[midPoint] Circular dependency error

Tue Feb 14 22:40:47 CET 2017

Hi guys, doing some deeper research we found that this issue is related to
the existence configuration.

The ACTIVE_DIRECTORY_LDAP resource is configured to disable accounts
instead of delete them following this document
<https://wiki.evolveum.com/display/midPoint/Disable+instead+of+Delete>. As
Ivan said on a previous thread
<http://lists.evolveum.com/pipermail/midpoint/2016-November/002823.html>,
that configuration will fail or throw a warning on deleting users from
midPoint (but the users are deleted on MP). Maybe this warning/error is
triggering the dependency error.

If I remove the existence configuration from the resource, the dependency
policy works fine on both create and on delete operations. Is there any
limitation to use existence and dependency on the same resource ?

Best regards,

Ing Nicolás Rossi
Identicum S.A.
Jorge Newbery 3226
Tel: +54 (11) 4552-3050
www.identicum.com

On Tue, Feb 14, 2017 at 11:30 AM, Nicolas Rossi <nrossi at identicum.com>
wrote:

> Here are more context information:
>
> - Environment: midPoint 3.5
> - Resource ACTIVE_DIRECTORY_LDAP (00000000-0000-1de4-0002-000000000001)
> has a dependency of resource 00000000-0000-1de4-0002-000000000004
> (BANNER_PERSONAS)
> - We created a new user and it worked perfectly. He has 2 projections, one
> for BANNER_PERSONAS and other for ACTIVE_DIRECTORY and created in the right
> order
> - After that If we try to delete the user we get the "Circular Dependency
> Error"
>
> This is the dependency configuration:
>
>          <dependency>
>             <resourceRef oid="00000000-0000-1de4-0002-000000000004"
> type="c:ResourceType" />
>             <kind>account</kind>
>             <intent>default</intent>
>             <strictness>strict</strictness>
>             <order>1</order>
>          </dependency>
>
> On the other hand when DependencyProcessor tries to determine wave for the
> second projection (ACTIVE_DIRECTORY) the projectionContext.isDelete() is
> returning false instead of true.
>
> 2017-02-14 11:01:20,828 [] [http-bio-8080-exec-11] TRACE
> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor):*
> Determining wave for (deprovision)*: LensProjectionContext(
> ShadowType:d4178715-263b-4910-9d19-6205c9a91c09 on
> resource:00000000-0000-1de4-0002-000000000004(BANNER_PERSONAS))
> 2017-02-14 11:01:20,828 [] [http-bio-8080-exec-11] TRACE
> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor):
> DEP(rev): com.evolveum.midpoint.xml.ns._public.common.common_3.
> ResourceObjectTypeDependencyType at c308d3b[strictness=STRICT,
> order=1,forceLoad=<null>,resourceRef=com.evolveum.midpoint.xml.ns._public.
> common.common_3.ObjectReferenceType at 2ed5f95[_referenceValue=PRV(oid=
> 00000000-0000-1de4-0002-000000000004, targetType={.../common/common-3}ResourceType,
> targetName=BANNER_PERSONAS)],kind=ACCOUNT,intent=default]
> 2017-02-14 11:01:20,829 [] [http-bio-8080-exec-11] TRACE
> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor): *Determining
> wave for (provision)*: LensProjectionContext(
> ShadowType:fe4caa26-8eb2-4dde-849d-601735a8cdbf on
> resource:00000000-0000-1de4-0002-000000000001(ACTIVE_DIRECTORY_LDAP))
> 2017-02-14 11:01:20,829 [] [http-bio-8080-exec-11] TRACE
> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor):
> DEP: com.evolveum.midpoint.xml.ns._public.common.common_3.
> ResourceObjectTypeDependencyType at c308d3b[strictness=STRICT,
> order=1,forceLoad=<null>,resourceRef=com.evolveum.midpoint.xml.ns._public.
> common.common_3.ObjectReferenceType at 2ed5f95[_referenceValue=PRV(oid=
> 00000000-0000-1de4-0002-000000000004, targetType={.../common/common-3}ResourceType,
> targetName=BANNER_PERSONAS)],kind=ACCOUNT,intent=default]
>
> Hope it helps !
>
> Regards,
>
>
>
> Ing Nicolás Rossi
> Identicum S.A.
> Jorge Newbery 3226
> Tel: +54 (11) 4552-3050
> www.identicum.com
>
> On Tue, Feb 14, 2017 at 11:13 AM, Rodrigo Yanis <ryanis at identicum.com>
> wrote:
>
>> Hello everyone,
>>
>> We're currently experiencing an issue with an LDAP driver throwing a
>> Circular Dependency error when attempting to delete a provisioned user.
>> We've configured the driver to be dependant on an Scripted SQL driver.
>>
>> The error stacktrace (on debug) is the following:
>>
>>> 2017-02-14 11:01:20,828 [] [http-bio-8080-exec-11] TRACE
>>> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor):
>>> Determining wave for (deprovision): LensProjectionContext(ShadowTy
>>> pe:d4178715-263b-4910-9d19-6205c9a91c09 on
