In IDM 4.7 the resiliency of dynamic group evaluation via the RRSD was enhanced.
This enabled rollback of a failed evaluation (per group as far as I understand).
It is still very possible to set the refresh frequency of dynamic group resolution to a crazily low value (like a few minutes). It is tempting for an IDM admin to set this value to ensure frequent evaluation (so one doesn't have to wait to see results).
Experience shows that a too frequent refresh rate (like under 10 minutes) can increase the chance that evaluation fails.
There should be a logged (in trace) error (or warning if successfully recovered) when such a failure occurs and/or that the driver shuts down with a fatal status if the value chosen is unsafely low.
by: Alex M. | over a year ago | Role Based Provisioning
Comments
Indeed!!!