UNSAccountBHasUNSItemB

Question

After disabling an user account in UNSAccountB we need than all assigned Items would be deactivated for the account (of course if we re-activate the user all items must be restored)). It seems "XIsInEffect" in UNSAccountBHasUNSItemB does it, but it is read-only and can not be changed. How to do it?

Markus Weiss-Ehlers · Accepted Answer

The account definitions do not handle the removal of directly assigned UNSAccountBHasUNSItemB entries OOTB. If the UNSItemB entries are assigned via UNSGroupB items, the removal of the group memberships would remove the UNSItemB memberships as well. 
 The only solution I can see currently - without changing the way you are assigning the data is to do the following: 
 
 Attention 
 This is for experienced users only. If you are uncomfortable with changing or creating SQL procedures please refrain from doing so. 
 If you still do, have a fresh backup at hand and test this thoroughly in your dev. environment before implementing this into your production environment. 
 
 You could take the procedure TSB_ZUNSAccountBHasUNSItemB and create a custom version of it CCC_ZUNSAccountBHasUNSItemB . 
 By duplicating the algorithm from TSB_ZUNSAccountBInUNSGroupB that uses dbo.TSB_FGIUserInGroupValid to check the flags implement your wanted custom behavior for UNSAccountBHasUNSItemB. 
 The new procedure CCC_ZUNSAccountBHasUNSItemB needs to be put into QBMDBQueueTask instead of TSB_ZUNSAccountBHasUNSItemB as ProcedureName . 
 Be aware that this change is not safe for migration. Means, after migrating the database you need to re-apply the changes in QBMDBQueueTask. We do have an open enhancement request that would make such changes in QBMDBQueueTask untouched during the migration but this is not implemented yet.

Trevor Pike · Answer

Hello,

You may want to investigate Account Definitions and how to put those to use. See https://support.oneidentity.com/technical-documents/identity-manager/8.0.2/administration-guide-for-connecting-to-custom-target-systems/17#TOPIC-1017828 for more.

But I assume you mean assigned items to the Employee, correct?

Trevor