Customized Reconciliation for compliance

Question

Hi Everyone,
I have a client requirement that while reconciliation if there is any update in certain attrs (lets say for 10 attrs out of 25 attrs that will reconcile) then these should not be update in OIM process form for resource but flag to manager/admin even if the recon event is linked. Also one flag attribute in OIM process form should also update so that we can capture this in reports. Client wants this requirement as he wants to control the direct update of some sensitive information in target resource.
Please put your ideas how i can achieve this.

Answer 1

You basically need to write a scheduled task that
1. Extracts the recon data from the trusted source
2. Applies the business logic that separates the "good" updated from the questionable
3. For the "good" events: creates the recon event and commit it
4. For the "bad" events: notify the manager and store the information offline
There are a couple of different options on how to handle the bad events.
One option is to create a separate resource object that can go through approval and if successful updates the OIM user.
Another more manual option is to create a weekly manual approval process, store the "approved" bad events in a flat file and then fire a recon that commits the events.
A completely different approach would be to use event handlers to intercept the recon events just before they are committed.
Hope this helps
/Martin