deprovisioning process is correctly handling deactivated users.

INC-304451

Import timeout​

Import resulted in a timeout due to an issue in the logging mechanism at the end of the import process and inconsistencies in identity reconciliation, leading to key duplicate conflicts.

The issues have been resolved, ensuring import performance stability and correct identity processing.

INC-306927

Cloud Application Gateway version
Import worker: 15.0.0.2185
Provisioning worker: 15.0.0.976

Resolved bugs and issues ​

Analytics inconsistencies​

Several inconsistencies were identified, including a mix of synchronization issues, referencing an incorrect account during RoPE calculations or data-handling. The main issue was timing with identity calculations overlapping with imports resulting in mismatch between accounts and resource assignments. The processing flow has been stabilized to prevent such overlaps, and remaining minor issues have been corrected to ensure accurate and predictable behavior.

INC-298001

Cloud Application Gateway version
Import worker: 15.0.0.2185
Provisioning worker: 15.0.0.976

Resolved bugs and issues ​

Import warnings​

There was an issue where system was showing warnings for the import, even though the import was completed successfully. The import log was stating no errors and warning details were empty. This resulted in differences between the import actual result and the UI status. The issue has been resolved and inconsistencies between the actual state of the import and the UI status have been fixed.

INC-305009

Authentication issue​

There was an issue with the authentication process, related to some OAuth2 handling limitations. It resulted in test connection producing misleading error messages. The issue has been resolved and the OAuth2 custom authorization is now supported when testing connection with Cloud Application Gateway is enabled.

INC-304718

Analytics inconsistencies​

Analytics inconsistencies related to missing references, despite data correctly appearing in the database, were identified. The inconsistencies were caused by a timing issue during identity calculation, where for example, identity was recalculated simultaneously with the import running. The issue with the synchronization has been resolved with validation verifying correct behavior.

INC-298001

System import error​

There was an issue with daily imports for non-SAP systems failing with errors reporting timeouts and database connection limits. The issue was caused by an incorrect import progress reporting and not data loss. It has been resolved.

INC-303120

Cloud Application Gateway version
Import worker: 15.0.0.2116
Provisioning worker: 15.0.0.974

Resolved bugs and issues ​

Azure Log Analytics size issue​

There was an issue with warnings in the Azure Log Analytics pointing to the exceeded size limit of log messages. The issue has been resolved, and the limit has been adjusted to safely handle larger log messages and prevent unnecessary warnings.

INC-303483

Halted imports​

There was an issue where imports appeared halted, caused by an inconsistency setting the import state to error in the UI, even though the underlying data processing was completed successfully. The import status handling has been fixed, and the issue is resolved.

INC-304436

Changes ​

Clean-up import profile​

The clean-up import profile implementation has been improved to boost efficiency and minimize downtime risks.

Previously the clean-up import profile was performed by an event definition. With the introduced changes, a scheduler component acts as a replacement for the event definition. It is operated and managed by Omada to optimize efficiency and minimize negative performance impact by adjusting the schedule based on recorded and predicted data load.

The clean-up feature itself is not affected by this change, providing instead more predictable and controllable behavior.

Resolved bugs and issues ​

Queued imports not running​

There was an issue with scheduled imports not initiating, despite no obvious blockers (actively running imports).

The issue has been resolved with the improvement to import execution and queue handling logic.

INC-298748

Test connection and preview feature failing​

There was an issue with the test connection and preview features timing-out. The issue has been resolved and both features are performed correctly.

INC-302553

Scheduled import failing​

A scheduled overnight import was failing during the Processing phase. The timeout was caused by incorrect reporting on processing progress. The issue has been resolved, and imports are now running correctly.

INC-303120

No-data import disables identities​

There was an issue where imports were processed as valid, even though they did not contain identity data. It initiated the DeleteDetection and led to the removal of all identities in the environment. This was caused by performing the delete-threshold validation when imports were queued and not initiated. The issue was resolved by shifting the threshold validation to a moment when the import is initiated. This ensures that the evaluation is accurate for each import.

