caseosborne Absent Member.
Absent Member.
1430 views

Code 9063 object already associated

Hi All,

I have a text driver to bulk load resources onto a user's nrfAssignedResources via UserApp/RBPM. This is an effort to true up application access to users so we can conduct Access Reviews using IGA that are more accurate. I ask the app owners for a simple file the format is GRANT|USERNAME|RESOURCE CN, this makes a call to userapp and assigns the resource. As I have been running these for different applications I am starting to see these errors. How do I avoid these associations, or is there a better way to bulk load resources to userapp/RBPM then this text driver? If the only solution is deleting the DirXML-Associations is there a way to do that on a large scale or as a scheduled job?

Thanks in Advance! Trace of error is below.
-Casey

[02/13/19 15:16:56.826]:bulkresource PT: Match found: src-dn='\ACME-TEST\data\users\JOHVILLA'
[02/13/19 15:16:56.826]:bulkresource PT:Policy returned:
[02/13/19 15:16:56.826]:bulkresource PT:
<nds dtdversion="1.1" ndsversion="8.6" xml:space="default">
<input>
<add class-name="User" dest-dn="" dest-entry-id="-1" src-dn="johvilla">
<association>johvilla</association>
<add-attr attr-name="Action">
<value type="string">Grant</value>
</add-attr>
<add-attr attr-name="CN">
<value type="string">johvilla</value>
</add-attr>
<add-attr attr-name="Resource">
<value type="string">cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system</value>
</add-attr>
<operation-data error.do-find-matching-object="\ACME-TEST\data\users\JOHVILLA"/>
</add>
</input>
</nds>
[02/13/19 15:16:56.827]:bulkresource PT:
DirXML Log Event -------------------
Driver: \ACME-TEST\system\Driver Set\Bulk Resource Load
Channel: Publisher
Object: johvilla
Status: Error
Message: Code(-9063) Object matching policy found an object that is already associated: {0}.
[02/13/19 15:16:56.868]:bulkresource PT:Fixing up association references.
[02/13/19 15:16:56.868]:bulkresource PT:Applying schema mapping policies to output.
[02/13/19 15:16:56.868]:bulkresource PT:Applying policy: %+C%14CNOVLDTXTBASE-smp%-C.
[02/13/19 15:16:56.869]:bulkresource PT:Applying output transformation policies.
[02/13/19 15:16:56.869]:bulkresource PT:Applying XSLT policy: %+C%14CNOVLDTXTBASE-ots%-C.
[02/13/19 15:16:56.869]:bulkresource PT:Policy returned:
[02/13/19 15:16:56.869]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<output>
<status level="error">Code(-9063) Object matching policy found an object that is already associated: {0}.<operation-data error.do-find-matching-object="\ACME-TEST\data\users\JOHVILLA"/>
<application>DirXML</application>
<module>Bulk Resource Load</module>
<object-dn>johvilla</object-dn>
<component>Publisher</component>
</status>
</output>
</nds>
Labels (1)
0 Likes
19 Replies
Knowledge Partner
Knowledge Partner

Re: Code 9063 object already associated

If your driver config has found a match, then presumably the object is
coming in with no association, or at least no association matching up with
an existing user which has that association stored, and that's a problem.
Anytime an application (including a text file) sends an object, it should
include the association value, or something that will uniquely identify
the object within the application, and in your case that might be the
USERNAME. From that point, your driver (shim) should take that value and
assign it within the association tags, which the engine will then use to
match up with an existing object before trying to do Matching.

It would help if we could see the full event, not just from the successful
match to the end. Hacking the matching with the NetIQ/Micro Focus shim
isn't hard, but it involves hacking XSLT within the driver config logic.
If you are using Stefaan's Generic File Driver, it's appropriately easy:
specify the attribute in the driver config in a single field as should be
the case anytime.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.
0 Likes
caseosborne Absent Member.
Absent Member.

Re: Code 9063 object already associated

OK I am just using the basic text driver (default). I am matching on CN - what I am going to do is in Event before Matching look at nodeset DirXML-Associations and loop through for the bulk resource load driver and then call a remove association. I will then have the MP find the match via CN and hopefully that should allow the new match and assign the resource. I figure if I do this everytime before match it should resolve the already associated issues? Because I will continuously be running these files through before an Access Review to true up Resources/Permissions.

