Re: User to position reconciliation in IDM

Hi Matt

Thanks for the response, appreciated. Yes you are right, hopefully the following describes the scenario clearer. In this scenario IDM and position based security are implemented together;

Scenario:

1. 1.       Existing SAP landscape being managed by CUA with direct provisioning

1. 2.       IDM implemented to replace management of the SAP landscape

1. 3.       Position based security introduced at the same time

1. 4.       User ID’s are defined as the users first initial and surname by IDM script

1. 5.       IDM UI configured to show users HCM data

1. 6.       The initial read job in IDM pulls in all users from all SAP clients

1. 7.       New users are driven out of HCM to IDM, user ID is created and the 105 record populated with the users ID

In this scenario I have two distinct groups of users, the new users being created by IDM are associated with their HCM data and this data is available to view in IDM UI, all good.

For existing users that were not created via IDM, IDM has read their User ID during the initial read job when no HCM data was available for the user.

Now the user ID is assigned to HCM via the 105 (Manual process)

The problem;

IDM knows of an existing user e.g. JBOND. When the user is assigned to their 105, IDM has no interaction with the users HCM data so does not know to update the data for JBOND with any HCM data. So in the UI JBOND does not show any HCM data.

If I run the HCM extract for this users position IDM wants to create User ID JBOND. The ID already exists but IDM does not know that the existing ID JBOND is the same person that it is trying to create.

I could delete JBOND from SAP and then have IDM re-create the ID again from HCM output but I expect this is overkill and there is a simpler solution that I am missing.

Does this all make sense?

Thanks

Barry