Return
-
Title
Locked users out of sync between Lotus Notes and Dell One Identity Manager -
Description
When you lock a user in Identity Manager, it performs the following actions:- D1IM changes the type of the person document in the target system from "PERSON" to "<Prefix>PERSON" as configured in the config parameter "TargetSystem\Notes\MailBoxAnonymPre". This is done so Notes Administrator hides the user from Person Views.
- D1IM prefixes the name and the mail address in the target system with the same configuration parameter, but without a rename in order to preserve the ID file. This is done so Lotus Notes hides the user from address lists.
- D1IM places the user in a deny access group as configured in "TargetSystem\Notes\DenyAccessGroups". These groups are added to the Deny Access list of all server documents.
In case of any mismatches between Identity Manager and Lotus Notes, no lock or unlock operation is performed in either direction. -
Cause
Lotus Notes does not have a unique account locking property. This means that NotesUser.AccountDisabled does not have a unique matching property in the target system and because of that it is not part of the mapping. Moreover, any customer could have chosen to implement a different locking mechanism, making it impossible for the fullsync task to recognise a locked account programmatically with absolute certainity. -
Resolution
In case of any mismatches of account locking between Identity Manager and Lotus Notes, you may have to resolve them manually. However, properties and group memberships are still synchronised even for locked users, so a possible solution for some customers might be to implement processes on INSERT and DELETE events for NotesUserInGroupTotal for a certain subset of groups.