Thanks,
Casey
0 Likes
Knowledge Partner
Knowledge Partner

Re: Code 9063 object already associated

On 02/14/2019 09:14 AM, caseosborne wrote:
>
> OK I am just using the basic text driver (default). I am matching on CN
> - what I am going to do is in Event before Matching look at nodeset
> DirXML-Associations and loop through for the bulk resource load driver


I think one of us is missing the point; either I do not understand what
you are doing, or you do not understand the association value. As
mentioned before, it would help to see the whole level three (3) trace for
the operation so maybe we can understand why the user comes in with an
association that does not work, only to find some associated object when
matching.

> and then call a remove association. I will then have the MP find the
> match via CN and hopefully that should allow the new match and assign
> the resource. I figure if I do this everytime before match it should
> resolve the already associated issues? Because I will continuously be


Sure, it probably will, but at best it is wasting time. If there is
something else wrong with the association when it comes in then perhaps
your matching is showing that, but gain we need to see the full trace to
know for sure.

> running these files through before an Access Review to true up
> Resources/Permissions.


The purpose of matching is to build an association when a target object
already exists, so deleting an association as you are proposing, only to
match up with the object again, is redundant and wasting time, which is
why I think we should understand the whole problem before doing that. Of
course, if "wasting time" means we now take ten (10) seconds to do what it
should only take five (5) seconds to do, and that processes your entire
file, perhaps it is not a big deal, but I worry there might be a bigger
problem.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.
0 Likes
caseosborne Absent Member.
Absent Member.

Re: Code 9063 object already associated

I can't get full trace in here too large, can I attach or email to you ?
0 Likes
Knowledge Partner
Knowledge Partner

Re: Code 9063 object already associated

caseosborne wrote:

> I can't get full trace in here too large, can I attach or email to you ?


Try pastebin.com or a similar service.

--
http://www.is4it.de/en/solution/identity-access-management/

(If you find this post helpful, please click on the star below.)
______________________________________________
https://www.is4it.de/identity-access-management
0 Likes
caseosborne Absent Member.
Absent Member.

