OIM 11g - Reconciliation of Target Resource Status

Question

Hi,
We're working with OIM 11.1.1.5.2 and connectors DBUM 9.1.0.4 and MSAD 9.1.1.7.
Provisioning and reconciliation seem to be working correctly, but we found that the status of the resource is not getting reconciled on OIM console.
For example, if we provision an user with an Oracle Database account, and then lock the account on the database, when we run reconciliation the event is generated and finished with "update succeded", we go to the UD_DB_ORA_U table and find that the field UD_DB_ORA_U_LOCK has a "LOCKED" value, then if we check the logs we can see that the connector is correctly mapping the resource status with the OIM object status:
prepareTargetUsersRecordInOIMFormat : record value : LOCKED
prepareTargetUsersRecordInOIMFormat : map : {OPEN=Enabled, 1=Disabled, YES=Disabled, 0=Enabled, EXPIRED & LOCKED=Disabled, NO=Enabled, LOCKED=Disabled}
prepareTargetUsersRecordInOIMFormat : roValue : TEMPORARY_TABLESPACE_QUOTA
prepareTargetUsersRecordInOIMFormat : Temp RO value : null
prepareTargetUsersRecordInOIMFormat : reconData : [{Default Tablespace=27~USERS, Authentication Type=PASSWORD, Password=Dummy, Default Tablespace=27~USERS, Authentication Type=PASSWORD, Password=Dummy, Default Tablespace Quota=, Profile Name=27~USUARIOS, IT Resource=Oracle, User Name=USPRUEBA65, Temporary Tablespace=27~TEMP, Account Status=LOCKED, Status=Disabled, Global DN=, Privilege List=[], Role List=[{Role Admin Option=NO, Role Name=}], Temporary Tablespace Quota=}]
prepareTargetUsersRecordInOIMFormat:: FINISHED
But, even though the reconciliation has succeded the administrative console shows the account on "Enabled" status, and when I check the OIU table i can see that the OIM object status is still enabled.
I found some threads related to this issue, the most similar was this one: Reconciliation for the deleted user accounts on Target Resource but everything there do not seem to be of much help because all tasks described are already done by the connector installation (at least in msad and dbum connectors).
This problem is happening both for Active Directory and Oracle Database Users, maybe we're missing something but based on the documentation for both connectors we thought it was an OOTB functionality. Is there some system property or connector parameter we need to configure to make this work?
Thanks.
Edited by: fmc on Jul 26, 2012 12:53 PM

Answer 1

Hi Pallavi,
Well, you were right after all, we were mixing 2 totally different problems here and it got us confused.
The problem with the DBUM connector was exactly what you said, a bug in the connector, just needed to modify the connector task object to status mapping. We were checking the Reconciliation Update Received task on AD and we thought it would be the same, and it was obviously not. Well, in this case teh recon event was being generated but nothing happened, after we changed the process task it worked like a charm.
On the other hand, the problem with the AD reconciliation was that our search filter on the recon job was configured to ommit accounts with the disabled status (!(userAccountControl=66050)), it was certainly a silly problem, never thought we had that in the filter (it's a huge filter and we didn't pay attention to that clause the first time around) but everything is working now, thanks!