Troubleshooting Verify Identity Governance Server problems

This section describes solutions for Verify Identity Governance Server problems.

Dynamic role membership is not evaluated while suspending or restoring a person
The default person suspend and restore operation workflow does not invoke policy evaluation after the person is suspended or restored.
In SUSE Linux, the design forms applet fails to load, or takes a long time to load
When you run the IBM Security Identity Manager on SUSE Linux kernel-smp-2.6.16.6.0-0.85.1, and use the Java plug-in version 1.7.0_55, the design forms applet fails to load. When you use Java plug-in version 1.7.0_51, the design forms applet takes up to 10 minutes to load.
A blank page is displayed when a customized person profile user logs in to IVIG Service Center
In the IVIG Service Center, a person profile that is created by using a customized schema can have either of the following problems.
IVIG Service Center view options are displayed even though it is not installed with the fix pack
Install the Security Identity Manager fix packs 6.0.0.x without installing the IVIG Service Center. The IVIG Service Center view options are displayed when an administrator configures a view definition on the server.
Date format does not display correctly in the Self-Service User Interface
Some of the pages display incorrect date formats in the Self-Service User Interface.
Text search does not consider the language sensitivity in the user interfaces
In IBM Security Identity Manager user interfaces, text search does consider the language sensitivity.
Resolving concurrent provisioning requests failures
Simultaneous multiple provisioning requests can cause racing conditions. If two concurrent threads try to provision the same account, one thread succeeds, the other thread fails. The enrole attribute account.provision.concurrency.resolution was added at Fix Pack 4 to resolve racing conditions. If the subsequent provisioning requests are failing because the account exists, you can take corrective actions.
Service creation fails
After you install IBM Security Directory Integrator versions 7.2 or IBM Tivoli Directory Integrator 7.1.1-TIV-TDI-LA0022, you cannot create a service.
Forgotten password problems in Turkish
The forgotten password challenge response might not work with the Turkish language because of case sensitivity issues.
Gathering license metrics fails with a NoClassDefFoundError message
If the lifecycle rule for gathering license metrics fails with a NoClassDefFoundError error message, you must check the server trace file.
IVIG Service Center search control and sub form limitations
IBM Verify Identity Governance supports various controls to customize the account form and other forms. The Search control, Search match control, and the Sub Form in a customized account form can have certain limitations when you use the IVIG Service Center to request an account in a service that contains these controls.
Cognos reports and data widget do not display
IBM Security Identity Manager, supports IBM Cognos Analytics Server, Version 11.0.13. Cognos reports and the date widget in the IBM Cognos Analytics Server 11.0.13 do not display when you use Microsoft Internet Explorer 11.0 in native mode.
Errors occur when you submit the account forms in the IVIG Service Center
In the IVIG Service Center, the group attributes on the account form are hidden. When you submit the account form through the IVIG Service Center, errors are displayed in the IVIG Service Center user interface.
Business Partner Organization entity does not display when configured in a search control or a search match control
When you configure the search control or search match control for the person or account form to search based on the Business Partner Organization, the search operation does not return the Business Partner Organization in the IVIG Service Center.
The upgrade process does not preserve modified attribute values
After you upgrade to IBM Security Identity Manager version 6.0.0.10 from previous fix packs, attribute values that are modified by users in the workflowextensions.xml and workflowDataSyntax.xml files in the previous fix pack, are not preserved in the fix pack 6.0.0.10.
Modified values section in the view request details might contain unedited attributes
Changes made to attributes from the administrative console display extra attributes in the modified values section of the view request details. These extra attributes are the default values that usually correspond to the check boxes or drop-down boxes and displayed in the modified values table even no changes are made to them. The view request details of the administrative console as well as IVIG Service Center are affected.
Non-profile attribute specific search might return unexpected results
IBM Verify Identity Governance REST API and IVIG Service Center user interface might return unexpected results for a non- profile attribute specific search.
Incorrect fix pack version is displayed in the installation summary during upgrade
When you upgrade from the IBM Security Identity Manager fix pack version 6.0.0.6 to the fix pack version 6.0.0.10, an incorrect version is displayed in the installation summary message for the base product. The installation summary displays that an upgrade is done on the IBM Security Identity Manager fix pack version 6.0.0.4, which is incorrect.
Inconsistent non-compliant access view in the IVIG Service Center
In the IVIG Service Center, an incorrect non-compliance status is displayed for a role or group that is defined as access.
Challenge questions configuration in the IVIG Service Center
The requirement that a user must answer the challenge questions is configurable in the IVIG Service Center. By default, a user can bypass the challenge questions.
Customized labels in the design forms display inconsistently
If you edit a control label in the design form of the IVIG Service Center, the view of the customized label is not displayed consistently in the View Requests section of the View and Edit Profile and Edit and Delete Access wizards.
An error icon might display when the forgotten password questions and answers are set
In the IVIG Service Center, after the subset of the forgotten password questions and answers are set and when a user returns to the justification page, the justification page displays the success icon. However, when a user returns to the forgotten password questions and answers page again, the question text boxes might display an error icon.