Re: Code 9063 object already associated

So I deleted the DirXML-Assocation for this driver on the user's account in eDir and now I am getting the unable to determine target object error:
[02/15/19 08:23:01.503]:bulkresource PT:Applying input transformation policies.
[02/15/19 08:23:01.503]:bulkresource PT:Applying XSLT policy: %+C%14CNOVLDTXTBASE-its%-C.
[02/15/19 08:23:01.503]:bulkresource PT:Policy returned:
[02/15/19 08:23:01.503]:bulkresource PT:
<nds dtdversion="1.1" ndsversion="8.6" xml:space="default">
<input>
<add class-name="User" src-dn="johvilla">
<association>johvilla</association>
<add-attr attr-name="Action">
<value type="string">Grant</value>
</add-attr>
<add-attr attr-name="CN">
<value type="string">johvilla</value>
</add-attr>
<add-attr attr-name="Resource">
<value type="string">cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system</value>
</add-attr>
</add>
</input>
</nds>
[02/15/19 08:23:01.504]:bulkresource PT:Applying schema mapping policies to input.
[02/15/19 08:23:01.505]:bulkresource PT:Applying policy: %+C%14CNOVLDTXTBASE-smp%-C.
[02/15/19 08:23:01.505]:bulkresource ST:Successfully processed state change event.
[02/15/19 08:23:01.505]:bulkresource PT: Mapping class-name 'User' to 'User'.
[02/15/19 08:23:01.505]:bulkresource ST:Submitting identification query to subscriber shim:
[02/15/19 08:23:01.505]:bulkresource PT: Mapping attr-name 'Action' to 'Action'.
[02/15/19 08:23:01.505]:bulkresource ST:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<input>
<query event-id="query-driver-ident" scope="entry">
<search-class class-name="__driver_identification_class__"/>
<read-attr/>
</query>
</input>
</nds>
[02/15/19 08:23:01.505]:bulkresource PT: Mapping attr-name 'CN' to 'CN'.
[02/15/19 08:23:01.506]:bulkresource ST:SubscriptionShim.execute() returned:
[02/15/19 08:23:01.506]:bulkresource PT: Mapping attr-name 'Resource' to 'Resource'.
[02/15/19 08:23:01.506]:bulkresource ST:
<nds dtdversion="2.0">
<source>
<product build="20170208_0908" instance="Bulk Resource Load" version="4.0.2.0">Identity Manager Driver for Delimited Text</product>
</source>
<output>
<instance class-name="__driver_identification_class__">
<attr attr-name="driver-id">
<value type="string">TEXT</value>
</attr>
<attr attr-name="driver-version">
<value type="string">4.0.2.0</value>
</attr>
<attr attr-name="min-activation-version">
<value type="int">2</value>
</attr>
<attr attr-name="query-ex-supported">
<value type="state">false</value>
</attr>
</instance>
<status event-id="query-driver-ident" level="success"/>
</output>
</nds>
[02/15/19 08:23:01.507]:bulkresource PT:Resolving association references.
[02/15/19 08:23:01.508]:bulkresource PT:Applying event transformation policies.
[02/15/19 08:23:01.508]:bulkresource PT:Applying policy: %+C%14CHH Scoping%-C.
[02/15/19 08:23:01.508]:bulkresource PT: Applying to add #1.
[02/15/19 08:23:01.508]:bulkresource PT: Evaluating selection criteria for rule 'Scoping for Add/Modify Operations'.
[02/15/19 08:23:01.509]:bulkresource PT: (if-operation not-equal "add") = FALSE.
[02/15/19 08:23:01.509]:bulkresource PT: Rule rejected.
[02/15/19 08:23:01.509]:bulkresource PT:Policy returned:
[02/15/19 08:23:01.509]:bulkresource PT:
<nds dtdversion="1.1" ndsversion="8.6" xml:space="default">
<input>
<add class-name="User" src-dn="johvilla">
<association>johvilla</association>
<add-attr attr-name="Action">
<value type="string">Grant</value>
</add-attr>
<add-attr attr-name="CN">
<value type="string">johvilla</value>
</add-attr>
<add-attr attr-name="Resource">
<value type="string">cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system</value>
</add-attr>
</add>
</input>
</nds>
[02/15/19 08:23:01.510]:bulkresource PT:No associated objects.
