SAP IDM 7.2 - Suspending provisioning to a specific repository for a short period

[former_member297605]

Hi Experts

I have a requirement from my client to suspend provisioning to a specific SAP repository for a few hours while they take that SAP system down for some upgrade activities. They want provisioning to the other SAP systems to continue as normal so I cannot stop the dispatchers.

How can I accomplish this?

Please advise

Thanks

Ranjit

[jaisuryan · Accepted solution]

Hi Ranjit,

There are few ways but the best way to go depends on your system config.

Recently I got this scenario so I scrambled the host name constant in repository so that provisioning fail. Once the system is back, I reverted to correct host name and retry all failed entries using a job. (Alternative is to remove the hook tasks)

This is just one of many ways though. Let's see if anyone else good option for this scenario.

Kind regards,

Jai

[former_member297605 · Accepted solution]

Thanks Jai

I was thinking of removing the user defined in the repository which is used to connect to the backend system. I'm hoping this gives the same result of a provisioning failure. Then I can do a "retry" on the failed assignments when the system is back up.

Question, which table can I use to see the failed assignments for that repository?

Please could you also share the job definitions that you set up to retry the failed entries.

Thanks for your response.

Ranjit.

[jaisuryan · Accepted solution]

Hi Ranjit,

Scrambling, username or password or hostname etc in repository constants all yield the same result.

select mcThisMSKEY as UserMskey, mcOtherMSKEY as RoleMskey from idmv_link_simple_active where mcexecstatehierarchy = 5

Above SQL will give the Failed entries. Then use uIS_RepairEntry function to retry provisioning.

Kind regards,

Jai

[former_member297605 · Accepted solution]

Thanks Jai... will try that and advise how I get on.

[former_member297605 · Accepted solution]

Hi Jai

With the SQL statement you gave me above I'm not able to see the failed assignments for today.

I did some tests after scrambling the hostname and the assignment failed which is what I wanted.

But im not able to see that in the SQL table you gave me. I only want to be able to see failed assignments for a specific repository just for today. Is that possible?

Please advise.

[former_member297605 · Accepted solution]

Hi Jai

Further to my above response I have now gone with

as it seems to give the right data as per my testing.

[jaisuryan · Accepted solution]

Hi Ranjit,

All good if you were able to resolve it. The SQL i gave works in two of my systems. Not sure why not on yours. If you are not looking for anything else regarding this post, please close the thread. Thanks.

Kind regards,

Jai

[former_member297605 · Accepted solution]

Hi Jai

What is mcexecstatehierarchy = 5 ? I tried it with a 4 and that's when I got the right data.

What do these numbers mean?

Please advise.

Thanks

Ran

[terovirta · Accepted solution]

The statuses are explained behind this help link: Views for reference attributes and LinkExecState and LinkExecStateHier

[michaelfranke · Accepted solution]

Hi Jai,

hi Ranjit,

I have scrambled the hostname (1st try) and removed the hook task (2nd try). In both cases there was a failed job, but no entry in idmv_link_ext2 or idmv_link_simple_active.

Therefore I can not check afterward which identities are affected.

Any idea?

Thanks and best wishes

Michael

[jaisuryan · Accepted solution]

Hi Michael,

We need more information to figure out what would have happened.

So you did 2 separate tries, 1st with scrambled hostname and 2nd try with hook task removed? or just one try with both scrambled hostname and hook task removed?

When you remove the hook task, then the entries wouldn't fail. They would be marked successful.

Also which task failed and what is the SQL you used?

Kind regards,

Jai

[former_member297605 · Accepted solution]

Hi Michael

What are the details of the failed jobs. It should give you the MSKEY or MSKEYVALUE of the identity affected. From their you should be able to decipher who the affected identities are. You can also look at the job log > errors and sort by repository and pick the errors for the repository that you have scrambled the hostname for (from the time you scrambled it).

cheers

Ranjit

[michaelfranke · Accepted solution]

Hi,

the error log from 1st try (scrambled hostname):

Error log from 2nd try (removed hook task):

Thanks!

Michael

[former_member297605 · Accepted solution]

Hi

Can you try the below but change the like to your rep.

Sorry didn't get the full screenshot.

So select * and the below in the screenshot.

[michaelfranke · Accepted solution]

Hi Ranjit,

thanks for your help. The statement provides no information.

I have opened a SAP call, maybe the supoport can help us.

Thanks and best wishes

Michael

[michaelfranke]

Hi Jai,

yes, I did 2 seperate tries.

I tried in both cases to remove a privilege from ABAP system. The status switched from pending back to OK.

I used the following statements:

select mcThisMSKEY as UserMskey, mcOtherMSKEY as RoleMskey

from idmv_link_simple_active

where mcExecStateHierarchy != 1 and mcExecStateHierarchy != 512

select mcThisMSKEYVALUE as UserMskeyvalue, mcOtherMSKEYVALUE as PrivMskeyvalue, mcExecStateHierarchy, mcAddedTime, mcModifyTime

from idmv_link_ext2

where mcExecStateHierarchy != 1 and mcExecStateHierarchy != 512

BR

Michael