Import not scoping users on first import

David_Johnsen

I've just logged this to support, but I'm thinking it might be a Service Manager question rather than Cireson.

Anyone else noticing this?


When we create new AD users (did a couple yesterday), when they import to service manger overnight, the next day they are able to see ALL offerings on Cireson, but only on the first day after creating the account, by the second day (and import run) they are then OK. 

On closer inspection it looks like it’s because they’ve not been “scoped” right yet?

If I run the below, it doesn’t bring anything back at all (no rows):

SELECT U.UserName,SU.IsConfigItemScoped,SU.IsWorkItemScoped,SU.IsServiceCatalogScoped

FROM ScopedUser SU

INNER JOIN CI$User U ON SU.UserId=U.Id

WHERE U.UserName='testdj'

Whereas if I run this for any other user (e.g. ones created last week), it does bring back a result.

I’m surmising that it maybe takes two overnight imports for it to create the account in SCSM, then the 2nd import to “scope” it?

It wouldn’t be an issue if it meant they had no access to start with, but having ALL offerings is a little dangerous. (as they can see our test and internal IT forms etc.

Brian_Wiest

This is due to your timing.

What to watch

Select * from LastModified

Here you will find the date/time of the last sync.

In the CiresonPortal\bin\Cireson.CacheBuilder.WindowsService.exe.config you will see the refreshInterval

    <cacheCommands>
      <cacheCommand name="UserAndGroups" threadName="USER" refreshInterval="120" batchSize="500" />
      <cacheCommand name="ConfigItems" threadName="CONF" refreshInterval="60" batchSize="1000" />
      <cacheCommand name="EnumLookup" threadName="ENUM" refreshInterval="1440" batchSize="5000" />
      <cacheCommand name="ServiceCatalog" threadName="CATA" refreshInterval="5" batchSize="500" />
      <cacheCommand name="WorkItems" threadName="WORK" refreshInterval="1" batchSize="500" />
      <cacheCommand name="ScopedAccess" threadName="SCOP" refreshInterval="1440" batchSize="500" />
    </cacheCommands>

You can see that 120 minutes after SCSM Syncs with AD those new users will be available in the portal. Then every 24 hours their SCOP access is determined.

Now I have a maintenance task that runs every weekend to reset the cache builder in the early morning. So in the end I know my SCOP calculation runs about 5am after I know the AD sync job runs Midnight. So while all AD changes have to wait overnight the SCOP will have been calculated.

Also included in this timing to be aware of is the app pool recycling schedule. By default it runs on a 25 hour schedule. This is the final step for the user scoping of the service catalog.

HTH

Brian_Wiest

The LastModifed will provide that last time the sync ran. The config file shows the time frame in minutes until the next time its ran. Since I restart the cache builder at a specific time every week I know that value.

Meaning if you stop the builder,truncate lastmodified and start the service at Noon, then you know each day your SCOP will be updated in the database at noon. Then of course you have to wait for the app pool to recycle.

Here is the script I use to perform the weekly task

https://community.cireson.com/discussion/3905/full-scsm-and-cireson-cache-flush-powershell-script

Brian_Wiest

This is due to your timing.

What to watch

Select * from LastModified

Here you will find the date/time of the last sync.

In the CiresonPortal\bin\Cireson.CacheBuilder.WindowsService.exe.config you will see the refreshInterval

    <cacheCommands>
      <cacheCommand name="UserAndGroups" threadName="USER" refreshInterval="120" batchSize="500" />
      <cacheCommand name="ConfigItems" threadName="CONF" refreshInterval="60" batchSize="1000" />
      <cacheCommand name="EnumLookup" threadName="ENUM" refreshInterval="1440" batchSize="5000" />
      <cacheCommand name="ServiceCatalog" threadName="CATA" refreshInterval="5" batchSize="500" />
      <cacheCommand name="WorkItems" threadName="WORK" refreshInterval="1" batchSize="500" />
      <cacheCommand name="ScopedAccess" threadName="SCOP" refreshInterval="1440" batchSize="500" />
    </cacheCommands>

You can see that 120 minutes after SCSM Syncs with AD those new users will be available in the portal. Then every 24 hours their SCOP access is determined.

Now I have a maintenance task that runs every weekend to reset the cache builder in the early morning. So in the end I know my SCOP calculation runs about 5am after I know the AD sync job runs Midnight. So while all AD changes have to wait overnight the SCOP will have been calculated.

Also included in this timing to be aware of is the app pool recycling schedule. By default it runs on a 25 hour schedule. This is the final step for the user scoping of the service catalog.

HTH

David_Johnsen

Thanks Brian, that's great and answers why it isn't scoping the users then.

Do you know if the expected behaviour is that "unscoped" users can see all offerings initially!? Or have I maybe configured a default group/user role incorrectly?

Brian_Wiest

That I am not sure of. Typically for me when a new user was onboarded until the sync jobs completed they would only see the All users catalog. (have one group of catalog items for Domain users). Based on your issue I am not sure how that would occur. Hopefully Cireson could answer that one.

David_Johnsen

OK thanks.
Could I just check, the refresh intervals, are they minutes from the last CacheBuilder restart or just the last synch.
What I'm asking is can I change the SCOP synch to be at say 5am everyday?

David_Johnsen

Ah just found this https://support.cireson.com/KnowledgeBase/View/1176#/

I'll do some reading...

Brian_Wiest

The LastModifed will provide that last time the sync ran. The config file shows the time frame in minutes until the next time its ran. Since I restart the cache builder at a specific time every week I know that value.

Meaning if you stop the builder,truncate lastmodified and start the service at Noon, then you know each day your SCOP will be updated in the database at noon. Then of course you have to wait for the app pool to recycle.

Here is the script I use to perform the weekly task

https://community.cireson.com/discussion/3905/full-scsm-and-cireson-cache-flush-powershell-script

David_Johnsen

OK brill thanks. 

I've just resynched the CacheBuilder and the account created yesterday is now sorted. It's weird as I'm sure I would have restarted it as a test on Tuesday when I noticed this with other accounts. But maybe not!

So I think the fix will be to get the schedule to resynch at 5am as you do.

Many thanks for your help!