>>> resource:00000000-0000-1de4-0002-000000000004(BANNER_PERSONAS))
>>> 2017-02-14 11:01:20,828 [] [http-bio-8080-exec-11] TRACE
>>> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor):
>>> DEP(rev): com.evolveum.midpoint.xml.ns._public.common.common_3.Resourc
>>> eObjectTypeDependencyType at c308d3b[strictness=STRICT,orde
>>> r=1,forceLoad=<null>,resourceRef=com.evolveum.midpoint.xml.
>>> ns._public.common.common_3.ObjectReferenceType at 2ed5f95[_refe
>>> renceValue=PRV(oid=00000000-0000-1de4-0002-000000000004,
>>> targetType={.../common/common-3}ResourceType,
>>> targetName=BANNER_PERSONAS)],kind=ACCOUNT,intent=default]
>>> 2017-02-14 11:01:20,829 [] [http-bio-8080-exec-11] TRACE
>>> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor):
>>> Determining wave for (provision): LensProjectionContext(ShadowTy
>>> pe:fe4caa26-8eb2-4dde-849d-601735a8cdbf on
>>> resource:00000000-0000-1de4-0002-000000000001(ACTIVE_DIRECTORY_LDAP))
>>> 2017-02-14 11:01:20,829 [] [http-bio-8080-exec-11] TRACE
>>> (com.evolveum.midpoint.model.impl.lens.projector.DependencyProcessor):
>>> DEP: com.evolveum.midpoint.xml.ns._public.common.common_3.Resourc
>>> eObjectTypeDependencyType at c308d3b[strictness=STRICT,orde
>>> r=1,forceLoad=<null>,resourceRef=com.evolveum.midpoint.xml.
>>> ns._public.common.common_3.ObjectReferenceType at 2ed5f95[_refe
>>> renceValue=PRV(oid=00000000-0000-1de4-0002-000000000004,
>>> targetType={.../common/common-3}ResourceType,
>>> targetName=BANNER_PERSONAS)],kind=ACCOUNT,intent=default]
>>> 2017-02-14 11:01:20,829 [] [http-bio-8080-exec-11] DEBUG
>>> (com.evolveum.midpoint.model.impl.lens.projector.Projector): Projector
>>> failed: Circular dependency, path: 00000000-0000-1de4-0002-000000000004(ACCOUNT/default).
>>> Etime: 58 ms
>>> 2017-02-14 11:01:20,885 [] [http-bio-8080-exec-11] ERROR
>>> (com.evolveum.midpoint.web.page.admin.users.PageUsers): Couldn't delete
>>> user.
>>> com.evolveum.midpoint.util.exception.PolicyViolationException: Circular
>>> dependency, path: 00000000-0000-1de4-0002-000000000004(ACCOUNT/default)
>>>         at com.evolveum.midpoint.model.impl.lens.projector.DependencyPr
>>> ocessor.checkForCircular(DependencyProcessor.java:269)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.projector.DependencyPr
>>> ocessor.determineProjectionWaveProvision(DependencyProcessor.java:130)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.projector.DependencyPr
>>> ocessor.determineProjectionWave(DependencyProcessor.java:110)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.projector.DependencyPr
>>> ocessor.determineProjectionWaveDeprovision(DependencyProcessor.java:208)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.projector.DependencyPr
>>> ocessor.determineProjectionWave(DependencyProcessor.java:107)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.projector.DependencyPr
>>> ocessor.sortProjectionsToWaves(DependencyProcessor.java:75)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.projector.Projector.pr
>>> ojectInternal(Projector.java:239) ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.projector.Projector.project(Projector.java:112)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.Clockwork.click(Clockwork.java:311)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.lens.Clockwork.run(Clockwork.java:221)
>>> ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.controller.ModelController.
>>> executeChanges(ModelController.java:575) ~[model-impl-3.5.jar:na]
>>>         at com.evolveum.midpoint.model.impl.controller.ModelController.
>>> executeChanges(ModelController.java:371) ~[model-impl-3.5.jar:na]
>>>         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>> ~[na:1.8.0_121]
>>
>>
>> Please note that *00000000-0000-1de4-0002-000000000004* stands for the
>> resource's OID to which our Active Directory resource is dependant.
>>
>> We're not sure why this is happening - it seems like the
>> dependencyProcessor is reevaluating provisioning for the Active Directory
>> projection and failing as the dependency was already deprovisioned.
>>
>> Do you have any insights on this?
>>
>> Thanks,
>>
>> *Rodrigo Yanis.*
>> Identicum S.A.
>> Jorge Newbery 3226
>> Tel: +54 (11) 4824-9971
>> ryanis at identicum.com
>> www.identicum.com
>>
>> _______________________________________________
>> midPoint mailing list
>> midPoint at lists.evolveum.com
>> http://lists.evolveum.com/mailman/listinfo/midpoint
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.evolveum.com/pipermail/midpoint/attachments/20170214/073dac02/attachment.htm>