Return
-
Title
DSA doesn't match object even when matching rule is selected. -
Description
QMM has been configured to use matching rule meanwhile it doesn't work. -
Cause
DSA.log contains
08/17/17 16:53:05 (GMT+01:00) Target JobID:0 -> Starting next matching: sIDHistory;objectClass08/17/17 16:53:05 (GMT+01:00) Target JobID:0 -> This is a LOW priority matching rule08/17/17 16:53:05 (GMT+01:00) Target JobID:0 -> No source object includes this matching ruleWhich means that when DSA converts ObjectSID->SidHistory to search in target for matched objects converted object doesn't have SIDHIstory attribute because it has been skipped in sync options.Another case:08/17/17 16:53:05 (GMT+01:00) Target JobID:0 -> Starting next matching: objectGUID;objectClass08/17/17 16:53:05 (GMT+01:00) Target JobID:0 -> This is a HIGH priority matching rule08/17/17 16:53:05 (GMT+01:00) Target JobID:0 -> No source object includes this matching ruleIn this case DSA tries to convert source Matching attribute (ExtensionAttribute15 by default) to objectGUID and resulted object has empty ObjectGUID.This means that Source object has not been matched in reverse sync and ExtensionAttribute15 is empty and cannot be converted to ObjectGUID -
Resolution
In most cases you need to make sure that both source and target attribute that is used for matching are not skipped
Hight Priority matching rules:
ObjectGUID-> ExtensionAttribute15
ExtensionAttribute15->ObjectGUID
Low Priority matching rules
ObjectSID-> SIDHistory
SamaccountName->SamaccountName