Termination threshold (userImport.termUserLimit) not working as expected

[kunal_saxena]

We have to requirement to set a threshold on number of terminations that can occur through user import. User import will happen via DB connection and job - UserImportFullJob / UserImportJob

We are attempting to use the property - userImport.termUserLimit to set the threshold. This property is present in externalconfig.properties file.

For testing purpose, we applied the following changes:

• Set the userImport.termUserLimit to 1
• Inactivated 2 users using CSV user import (setting statuskey to 0)

After executing the CSV user import, both the users got inactivated. Since the userImport.termUserLimit was set to 1, we were expecting for only 1 user to be inactivated.

Following is what we could find in the logs:
2023-10-19T17:41:57+05:30-ecm-worker-2023-10-19T12:11:56.621308665Z stdout F 2023-10-19 12:11:56,621 [quartzScheduler_Worker-10] DEBUG saviynt.ImportExternalDbService - User Termination Limit = 1
2023-10-19T17:41:57+05:30-ecm-worker-2023-10-19T12:11:56.621339765Z stdout F 2023-10-19 12:11:56,621 [quartzScheduler_Worker-10] DEBUG saviynt.ImportExternalDbService - Number of users terminated 1 are higher than the configured 1 value for Terminated user limit
2023-10-19T17:41:57+05:30-ecm-worker-2023-10-19T12:11:56.650083045Z stdout F 2023-10-19 12:11:56,650 [quartzScheduler_Worker-1] DEBUG saviynt.ImportExternalDbService - User Termination Limit = 1
2023-10-19T17:41:57+05:30-ecm-worker-2023-10-19T12:11:56.650102345Z stdout F 2023-10-19 12:11:56,650 [quartzScheduler_Worker-1] DEBUG saviynt.ImportExternalDbService - Number of users terminated 1 are higher than the configured 1 value for Terminated user limit
2023-10-19T17:41:49+05:30-ecm-2023-10-19T12:11:48.916487615Z stdout F 2023-10-19 12:11:48,916 [http-nio-8080-exec-3] DEBUG ws.Restfulv5Controller - Default max limit is set to 50
2023-10-19T17:41:46+05:30-ecm-2023-10-19T12:11:45.844667914Z stdout F 2023-10-19 12:11:45,842 [http-nio-8080-exec-10] DEBUG ws.Restfulv5Controller - Default max limit is set to 50
2023-10-19T17:41:42+05:30-ecm-2023-10-19T12:11:41.71432181Z stdout F 2023-10-19 12:11:41,714 [http-nio-8080-exec-7] DEBUG ws.Restfulv5Controller - Default max limit is set to 50
2023-10-19T17:41:37+05:30-ecm-2023-10-19T12:11:36.665370778Z stdout F 2023-10-19 12:11:36,665 [http-nio-8080-exec-5] DEBUG ws.Restfulv5Controller - Default max limit is set to 50
2023-10-19T17:41:33+05:30-ecm-2023-10-19T12:11:32.783512091Z stdout F 2023-10-19 12:11:32,783 [http-nio-8080-exec-9] DEBUG services.ImportSAvDataUserService - terminateuserviaconfig before calling terminateuser - false
2023-10-19T17:41:33+05:30-ecm-2023-10-19T12:11:32.783515291Z stdout F 2023-10-19 12:11:32,783 [http-nio-8080-exec-9] DEBUG services.ImportSAvDataUserService - Not calling terminateuser since terminateuserviaconfig=false

2023-10-19T17:41:33+05:30-ecm-2023-10-19T12:11:32.78347399Z stdout F 2023-10-19 12:11:32,783 [http-nio-8080-exec-9] DEBUG services.ImportSAvDataUserService - Number of Users inactivated = 2

2023-10-19T17:41:33+05:30-ecm-2023-10-19T12:11:32.401675158Z stdout F 2023-10-19 12:11:32,401 [http-nio-8080-exec-9] DEBUG services.ImportSAvDataUserService - terminateuserviaconfig = false
2023-10-19T17:41:33+05:30-ecm-2023-10-19T12:11:32.398080739Z stdout F 2023-10-19 12:11:32,398 [http-nio-8080-exec-9] DEBUG services.ImportSAvDataUserService - Setting Zero Day Limit = 100
2023-10-19T17:41:33+05:30-ecm-2023-10-19T12:11:32.39808914Z stdout F 2023-10-19 12:11:32,398 [http-nio-8080-exec-9] DEBUG services.ImportSAvDataUserService - Setting User Termination Limit = 1

Is there any configuration that needs to be implemented in order for userImport.termUserLimit to work as expected?

I can see in the logs that terminateuserviaconfig is set to false. How can we set it to true, to check if this is affecting the configuration?

