Unable to set MX_INACTIVE = 1 on a user in a To Identity store pass

[jonathon_sells3]

We are using a To Identity store pass to add the MX_INACTIVE attribute to a user id that is a MX_PERSON entry type.

We get the following error:

Exception from Modify operation:com.sap.idm.ic.ToPassException: ToIDStore.modEntry failed modifying entry 't_employee22'. IDStore returned error message: " Not possible to inactivate entries of this entry type. Only identities can be set inactive:Attribute: MX_INACTIVE" when storing attribute 'MX_INACTIVE=1'

We can see in the DB that the user is a MX_PERSON entry type.

Any suggestions would help.

Regards,

Jon Sells

NOTE: We are on IDM 7.2 SPS 8 on DB2 10.1

[jonathon_sells3]

Thanks Tero and Matt for your suggestions. I undrestand what you mean now. We tried unchecking that box and using the MSKEY. Still no luck.

We even tried hard coding an MSKEY as well as trying the same for an MSKEYVALUE into the destination tab with same errors.

Given the fact that we cant even perform this using the check box in the UI, we are going to create a customer message with SAP.

I will update the findings when we resolve.

[jonathon_sells3]

[terovirta]

If the "use identity store" option is ticked then your query must (AFAIK) return a column called MSKEY with valid mskey(s).

Try "select mcMSKEY as MSKEY from..."

regards, Tero

[jonathon_sells3]

as for a) the tab mapping is already using "mskeyvalue=%mskeyvalue%". See that attached screen shot in my first posting.

item b) throws a different set of errors when sending the mskey

putNextEntry failed storing1133786

Exception from Modify operation:com.sap.idm.ic.ToPassException:
ToIDStore.modEntry failed updating entry '1133786'. IDStore returned error
message: "Entry does not exist" when fetching entry

[terovirta]

Your first post/screenshot has "mskeyvalue=%mcmskeyvalue%" mapping.

regards, Tero

[former_member2987]

Hi Jon,

As Former Member mentioned, please turn off the use identity store option and run it that way.

Thanks,

Matt

[terovirta]

If you tick the "use IdStore" in source-tab the runtime will load the entry from IdStore by using the MSKEY you supply in the source selection criteria, so the destination-tab must use IdStore attributes like mskeyvalue in the attribute-mapping.

(With the "use IdStore" option the runtime seems to require only that there is a column with heading MSKEY in the result set, so you can state "select 12345 as MSKEY from.." If you have 12345 as MSKEY then the entry is fetched for processing, if you don't have then the query won't return anything and basically nothing happens / no errors are returned.)

If you want to run a query that does not return MSKEY but for example mcMSKEYVALUE, then you should not tick the "use IdStore" option but define the DB URL instead. Easiest is to use the "%ddm.identitycenter% constant. Then you use the columns returned by your SQL statement in the destination mapping NOT the IdStore attributes.

I am not sure whether this fixes your issue but since you have a conflict (IMO) between the source and target tabs, this should be fixed first.

regards, Tero

[terovirta]

Can you share the source tab?

What happens if you would:

a) change the destination tab mapping with "mskeyvalue=%mskeyvalue%"

b) change the query in source tab to return "mcMSKEY as MSKEY" instead of mcMSKEYVALUE and tick the "use id store" option.

regards, Tero

[siarhei_pisarenka3]

Check also that MX_PERSON is set as Identity, to be on safe side.

[jonathon_sells3]

Thank you for your prompt response, but yes that is checked as well.

Jon Sells

[jaisuryan]

Hi Jon,

Are you writing to the correct identity store? i.e in your case, identity store with id=1.

Does the issue replicate when you try to assign MX_INACTIVE=1 to other users as well?

Kind regards,

Jai

[jonathon_sells3]

Hi Jai,

Yes we checked that. The attribute MX_INACTIVE is already allowed for MX_PERSON.

Hi Siarhei,

Yes the id t_employee22 is an entry type MX_PERSON. I show a screen shot in the first posting.

Regards,

Jon

[siarhei_pisarenka3]

Hi Jonathon

Please check entry type of your entry with MSKEYVALUE = "t_employee22". I could be that this particular entry is not MX_PERSON, but MX_GROUP or whatever else. That would be the reason when you could not modify it.

select * from idmv_entry_simple (nolock) where mcMSKEYVALUE = 't_employee22'

BR

Siarhei

[jaisuryan]

Hi Jon,

Open MX_INACTIVE attribute, go to "Entry Types" tab and select allow checkbox for MX_PERSON.

Let me know if it worked. Thanks.

Kind regards,

Jai

Message was edited by: Jai Suryan

[jonathon_sells3]

Please note we are also unable to set in the UI.

Unable to set value for attribute Inactive. Detailed information (may not be translated): Cannot set entries of this entry type as inactive; only identities can be set as inactive.

Regards,

Jon Sells