INC-303020

Failing deprovisioning attempts​

Omitted removed resource assignment resulted in a repeated and failing deprovisioning attempts. The issue has been resolved by correcting deletion state tracking and by enforcing a full state refresh after imports.

INC-299571

Account ownership issue​

Account ownership configuration provided in a survey did not result in the account being correctly joined to an appropriate identity. This resulted in the same accounts reappearing in later surveys. The issue has been resolved.

INC-298777

Resolved bugs and issues ​

Clean-up import failing to complete​

The clean-up import remained in a running state, even after a log entry indicated the process was completed. This blocked other imports. The issue has been resolved, and clean-up imports are now correctly transitioned to the completed state after finalization.

INC-296698

Failing imports​

There was an issue with imports failing with a timeout message. This was due to an unusually large number of resource assignments marked for deletion that led to exceeding the timeout threshold. To resolve the issue a clean-up was performed and following imports were successful.

INC-300640

Identity join issue​

The identity join process was not performing correctly. The issue has been resolved.

INC-296642

Resolved bugs and issues ​

Import errors on CSV systems​

There was an issue with the flat file connector failing with a Permission denied (password) message. Retrying the selected action usually resolved the issue. To mitigate the issue, the flat file connector was improved with support for both password and keyboard-interactive authentication methods. An auto-retry mechanism for failed login attempts was also added.

INC-298874

Identities import issues​

There was an issue with importing identities with delta imports. Some were processed only after performing a full HR import with the Reset High Watermark option enabled. The issue was caused by incorrect and inconsistent parsing on watermark timestamps. The parsing and handling of timestamps have been improved resolving the import issue.

INC-295761

Import thresholds behavior​

There was an issue with identity updates not processed after accepting an import threshold, causing the threshold to be repeatedly triggered. The issue was a result of an inconsistent handling of date values containing UTC offset. The date handling has now been improved and all accepted updates are now processed correctly.

INC-297004

System page slow loading​

The performance has been optimized, decreasing page loading times and improving reliability.

INC-296091

Account ownership review​

There was an issue where accounts approved using Account Ownership reviews in the compliance workbench remained orphaned and were not linked to the selected identity. This has been resolved by applying survey decisions automatically, so matching between approved accounts and correct identities no longer requires manual actions from the user.

INC-297773

Identity property loss​

Previously, there was a risk that identity properties could be lost after an import with Reset High Watermark option enabled failed. To remove the risk, the system now prioritizes active entities during data joins. This prevents incomplete merges and ensures all identity attributes remain intact after imports.

INC-297866

Lookup feature issues​

There was an issue with environment timeouts related to the lookup functionality. To resolve the issue we have optimized lookup during exports to reduce timeouts in environments with large volumes of context assignments and accounts. Batching and latest-record resolution were improved, leading to more stable HR imports and fewer lookup-related warnings.

INC-296892

Resolved bugs and issues ​

Preview blocking system removal​

There was an issue where a system could not be removed if a preview was performed. The issue has been resolved, and performing a preview no longer blocks system removal.

INC-296779

System page loading issues​

There was an issue with unsuccessful or prolonged loading of systems pages. The performance has been improved to address those issues and stabilize loading time.

INC-295786

Migration failing​

There was an issue with the migration process failing due to unsupported mappings. The issue has been resolved and migration is no longer compromised.

INC-265344

Expression execution issue in mappings​

Expressions in mappings failed to execute when referenced properties were empty or missing values. This issue has been resolved, and expressions now handle empty property values correctly, ensuring reliable execution.

INC-295659

Prolonged RoPE calculations​

RoPE calculations were prolonged and occasionally caused time-outs. Performance has been optimized to ensure faster and more reliable calculations.

INC-295088

Resource assignment deprovisioning after import​

Recalculation was not automatically triggered following imports that included removed resources with associated resource assignments. For some identities this led to unintended deprovisioning of deleted resource assignments. This issue has been resolved and recalculation now occurs as expected, preventing incorrect deprovisioning.

