Account Loading

Question

Hi everyone,
I'm trying to nail down a reliable way to initially load accounts into the IdM. We have a largish Active Directory installation that we want to load from, but we don't want to load all accounts that are in the directory. (There are a lot of system accounts, resource mailboxes, etc. that we don't want in IdM). We already have some tools running to extract flat files of the accounts that we're interested, so I figured we'd just leverage those to get the job done.
What I'm attempting to do right now is create Lighthouse accounts with just the username, and then either Reconcile them against Active Directory to link up resource accounts, or to try and Synchronize them to accomplish the same. Neither of which is working properly for me.
I can reconcile and link up all the resource accounts, but none of the account attributes show up in IdM; I just have an accountId and a linked account in the Admin interface. If I go to edit any account, the attributes will show up, and hitting save puts them in place (without any manual editing). That's really not feasible for the 12,000+ accounts I need to get in there though.
I tried setting a per-account workflow while reconciling to do this, but the reconcile will error out after it runs into accounts in Active Directory that are not in IdM. I tried to do a post-reconcile workflow too, without any luck.
I had a bit more luck with Active Sync; it was pulling in account information the way it's supposed to, but it too eventually errored out without a good error message.
I might be going down the wrong path here; it may be best just to load all the user attributes along with their accounts in the first place, but I want to do it this way to make sure that syncing attributes works the way it's supposed to work. Anyone have any recommendations?

Answer 1

fisch003 wrote:
Hi everyone,
I'm trying to nail down a reliable way to initially load accounts into the IdM. We have a largish Active Directory installation that we want to load from, but we don't want to load all accounts that are in the directory. (There are a lot of system accounts, resource mailboxes, etc. that we don't want in IdM). We already have some tools running to extract flat files of the accounts that we're interested, so I figured we'd just leverage those to get the job done.First of all, if you want to exclude some OUs or some accounts from AD you can make an exclusion rule and mention the logic to exclude the accounts.
What I'm attempting to do right now is create Lighthouse accounts with just the username, and then either Reconcile them against Active Directory to link up resource accounts, or to try and Synchronize them to accomplish the same. Neither of which is working properly for me.You need to create a bulk load file where you would want to mention IDM command, all account to be created in IDM, all account attributes. you can also use merge command in the file to upload AD accounts as well.
I can reconcile and link up all the resource accounts, but none of the account attributes show up in IdM; I just have an accountId and a linked account in the Admin interface. If I go to edit any account, the attributes will show up, and hitting save puts them in place (without any manual editing). That's really not feasible for the 12,000+ accounts I need to get in there though.You need to create a user form where you will have to mention about the mapping of account attributes you need, then assign that form to a recon admin user and then run the reconciliation with this user as proxy user.
I tried setting a per-account workflow while reconciling to do this, but the reconcile will error out after it runs into accounts in Active Directory that are not in IdM. I tried to do a post-reconcile workflow too, without any luck.
I had a bit more luck with Active Sync; it was pulling in account information the way it's supposed to, but it too eventually errored out without a good error message.
I might be going down the wrong path here; it may be best just to load all the user attributes along with their accounts in the first place, but I want to do it this way to make sure that syncing attributes works the way it's supposed to work. Anyone have any recommendations?