In general, Identities are created to represent an organization’s personnel (as represented in the authoritative data source(s)) and each user's application accounts are associated to their Identity as the accounts are aggregated. In fact, the IdentityIQ data model requires that all accounts be tied to an Identity. When an account is aggregated into IdentityIQ from a non-authoritative source and cannot be correlated to an existing Identity in the system, IdentityIQ still needs to record the existence of the account and still needs an Identity to support the account, so it creates a new, uncorrelated Identity. (These uncorrelated accounts are often referred to as “orphaned” accounts since they lack an authoritative “parent” Identity.)
Uncorrelated Account / Orphaned Account: an account from a non-authoritative system which cannot be correlated to an existing authoritative Identity
Uncorrelated Identity: a non-authoritative Identity created solely to support an uncorrelated account until it can be correlated to an authoritative Identity
Organizations have several choices for addressing these uncorrelated accounts.
Manually correlate the accounts to existing authoritative Identities.
Alter the correlation configuration/rule so it will correctly correlate these accounts to the appropriate authoritative Identity and re-run the aggregation.
Clean up the data in the native system, deleting any invalid accounts, and re-run the aggregation with the Detect deleted accounts option selected; IdentityIQ then recognizes that the accounts do not exist and deletes the accounts from its records.
In all of these cases, once the accounts have been disassociated from the non-authoritative Identities, the uncorrelated Identities still exist in the system but no longer have any accounts associated to them and are therefore no longer needed. The Prune Identity Cubes task can be run to delete those Identities.
Depends on the method you have chosen for addressing the uncorrelated accounts. Each of the three bullet points in the list are independent choices and only 2 of them require reaggregation.
If you manually correlate them on the Manage -> Identity Correlation page, no, you don't have to reaggregate. If, on the other hand, you realized your correlation rule/config was bad and you fixed that correlation rule/config, you do need to re-run the aggregation to make it correlate the accounts correctly. And if you discovered the reason you had uncorrelated accounts is that you had bad data in the source system and you fixed that, you would have to reaggregate with Detect Deleted Accounts turned on to make IdentityIQ discover the accounts to be deleted.
You do still need to run the pruning task in all cases to make the identities created to support the uncorrelated accounts disappear (because once their accounts are appropriately correlated, the identities no longer have accounts hanging on them and are therefore no longer needed).
The following option in an aggregation task - "Check to update existing identities, but not create new identities if a match is not found" - shouldn't this inhibit uncorrelated accounts from getting created during aggregation?
Additionally, is there a way to clean up identities without cleaning the application data source / correlating the identities? I do not want them in IIQ.
What about application accounts that have been created in IIQ because the option was not checked the first time we ran aggregation? They are now in IIQ and have the application's accounts.
I used extended attribute for correlation but the accounts was uncorrelated. The third option helps me to solve the issue. "Clean up the data in the native system, deleting any invalid accounts, and re-run the aggregation". I reset the source and aggregate again then the accounts correlates.