INC-295643

Resolved bugs and issues ​

Import issue​

There was an issue with timeout while processing messages that resulted in the import processing. The issue has been resolved.

INC-295476, INC-295088

Issues with the ManagedInternally parameter​

There was an issue where the PublicIdentityMerged.ManagedInternally parameter retained the true value even after the employee record was imported from another source system. The issue has been resolved and the parameter behavior is now correct.

INC-294726

Account join failing​

There was an issue where account join did not happen, even though identity and account met the join criteria. The issue has been resolved and the behavior is now correct.

INC-295089

Changes ​

Processing terminated identities​

The introduction of Horizons improved performance, scalability and brought additional functionalities, for example identity merge, without drastically changing how data is manipulated during the import process. However, terminated identities were filtered out from the processing stage which made managing updates and attributes for terminated and re-hires identities challenging.

To address the challenge with the processing of terminated identities that have accounts still existing in the system, the FilterTerminatedIdentities setting has been configured to the false value by default.

With the following mappings it allows to have an overview of the account ownership for terminated identities that were not deleted from Omada Identity.

For newly deployed and migrated systems that are operating with the Horizons solution, the FilterTerminatedIdentities setting is by default configured to false.

For systems that are already utilizing Horizons, Omada recommends changing the FilterTerminatedIdentities value to false for non-production environments.If testing of the terminated identities management is satisfactory, contact Omada Support to change the default value of the setting in the production environment.

For more information, go to the Recommendations section of Horizons documentation.

Resolved bugs and issues ​

Account joined to multiple identities​

There was an issue with a single account joined to multiple identities. The issue has been resolved and no longer occurs.

INC-288773

Account matching to two identities​

There was an issue with an account matching to two identities, with one of them having the terminated status. The issue has been resolved.

INC-289439

Frozen import​

There was an issue with imports being suspended and not progressing. The issue has been resolved.

INC-290154

New hire calculations fail​

There was an issue with the way accounts were fetched resulting in calculations failing. This issue has been resolved and identities are processed correctly.

INC-289592

Import not starting​

There was an issue with the Worker Service losing connection with SignalR. If the reconnection attempt failed in a short timeframe, the Worker Service was not receiving notifications from SignalR, thus disrupting the import process. The issue has been resolved.

INC-289305

Resolved bugs and issues ​

Missing Account join scope​

There was an issue with the missing Account join scope in ownership rules. It has been resolved, and complete configuration is provided to the Account join component, ensuring it works correctly.

INC-289350

Account classification issue​

We have resolved a classification issue where, during the migration process, accounts were assigned incorrect type.

INC-288861

Resolved bugs and issues ​

Identities joining on empty fields​

There was an issue with identities joining with the join field value empty or set to null. The issue has been resolved preventing this behavior.

Errors during staging phase of the import​

There was an issue with inconsistent date formats in records, which caused errors during the staging phase of the import. Changing the expression to parse the incorrect date format has resolved the issue.

INC-286652

System import issue​

An issue with starting the system import, caused by incorrectly set id, has been resolved.

INC-286535

RoPE calculation issue​

An issue with a suspended RoPE calculation has been resolved.

INC-286501

Account join doesn't assign account type​

An issue where classification rule, that can only have the Scope attribute setting configured with the Identity join reason or Identity join properties value, was not working correctly because those values are also used by the ownership rule. The issue has been resolved.

INC-286323

Old data not removed after updating​

An issue with old records not being removed after data is updated has been resolved and now only entries with correct data are visible.

INC-286406

The following components have been updated ​

• Account join
• API
• Delete detection
• History tracking
• Identity join
• Identity merge
• Import service
• Import worker
• Lookup service
• Operational data store
• Reproject component
• Rope adapter

The following components have been updated ​

• Account join
• API
• Delete detection
• Identity join
• Identity merge
• Import service
• Lookup service
• Reproject component
• RoPE adapter
• RoPE calculator
• Worker service