Assign business role to thousands of users.

[Former Member]

Hello experts.

I need your expert assistance. I'm using IDM 72SP5. What is the way to go about assigning a business role to about 100k users. The business role contains technical privileges to various abap\business suit clients. No approval required. Does anyone have a script to share or some kind of a headway? I tried creating a job with script but strugglling so far.

Thanks.

[Former Member · Accepted solution]

Hello Peter,

Just one last question on the scripts, the pass should be a "To Identity Store" right. Thanks.

[Former Member · Accepted solution]

Hi Fernandez

Definitely.  To IdStore.  Also make sure you set the correct entry type (MX_PERSON) or you might get issues...

Peter

[Former Member · Accepted solution]

Thank you so much again Peter.

I tried it and it worked well. I appreciate your help immesely.

[Former Member]

Hi Fernandez

A little more information is required - specifically, how are you identifying the users you want to assign it to?  A simple job would be easy enough if there was some way to identify them from their IDM data.

With that many users you'll need to use a Job rather then an IDStore task.

Peter

[Former Member]

The users are already in IDM with unique MSKEYVALUE.

[Former Member]

Alternatively, I could have users listed in a spreadsheet/csv file.

[Former Member]

Is it all users?  If so, a job with:

SELECT distinct mcvalue FROM idmv_vallink_basic_active WHERE mcattrname='MSKEYVALUE' AND mcidstore = %gbl.SAP_MASTER_IDS_ID% AND MSKEY IN (SELECT mskey FROM idmv_vallink_basic_active WHERE mcattrname='MX_ENTRYTYPE' AND mcvalue = 'MX_PERSON')

This should select all active users.

The Destination is:

MSKEYVALUE   %mcvalue%

changetype  modify

MXREF_MX_ROLE  {A}<rolename>

That should do the job.  You can keep adding clauses to the SQL select to get the right set of users

Peter

[Former Member]

Peter,

Thanks for this script. i'll play around with it. No, it's not all the user. it's a about 100K users already in IDM. User provided in a spreasheet. Trying to assign same role in IDM that grants ABAP privileges.

[Former Member]

In that case, just read the users in using a From ASCII pass to a temporary table.

Then use SELECT identifier FROM temptable

with the same destination pass:

MSKEYVALUE   %identifier%

changetype  modify

MXREF_MX_ROLE  {A}<rolename>

[Former Member]

Peter,

Thanks much. i'll update you of my outcome.

[Former Member]

I see this is answered but I want to add this anyway for future searchers that end up here:

To find entries its quicker and more efficient to use the idmv_entry_simple view, example:

select

mcmskeyvalue from idmv_entry_simple where mcEntryType = 'MX_PERSON'

and mcIdStore = %glb.SAP_MASTER_IDS_ID%

(idmv_vallink_<> views are joins between multiple tables while idmv_entry_<> has no joins)

And if on SQL Server add WITH(NOLOCK) to queries used in the source of passes that write to IDStore to avoid issuing a shared lock when reading the entry you'll update on the destination pass. Especially important when using idmv_vallink... or other views that access MXI_VALUES.

[Former Member]

Thanks much Per,

I tried this and it lit up my face.