21 posts tagged with "Horizons"

Cloud Application Gateway version
Import worker: 16.0.0.273
Provisioning worker: 16.0.0.129

Changes ​

Instance ID displayed next to workers in System Heartbeats​

The System Heartbeats widget in the Operations dashboard now displays the instance ID next to each worker service. Previously, the Import Worker Service and Provisioning Worker Service could appear twice in the widget when two Cloud Application Gateway (CAG) instances were sending heartbeats, one hosted by the customer and one hosted by Omada.

This allows you to distinguish between the instances and avoids confusion about duplicate worker services.

Resolved bugs and issues ​

Identities losing organizational unit and policy-driven assignments​

We have fixed an issue where identities could lose their organizational unit and the related policy-driven assignments after an import that received both contexts and context assignments. In this case, a context was received with a new query ID while the existing context assignment still referenced the previous query ID. The lookup could not find a valid owner for the context and removed the previous lookup data. When the new context assignment was received later in the same import, the required lookup data was already missing, so the context assignment was not stored.

The processing of contexts and context assignments received in the same import has been corrected to prevent the issue from reoccurring.

INC-319352

Organizational unit changes not applied to employments​

We have fixed an issue where a change of the organizational unit in the source system was not applied to the employment in Omada. When the parent business key of a context changed, Enhanced Delta updated only the reference to the latest version of the original parent and did not look up the new parent. As a result, the parent context ID in the lookup data still pointed to the original parent, and employments kept the previous organizational unit, which could affect access based on the organizational unit.

The Enhanced Delta now updates the parent reference when the parent business key changes.

INC-320008

Cleanup import profile reported as failed​

We have fixed an issue where the cleanup import profile was reported as failed even though all cleanup operations were completed successfully. An incorrect status update prevented the process from reporting completion, so the task timed-out and was marked as failed. No operational data was affected.

The issue has been resolved and the cleanup status is now reported correctly.

INC-319948

Cloud Application Gateway automatic update failing in proxy environments​

We have fixed an issue where the automatic update of the Cloud Application Gateway (CAG) could fail in environments where outbound connections are routed through a proxy. The worker manager application, which handles the upgrade process, was unable to connect to the Omada Cloud Service, while the import and provisioning workers connected successfully.

The issue has been resolved with the updated CAG version.

INC-319706

RoPE calculation stalling due to outdated statistics on indirect resource assignments​

We have fixed an issue where identity calculation in RoPE could stall when a large number of new versions were created in the indirect resource assignment table, for example, in environments that run imports frequently. The database statistics for this table were not refreshed fast enough, which could cause an inefficient query execution plan and lead to timeouts.

To resolve the issue, the statistics are now updated as part of the indirect resource assignment calculation on each import.

INC-316658

Provisioning dashboard showing incorrect operation for a task mapping​

We have fixed an issue where the Provisioning dashboard showed the original operation of a provisioning task instead of the operation set by a task mapping. In review mode, the operation was displayed incorrectly until the task was reviewed. The operation that was actually executed was correct, and only the display was affected.

The dashboard now shows the operation set by the task mapping.

INC-319532

Incorrect job counts in Processed last hour and Processed last 24 hours​

We have fixed an issue where jobs were counted twice in the Processed last hour and Processed last 24 hours values when relayed connectivity was enabled. The list of jobs in the grid showed the correct number. The counters now show the same number of jobs as the grid.

INC-318786

Identity processing failing after a person is moved between OIS identities​

We have fixed an issue where the Identity Processing step of an import could fail repeatedly when a person was moved from one OIS identity to another and the previous identity was renamed in the same import, for example during an employee or contractor conversion. The previous identity remained linked to the person and took over the OISID of the new identity instead of keeping its own. When this identity was processed, the safeguard that prevents an OISID from changing, which would otherwise create a duplicate identity in OIS, stopped the batch. As a result, identities in the affected batch were left unprocessed, which delayed provisioning and credential delivery.

An identity now retains its own OISID unless it is matched through a joining attribute.

INC-320147

AD import not delivering attributes to ODW due to message size limit​

We have fixed an issue where an AD import could complete without making new attributes, such as extension attributes, available in ODW. During lookup processing, the result message exceeded the maximum message size allowed by Azure Service Bus (1 MB), so it was rejected with the MessageSizeExceeded error and the affected data was not delivered.

