Macro %mduchglb behaves incosistently

[milts]

We are calling the user import macro %mduchglb to insert groups and users to the SAS metadata.

We see some inconsistencies with the resultsas when we process the loading for all users, it fails with an error "object reference to Person was requested without an identifier". But let's say we only process one user at a time, it will be assigned to all groups mapped to it. We tried to sort the canonical tables before calling the macro and it resolves some, but still has some failures. While processing each user one at a time can be a workaround, it will not be scalable as processing time will definitely increase if we will be managing 1000+ users.

Is there some limit to the number of records the import macro can process? Or some order on the tables being used for the processing?

Greatly appreciate any thoughts or inputs on this.

Example:

User 1 assigned to 5 groups

User 2 assigned to 4 groups

User 3 assigned to 4 groups

User 4 assigned to 2 groups

User 5 assigned to 5 groups

Result:

User 1 assigned to 5 groups

User 2 assigned to 4 groups

User 3 assigned to 3 groups

User 4 assigned to 2 groups

User 5 assigned to 3 groups

[JuanS_OCS]

Hello @milts,

the macro has no limitations. However, your AD/LDAP version might have it. Please read: http://documentation.sas.com/?docsetId=bisecag&docsetTarget=n16wd5khdis6qon1ac6rbmv79wyd.htm&docsetV...

Besides this, the inconsistency that can be found during user sync would be basically due to conflicts on the keyID (the Primary Key on the cannonical tables). The errors table would reference and explain the type of conflicts found during user sync.

[PaulHomes]

I have seen that error message a few times but my memory fails me as to what the exact causes were at the time. I thought it was invalid/mismatched data in the canonical tables, but given it works for you when running single users at a time that doesn't sound like the problem.

In addition to the suggestions from @JuanS_OCS, have you noticed that the %MDUCHGLB macro sends the changes to the metadata server in batches/blocks? You might want to try playing around with the blksize parameter. I wonder if it's possibly a reference that crosses a batch boundary.

In the past I have found that capturing and reviewing the XML requests the macro sends to the metadata server have been very helpful in finding the cause of any problems. There are a couple of macro variables you can set to do this. There is more info in the thread at https://communities.sas.com/t5/Administration-and-Deployment/Sync-uner-from-LDAP-to-MC-works-but-fai...

I have used the %MDUCHGLB and other MDU macros extensively and not run into too many issues. The XML escaping/encoding could do with some improvement. We sometime encounter issues with trying to delete and add logins in the same run so we are intending to split it into 2 parts - deletes followed by adds/updates. There is also a rare truncation issue with columns length defined in bytes instead of characters when dealing with long unicode character strings. We try to work around these issues in our Identity Sync plug-in as we encounter them.