How to run process step not under computer account?

The thing is, that you are using "Windows Integrated Authentication" in your connection to the SQL Server as configured in DialogDatabase. But your job server is using the system account to start and therefore uses the machine account in the SQL Server connection.

Option 1: Use a different service account to start the Job Service that has proper database access. (Be aware that changing the user, invalidates the Job Service connection configuration (and private key storage) and you have to re-create these).

Option 2: Configure an Application Server connection for this Job Service in Designer.

The thing is, that you are using "Windows Integrated Authentication" in your connection to the SQL Server as configured in DialogDatabase. But your job server is using the system account to start and therefore uses the machine account in the SQL Server connection.

Option 1: Use a different service account to start the Job Service that has proper database access. (Be aware that changing the user, invalidates the Job Service connection configuration (and private key storage) and you have to re-create these).

Option 2: Configure an Application Server connection for this Job Service in Designer.

Hi Markus!

Thanks for the fast reply. I know regarding option 1 and this is definetly, will not suit in my case.

How can I configure an Application Server connection for this Job Service in Designer? Where I can read regarding this topic?

And one more question - am I right that there is no way to switch to any system user inside the parameters of the process step by changing AuthenticationString?

The documentation describes how to use an application server for process generation.

https://support.oneidentity.com/technical-documents/identity-manager/8.1.2/configuration-guide/44#TOPIC-1368649

But be aware that SQL job cannot be executed of this connection.

In regards to your second question, why do you need to switch users?

Regarding second question - just want to understood, is there a way to put any system user to pass its credentials during DataImport process like when starting data import tool under regular account for script preparation.

Theoretically, yes. But not interactively of course.

Thank you, I'll try option 2. What does it mean - SQL job cannot be executed of this connection? Data import can't be executed? I need just to create a service categories and service items from a sap systems and roles.

It means that pure SQL operations, like the ones coming from the SQLComponent are not runnable on this \Queue.

Hmm, such scenario does not suit too, unfortunately =(( At this point, from my understanding, I need to discover how to run ScriptComponent - DataImport under another user. OIM service is running under Local system on all of the servers which we have, returning us to Option 1, which is only remain available.

What is your issue with option 2?

Markus Weiss-Ehlers said:

It means that pure SQL operations, like the ones coming from the SQLComponent are not runnable on this \Queue.

All of SQLComponents can't be executed in this \queue, but i think that we have some processes which contain mentioned component and they will try to be started in this \queue