When managed/user is the source in a mapping, the defaultPostMapping.groovy script will update its "lastSync" attribute after a sync for that mapping completes. When this happens, relationships which are "returnedByDefault" are somehow being included in the request from the managed service to the repo service. Depending on how the repo service has been configured, this will result in one of two things:
1) If generic, then the fullobject attribute will contain the extra copy of relationship data
2) If explicit, then warnings are produced on the IDM console regarding un-mapped values being discarded.
This can be reproduced like so:
1) Create a mapping from managed/user to any target
2) Set "returnByDefault": true for manager in the managed/user schema
3) Add an "onStore" script for managed/user which prints out the object, like so:
4) Create a managed/user that has a manager defined
Note the logs produced by the onStore script. You should never see "manager" included in the content, because it's a relationship value. And when you create the managed/user, you see that it is correctly omitted. However, due to the defaultPostMapping behavior, you'll see another log entry produced as part of that onStore event. This second log entry will incorrectly include the "manager" attribute, resulting in one of the two above-mentioned undesirable outcomes.
In the onStore script, manually delete the relationship attributes from the object, like so: