Is there a way to identify user accounts that need to be locked?

Question

Hi,
I am trying to write a script that will lock user accounts for employees that are being outprocessed (e.g. quit, fired, went to a different project).  The trouble I'm having is that the way I'm notified is by email from security that a person (first and last name provided in the email) is being outprocessed.  However, that individual may have multiple accounts and the account names don't always follow the same format like 'first initial last name'.  For example, I may have a user named John Doe with accounts like jdoe_sensor1, jdoe_sensor2, etc.  Then there could be a user Alice Smith with account like alice_s_sensor1, alice_s_sensor2, etc.  I know I can use OEM to lock users, but there are two main problems with that.  1 -- Finding the users, then clicking on each user and then locking them one by one.  And 2 -- I may not need to lock them right away.  For example, the email from security may say "Lock all accounts for FIRSTNAME LASTNAME at the end of the day on a certain date.  So I was hoping to write a script to identify the accounts, lock the user, and then verify they were locked and run it in cron, so the accounts get locked when they're supposed to.  An example of the SQL statements I'm thinking of are:
SELECT username, user_id, account_status FROM dba_users WHERE username like upper ('%$user%');
ALTER user $user ACCOUNT LOCK;
SELECT username, user_id, account_status FROM dba_users WHERE username like upper ('%$user%');
So basically, I need a way to find out what the possible combinations are for $user.  Is there a view besides dba_users which has more detailed information like first name and last name?  I'm thinking if there is, then I can query that and find out all the accounts that user has and then plug those into the lock script.    
Thanks!
Jon

Answer 1

There is a very large problem with being given only a person's name and not their user ids.
For example, if you have two people with same (or similar) name, then what?
John Doe
John J. Doe
This seems to be very common, and even more so with some very common names:
Smith
Chin
etc
So even if you have a lookup table:
Name
Userid
John Doe
johndoe
John Doe
jdoe
John J. Doe
johnd
J. Doe
jdoe2
John D
john_d
Jon Doe
jond
Jim Doe
jidoe
Johnny Doe
jonydoe
Really, nowadays, with different policies, practices, etc, I've seen all manner of userids. When you're given somebody to "close down", you should really press them to provide userids, not just first name, last name.
After all, if they tell you to lock all "John Doe's" accounts, how do you know that the id "johnd" isn't supposed to be locked? or even "jond" ??  You really have no idea. Did security mean "John J. Doe" and didn't provide his initial? What if they both happen to have J middle initial, but once's just registered with the company because the other one existed?
My thought: If you're not given the specific userid(s), you're running a pretty good risk (at some point in time) that you will lock an id you shouldn't, or not lock an id you should.