The issue has been resolved, and large lookup results are now handled correctly.

INC-319850

Account type not recalculated when an extension property used in account join rules changes​

We have fixed an issue where an account was not reclassified to a different account type after the value of an extension property used in the scope of account join rules changed, for example, when an account was moved to a different organizational unit. The value of this property was not included in the calculation of the configuration hash code. As a result, Enhanced Delta did not detect a change affecting the account join and processed the account through the faster workflow without recalculating the join, so the account kept its previous account type.

The issue has been resolved by including the value in the configuration hash code calculation.

INC-316816

Cloud Application Gateway version
Import worker: 16.0.0.176
Provisioning worker: 16.0.0.107

Resolved bugs and issues ​

Import failing due to threshold violation​

We have fixed an issue where import thresholds configured with a 24-hour interval were misinterpreted as 24 days. The interval value was parsed using .NET's TimeSpan.Parse(), which does not support hours of 24 or greater, so the hours were reinterpreted as days instead. The 24:00:00 was stored as 2,073,600 seconds (24 days) rather than the expected 86,400 seconds, or 24 hours. This caused import threshold violations to trigger incorrectly for intervals of 24 hours or more. The fix replaces the TimeSpan.Parse() with manual HH:MM:SS parsing that correctly derives the interval in seconds.

INC-318721

Provisioning failure when manager attribute is mapped to null​

We have resolved an issue related to a recent Cloud Application Gateway (CAG) update where provisioning tasks failed to update their status when the manager attribute was mapped to null, preventing affected accounts from being created.

INC-319236

Import failing during the event generation stage​

We have fixed an issue where imports could intermittently fail during the event generation stage. The failure was caused by an invalid execution plan in the underlying stored procedure. The procedure has been corrected to prevent the issue from recurring.

INC-317353

Actual direct resource assignments lost after RoPE identity recalculation​

We have fixed an issue where repeated event generation failures could cause identities to lose their Actual Direct resource assignments, triggering unwanted account creation jobs in RoPE. The affected data has been repaired, and the underlying issue has been resolved to prevent the problem from recurring.

INC-318635

Stalling RoPE calculation due to prolonged actual state retrieval​

We have resolved an issue where identity calculation in RoPE could stall or time out while retrieving actual resource assignment data, causing identities to remain in the Pending state. The issue was caused by an expanding volume of expired historical data in an internal assignment table. A cleanup mechanism has been added to prevent this data from accumulating.

INC-316658

Cloud Application Gateway version
Import worker: 16.0.0.102
Provisioning worker: 16.0.0.50

Resolved bugs and issues ​

SAP HCM failing import​

There was an issue with the SAP HCM import failing during the adaptation stage. As a result, all following scheduled imports were aborted. The issue was caused by the EsAdapter service user's group losing access to the Systems entity, so it could not retrieve export mappings for the Omada Identity system.

The issue has been resolved by restoring the EsAdapter service user's group access to the Systems entity.

INC-317432

Import timeout related to AccountJoin​

There was an issue with imports failing due to timeouts. The issue was caused by the AccountJoin duplicate-key conflict. When an identity was deleted in the source system and later re-created with a new business key, the original AccountJoin record, which was retained in a deleted state, conflicted with the unique index on AccountId. The new AccountJoin could not be created

The AccountJoin behavior was corrected to mitigate the import timeout issue.

INC-314030

Actual Direct assignments lost after import adapting-phase failures​

There was an issue where Actual Direct assignments for identities imported from the Active Directory source system became unconfirmed following import adapting-phase failures.

The missing resource assignments were recalculated and manually restored. Additionally, terminated identities were remapped using the useridWH extension attribute to join accounts correctly. The repopulation process has been extended to also be triggered by the AccountJoin changes.

INC-314133

Cloud Application Gateway version
Import worker: 16.0.0.102
Provisioning worker: 16.0.0.50

Resolved bugs and issues ​

Incorrect import status​

There was an issue with the import reported as successful, even though the import failed during the adaptation stage. The import status logic was fixed, and the issue has been resolved.

