IdStory Identity Manager

• 863 identities with the same contract EAV value. All identities have 2 contracts, only one of them has the EAV filled with value.
• 1 superrole + 1 subrole (the subrole has no other superior roles)
• added automatic role for the superrole, rules: 1 contract EAV equals "testvalue"
• result: all identities have the superrole assigned once and the subrole once as subrole (OK). But most of them have the subrole also directly assigned, some once, some more than once:
  

  select pocet as pocetprideleni, count(*) as pocetidentit from (SELECT count(*) pocet, i.username  FROM idm_identity i
  JOIN idm_identity_contract ic ON ic.identity_id=i.id 
  JOIN idm_identity_role ir ON ir.identity_contract_id=ic.id 
  JOIN idm_role r ON ir.role_id=r.id where r.code='subrole' and ir.direct_role_id is null and ir.created < '2020-12-09 18:39:00.000' group by i.username ) as t group by pocet order by pocet; 
   pocetprideleni | pocetidentit 
  ----------------+--------------
                1 |          214
                2 |          196
                3 |          133
                4 |          176
                5 |           82
  

  
  I tested also situations where the automatic role was not a business role and there were no duplicities (tested for 1 or 2 EAVs of identity or contract).
  In all cases, the "Processed" field of the LRT ProcessAutomaticRoleByAttributeTaskExecutor shows numbers like 2982 / 863, but only business roles created duplicities.

Also when I added second superrole to the subrole and created automatic role for this second superrole, the number of direct assignments of "subrole" increased very much:

# select pocet as pocetprideleni, count(*) as pocetidentit from (SELECT count(*) pocet, i.username  FROM idm_identity i
JOIN idm_identity_contract ic ON ic.identity_id=i.id 
JOIN idm_identity_role ir ON ir.identity_contract_id=ic.id 
JOIN idm_role r ON ir.role_id=r.id where r.code='subrole' and ir.direct_role_id is null  group by i.username ) as t group by pocet order by pocet; 
pocetprideleni | pocetidentit 
----------------+--------------
              1 |            1
              2 |          167
              3 |           54
              4 |          140
              5 |           59
              6 |          107
              7 |           23
              8 |           51
              9 |           98
             10 |           20
             11 |           81

• synchronized new 228 identities and contracts
• started ProcessAllAutomaticRoleByAttributeTaskExecutor
• it processed 7/7 automatic roles by attributes
• 8/228 ended with only subrole, other 220 identities had the subrole assigned directly and some more than once
  pocetprideleni | pocetidentit
  ----------------+--------------
  1 | 20
  4 | 58
  5 | 10
  6 | 52
  7 | 71
  8 | 9