[02/15/19 08:23:01.511]:bulkresource PT:Applying publisher filter.
[02/15/19 08:23:01.511]:bulkresource PT:Publisher processing add for johvilla.
[02/15/19 08:23:01.511]:bulkresource PT:Applying object matching policies.
[02/15/19 08:23:01.511]:bulkresource PT:Applying policy: %+C%14CNOVLDTXTBASE-pub-mp%-C.
[02/15/19 08:23:01.511]:bulkresource PT: Applying to add #1.
[02/15/19 08:23:01.511]:bulkresource PT: Evaluating selection criteria for rule 'Match based on CN'.
[02/15/19 08:23:01.512]:bulkresource PT: (if-class-name equal "User") = TRUE.
[02/15/19 08:23:01.512]:bulkresource PT: Rule selected.
[02/15/19 08:23:01.512]:bulkresource PT: Applying rule 'Match based on CN'.
[02/15/19 08:23:01.512]:bulkresource PT: Action: do-find-matching-object(scope="subtree",arg-match-attr("CN")).
[02/15/19 08:23:01.512]:bulkresource PT: arg-match-attr("CN")
[02/15/19 08:23:01.512]:bulkresource PT: Query from policy
[02/15/19 08:23:01.512]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<input>
<query class-name="User" scope="subtree">
<search-class class-name="User"/>
<search-attr attr-name="CN">
<value type="string">johvilla</value>
</search-attr>
<read-attr/>
</query>
</input>
</nds>
[02/15/19 08:23:01.513]:bulkresource PT: Pumping XDS to eDirectory.
[02/15/19 08:23:01.513]:bulkresource PT: Performing operation query for .
[02/15/19 08:23:01.513]:bulkresource PT: --JCLNT-- \ACME-TEST\system\Driver Set\Bulk Resource Load - Publisher : Duplicating : context = 9831115, tempContext = 9831116
[02/15/19 08:23:01.515]:bulkresource PT: --JCLNT-- \ACME-TEST\system\Driver Set\Bulk Resource Load - Publisher : Calling free on tempContext = 9831116
[02/15/19 08:23:01.515]:bulkresource PT: Query from policy result
[02/15/19 08:23:01.515]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<output>
<instance class-name="User" event-id="0" qualified-src-dn="O=data\OU=users\CN=JOHVILLA" src-dn="\ACME-TEST\data\users\JOHVILLA" src-entry-id="33579">
<association state="associated"></association>
</instance>
<status event-id="0" level="success"></status>
</output>
</nds>
[02/15/19 08:23:01.516]:bulkresource PT: Match found: src-dn='\ACME-TEST\data\users\JOHVILLA'
[02/15/19 08:23:01.516]:bulkresource PT:Policy returned:
[02/15/19 08:23:01.516]:bulkresource PT:
<nds dtdversion="1.1" ndsversion="8.6" xml:space="default">
<input>
<add class-name="User" dest-dn="\ACME-TEST\data\users\JOHVILLA" dest-entry-id="33579" src-dn="johvilla">
<association>johvilla</association>
<add-attr attr-name="Action">
<value type="string">Grant</value>
</add-attr>
<add-attr attr-name="CN">
<value type="string">johvilla</value>
</add-attr>
<add-attr attr-name="Resource">
<value type="string">cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system</value>
</add-attr>
<operation-data/>
</add>
</input>
</nds>
[02/15/19 08:23:01.518]:bulkresource PT:A match found, using \ACME-TEST\data\users\JOHVILLA.
[02/15/19 08:23:01.518]:bulkresource PT:Merging eDirectory and application values.
[02/15/19 08:23:01.519]:bulkresource PT:Reading relevant attributes from \ACME-TEST\data\users\JOHVILLA.
[02/15/19 08:23:01.519]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<input>
<query class-name="User" dest-dn="\ACME-TEST\data\users\JOHVILLA" dest-entry-id="33579" scope="entry">
<read-attr attr-name="Action"/>
<read-attr attr-name="CN"/>
<read-attr attr-name="Resource"/>
<read-attr attr-name="Object Class"/>
</query>
</input>
</nds>
[02/15/19 08:23:01.520]:bulkresource PT:Pumping XDS to eDirectory.
[02/15/19 08:23:01.520]:bulkresource PT:Performing operation query for \ACME-TEST\data\users\JOHVILLA.
[02/15/19 08:23:01.520]:bulkresource PT:--JCLNT-- \ACME-TEST\system\Driver Set\Bulk Resource Load - Publisher : Duplicating : context = 9831115, tempContext = 9830547
