Lock flag in individual abap system but IDM unlocks it at night

[Former Member]

In our main production ABAP client, a user gets locked out after 3 failed password attempts. But IDM comes in overnight and doesnt recognise that the account has been locally locked and unlocks the account.

Any one come across this ?

Should I run a nightly job before the IDM sync to update IDM with the locked flag status ? But then what about the other ABAP clients in production that are not locked ?

Thanks

(SAPIDM 7.1 SP4)

[Former Member]

Hi Phil,

There are 2 solutions:

1.

Yes, you should use an "Update ABAP User" administration job scheduled to update IDM with local ABAP information.

You can use "delta" to have good performance on this kind of job.

Then, when updating ABAP SU01 user definition, IDM will not unlock user due to password failed.

2.

Split your Update User provisioning task into 2 tasks/jobs. One updating general informaiton (as Firstname, Lastname, phone numbers ....) trigged by modify user for example,

and a other one for connexion settings with locks (admin and password failed), SNC, ... called by web UI or specific updates.

Benjamin