Users not inactivated after changing userReconcillationField in DB connector

[IDAM09]

Hi,

We are importing users via DB connector in Saviynt. In the first roll-out the userReconciliation field was "username" - during which the users were getting inactivated when those corresponding records where missing in the view - as expected.

However, due to some requirements - we updated the userReconciliation field to another unique field and since then the users are still Active in Saviynt even though those user records are missing in the view.

Appreciate if any one could help resolve or share any ideas to fix the issue.

Thanks.

[CR]

add below on in ThresholdConfig try it.

{
"statusAndThresholdConfig": {
"accountThresholdValue": 50,
"statusColumn": "customproperty12",
"activeStatus": [
"true","TRUE","True"
],
"deleteLinks": false,
"correlateInactiveAccounts": true,
"inactivateAccountsNotInFile": "true"
}
}

and try it below if not added in your xml

<userNotInFileAction>NOACTION</userNotInFileAction>

[IDAM09]

@CR Thanks for the quick response. 

We are facing the issue with User/Identity inactivation. Not Account inactivation.

The User Import xml already has this value set <userNotInFileAction>INACTIVATE</userNotInFileAction> 

[CR]

can you try like below

<userNotInFileAction>NOACTION</userNotInFileAction>

[IDAM09]

@CR The requirement is to Inactivate if the user is missing in the file.

[IDAM09]

The Global config is Enabled and we are on 24.1 version.

The same configuration is working in the lower environment. However, issue persists only in production. Trying to analyse if the change in userReconciliation field has caused this issue and if so how to rectify the same.

Thanks.

[RJswarup]

After changing the user recon field from username to some other unique field, do you still have the username mapping on the json?, If not then have the username mapping and try to do user import again with the other unique attribute as the recon field.

[IDAM09]

@RJswarup We do have the mapping for username in the json. And the recon attribute is the other unique field.

<mapfield saviyntproperty="username" sourceproperty="username" type="character"></mapfield>

[rushikeshvartak]

Please share full xml

<importsettings>
<zeroDayProvisioning>false</zeroDayProvisioning>
<userNotInFileAction>NOACTION</userNotInFileAction>
<checkRules>true</checkRules>
<generateEmail>false</generateEmail>
<userReconcillationField>username</userReconcillationField>
<buildUserMap>false</buildUserMap>
</importsettings>

[IDAM09]

<importsettings>
<zeroDayProvisioning>true</zeroDayProvisioning>
<generateEmail>true</generateEmail>
<userNotInFileAction>INACTIVATE</userNotInFileAction>
<checkRules>true</checkRules>
<buildUserMap>false</buildUserMap>
<generateSystemUsername>false</generateSystemUsername>
<userReconcillationField>employeeid</userReconcillationField>
</importsettings>

[rushikeshvartak]

                    <userNotInFileAction>InactivateUserOnly</userNotInFileAction>

[rushikeshvartak]

From Release v 23.11, you can also do the following:

• Specify the value of the userNotInFileAction tag as InactivateUserOnly. When you specify this value, the status of existing users not present in the HR system is changed as Inactive instead of terminating them and creating a Revoke Access task. This option does not terminate users although the User Termination from Imports configuration is enabled under Admin > Global Configurations > Identity lifecycle > OFFBOARDING.

• https://docs.saviyntcloud.com/bundle/Database-v24x/page/Content/Configuring-the-Integration-for-Impo...

[IDAM09]

Select InactivateUserOnly to change the status of existing users not present in the HR system as Inactive instead of terminating them and creating a Revoke Access task in EIC. This option does not terminate users although the User Termination from Imports configuration is enabled under Admin > Global Configurations > Identity lifecycle > OFFBOARDING.

We would want to Inactivate and terminate along with revoke access.

[rushikeshvartak]

Does this configuration worked ? Please share job configurations

[IDAM09]

The logic works in non-prod. However, the users were imported with the "employeeid" as the recon field. But in prod, the users were first imported with username and then the recon field was changed.

Job configured is "Users Import (Complete) from Database (UserImportFullJob)"

[rushikeshvartak]

Please share job config screenshot

[IDAM09]

[rushikeshvartak]

It seems issue with XML . Please share full XML

[IDAM09]

Sorry, I wouldn't be able to share the full xml.

<dataMapping>
<sql-query description="This is the Source DB Query" uniquecolumnsascommaseparated="username,employeeid">
<![CDATA>
</sql-query>
<importsettings>
<zeroDayProvisioning>true</zeroDayProvisioning>
<generateEmail>true</generateEmail>
<userNotInFileAction>INACTIVATE</userNotInFileAction>
<checkRules>true</checkRules>
<buildUserMap>false</buildUserMap>
<generateSystemUsername>false</generateSystemUsername>
<userReconcillationField>employeeid</userReconcillationField>
</importsettings>
<mapper description="This is the mapping field for Saviynt Field name">
<mapfield saviyntproperty="username" sourceproperty="username" type="character"></mapfield>
<mapfield saviyntproperty="firstname" sourceproperty="firstname" type="character"></mapfield>
<mapfield saviyntproperty="lastname" sourceproperty="lastname" type="character"></mapfield>
<mapfield saviyntproperty="statuskey" sourceproperty="status" type="character"></mapfield>
<mapfield saviyntproperty="middlename" sourceproperty="middlename" type="character"></mapfield>
<mapfield saviyntproperty="employeeid" sourceproperty="employeeid" type="character"></mapfield>
</mapper>
</dataMapping>

[rushikeshvartak]

<sql-query description="This is the Source DB Query" uniquecolumnsascommaseparated="username">