Hi Saifee

We had a similar problem and solved it by running the application collection and publish just before the identity collection and publish using the schedule capability.

Johan

I have tried this but the problem I see with this is that the mapping between Identity and Account will not get resolved. It gets resolved only when Application is published after Identity Publish. 

This is the error I get when the Fulfillment fails for this case

[SEVERE] 2024-01-22 14:16:55.779 [com.netiq.iac.persistence.dcs.prov.worker.AutoProvisioningWorkerThread] [IG-DTP] Unexpected error while provisioning changeItem id: 6084. Reason: Item 'ADD_PERMISSION_TO_USER' does not contain all required provisioning attributes (permProvAttr, permProvId, accountProvId).

I assume you are using the AD fulfillment. We use CSV fulfillment and I added the recipient data under " Configuration, Fulfillment context Attributes". If you add the recipient attributes here, you can use the fulfillment mapping to insert the recipient DN in accountProvID. It will require a script under "Fulfillment item configuration and mapping". I have not tested it, but it should work.

Do I understand the problem correctly - you collect a new Identity record, and your business role is processed and immediately tries to create a fulfillment to grant an AD account as well as a permission, however, you have a separate process that already has created the AD account, but it hasn't been collected yet, so IG doens't know which account it is supposed to assign the permission to?

To reiterate: are you creating the AD account outside of IG - and the problem seems that you want to collect the identity and the account first, then perform the business role evaluation?

--Jim

Fixed the issue. Thank you Johan!

yes that is right, I am creating AD accounts outside of IG and using the business roles to only grant permissions to an already created account. 

Issue: I want to collect the identity and the account first, then perform the business role evaluation, but I don't see a way that a business role evaluation can be delayed.

I have fixed the issue using the solution provided by gogga 

If you are using CSV fulfillment, its just writing the required changes out to a file, and then you need to manually fulfill them, right?   IF you could get this to work with the AD fulfiller, that woudl make those changes automatically for you - would that be better in your situation?

-Jim