As far as I know, this shouldn't be possible, but the trace shows quite
clearly what didn't happen that should have.

Here's the starting doc, coming in on the Subscriber channel as a modify
of an object that is not yet associated:

[04/21/11 12:18:56.935]:PeopleSoft Output ST:Start transaction.
[04/21/11 12:18:56.936]:PeopleSoft Output ST:Processing events for
transaction.
[04/21/11 12:18:56.937]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<modify cached-time="20110421171856.849Z" class-name="User" event-
id="gw2843" qualified-src-dn="O=NIU\OU=U
sers\CN=XXXXXXXX" src-dn="\NIU-FLAT\NIU\Users\XXXXXXXX" src-entry-
id="395147" timestamp="1303406336#2">
<modify-attr attr-name="Internet EMail Address">
<add-value>
<value timestamp="1303406336#2"
type="string">XXXXXXXX@XXX.XXX.XXX.XXX</value>
</add-value>
</modify-attr>
</modify>
</input>
</nds>
[04/21/11 12:18:56.940]:PeopleSoft Output ST:Applying event
transformation policies.
[04/21/11 12:18:56.940]:PeopleSoft Output ST:Applying policy: %+C%14CScope
Filter%-C.
[04/21/11 12:18:56.941]:PeopleSoft Output ST: Applying to modify #1.
[04/21/11 12:18:56.941]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Scope Filter'.
[04/21/11 12:18:56.942]:PeopleSoft Output ST: Query from policy
[04/21/11 12:18:56.942]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<query class-name="User" dest-dn="\NIU-FLAT\NIU\Users\XXXXXXXX" dest-
entry-id="395147" scope="entry">
<read-attr attr-name="employeeStatus"/>
<read-attr attr-name="workforceID"/>
</query>
</input>
</nds>
[04/21/11 12:18:56.951]:PeopleSoft Output ST: Pumping XDS to
eDirectory.
[04/21/11 12:18:56.952]:PeopleSoft Output ST: Performing operation
query for \NIU-FLAT\NIU\Users\XXXXXXXX
..
[04/21/11 12:18:56.953]:PeopleSoft Output ST: Query from policy
result
[04/21/11 12:18:56.953]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<output>
<instance class-name="User" qualified-src-dn="O=NIU\OU=Users
\CN=XXXXXXXX" src-dn="\NIU-FLAT\NIU\Users\A155
9677" src-entry-id="395147">
<attr attr-name="employeeStatus">
<value timestamp="1303406326#12" type="string">A</value>
</attr>
<attr attr-name="workforceID">
<value timestamp="1303406326#11" type="string">nnnnnnnn</value>
</attr>
</instance>
<status level="success"></status>
</output>
</nds>
[04/21/11 12:18:56.956]:PeopleSoft Output ST: (if-attr
'employeeStatus' not-match ".+") = FALSE.
[04/21/11 12:18:56.957]:PeopleSoft Output ST: Rule rejected.
[04/21/11 12:18:56.957]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Data Filter'.
[04/21/11 12:18:56.958]:PeopleSoft Output ST: (if-attr 'workforceID'
not-available) = FALSE.