INC-310706

Import timing out​

There was an issue where imports were failing with the The import process was stopped because it took too long to process all messages error when an identity deleted in a source system was later re-created with a new business key. The conflicting AccountId index prevented the new AccountJoin record from being created, causing affected messages to retry until reaching the processing threshold. The behavior has been improved to handle re-created identities correctly.

INC-314030

Attempts to create account assignments for terminated identities​

There was an issue in which the system attempted to create account assignments for terminated identities, resulting in warnings. The issue has been resolved, and terminated identities are now correctly excluded from the creation of account assignments.

INC-311754

Cloud Application Gateway version
Import worker: 15.0.0.2418
Provisioning worker: 15.0.0.1149

Changes ​

Improved context handling and CBK alignment​

As part of ongoing data model alignment, we have improved how contexts are identified to ensure consistency between legacy and current formats. Contexts generated using different identifier formats are now merged, with the latest value from Enterprise Server used as the authoritative source.

Additionally, ContextAssignment and ContextOwner data are now included in the migration, ensuring consistent context relationships across the platform.

These changes eliminate duplicate contexts, improve data consistency, and ensure accurate reporting and relationship mapping across analytics.

Added resource status to data model​

We have enhanced the resource dimension in the Data Warehouse (and, as the next step, in Omada Identity Analytics), with the Resource Status derived from the Enterprise Server. Resources are still included in reports even if deleted, but their status is now available to support filtering and analysis.

This approach ensures transparency while allowing customers to filter out deleted resources without introducing inconsistencies in assignment data.

Resolved bugs and issues ​

Preview, provisioning, and import non-functional​

There was an issue where despite the Cloud Application Gateway being operational, the preview, provisioning, and import processes were non-functional. The appsettings.customer.json configuration file had a mismatch. The dedicated instance name was set to a different value than Default causing the issue.

Correcting the configuration resolved the problem, and the preview, provisioning, and import capabilities have been restored.

INC-313169

Connectivity issues due to proxySettings ignored​

The proxySettings configured in the appsettings.customer.json file were being ignored, resulting in connectivity failure.

The issue was resolved by reconfiguring the Cloud Application Gateway services to make them operate under a Service account. This allowed proper proxy usage and restored connectivity.

INC-312866

HR import not working​

There was an issue with the HR import not working correctly. The issue was caused by faulty expression handling the Corporate_mobile_number field. Some identities had values shorter than expected resulting in the StartIndex cannot be less than zero error.

The issue was resolved by correcting the data causing errors or by adding validation logic allowing to handle shorter values correctly.

INC-313028

Calculation warning for terminated identities​

There was an issue with calculating terminated identities. The system continuously attempted to create account assignments for terminated identities.

The assignment handling for terminated identities has been corrected, preventing unnecessary calculations and errors.

INC-311754

Initial import error after the migration to Horizons​

There was an issue with the initial import after the migration to Horizons. The problem was caused by an initialization flaw in the migration process, resulting in a GraphQL-related database object being created before the required table existed.

The issue was self-corrected with export mapping initiation that created the necessary table.

INC-312875

Effective time handling after enabling Horizons​

We identified an issue where the EffectiveTime could be incorrectly set when enabling Horizons. This occurred because the system updated the effective date before a valid creation timestamp was available for the identity.

We have updated the process to wait until the identity is delivered with a valid creation timestamp before setting the EffectiveTime, ensuring inconsistencies are resolved automatically.

INC-309375

SSIS: improved performance for long-running imports​

We have resolved an issue where long-running SSIS imports could experience performance degradation, with execution times exceeding historical baselines and impacting overall system responsiveness. The issue was caused by sustained resource pressure and data inefficiencies, including duplicate data and continuous identity calculation backlogs.

We have optimized import performance to restore expected execution times and improve overall system stability.

INC-309621

Cloud Application Gateway version
Import worker: 15.0.0.2336
Provisioning worker: 15.0.0.1087

Resolved bugs and issues ​

Unwarranted resets​

There was an issue with the existing accounts being treated as missing due to an exceeded AD import threshold. It initiated job recreation and caused a password reset for a substantial number of users.

The issue was resolved by reverting to a stable state, and while the import was halted, threshold values were increased to prevent repeated violations. To contain the risk of recurrence, the system state inconsistencies were corrected.