[02/15/19 08:23:01.521]:bulkresource PT:--JCLNT-- \ACME-TEST\system\Driver Set\Bulk Resource Load - Publisher : Calling free on tempContext = 9830547
[02/15/19 08:23:01.521]:bulkresource PT:Read result:
[02/15/19 08:23:01.522]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<output>
<instance class-name="User" event-id="0" qualified-src-dn="O=data\OU=users\CN=JOHVILLA" src-dn="\ACME-TEST\data\users\JOHVILLA" src-entry-id="33579">
<association state="associated"></association>
<attr attr-name="CN">
<value naming="true" timestamp="1494364995#246" type="string">JOHVILLA</value>
</attr>
<attr attr-name="Object Class">
<value timestamp="1453477875#392" type="string">User</value>
<value timestamp="1453477875#393" type="string">hhUser</value>
<value timestamp="1453477875#394" type="string">Organizational Person</value>
<value timestamp="1453477875#395" type="string">Person</value>
<value timestamp="1453477875#396" type="string">ndsLoginProperties</value>
<value timestamp="1453477875#397" type="string">Top</value>
<value timestamp="1501198059#589" type="string">nrfIdentity</value>
<value timestamp="1453477876#1382" type="string">DirXML-EntitlementRecipient</value>
<value timestamp="1453477877#481" type="string">DirXML-PasswordSyncStatusUser</value>
<value timestamp="1499983371#87" type="string">DirXML-ApplicationAttrs</value>
</attr>
</instance>
<status event-id="0" level="success"></status>
</output>
</nds>
[02/15/19 08:23:01.524]:bulkresource PT:Found non-class attribute Resource.
[02/15/19 08:23:01.524]:bulkresource PT:Found non-class attribute Action.
[02/15/19 08:23:01.525]:bulkresource PT:Updating eDirectory with application values.
[02/15/19 08:23:01.525]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<input>
<modify class-name="User" dest-dn="\ACME-TEST\data\users\JOHVILLA" dest-entry-id="33579" from-merge="true" src-dn="johvilla">
<association>johvilla</association>
<modify-attr attr-name="Resource">
<add-value>
<value type="string">cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Action">
<add-value>
<value type="string">Grant</value>
</add-value>
</modify-attr>
<operation-data/>
</modify>
</input>
</nds>
[02/15/19 08:23:01.526]:bulkresource PT:Applying command transformation policies.
[02/15/19 08:23:01.526]:bulkresource PT:Applying policy: %+C%14CHH-Command%-C.
[02/15/19 08:23:01.527]:bulkresource PT: Applying to modify #1.
[02/15/19 08:23:01.527]:bulkresource PT: Evaluating selection criteria for rule 'Bulk Resource Load'.
[02/15/19 08:23:01.527]:bulkresource PT: (if-attr 'Resource' available) = TRUE.
[02/15/19 08:23:01.527]:bulkresource PT: Rule selected.
[02/15/19 08:23:01.527]:bulkresource PT: Applying rule 'Bulk Resource Load'.
[02/15/19 08:23:01.527]:bulkresource PT: Action: do-set-local-variable("lv_Resource",scope="policy",token-attr("Resource")).
[02/15/19 08:23:01.527]:bulkresource PT: arg-string(token-attr("Resource"))
[02/15/19 08:23:01.528]:bulkresource PT: token-attr("Resource")
[02/15/19 08:23:01.528]:bulkresource PT: Token Value: "cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system".
[02/15/19 08:23:01.528]:bulkresource PT: Arg Value: "cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system".
[02/15/19 08:23:01.528]:bulkresource PT: Action: do-if().
[02/15/19 08:23:01.528]:bulkresource PT: Evaluating conditions.
[02/15/19 08:23:01.529]:bulkresource PT: (if-attr 'Action' equal "Grant") = TRUE.
[02/15/19 08:23:01.529]:bulkresource PT: Performing if actions.
[02/15/19 08:23:01.529]:bulkresource PT: Action: do-add-resource(id="CN=uaadmin,OU=sa,OU=users,O=data",resource-id="$lv_Resource$",time-out="0",url="http://10.252.163.212:8080/IDMProv",arg-password(token-named-password("uaadmin_password")),arg-association(token-association()),"Added by IDMS").
