I want to create several rules:

1. Create users with the same CODE as SamAccountName in AD automatically when the AD accounts are digested in IGI and map them together. Right now when we connect AD, AD accounts are created, but not IDEAS users. How do we go about creating a needed rule and how do we run it? Do we need to create a post-mapping rule in read-from channel?
2. How do we go about making and running rule to delete a user who was not active in 3 months?

Sorry for the Delay. I just learned about this forum for IGI. I assume that you got your answer by now.

1.) If not, the basics are that you add a rule the Live Events->Target->Create Account rule flow. There are several default rules in the flow for matching the account to a user. You would write a rule that first looks to see if the user exists by one of the matching rules, or one of your own design. If there is no user, instead of allowing the last rule in the flow to create the account "Unmatched" you would Create the users first and then match the account. to the new user.

But it might be easier to create and HR Feed places new users in the USER_ERC table (the IN - USER Queue) and let IGI create the users from AD before the AD accounts are reconciled. This is the best practice for loading and managing users and matching accounts.

2.) I am not sure what you mean by "Active" user. I assume you mean they have not logged into their AD Account in over 3 months. For that, you would use an Advanced Rule that runs on a nightly IGI task to determine what we call Dormant accounts. This is basically checking the Last Login Date of an account and suspending the account, if it is the last login is more than 30 days. You can also suspend the Ideas account of the user, as well. You can delete users, but that is not usually the best practice.

David Kuehr-McLaren

IBM Security Expert Labs

1. Typically customers will have an HR feed that creates IDEAS accounts. When the AD sync takes place, it will match the AD account with the IDEAS account. If you want IDEAS accounts created when AD accounts are imported, it will likely require a good deal of work building out custom rules. You may want to inquire with IBM Services to see if this is possible.
2. Similarly, this will require custom rules in order to detect user inactivity/last login and then suspend or remove that user. This also would be something that IBM Services or a business partner should be able to help you with.

In general, the reason customers use an HR feed to create/load IDEAS users is because AD often contains service accounts or 2nd user accounts with admin permissions etc that you wouldn't necessarily want IDEAS accounts created for. Just something to consider...

Regards,

-Jensen

What would you recommend as the best practice in the second case?