AD Identity Service: Delete or Disable users that aren't found?

Question

We currently set users to be "disabled" but then we have to periodically remember to go in there and delete them manually. It also creates issues with duplicate login names. Do you delete your users automatically? I've always been concerned that if something goes wrong with a sync then all my users would be deleted.

Answer 1

We had the same issue here, so I wrote an external operation that piggybacks on the user sync job and deletes any disabled users older than X amount of days. For instance, in our case users are deleted after 180 days of being disabled (this is a bit extreme). This way you can give yourself a few days before the users are actually deleted, but keep the process automated. There are a couple of options built in, which should be discernible from the source code. Here is the source:
package com.oracle.services.jobs;
import com.oracle.services.utility.SessionManager;
import com.plumtree.openfoundation.util.XPCalendar;
import com.plumtree.openfoundation.util.XPDateTime;
import com.plumtree.portaluiinfrastructure.resultwrapper.ASQueryResultWrapper;
import com.plumtree.server.IPTObjectManager;
import com.plumtree.server.IPTQueryResult;
import com.plumtree.server.IPTSession;
import com.plumtree.server.IPTUser;
import com.plumtree.server.IPTUserManager;
import com.plumtree.server.PT_LOCKSTATES;
import com.plumtree.server.PT_PROPIDS;
* This class takes care of the automation server job for deleting user accounts
* which have been disabled for some number of days.
* @author hross
public class DeleteDisabledAccountsJob {
     // filter for only deleting agent disabled accounts
     private static String FILTER_AGENT = "This user has been locked by a User Synchronization Job.";
     // filter for deleting all disabled accounts (including those disabled by an
     // admin)
     private static String FILTER_ALL = "";
     public static void main(String[] args) {
          // check arguments
          if ((args.length < 2) || (args.length > 4)) {
               System.err.println("usage: ");
               System.err
                         .println("DeleteDisabledAccountsJob <security_token> <num_days>");
               System.err
                         .println("DeleteDisabledAccountsJob <security_token> <num_days> all");
               return;
          // get a session from the login token
          IPTSession session = SessionManager.createSession(args[0]);
          // get a number of days
          int numDays = 0;
          try {
               numDays = Integer.parseInt(args[1]);
          } catch (Exception ex) {
               System.err.println("Number of days not a valid integer.");
               return;
          // filter all or just the agent?
          boolean filterAll = ((args.length > 2) && (args[2].equals("all")))
                    || ((args.length > 3) && (args[3].equals("all")));
          boolean test = ((args.length > 2) && (args[2].equals("test")))
                    || ((args.length > 3) && (args[3].equals("test")));
          if (test) {
               System.err.println("This is a just a test. Nothing will be deleted.");
          if (filterAll) {
               System.err
                         .println("This job will delete all disabled accounts (even those disabled by an admin).");
          } else {
               System.err
                         .println("This job will delete only users disabled by an authentication source.");
          // calculate 180 days in the past based on today's date
          XPDateTime cutOff = new XPDateTime();
          XPCalendar xpCalendar = XPCalendar.GetInstance();
          xpCalendar.Add(XPCalendar.HOUR, -(24 * numDays));
          cutOff = xpCalendar.GetTime(); // subtract 180 days from current time
          System.err
                    .println("This job will delete any user accounts disabled before: "
                              + cutOff.toString());
          // query for disabled user accounts
          IPTUserManager userManager = (IPTUserManager) session.GetUsers();
          IPTQueryResult result = userManager.GetLockedAccounts(filterAll ? FILTER_ALL
                    : FILTER_AGENT, 0, -1);
          //ASQueryResultWrapper ptqrUserLock = new ASQueryResultWrapper(result);
          for (int i = 0; i < result.RowCount(); i++) {
               // get some basic user info
               int userId = result.ItemAsInt(i, PT_PROPIDS.PT_PROPID_OBJECTID);
               String name = result.ItemAsString(i, PT_PROPIDS.PT_PROPID_NAME);
               String login = result.ItemAsString(i, PT_PROPIDS.PT_PROPID_USER_LOGINNAME);
               XPDateTime dt = result.ItemAsXPDateTime(i, PT_PROPIDS.PT_PROPID_CREATED);
//               System.err.println("Found account: (" + userId + ") " + login
//                         + ", " + name);
               // check to see if we need to delete the user
               if (dt.Before(cutOff)) {
                    if (!test) { // if test, we just want to see who we would have delted
                         // we have to try to unlock the user b/c of a bug in
                         // automation
                         // server
                         IPTUser user = (IPTUser) ((IPTObjectManager) userManager)
                                   .Open(userId, false);
                         try {
                              user.SetLockedStatus(false);
                              user.Store();
                         } catch (Exception ex) {
                              // we expect this will fail b/c of a bug
                         // make sure the account gets unlocked
                         if (user.GetLockState() == PT_LOCKSTATES.PT_LOCKED)
                              user.UnlockObject();
                         // okay, now we can delete the user
                         ((IPTObjectManager) userManager).Delete(userId);
                    System.err.println("Removed user account: " + userId + " - " + login + " - " + name);
}