[04/21/11 12:18:56.958]:PeopleSoft Output ST: Rule rejected.
[04/21/11 12:18:56.958]:PeopleSoft Output ST:Policy returned:
[04/21/11 12:18:56.959]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<modify cached-time="20110421171856.849Z" class-name="User" event-
id="gw2843" qualified-src-dn="O=NIU\OU=U
sers\CN=XXXXXXXX" src-dn="\NIU-FLAT\NIU\Users\XXXXXXXX" src-entry-
id="395147" timestamp="1303406336#2">
<modify-attr attr-name="Internet EMail Address">
<add-value>
<value timestamp="1303406336#2"
type="string">XXXXXXXX@XXX.XXX.XXX.XXX</value>
</add-value>
</modify-attr>
</modify>
</input>
</nds>
[04/21/11 12:18:56.962]:PeopleSoft Output ST:Applying policy: %+C%14CEvent
Transformation Policies%-C.
[04/21/11 12:18:56.962]:PeopleSoft Output ST: Applying to modify #1.
[04/21/11 12:18:56.963]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Block Delete Events'.
[04/21/11 12:18:56.963]:PeopleSoft Output ST: (if-operation equal
"delete") = FALSE.
[04/21/11 12:18:56.964]:PeopleSoft Output ST: Rule rejected.
[04/21/11 12:18:56.964]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Block Modify-Password
Events'.
[04/21/11 12:18:56.965]:PeopleSoft Output ST: (if-operation equal
"modify-password") = FALSE.
[04/21/11 12:18:56.965]:PeopleSoft Output ST: Rule rejected.
[04/21/11 12:18:56.965]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Block Move Events'.
[04/21/11 12:18:56.966]:PeopleSoft Output ST: (if-operation equal
"move") = FALSE.
[04/21/11 12:18:56.966]:PeopleSoft Output ST: Rule rejected.
[04/21/11 12:18:56.967]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Transform Rename even
t to Modify of CN'.
[04/21/11 12:18:56.967]:PeopleSoft Output ST: (if-operation equal
"rename") = FALSE.
[04/21/11 12:18:56.968]:PeopleSoft Output ST: Rule rejected.
[04/21/11 12:18:56.968]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Specify Destination O
bject'.
[04/21/11 12:18:56.969]:PeopleSoft Output ST: (if-operation equal
"modify") = TRUE.
[04/21/11 12:18:56.969]:PeopleSoft Output ST: (if-association
available) = FALSE.
[04/21/11 12:18:56.970]:PeopleSoft Output ST: Rule rejected.
[04/21/11 12:17:27.659]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<modify cached-time="20110421171727.613Z" class-name="User" event-
id="gw2836" qualified-src-dn="O=NIU\OU=U
sers\CN=XXXXXXXXXX" src-dn="\NIU-FLAT\NIU\Users\XXXXXXXXXX" src-entry-
id="395146" timestamp="1303406247#2">
<modify-attr attr-name="Internet EMail Address">
<add-value>
<value timestamp="1303406247#2"
type="string">XXXXXXXXXX@XXX.XXX.XXX.XXX</value>
</add-value>
</modify-attr>
</modify>
</input>
</nds>


