Double login and email creation when we provision Directory users with HR Employees

Products Identity Manager Discussions & Questions
,
1

Hello,

We’re facing an issue that might be obvious for advanced users but we didn’t manage to solve it.

For the context, we are testing this with a DB reset at the config importation. So this is like a fresh start.

After :

  • upload of the Directory template
  • Run complete all tasks on Directory Entity Types
  • Run complete all tasks on RH connector Entity Types
  • Run all tasks on Directory Ressource Types

All the HR Employees that have 2 positions (for 1 contract) are created as a Directory User with two (different) logins and 2 (different) emails.

We don’t want 2 logins neither 2 emails. One employee only have one unique email and one unique login.

We did some XML modifications that might have lead to this situation. Especially on the Directory User Workflows New.xml because the login and email C# creation rules where not satisfying.
Also on FulfillInternalWorkflow.json but it was just adding the “User” as a Navigation properties.

Do you know what workflow could lead to such behavior and how we could solve it ?

Thank you.

2

hi @ValBee ,

To analyze this issue, can you please open a support ticket? I’ve spoken with the team about your request, and they are prepared to assist you. :slight_smile:

Thanks,

Kate

1 Like
4

Hello Valérie,

Is it normal that all users have 2 positions for 1 contract?
If it is not the case, you need to check your correlation rules for theResourceType “HR to Directory_UserRecord”.
You need also to make sure that the ‘PositionIdentifier’ is the same in the Directory and in the HR system.

Otherwise, if the multiple positions is intended, you need to check your “BuildUniqueValueAspect” for both Logins and Emails addresses where the PointCut is “Directory_User_CreateFromHR” or “Directory_User_UpdateFromHR”

You might need to add a control in the email/login generation rule.
Example:

If (resource.Login != null) {
   return resource.Login
} else {
  <--some login generation code-->
}

Something for the Email.

Regards
Hazem

5

Hello Hazem,

Thanks for your reply !

Yes it’s normal to have two (or more) positions for 1 contract. Someone can move from one position to an other, or someone can have two positions at the same time (working on different site for example).

I checked the BuildUniqueValueAspect and as far as I understand the C# part, it looks the same, here for the login :

BuildUniqueValueAspect Identifier=“Directory_UserRecord_UniqueValue_Login” Binding=“Workflow_Directory_User:Directory_User.Records.Login” ExpressionBinding=“Workflow_Directory_User:Directory_User.Records” Expression=“C#:resource:return resource.Login != null ? resource.Login : (Usercube.Expressions.[…];” IterationsCount=“10” Priority=“70”

Or do I miss something ?

But for the email, it’s apparently missing (I’ll add it and test, thank you) :

BuildUniqueValueAspect Identifier=“Directory_UserRecord_UniqueValue_Email” Binding=“Workflow_Directory_User:Directory_User.Records.Email” ExpressionBinding=“Workflow_Directory_User:Directory_User.Records” Expression=“C#:person:return (person.FirstName?.ToLowerInvariant()?.RemoveDiacritics()?.Replace(" ", "") + ‘.’ + person.LastName?.ToLowerInvariant()?.RemoveDiacritics()?.Replace(" ", "") + (iteration == 0 ? "" : iteration.ToString()) + person.UserType?.EmailSuffix + "@" + (person.Subsidiary?.EmailDomain != null ? person.Subsidiary?.EmailDomain : "XXXX.XX"))?.Replace("'", "")?.Replace("’", "");” IterationsCount=“10” Priority=“70” HistorizeBinding=“Workflow_Directory_User:Directory_User.Records.EmailAliases”

(by the way, I also opened a ticket as Kate suggested)

Regards,

Valérie

6

Hello,

Okay
I can propose a workaround while the support team studies your case.

You can add a new attribute ‘Login’ in the Directory_User EntityType
Add an expression that fulfills this property based on the MainRecord

<EntityPropertyExpression Identifier="Directory_User_Login" Binding="MainRecord.Login" EntityType="Directory_User" Property="Login" Priority="-1" />

Then in the BuildUniqueValueAspect you check this value

resource.User.Login != null

Regards
Hazem

1 Like
7

Thank you Hazem !

I’ll try your solution as well.

What the support suggested, it’s to change the ExpressionBinding in BuildUniqueValueAspect.

It was set to Workflow_Directory_User:Directory_User.Records

And need to be set to Workflow_Directory_User:Directory_User

I just tried and it works, but I had to adapt the C# expression and use person.Records[0].FirstName instead of person.FirstName (for example).

I still need to check a bit further to see if there’re no side effects.

Best Regards,
Valérie

8

Hello,

This looks good too.
I’ll let you test it and may be give us your feedback about the solution.

Regards
Hazem

1 Like