OIM 9.1 DB Recon Changes Locked Account status in OIM back to Provisioned

Question

Hi,
I have a scheduled task that runs the OIM DBAccessReconTask but am seeing some unexpected behavior. Here are the steps to produce the error:
1. Provision a DB account to a user in OIM (this creates an account in the target database and the account shows in the user's resource profile with a status of "Provisioned")
2. Disable the DB account in OIM from the User's Resource profile screen (this successfully disables the account in the database and changes the account status to "Disabled")
3. Run the DBAccessReconTask
4. After the DBAccessRecon task completes the status of the DB account in the database is still disabled but in OIM on the user's resource profile screen it is marked as "Provisioned"
I did not expect this to be changed to provisioned in OIM since it is disabled in the database. Has anyone seen similar issues when running the DBAccessReconTask or know a way to fix this?

Answer 1

Hi Suren,
Thanks for the reply. Originally I thought your solution would work but after analyzing it closer there is a more fundamental problem we are having with the DBReconTask. We only want the reconciliation to take place going from OIM to the database and not vice versa (i.e. changes to an account in OIM should be pushed to the database but not from the database to OIM). However, currently if a change is made in the database (a role is added, the profile is changed, etc...) and the DBReconTask is run then it will be updated in OIM. Do you know how this can be achieved? These are the properties we currently use when creating the task:
Properties props = new Properties();
props.put("Target System Login Recon - Resource Object name:", ro.getName());
props.put("Target System User Recon - Resource Object name:", ro.getName());
props.put("Trusted Source Recon - Resource Object name:", "Xellerate User");
props.put("Server", itResource.getName());
props.put("Record Size", "ALL");
props.put("isTrusted", "NO");
props.put("DBName", "nodata");
props.put("ExcludeSystemUsers", "nodata");
props.put("ReconcileLockedUser", "YES");
props.put("Login Name", "nodata");