How do you resync idpusers, when the onbase users have been deleted\deactivated and recreated?

[Thomas_Reu]

Occasionally we have a user corruption issue in onbase.  This is easily solved by deleting the onbase user via the config tool and letting the clients' next login recreate the user from active directory (AD).  This works great for Unity, Web and Thick Client.  However, if you do this and the client has an idp client, then idp goes out to lunch, for that user, since idp still wants to use the old deactivated account.   

From a tech point of view, if you open the db table:  hsiidp.idpusers, you'll notice the scim_user_id is still using the old/deactivated usernum from the hsi.useraccount table rather than the new usernum, from the recreated user.   Since IDP is using the old deactivated account, it generates the obvious error: "Failed to connect.  User xyz-<oldid > (DEACTIVATED )does not belong to any groups.

Enabling  "User Provisioning Create Enabled" and\or "User Provisioning Update Enabled" is ignored. 

Is there another flag, I can set, that allows onbase users to resync with IDP or do we have to contact our FLOS\Hyland to to delete the record in the idpusers table, so the user can be recreated correctly, or is there another solution?

Regards

[AdamShaneHyland]

Hi @Tom ,  

Likely you'll need to work with support on this. 

OnBase Config does not have any concept of the HSIIDP schema used by the Hyland IDP.  The hsiidp.IdpUsers table is used to map a unique ID from SAML to a user in OnBase.  If you delete the user in OnBase Config, the hsi.useraccount table will be updated to deactivate in the user account table.  I believe the hsiidp.IdpUsers table should be updated with the appropriate usernum in OnBase.

If this is not what you are seeing, please contact your FLOS. 

Best wishes.

[Nelson_Porrata1]

Hi Adam,

I see that this exchange is from a year ago. A year later, if we have the same problem, do we still need to contact our FLOS\Hyland to take care of this or is there currently another solution for this?

Best regards,

[Thomas_Reu]

Thanks Adam.  I already have a ticket open with our FLOS.  I was hoping this might just be a config issue that could easily be resolved with a community post.  Based on your response, this does not appear to be the case.  Thanks for the clarification.  

[AdamShaneHyland]

No problem @Tom .

Good luck.