Another IDM360 riddle: in a SAP HR driver I have an input transform that creates pseudo-relationship attributes. In a following step history and future data is stripped and remaining XML fragments are cleaned up. This all worked well until I started cloning Relationship-A002/B002 to groupMember/Group Membership to set up org units as nested groups. Now IDM starts throwing an error Code(-9010) An exception occurred: com.novell.xml.dom.DOMExceptionImpl:


[12/15/08 16:16:37.347]:SRV_SAPHR-MQ1 PT: Action: do-set-local-variable("trace",scope="policy",token-xml-serialize(token-xpath("."))).
[...]
[12/15/08 16:16:37.350]:SRV_SAPHR-MQ1 PT: Arg Value: "<modify class-name="O" event-id="..." src-dn="50000059" timestamp="20081215">
<association>50000059</association>
<modify-attr attr-name="P1000:STEXT:none:98:40">
<remove-all-values/>
<add-value>
<value seqnr="000" timestamp="20030101-20071231">SomeOldName</value>
<value seqnr="000" timestamp="20080101-99991231">SomeNewName</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-A002">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-B002">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-A003">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-B003">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-A007">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-B007">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-A008">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-B008">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-A012">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-B012">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Relationship-A002">
<add-value>
<value association-ref="50000050" timestamp="20030101-99991231" type="dn">O-50000050</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-A011">
<add-value>
<value association-ref="00001094500001" timestamp="20030101-99991231" type="dn">K-00001094500001</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-AZ01">
<add-value>
<value association-ref="50001566" timestamp="20030101-99991231" type="dn">01-50001566</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-AZ02">
<add-value>
<value association-ref="50001576" timestamp="20030101-99991231" type="dn">01-50001576</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-B002">
<add-value>
<value association-ref="50000584" timestamp="20030101-20071231" type="dn">O-50000584</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-B002">
<add-value>
<value association-ref="50000585" timestamp="20030101-99991231" type="dn">O-50000585</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-B003">
<add-value>
<value association-ref="50000581" timestamp="20030101-20050630" type="dn">S-50000581</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-B003">
<add-value>
<value association-ref="50004888" timestamp="20050301-20071231" type="dn">S-50004888</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-B012">
<add-value>
<value association-ref="50000581" timestamp="20030101-20050228" type="dn">S-50000581</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Relationship-B012">
<add-value>
<value association-ref="50004888" timestamp="20050301-20071231" type="dn">S-50004888</value>
</add-value>
</modify-attr>
<modify-attr attr-name="Group Membership">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Group Membership">
<add-value>
<value association-ref="50000050" timestamp="20030101-99991231" type="dn">O-50000050</value>
</add-value>
</modify-attr>
<modify-attr attr-name="groupMember">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="groupMember">
<add-value>
<value association-ref="50000584" timestamp="20030101-20071231" type="dn">O-50000584</value>
</add-value>
</modify-attr>
<modify-attr attr-name="groupMember">
<add-value>
<value association-ref="50000585" timestamp="20030101-99991231" type="dn">O-50000585</value>
</add-value>
</modify-attr>
</modify>".
[12/15/08 16:16:37.364]:SRV_SAPHR-MQ1 PT: Action: do-strip-xpath("self::*//value[substring(@timestamp,1,8) > $today]").
[12/15/08 16:16:37.365]:SRV_SAPHR-MQ1 PT: Action: do-strip-xpath("self::*//value[substring(@timestamp,10,8) < $today]").
[12/15/08 16:16:37.365]:SRV_SAPHR-MQ1 PT: Action: do-strip-xpath("self::*//value/@seqnr").
[12/15/08 16:16:37.366]:SRV_SAPHR-MQ1 PT: Action: do-strip-xpath("self::*//value/@timestamp").
[12/15/08 16:16:37.363]:SRV_SAPHR-MQ1 PT:
DirXML Log Event -------------------
Driver: \IDM-DEV\system\idm\drvset01\SRV_SAPHR-MQ1
Channel: Publisher
Status: Error
Message: Code(-9010) An exception occurred: com.novell.xml.dom.DOMExceptionImpl
at com.novell.xml.dom.NamedNodeMapImpl.removeNamedIte m(NamedNodeMapImpl.java:182)
at com.novell.xml.dom.ElementImpl.removeAttributeNode (ElementImpl.java:242)
at com.novell.nds.dirxml.engine.rules.DoStripXPath.ap ply(DoStripXPath.java:90)
at com.novell.nds.dirxml.engine.rules.ActionSet.apply (ActionSet.java:177)
at com.novell.nds.dirxml.engine.rules.DirXMLScriptPro cessor.applyRules(DirXMLScriptProcessor.java:298)
at com.novell.nds.dirxml.engine.Transformer.applyInpu tTransformation(Transformer.java:306)
at com.novell.nds.dirxml.engine.Publisher.execute(Pub lisher.java:243)
at com.novell.nds.dirxml.remote.driver.PublicationShi mImpl.publish(PublicationShimImpl.java:259)
at com.novell.nds.dirxml.remote.driver.PublicationShi mImpl.start(PublicationShimImpl.java:175)
at com.novell.nds.dirxml.engine.Publisher.run(Publish er.java:420)
at java.lang.Thread.run(Unknown Source)

If I disable the clone tokens resulting in the same input doc as above except the last 5 modify-attr nodes:

<modify-attr attr-name="Group Membership">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="Group Membership">
<add-value>
<value association-ref="50000050" timestamp="20030101-99991231" type="dn">O-50000050</value>
</add-value>
</modify-attr>
<modify-attr attr-name="groupMember">
<remove-all-values/>
</modify-attr>
<modify-attr attr-name="groupMember">
<add-value>
<value association-ref="50000584" timestamp="20030101-20071231" type="dn">O-50000584</value>
</add-value>
</modify-attr>
<modify-attr attr-name="groupMember">
<add-value>
<value association-ref="50000585" timestamp="20030101-99991231" type="dn">O-50000585</value>
</add-value>
</modify-attr>

no error occurs. Also moving the clone tokens further down past the offending do-strip-xpath will work. What am I missing here? Does IDM treat groupMember/Group Membership differently from my own aux attributes that are in multi-valued dn syntax, too? Or is it just another funny little bug I ran into?

Cheers, Lothar