Thanks,

Kunal

[Dhruv_S]

Hi @kunal_saxena 

Could you please test with the below field in user import job and confirm. 

User Terminate Limit

Use this parameter to specify the threshold limit for terminating users. If the number of users set for termination exceeds this value, the operation is aborted and no users are terminated.

Reference documentation

Importing Users using the User Import Job (saviyntcloud.com)

Regards,
Dhruv Sharma
If this reply answered your question, please accept it as Solution to help others who may have a similar problem.

[rushikeshvartak]

Use User import job and add limit 

[kunal_saxena]

Hi @Dhruv_S @rushikeshvartak ,

Thank you for your replies. Will test using this configuration and update with my observations.

Thanks,

Kunal

[samarth]

Tried this just now, this setting didn't work. I set "User Terminate Limit" as 1 and there were 2000 terminated users from import. The job completed successfully. Screenshot below. Note that our Status Config is blank. We can setting the user status from Modify User Data JSON. Can you please help? @rushikeshvartak @Dhruv_S 

[rushikeshvartak]

after external config file changes did u restarted the server ?

[kunal_saxena]

Hi @Dhruv_S @rushikeshvartak ,

I have configured the user import job with job type = User Import via a Connection. Had set the User Terminate Limit = 1.

When I run the job, it finishes within a minute. The status is success, however, I am unable to access the results of the job execution, i.e., how many users created/updated etc. 

When I run the user import via another job with job type - Users Import (Complete) from Database (UserImportFullJob) using the same DB connection, then the job runs for a significant amount of time and gives the results, i.e., how many users created/updated etc. 

Can I use the User Import via a Connection job type for a DB connection? OR do I need to use Users Import (Complete) from Database (UserImportFullJob) job type?

[Dhruv_S]

Hi @kunal_saxena 

As per the documentation, job with job type Users Import (Complete) from Database (UserImportFullJob) is used to import users from DB connector.

Please refer the below documentation for more details.

Job Categories for Flat Job Control Panel (saviyntcloud.com)

Configuring the Integration for Importing Users (saviyntcloud.com)

Regards,

Dhruv Sharma

[kunal_saxena]

Hi @Dhruv_S , Thanks for your reply. If that is the case, how do I implement termination threshold when we are importing users using Users Import (Complete) from Database (UserImportFullJob) job type?

As I mentioned earlier, userImport.termUserLimit in externalconfig.properties file is not working as expected.

FYI - Users Import (Complete) from Database (UserImportFullJob) job type does not have the User Terminate Limit option 

(This option is available in User Import via a Connection job type) 

Thanks,

Kunal

[Dhruv_S]

Hi @kunal_saxena  

Thanks for reaching out.

Configuration to limit the number of users is set either in one of the three places.

1. ImportJob level
2. Externalconfig.properties file 
3. Connector level configuration (Importuser  Json/XML)

1. ImportJob level
Users Import (Complete) from Database (UserImportFullJob)  doesn't have the term limit parameter in the jobs. Hence this approach is not applicable for the DB connection.

2. Externalconfig.properties file 
Please re-test this scenario by updating the termUserLimit parameter and restart the services. While running the job, please capture the logs and see if it is picking the correct value from externalconfig.

3. Connector level configuration (Importuser  Json/XML)
Although DB connector documentation doesn't mention the termlimit parameter in Importsettings. You can try once the below in lower environment.

Please go to DB connection from Admin->Identity Repository->Connections- Select the DB connection you are using for this. Go to USERIMPORT and go to <importsettings> section in the XML mentioned there. Add <termUserLimit>1</termUserLimit>  in importsettings.

<importsettings>
.......
<termUserLimit>1</termUserLimit>
.....
</importsettings>

Regards,
Dhruv Sharma

[kunal_saxena]

Hi @Dhruv_S , I tried the Connector level configuration (Importuser  Json/XML) suggested by you. Updated termUserLimit in UserImport XML:

<importsettings>
<zeroDayProvisioning>true</zeroDayProvisioning>
<generateEmail>false</generateEmail>
<userNotInFileAction>NOACTION</userNotInFileAction>
<checkRules>true</checkRules>
<buildUserMap>false</buildUserMap>
<generateSystemUsername>false</generateSystemUsername>
<userReconcillationField>USERNAME</userReconcillationField>
<termUserLimit>1</termUserLimit>
</importsettings>

I ran the User Import from DB (Full Import) job and more than 1 user got inactivated.

[Dhruv_S]

Hi @kunal_saxena 

The above screenshot is showing terminated users as 0 and inactivated users as 72473.

The term limit configurations should limit the user terminations.

Could you please also check the below configuration as whether the termination through import is even enabled?

Regards,

Dhruv Sharma