[02/15/19 08:23:01.529]:bulkresource PT: Expanded variable reference '$lv_Resource$' to 'cn=Haemonetics - McKesson Blood Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver Set,o=system'.
[02/15/19 08:23:01.530]:bulkresource PT: arg-password(token-named-password("uaadmin_password"))
[02/15/19 08:23:01.530]:bulkresource PT: token-named-password("uaadmin_password")
[02/15/19 08:23:01.530]:bulkresource PT: Retrieving password value for named password 'uaadmin_password'.
[02/15/19 08:23:01.531]:bulkresource PT: Token Value: "-- suppressed --".
[02/15/19 08:23:01.531]:bulkresource PT: Arg Value: "-- suppressed --".
[02/15/19 08:23:01.531]:bulkresource PT: arg-association(token-association())
[02/15/19 08:23:01.531]:bulkresource PT: token-association()
[02/15/19 08:23:01.532]:bulkresource PT: Token Value: "johvilla".
[02/15/19 08:23:01.532]:bulkresource PT: Arg Value: "johvilla".
[02/15/19 08:23:01.533]:bulkresource PT:
DirXML Log Event -------------------
Driver: \ACME-TEST\system\Driver Set\Bulk Resource Load
Channel: Publisher
Object: johvilla (\ACME-TEST\data\users\JOHVILLA)
Status: Error
Message: Code(-9145) Error in vnd.nds.stream://ACME-TEST/system/Driver+Set/Bulk+Resource+Load/Publisher/HH-Command#XmlData:22 : Unable to determine target object for action 'do-add-resource(id="CN=uaadmin,OU=sa,OU=users,O=data",resource-id="$lv_Resource$",time-out="0",url="http://10.252.163.212:8080/IDMProv",arg-password(token-named-password("uaadmin_password")),arg-association(token-association()),"Added by IDMS")'.
[02/15/19 08:23:01.540]:bulkresource PT:Fixing up association references.
[02/15/19 08:23:01.540]:bulkresource PT:Applying schema mapping policies to output.
[02/15/19 08:23:01.540]:bulkresource PT:Applying policy: %+C%14CNOVLDTXTBASE-smp%-C.
[02/15/19 08:23:01.540]:bulkresource PT:Applying output transformation policies.
[02/15/19 08:23:01.540]:bulkresource PT:Applying XSLT policy: %+C%14CNOVLDTXTBASE-ots%-C.
[02/15/19 08:23:01.541]:bulkresource PT:Policy returned:
[02/15/19 08:23:01.541]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<output>
<status level="error">Code(-9145) Error in vnd.nds.stream://ACME-TEST/system/Driver+Set/Bulk+Resource+Load/Publisher/HH-Command#XmlData:22 : Unable to determine target object for action 'do-add-resource(id="CN=uaadmin,OU=sa,OU=users,O=data",resource-id="$lv_Resource$",time-out="0",url="http://10.252.163.212:8080/IDMProv",arg-password(token-named-password("uaadmin_password")),arg-association(token-association()),"Added by IDMS")'.<operation-data/>
<application>DirXML</application>
<module>Bulk Resource Load</module>
<object-dn>johvilla (\ACME-TEST\data\users\JOHVILLA)</object-dn>
<component>Publisher</component>
</status>
</output>
</nds>
[02/15/19 08:23:01.542]:bulkresource PT:
<nds dtdversion="4.0" ndsversion="8.x">
<source>
<product edition="Advanced" version="4.6.0.0">DirXML</product>
<contact>NetIQ Corporation</contact>
</source>
<output>
<status level="error">Code(-9145) Error in vnd.nds.stream://ACME-TEST/system/Driver+Set/Bulk+Resource+Load/Publisher/HH-Command#XmlData:22 : Unable to determine target object for action 'do-add-resource(id="CN=uaadmin,OU=sa,OU=users,O=data",resource-id="$lv_Resource$",time-out="0",url="http://10.252.163.212:8080/IDMProv",arg-password(token-named-password("uaadmin_password")),arg-association(token-association()),"Added by IDMS")'.<operation-data/>
<application>DirXML</application>
<module>Bulk Resource Load</module>
<object-dn>johvilla (\ACME-TEST\data\users\JOHVILLA)</object-dn>
<component>Publisher</component>
</status>
</output>
</nds>
0 Likes
Knowledge Partner
Knowledge Partner