User XXXXXXXX has an email address now. Nothing unusual there. This is a
normal account create (from HR) that has been provisioned in to
GroupWise, and the return Internet Email Address from GW is being
processed. This should go down the Subscriber here, and updates the HR
records for the person


[04/21/11 12:17:27.662]:PeopleSoft Output ST:Subscriber processing modify
for \NIU-FLAT\NIU\Users\XXXXXXXXXX.
[04/21/11 12:17:27.663]:PeopleSoft Output ST:Converting <modify> to <add>
[04/21/11 12:17:27.663]:PeopleSoft Output ST:Reading relevant attributes
from \NIU-FLAT\NIU\Users\XXXXXXXXXX.
[04/21/11 12:17:27.664]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<query class-name="User" dest-dn="\NIU-FLAT\NIU\Users\XXXXXXXXXX"
dest-entry-id="395146" scope="entry">
<read-attr attr-name="CN"/>
<read-attr attr-name="Internet EMail Address"/>
<read-attr attr-name="Telephone Number"/>
<read-attr attr-name="workforceID"/>
</query>
</input>
</nds>


Here, the engine has figured out that the user is not yet associated, and
is doing the synthetic add thing. The query for the attributes in the
filter has been built and sent back to eDirectory.


[04/21/11 12:17:27.666]:PeopleSoft Output ST:Pumping XDS to eDirectory.
[04/21/11 12:17:27.666]:PeopleSoft Output ST:Performing operation query
for \NIU-FLAT\NIU\Users\XXXXXXXXXX.
[04/21/11 12:17:27.668]:PeopleSoft Output ST:Read result:
[04/21/11 12:17:27.668]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<output>
<instance class-name="User" qualified-src-dn="O=NIU\OU=Users
\CN=XXXXXXXXXX" src-dn="\NIU-FLAT\NIU\Users\A156
8864" src-entry-id="395146">
<attr attr-name="CN">
<value naming="true" timestamp="1303406232#65"
type="string">XXXXXXXXXX</value>
</attr>
<attr attr-name="Internet EMail Address">
<value timestamp="1303406247#2"
type="string">XXXXXXXXXX@XXX.XXX.XXX.XXX</value>
</attr>
<attr attr-name="workforceID">
<value timestamp="1303406247#13" type="string">nnnnnnnn</value>
</attr>
</instance>
<status level="success"></status>
</output>
</nds>


The query read result doc looks good. Note that it has both Internet
Email Address and WorkforceID in it, like it should. Both attributes are,
of course, present on the eDirectory object. Then here's where it gets
weird. The resulting <add> document built from this is:


[04/21/11 12:17:27.672]:PeopleSoft Output ST:Synthetic add:
[04/21/11 12:17:27.673]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input>
<add class-name="User" event-id="gw2836" qualified-src-dn="O=NIU
\OU=Users\CN=XXXXXXXXXX" src-dn="\NIU-FLAT\N
IU\Users\XXXXXXXXXX" src-entry-id="395146">
<add-attr attr-name="CN">
<value naming="true" timestamp="1303406232#65"
type="string">XXXXXXXXXX</value>
</add-attr>
<add-attr attr-name="Internet EMail Address">
<value timestamp="1303406247#2"
type="string">XXXXXXXXXX@XXX.XXX.XXX.XXX</value>
</add-attr>
</add>
</input>
</nds>


Note that WorkforceID is not present. It should be. It's in the filter,
and the synthetic adds *before* and *after* this one all include
WorkforceID correctly. Just this one is missing it.


[04/21/11 12:17:27.676]:PeopleSoft Output ST:No object matching policies.
[04/21/11 12:17:27.677]:PeopleSoft Output ST:Applying object creation
policies.
[04/21/11 12:17:27.677]:PeopleSoft Output ST:Applying policy: %+C%
14CRequired Attributes%-C.
[04/21/11 12:17:27.678]:PeopleSoft Output ST: Applying to add #1.
[04/21/11 12:17:27.678]:PeopleSoft Output ST: Evaluating selection
criteria for rule 'Required Attributes f
or User Objects'.
[04/21/11 12:17:27.679]:PeopleSoft Output ST: (if-operation equal
"add") = TRUE.
[04/21/11 12:17:27.679]:PeopleSoft Output ST: (if-class-name equal
"User") = TRUE.
[04/21/11 12:17:27.680]:PeopleSoft Output ST: Rule selected.
[04/21/11 12:17:27.680]:PeopleSoft Output ST: Applying rule 'Required
Attributes for User Objects'.
[04/21/11 12:17:27.681]:PeopleSoft Output ST: Action: do-veto-if-op-
attr-not-available("workforceid").
[04/21/11 12:17:27.681]:PeopleSoft Output ST:Policy returned:
[04/21/11 12:17:27.682]:PeopleSoft Output ST:
<nds dtdversion="3.5" ndsversion="8.x">
<source>
<product version="3.6.10.4747">DirXML</product>
<contact>Novell, Inc.</contact>
</source>
<input/>
</nds>


And, since a required attribute is missing, the <add> is veto'd. That
part is correct, logically, but the attribute *isn't* missing. It's in
eDir, it's in the reply to the query, it's shown in the trace, it just
never made it in to the <add> document on this event like it should have.

Anybody ever seen something like this before? I'm thinking obscure engine
bug, as nothing else really seems to make any sense.


--
---------------------------------------------------------------------------
David Gersic dgersic_@_niu.edu
Novell Knowledge Partner http://forums.novell.com

Please post questions in the newsgroups. No support provided via email.