OIM 11g - DBUM Connector Reconciliation Time Stamp

Question

Hi,
We're using OIM 11.1.1.5.2 with the 9.1.0.4 Database User Management Connector.
We're trying to use incremental reconciliation but it doesn't seem to work right.
As per the connector's guide:
"The Last Execution Time attribute holds the time stamp at which the last reconciliation
run started. This attribute is used in conjunction with the reconciliation query
specified by the Query Name attribute. During a reconciliation run, only target system
records added or modified after the time stamp value stored in the Last Execution
Time attribute are fetched into Oracle Identity Manager for reconciliation."
However everytime we run the reconciliation for a specific target, we only get reconciliation for users CREATED after the last reconciliation dates, users MODIFIED after last reconciliation dates are not being reconciled.
The connector is not working as documented, when i review the log, i can see that it is using the following query for recon:
SELECT USERNAME, DECODE(PASSWORD, 'EXTERNAL', 'EXTERNAL', 'GLOBAL', 'GLOBAL', 'PASSWORD') PASSWORD, EXTERNAL_NAME , DEFAULT_TABLESPACE, ACCOUNT_STATUS, TEMPORARY_TABLESPACE, PROFILE, (SELECT MAX_BYTES FROM DBA_TS_QUOTAS WHERE dba.USERNAME = USERNAME AND TABLESPACE_NAME = dba.DEFAULT_TABLESPACE) AS DEFAULT_TABLESPACE_QUOTA , (SELECT MAX_BYTES FROM DBA_TS_QUOTAS WHERE dba.USERNAME = USERNAME AND TABLESPACE_NAME = dba.TEMPORARY_TABLESPACE) AS TEMPORARY_TABLESPACE_QUOTA FROM DBA_USERS dba WHERE ((CREATED - TO_DATE('01011970','ddmmyyyy')) *24*60*60*1000) >1341440733000
I don't think the "CREATED" field on the dba_users table is changed everytime the user is modified, and that field is the only one used on the where clause of the query, so, seems like there's something wrong with it.
The only way to reconcile changes on users right now is running a full reconciliation.
Has anyone ran into this problem before?
Thanks.

Answer 1

Thanks Nishith,
I tested that approach and it worked. However, i had an interesting discussion on the DB forum and they convinced me not to use custom triggers on ddl, but instead use the audit capabilities of the database itself, so i came up with a new query using audit on alter user and grant and revoke role:
Creating a system event DDL trigger for alter user statement
What i used was a join between dba_users and dba_audit_trail, like i said in the other thread, it's not the efficient query ever, but it works, and i think it should work just fine as long as our dba's keep purging the audit tables regularly...
SELECT dba.USERNAME, DECODE(dba.PASSWORD, 'EXTERNAL', 'EXTERNAL', 'GLOBAL', 'GLOBAL', 'PASSWORD') PASSWORD, dba.EXTERNAL_NAME , dba.DEFAULT_TABLESPACE,
dba.ACCOUNT_STATUS, dba.TEMPORARY_TABLESPACE, dba.PROFILE,
(SELECT MAX_BYTES FROM DBA_TS_QUOTAS WHERE dba.USERNAME = USERNAME AND TABLESPACE_NAME = dba.DEFAULT_TABLESPACE) AS DEFAULT_TABLESPACE_QUOTA ,
(SELECT MAX_BYTES FROM DBA_TS_QUOTAS WHERE dba.USERNAME = USERNAME AND TABLESPACE_NAME = dba.TEMPORARY_TABLESPACE) AS TEMPORARY_TABLESPACE_QUOTA
FROM DBA_USERS dba , DBA_AUDIT_TRAIL aud
WHERE dba.username = aud.obj_name
AND aud.action_name not like 'DROP%'
AND ((aud.TIMESTAMP - TO_DATE('01011970','ddmmyyyy')) *24*60*60*1000) > :lastExecutionTime
UNION
SELECT dba.USERNAME, DECODE(dba.PASSWORD, 'EXTERNAL', 'EXTERNAL', 'GLOBAL', 'GLOBAL', 'PASSWORD') PASSWORD, dba.EXTERNAL_NAME , dba.DEFAULT_TABLESPACE,
dba.ACCOUNT_STATUS, dba.TEMPORARY_TABLESPACE, dba.PROFILE,
(SELECT MAX_BYTES FROM DBA_TS_QUOTAS WHERE dba.USERNAME = USERNAME AND TABLESPACE_NAME = dba.DEFAULT_TABLESPACE) AS DEFAULT_TABLESPACE_QUOTA ,
(SELECT MAX_BYTES FROM DBA_TS_QUOTAS WHERE dba.USERNAME = USERNAME AND TABLESPACE_NAME = dba.TEMPORARY_TABLESPACE) AS TEMPORARY_TABLESPACE_QUOTA
FROM DBA_USERS dba , DBA_AUDIT_TRAIL aud
WHERE dba.username = aud.grantee
AND ((aud.TIMESTAMP - TO_DATE('01011970','ddmmyyyy')) *24*60*60*1000) > :lastExecutionTime;
Thanks.