Managing Entities

An entity exists both in the source and the target system.

1. You run a provisioning job for the first time.

   As a result, Identity Provisioning reads this entity from the source and updates it on the target system.

2. You delete the relevant entity from the source system.

3. You run another provisioning job which finishes successfully.

   However, the service recognizes the relevant entity as a "previously existed one" and does not delete it from the target.

The following sequence of steps is recommended for synchronizing the deletion of entities between source and target systems, as in Scenarios 1, 2 and 3:

You have run successful provisioning jobs (Read or Resync) between the systems.

1. Delete an entity from the source system.
2. On the Properties tab of the target system, add the ips.delete.existedbefore.entities property and set its value to true.
3. Run a provisioning job.
4. Verify that the relevant entity has been deleted from the target system.

If the property is set afterward, entities recognized as "previously existed ones" cannot be deleted from the target system anymore. In this case, you need to delete them from the target system (for example, manually or through a script).

The ips.delete.existedbefore.entities is an optional property that can be set on every target system. You can use it to control whether recognized entities as "previously existed ones" should be deleted from the target system.

This is important for security and legal reasons in cases when users (for example, employees) are no longer active in the source system, and their availability and permissions must be removed from the relevant target systems.

An entity does not exist in either system (neither source, nor target).

1. You run provisioning jobs (Read or Resync) between the systems.
2. You add this entity to the source system.
3. The same entity is added (manually or through script) to the target system.
4. You run a new provisioning job.

   As a result, Identity Provisioning reads this entity from the source and updates it in the target system.

5. You delete the relevant entity from the source system.
6. You run another provisioning job which finishes successfully.

   However, the service recognizes the relevant entity as a "previously existed one" and does not delete it from the target.

An entity exists in the source system only.

1. You run at least one provisioning job.

   As a result, Identity Provisioning reads this entity and creates it in the target system.

2. You reset one of these systems.
3. You run a new provisioning job.

   As a result, Identity Provisioning reads this entity from the source system (but is not "aware" of it, that is, it behaves like it is reading it for the first time) and makes a full update of it in the target system.

4. You delete the relevant entity from the source system.
5. You run another provisioning job which finishes successfully.

   However, the service recognizes the relevant entity as a "previously existed one" and does not delete it from the target.

An entity exists both in the source and the target system. (It has not been created on the target by the Identity Provisioning service.)

Conditions or expressions, such as (ignore or skipOperations), are not set in the target transformation.

1. You run a successful Read job. As a result, Identity Provisioning updates the existing entity on the target system.
2. You delete this entity from the source system.
3. You run a provisioning job which finishes with error.

   As a result, the relevant entity has not been deleted from the target system.

4. In the job log, you see that there are failed entities (users or groups) on the source system. That means that the job has failed trying to read them from the source.

1. Resolve the failed entities in the source system.
2. On the Properties tab of the target system, add the ips.delete.existedbefore.entities property and set its value to true.
3. Run a successful Read job between the systems.
4. Verify that the relevant entity has been deleted from the target system.
   Note

   Even if the job fails due to errors on the target system, if the read from the source is successful, the service will still delete the entity from the target.

An entity exists in the source system and has been provisioned to the target by the Identity Provisioning service.

Conditions or expressions, such as (ignore or skipOperations), are not set in the target transformation.

1. You delete this entity from the source system.
2. You run a provisioning job which finishes with error.

   As a result, the relevant entity has not been deleted from the target system.

3. In the job log, you see that there are failed entities (users or groups) on the source system. This means that the job has failed trying to read them from the source.

1. Resolve the failed entities in the source system.
2. Run a successful Read job between the systems.
3. Verify that the relevant entity has been deleted from the target system.
   Note

   Even if the job fails due to errors on the target system, if the read from the source is successful, the service will still delete the entity from the target

An entity exists in the source system and has been provisioned to the target by the Identity Provisioning service.

Conditions or expressions, such as (ignore or skipOperations), are not set in the target transformation.

1. You delete an entity from the source system.
2. You run a delta read job which finishes successfully.

   However, the relevant entry has not been deleted from the target system. That is because delta read jobs do not take deleted users into consideration. ).

1. On the Properties tab of the source system, set the ips.delta.read property to false.

   Alternatively, you can wait for the next scheduled full job to start (if it is coming soon), according to the number you have set for property ips.full.read.force.count.

2. Run a new provisioning job (or wait for it to run automatically). It will be a full read job.
3. Verify that the relevant entity has been deleted from the target system.
4. (Optional) If you want to continue running delta read jobs, go to the ips.delta.read property and set it back to true.