Overview

This document will cover some of the common questions and problems around Automated Provisioning.

Troubleshooting Tool

To assist with troubleshooting, the iQmetrix 3PA Troubleshooting Tool allows you to see the data the WSTrust (ADFS) or OAuth2 (Okta) endpoint is returning.

1. Download the zipped folder
2. Extract the folder
3. Double click on iQmetrixThirdPartyAuthenticationTest.exe to run the tool
4. Modify values in the form
5. Click Submit
6. Interpret the response

ADFS Configuration

Okta Configuration

Response

The tool will display all data returned from the provided WSTrust or OAuth2 endpoint.

The fields in the response depend on which claims you have configured, as shown in the following table.

UserName: '{Username}'
EmailAddress: '{Email}'
FirstName: '{FirstName}'
LastName: '{LastName}'
AssignedEntityClientEntityId: '{AssignedEntityClientEntityId}'
AssignedEntityClientEntityIds: '{AssignedEntityClientEntityIds}'
SecurityGroupName: '{SecurityGroupName}'
HomePhoneNumber: {HomePhoneNumber}
WorkPhoneNumber: {WorkPhoneNumber}
CellPhoneNumber: {CellPhoneNumber}
ClientUserId: '{ClientUserId}'
Attribute {AttributeName}: '{AttributeValue}'
Attribute {CustomAttributeName}: '{CustomAttributeValue}'

Example

UserName: 'testuser9a@retaillabs.io'
EmailAddress: 'testuser9a@retaillabs.io'
FirstName: 'Test'
LastName: 'User 9aa'
AssignedEntityClientEntityId: 'KY'
SecurityGroupName: 'Dealer'
HomePhoneNumber: [not set]
WorkPhoneNumber: [not set]
CellPhoneNumber: [not set]
ClientUserId: '123123'
Attribute CompensationType: 'Salaried'
Attribute YourCustomField: 'TheValue'

Things to Check

Checking Claims

One of the claims: AssignedEntityClientEntityId or AssignedEntityClientEntityIds must be provided so RQ knows at which level to assign the security role for the employee.

For more information, see Claims.

In addition, ensure the ADFS server time is correct. If the ADFS server is off by even a few minutes, logins will fail. WCF, by default, allows a five-minute gap, beyond this is throws an error. The solution is to sync machines. For more information, see Microsoft’s Blog Post.

Mapping your Security Roles

Every value that may be returned from your system using the securityGroupName claim must be mapped to a SecurityRoleName in Hub using the following steps:

1. Log into Hub
2. Click on Settings in sidebar
3. Click on Authentication Setup from the options on the page
   • If you do not see Authentication Setup, ensure your security roles are mapped correctly
4. Scroll down to Hub Security Roles Mapping
5. Ensure each role in your system is mapped to a Hub Security Role
6. Ensure the values in Identity Provider Role match the names of the roles in your system exactly

Mapping your Company Tree

Every value that may be returned from your system using the assignedEntityClientEntityId or assignedEntityClientEntityIds claim must be mapped as a External Node Identifier in Hub using the following steps:

1. Log into Hub
2. Click on Settings in sidebar
3. Click on Companies from the options on the page
4. Ensure each value from your system is mapped to a Company Tree Node in the form of an External Node Identifier

Checking User Ids

Every user in your system must have a unique identifier that will be set as a ClientUserId on the appropriate RQ user.

This is necessary for RQ to know which employee is logging in. Non-unique values may result in duplicate employees in RQ.