Custom password rule implementation errors
The cumulate() method, a Password Rules API enhancement to the IBM Verify Identity Governance, might cause errors when you implement the existing custom rules. To resolve the problem, add the cumulate() method to the custom rule, recompile, and replace the updated custom rule in the IBM Verify Identity Governance class path. This topic also explains how to use the cumulate() method.
ACI filter not working correctly when an account is created
Access control item (ACI) object filters for the Add Entity operation are ignored.
User accounts are included when performing a suspend, restore, or delete task
User accounts are included for suspend, restore, or delete tasks.
Warning messages not displayed during identity feed or reconciliation
The identity feed or a reconciliation operation does not display warning messages if account or user attributes are not successfully updated.
Changing the service name prevents viewing and performing actions on service requests
Changing the name of a service prevents you from viewing and performing actions on service requests that applied to the service before the name change.
Identity feed operation fails and returns an LDAP error
The installation program sets a maximum of 500 search operations per application task. If you set up an identity feed for more than 500 to populate the Verify Identity Governance Server, the operation fails. You must configure the LDAP server that is supplying the user data for the number of users in the feed.
Reconciliation operation fails with an out-of-memory error
The reconciliation operation fails with an out-of-memory error. You can increase the Java™ Virtual Machine (JVM) heap size limit in the WebSphere® Liberty. Try the reconciliation again.
A request fails because one or more values cannot be changed
If you submit a request to change a user, account, or service, the entire request fails if any single value cannot be changed.
Concurrent usage of Verify Identity Governance Server can affect changes to data
Certain conditions apply to how changes are made to data as a result of concurrency. An example of concurrency is when two or more users access the same data through the user interface using separate sessions on separate computers.
All results from a large search operation are not displayed
By default, the user interface can display a maximum of 1000 search entries. If your search returns more than 1000 entries, you can change the maximum amount.
Users are deleted from default groups in identity feeds
During an identity feed, users can be inadvertently deleted from the default groups that are associated with the customized groups.
Restoring the system administrator account
Incorrectly modifying a provisioning policy can deprovision all accounts except the built-in system administrator account. If you suspend or deprovision all IBM Verify Identity Governance accounts, including the system administrator account, you can restore the system administrator account through the IBM Security Directory Server.
Logging on to IBM Verify Identity Governance after stopping and starting the WebSphere Liberty administrative console
When you stop and restart the Verify Identity Governance Server using the WebSphere Liberty administrative console, subsequent attempts to log in to IVIG fail.
Do not change the date and time while users are logged in to IBM Verify Identity Governance
If you change the date and time while users are logged on, unpredictable behavior might occur.
A Java core dump occurs while performing a search from an applet
A Java core dump occurs in WebSphere Liberty during a search from an applet when the Java Virtual Machine (JVM) heap size is too small.
Presentation problems
This section describes solutions to information presentation problems.
Data problems
This section describes solutions to problems with data.
Workflow problems
This section describes problems with workflow processes.
Usage problems
This section describes problems with using the product.
Cleaning up the database with the DBPurge script
It is a good maintenance practice to keep the Verify Identity Governance Server database to a manageable size.
Customization problems
This section describes solutions for problems with customization.
Manager group is not updated when using custom person entity
If you use a custom person entity and want the accounts automatically added to the service manager group, the schema must be mapped correctly.
IBM Verify Identity Governance applets do not work
WebSEAL file and WebSphere Liberty configuration causes function problems with the applets in IVIG.
Limitation in access catalog search when intersection or custom join enabled
Initially, the access catalog search in IBM Verify Identity Governance does not support intersection and custom join for group access. There is a limitation in the search when the intersection or custom join is enabled. To make the search work correctly, you must change properties in the enRole.properties file.
Ignorable warnings occur for new access types
After you specify a new access type, ignorable warnings can occur because an icon file is not found, but is associated with the access type.
A screen reader such as JAWS does not read edited fields
In the IVIG Service Center, edits made to the field shows an error icon but it does not read edited fields in the View and Edit Profile > Review Changes panel.
State of RSA token is not updated
The state of the RSA token is not updated when the operation to create, modify, or delete RSA account fails or goes into wait or pending state.
Modify operation ACI limitation for organization movement
Even if the Modify operation ACI is denied on a target container, the organization movement activity is successful.
Advanced search option might not display role name and description
While you edit a profile through the IVIG Service Center, an advanced search option might not display the role name and description.
Limitation for batch requests in Manage Activities wizard
For a group or role batch request, the activities page displays only the first group or role name in the Manage Activities wizard of the IVIG Service Center.
Cannot proceed to request access for RSA service
In the IVIG Service Center, when you request access for RSA service, you cannot proceed until you specify the value of security domain attribute. By default, the security domain attribute is mandatory.

Parent topic: Troubleshooting and support