INC-310805

HR import failure​

The HR import failed due to a timeout after the Horizons update. The root cause was an identity missing a required internal business key, which caused the import to stall at the IdentityJoin step.

The issue was resolved by updating the identity with the unique business key, unblocking the import process.

INC-308354

Missing DeletionTime​

Following the Horizons update (23.03), there was an issue with identities marked as deleted, missing the DeletionTime attribute. As a result, the ExpirationTime field values were not populated, causing failures in identity lifecycle processing, including import failures.

The issue was resolved by correcting the handling of missing fields, related to deletion, in the identity data. Affected records were reprocessed to ensure the DeletionTime attribute and ExpirationTime fields were correctly populated.

INC-311099 INC-311599

Cloud Application Gateway version
Import worker: 15.0.0.2185
Provisioning worker: 15.0.0.976

Resolved bugs and issues ​

Service disruption​

There was a failure of scheduled import for all active systems caused by a duplicated initiation of the import process. It was a result of infrastructure performance degradation leading to API timeouts and delays in communication between staging and processing components.

The issue has been resolved to prevent duplicate processing and ensure correct handling of such edge cases in the future.

INC-307488

System import not initiated​

There was a recurring issue with the all systems import not being initiated. After a specific import has timed out, subsequent processes become stale, and full import attempts have not started correctly.

The issue was resolved by correcting the configuration of the system that was the root cause of the issue.

INC-307573

Deactivated users handling​

There was an issue with deactivated users. Instead of disabling existing accounts, the system misinterpreted the actual state and initiated a new account request, leading to failures, since the account already existed.

The issue was resolved, ensuring that the deprovisioning process is correctly handling deactivated users.

INC-304451

Import timeout​

Import resulted in a timeout due to an issue in the logging mechanism at the end of the import process and inconsistencies in identity reconciliation, leading to key duplicate conflicts.

The issues have been resolved, ensuring import performance stability and correct identity processing.

INC-306927

Cloud Application Gateway version
Import worker: 15.0.0.2185
Provisioning worker: 15.0.0.976

Resolved bugs and issues ​

Analytics inconsistencies​

Several inconsistencies were identified, including a mix of synchronization issues, referencing an incorrect account during RoPE calculations or data-handling. The main issue was timing with identity calculations overlapping with imports resulting in mismatch between accounts and resource assignments. The processing flow has been stabilized to prevent such overlaps, and remaining minor issues have been corrected to ensure accurate and predictable behavior.

INC-298001

Cloud Application Gateway version
Import worker: 15.0.0.2185
Provisioning worker: 15.0.0.976

Resolved bugs and issues ​

Import warnings​

There was an issue where system was showing warnings for the import, even though the import was completed successfully. The import log was stating no errors and warning details were empty. This resulted in differences between the import actual result and the UI status. The issue has been resolved and inconsistencies between the actual state of the import and the UI status have been fixed.

INC-305009

Authentication issue​

There was an issue with the authentication process, related to some OAuth2 handling limitations. It resulted in test connection producing misleading error messages. The issue has been resolved and the OAuth2 custom authorization is now supported when testing connection with Cloud Application Gateway is enabled.

INC-304718

Analytics inconsistencies​

Analytics inconsistencies related to missing references, despite data correctly appearing in the database, were identified. The inconsistencies were caused by a timing issue during identity calculation, where for example, identity was recalculated simultaneously with the import running. The issue with the synchronization has been resolved with validation verifying correct behavior.

INC-298001

System import error​

There was an issue with daily imports for non-SAP systems failing with errors reporting timeouts and database connection limits. The issue was caused by an incorrect import progress reporting and not data loss. It has been resolved.

INC-303120

Cloud Application Gateway version
Import worker: 15.0.0.2116
Provisioning worker: 15.0.0.974

Resolved bugs and issues ​

Azure Log Analytics size issue​

There was an issue with warnings in the Azure Log Analytics pointing to the exceeded size limit of log messages. The issue has been resolved, and the limit has been adjusted to safely handle larger log messages and prevent unnecessary warnings.

INC-303483

Halted imports​

There was an issue where imports appeared halted, caused by an inconsistency setting the import state to error in the UI, even though the underlying data processing was completed successfully. The import status handling has been fixed, and the issue is resolved.

INC-304436