Identity Panel Release Notes thru 2017-07-07 3.3.8

Release Notes for version 3.3.8

• Fixes issue with scheduler getting stuck due to network problems
• MIM Test step for Join, Disconnect, and Project of CS objects
• Support for templated rule expressions in Report parameters
• Standardized method for config protection

The new config data protection settings apply to both web application and panel tools. It does NOT apply to Users section for SaaS Azure AD authentication which is handled separately.

Values that are potentially sensitive, such as cross-domain Panel Tools credentials, or MongoDB connection string may be encrypted with DPAPI by adding:

"ProtectMode": "CurrentUser"

or

"ProtectMode": "LocalMachine"

to the "Auth" section of config.json

We’ve expanded the compatibility range of the rapid scan, and we’ve also enabled Identity Panel to scan different MAs in parallel. You can expect at least a 5x performance improvement between this version and 3.3.6.

In addition, there are new settings which you can use to performance tune data collection:

On the Sync Provider:

Enable Rapid Scan

Full scan vs MA run scans now decides based on the number of objects changing. If more than 33% of objects in an MA are new or different from what’s in Identity Panel it counts as a “full scan”.

WMI Timeout

This setting no longer needs to be tuned, because Identity Panel will always go straight to CSExport on objects with enough references to be in danger of timing out.

Reference Attributes from Hologram

Selecting this will reduce the number of database queries that need to be made on large groups.

Parallel Scan Limit

The number of MAs that can be read in parallel during a scan. 5 is a good compromise number for speeding things up without overloading MIM.

On Run steps:

Skip CS/MV Scan

If you have a run that adds too much scan time to the schedule and want to sacrifice time-traveller resolution for performance, this checkbox lets you avoid scanning object changes on individual runs. For example, you might skip scanning the result of a delta import, and just scan the delta sync that comes after.

Reference Count Threshold

If you specify a non-zero threshold, Identity Panel will skip scanning any objects (i.e. groups) with more reference values (i.e. members) than the indicated value. This solves the problem of all employees (and similar) groups taking 15 minutes to export on every pass through the delta cycle. Skipped groups will be picked up and rationalized on the next catchup full scan.