Re: Code 9063 object already associated

On 02/15/2019 08:54 AM, caseosborne wrote:
>
> So I deleted the DirXML-Assocation for this driver on the user's account
> in eDir and now I am getting the unable to determine target object
> error:


I'm still not sure why that is being done, but oh well.

> [02/15/19 08:23:01.529]:bulkresource PT: Performing if actions.
> [02/15/19 08:23:01.529]:bulkresource PT: Action:
> do-add-resource(id="CN=uaadmin,OU=sa,OU=users,O=data",resource-id="$lv_Resource$",time-out="0",url="http://10.252.163.212:8080/IDMProv",arg-password(token-named-password("uaadmin_password")),arg-association(token-association()),"Added
> by IDMS").
> [02/15/19 08:23:01.529]:bulkresource PT: Expanded variable
> reference '$lv_Resource$' to 'cn=Haemonetics - McKesson Blood
> Bank,cn=ResourceDefs,cn=RoleConfig,cn=AppConfig,cn=UserApplication,cn=Driver
> Set,o=system'.
> [02/15/19 08:23:01.530]:bulkresource PT:
> arg-password(token-named-password("uaadmin_password"))
> [02/15/19 08:23:01.530]:bulkresource PT:
> token-named-password("uaadmin_password")
> [02/15/19 08:23:01.530]:bulkresource PT: Retrieving
> password value for named password 'uaadmin_password'.
> [02/15/19 08:23:01.531]:bulkresource PT: Token Value: "--
> suppressed --".
> [02/15/19 08:23:01.531]:bulkresource PT: Arg Value: "--
> suppressed --".
> [02/15/19 08:23:01.531]:bulkresource PT:
> arg-association(token-association())
> [02/15/19 08:23:01.531]:bulkresource PT:
> token-association()
> [02/15/19 08:23:01.532]:bulkresource PT: Token Value:
> "johvilla".
> [02/15/19 08:23:01.532]:bulkresource PT: Arg Value:
> "johvilla".
> [02/15/19 08:23:01.533]:bulkresource PT:
> DirXML Log Event -------------------
> Driver: \ACME-TEST\system\Driver Set\Bulk Resource Load
> Channel: Publisher
> Object: johvilla (\ACME-TEST\data\users\JOHVILLA)
> Status: Error
> Message: Code(-9145) Error in
> vnd.nds.stream://ACME-TEST/system/Driver+Set/Bulk+Resource+Load/Publisher/HH-Command#XmlData:22
> : Unable to determine target object for action
> 'do-add-resource(id="CN=uaadmin,OU=sa,OU=users,O=data",resource-id="$lv_Resource$",time-out="0",url="http://10.252.163.212:8080/IDMProv",arg-password(token-named-password("uaadmin_password")),arg-association(token-association()),"Added
> by IDMS")'.


Your rule here is working explicitly based on association, which you just
stripped, so there is no association on the user in eDir. Put the
association back and then this should find the user by association again,
as it should.

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.
0 Likes
caseosborne Absent Member.
Absent Member.

Re: Code 9063 object already associated

Sorry having trouble pasting whole level 3 trace. This is happening for more users - it appears the 1st time they run through the driver and get the association, subsequent run throughs are having association issues, i think because the association on the DirXML-Assocation stored on their eDir account is CN - so it appears to be a duplicate?
The below user succesfully ran through the driver the other day and got resource assigned, I ran them through again right now to test with another resource and I got the original error 9063 object already associated. How can I remove this dirxml-association off of the edir record before I run them through the add resource driver? Do I need to create a separate loopback driver that can for loop through the DirXML-Associations and remove it before I run through the text Bulk Resource Load Driver?

cn=Bulk Resource Load,cn=Driver Set,o=system#1#CBROOKS
0 Likes
caseosborne Absent Member.
Absent Member.

Re: Code 9063 object already associated

I'm also looking at this https://www.netiq.com/communities/cool-solutions/lets-talk-about-dirxml-associations/ to see if there is a way to have a text driver that does not create/store the association in eDir, is that even possible? All I am using this text driver for is to make bulk calls to add resources via Grant or Revoke call to UserApp.
0 Likes
Knowledge Partner
Knowledge Partner

Re: Code 9063 object already associated

On 2/15/2019 2:24 PM, caseosborne wrote:
>
> I'm also looking at this
> https://www.netiq.com/communities/cool-solutions/lets-talk-about-dirxml-associations/
> to see if there is a way to have a text driver that does not
> create/store the association in eDir, is that even possible? All I am
> using this text driver for is to make bulk calls to add resources via
> Grant or Revoke call to UserApp.


So you do NOT require associations. They are just useful.

If you have an assoc then any further changes are modify's with just the
delta. Good. If there is no assoc and you let it flow, the modify
becomes an add.

Or you could just do everything in policy in the Sub-ETP and ignore
associations. It all depends on what your goal is.


0 Likes
Highlighted
Knowledge Partner
Knowledge Partner

Re: Code 9063 object already associated

On 02/15/2019 01:33 PM, Geoffrey Carman wrote:
> Or you could just do everything in policy in the Sub-ETP and ignore
> associations. It all depends on what your goal is.


I'm not sure how this applies to him; this is a text file driver, so the
Subscriber channel seems like you are thinking about Null drivers or
something else coming out of the engine (vs. going in).

--
Good luck.

If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below.

If you want to send me a private message, please let me know in the
forum as I do not use the web interface often.
0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.