Failed to sync with user provisioning. Check Planning log for details

Issue:

Even though a user is provisioned for a Planning application in Shared Services, when you try to log into that application by that user you get following error:

Failed to sync with user provisioning. Check Planning log for details

The basic reason for this issue is the SID (Security token IDentifier) mismatch between Shared Services and Planning repository for a user. In other words  even though the User/Group name is same in both repositories but the identifier is different. Point to note: Planning uses SIDs, not the User or Group name for syncing and internal communication. 

There may be times when you will be able to log into a planning application using few users and few of them will give this sync error. A simple way to check if you are running into SID mismatch issue is to check the SID in Shared Services schema table CSS_USERS/GROUPS and HSP_USERS/GROUPS.  Utilities which we use to sort this issue are ProvisionUsers and UpdateUsers but sometimes these utilities won’t give you the expected results. Here is a way to resolve this issue when above utilities doesn't work.

Let’s take a live example here, I have an application in which I can login using admin user but can’t log in using HypAdmin user though both of them are admin to this application in HSS, I tried running above utilities but still no luck.

Here when I tried to log in as admin to the application replica

Now when I tried to log in as hypadmin

Now let’s find the reason for this out of sync:

SELECT IDENTITY_ID  FROM [HYP].[dbo].[CSS_USERS] where  NAME like 'hypadmin';

Result: native://nvid=bee6d6feba94f924:5e6288bc:13fc9557697:-7a6a?USER

SELECT SID FROM [replicaTest].[dbo].[HSP_USERS] 

WHERE USER_ID = (SELECT OBJECT_ID FROM [replicaTest].[dbo].[HSP_OBJECT] WHERE OBJECT_NAME LIKE 'hypadmin')

Result: native://DN=cn=ca9436fdd94d1052:7a0c25f4:13c522b9cdd:-6b1c,ou=People,dc=css,dc=hyp,dc=

com?USER

It means the SIDs are not in sync between HSS and Planning, in this case there was a different reason for SID mismatch (I had a MSAD user and Native User with the same name HypAdmin to sort out that issue have a look at this blog post)

Solution for this issue is really simple:

Update planning with the ID in the HSS.

UPDATE [replicaTest].[dbo].[HSP_USERS] SET SID = 'native://nvid=bee6d6feba94f924:5e6288bc:13fc9557697:-7a6a?USER'

WHERE USER_ID = (SELECT OBJECT_ID FROM [replicaTest].[dbo].[HSP_OBJECT] WHERE OBJECT_NAME LIKE 'hypadmin')

Restart Planning and try login to application replica using hypadmin user.

 

Oracle documented solutions for this issue are:

Receiving Error "Failed to Sync with User Provisioning. Check Planning logs for details" When Importing Security Access Permissions Artifacts Via LifeCycle Management Utility. [ID 1360954.1]

Hyperion Planning Error: "Failed to sync with user provisioning. Check planning log for details." [ID 1127664.1]

Cheers...!!!

Rahul S.