That's a great catch - and thanks for confirming that behaviour. You're absolutely right: in MAS 9.1 and later, user entitlement logic has shifted away from explicit USER.ENTITLEMENT mapping toward Security Groupβbased classification, which MAS now uses to determine App Points and license usage dynamically.
The OSLC query still references user.entitlement for backward compatibility, but that property is no longer required or even populated in non-entitlement setups. This is exactly why removing it from the oslc.select clause resolves the query failure.
For others following this thread - if you're upgrading from 8.10 β 9.1 and seeing MASPERUSER or OSLC errors, you can safely omit that field when exporting or importing users. MAS will automatically assign App Points based on Security Groups once the sync runs.
Looking forward to your full field mapping update once you finish the 560-user load - that'll be extremely valuable for anyone automating user onboarding in MAS 9.1.
Original Message:
Sent: Thu September 11, 2025 06:39 AM
From: Brett Coleman
Subject: MAS 9.1 MASPERUSER and Import Users
That's what I expected. Is there a way to modify the OSLC urls directly in MAS or Openshift? Our problem appeared out of the box after upgrading to version 9.1 and in 9.1.1. I've searched through most of the object structures and the database looking for fields and columns related to that entitlement field, but haven't found anything so far.
------------------------------
Brett Coleman
Original Message:
Sent: Wed September 10, 2025 09:08 AM
From: David Miller
Subject: MAS 9.1 MASPERUSER and Import Users
I have actually figured this out but will post once I have done the full load of my 560 users. I have been able to push in a few samples and see them end up in Mongo and Manage. The most important thing I forgot and IBM does not mention is that Entitlements are no longer needed in 9.1. MAS determines the user classification by the Security Groups it is assigned and you do not need to pick a class or App Points to assign, its all; done for you. So, this is why you should not need entitlement in your URL. I will post a follow up with the columns I used when I have fully done my load.
------------------------------
David Miller
Managing Partner - Maximo Consultant
Enterprise Integration Partners LLC
Original Message:
Sent: Wed September 10, 2025 07:26 AM
From: Brett Coleman
Subject: MAS 9.1 MASPERUSER and Import Users
Hi David,
I'm commenting to follow this post. We're experiencing issues with our OSLC MASPERUSER query when opening the Users application in Maximo 9.1.
The Problem: When the app opens, this query runs and fails:
https://<clusterurl>/maximo/oslc/os/masperuser?oslc.select=personid,user.userid--userid,user.userid,user.status,user.isauthorized,user.entitlement,user.massyncstatus,user.owner,primaryemail&oslc.pageSize=20&oslc.where=user.userid="*"&oslc.orderBy=+personid&searchAttributes=personid,user.userid,primaryemail&collectioncount=1&ignorecollectionref=1&relativeuri=1&addschema=1&requestType=AUTO&lean=1&internalvalues=1&checkesig=1
Workaround Found: We can access user details using this URL, but it's not practical for daily use:
https://<clusterurl>/maximo/oslc/graphite/masuser/index.html?ids=<user_id>#/userdetailsedit
Root Cause: When I remove the user.entitlement parameter from the URL, we get our user data back successfully.
Impact: This has completely blocked our upgrade progress because we've lost the ability to update user passwords, entitlements, etc. We're a small organization and don't use LDAP or any special authentication setup.
Additional Notes:
- According to the documentation, entitlement can only be set when creating new users and by using security groups.
- I've had a support case open with IBM for 60+ days with no resolution
- IBM support seems to be struggling to identify the cause
I'm hoping someone in the community has encountered this issue and found a solution. What is your process like for bulk exporting users and reimporting them? Sorry I don't have more constructive feedback to your specific issue, but I have no problem experimenting on my end and circling back with you.
Thanks,
Brett
------------------------------
Brett Coleman
Original Message:
Sent: Tue September 09, 2025 09:13 AM
From: David Miller
Subject: MAS 9.1 MASPERUSER and Import Users
Struggling with Bulk User Imports in MAS 9.1?
It looks like IBM has changed how bulk user imports work between MAS 9.0 and MAS 9.1-and not for the better.
In MAS 9.0, there was a straightforward template we could use for user imports. But with MAS 9.1, that template no longer works. Instead, IBM now requires us to export existing data (using the MASPERUSER object structure) and then re-populate a sheet that mirrors that extract. The problem? There's little to no documentation on how this process is supposed to work.
The old template had 42 columns, which was manageable. The new extract has 132 columns-and there's no clear guidance on which fields are actually required to successfully import users. To make matters worse, there are multiple columns for emails, multiple columns for status, and the overall structure feels messy.
Even more concerning: I can't find any fields that handle Entitlements, App Point assignments, or related access settings. If those aren't included, that raises serious questions about how to properly configure new users in bulk.
So my question to the community is this:
π Has anyone successfully imported users in MAS 9.1 using this new process?
π If so, which columns did you include, and how did you handle App Point / Entitlement assignments?
Would really appreciate any insight or examples that could save others from hours of trial and error.
------------------------------
David Miller
Managing Partner - Maximo Consultant
Enterprise Integration Partners LLC
------------------------------