203 Lotus blogs updated hourly. Who will post next? Home | Blogs | Search | About 
Latest 7 Posts
Domino 10 – to be continued!
Mon, Nov 6th 2017 15
IBM Connections 6 – Following and Followers blank
Wed, Oct 25th 2017 5
Exchange integration into WebSphere Portal (SSO – Kerberos)
Tue, Sep 26th 2017 9
User provisioning for IBM Connections Cloud – You have the choice
Mon, Aug 28th 2017 7
SAML & IBM Connections 5.5 – not a dream team
Fri, Aug 18th 2017 9
IBM Docs – Migration from DB2 –> ORACLE
Fri, Jul 7th 2017 6
IBM Connections – trouble adding additional nodes
Wed, May 31st 2017 8
Top 10
Configuration of secret key storage in WebSphere Application Server
Thu, Mar 12th 2015 19
DB2 Instance autostart does not work on SLES 12 / RHEL 7
Tue, Jul 12th 2016 15
Domino 10 – to be continued!
Mon, Nov 6th 2017 15
IBM Connections Docs – file preview not possible for some CCM pdf files
Thu, Nov 17th 2016 14
WebSphere custom TAI – Doing SSO the right way
Tue, Sep 6th 2016 13
IBM Connections 5 CR2 – Atom feed changes
Mon, Jun 22nd 2015 11
SAML – Enterprise SSO in the WebSphere world
Mon, Jul 20th 2015 11
HTTP Outbound authentication via SAML
Tue, Oct 6th 2015 11
Security Bulletin: Vulnerabilities in Apache Struts affects IBM WebSphere Application Server (CVE-2016-1181 and CVE-2016-1182) (2016.06.28)
Tue, Sep 13th 2016 11
IBM Connections vulnerability – fixes for CVE-2014-3004 / CSVV in detail
Tue, Mar 3rd 2015 9

Using TDI to inactivate orphaned users after X-days
Twitter Google+ Facebook LinkedIn Addthis Email Gmail Flipboard Reddit Tumblr WhatsApp StumbleUpon Yammer Evernote Delicious
Julius Schwarzweller    

Using TDI to inactivate orphaned users after X-days

Hi all,

at IBMConnect I had several discussions if it is possible to automatically inactivate users that did not use IBM Connections for a specific time. The answer is yes – it is possible and we already had this customer requests.

I want to share how to write a simple assembly line that does this job.

Imagine you use the external feature and there are partners that only use the system once and then never again. You do not want to have your Connections wasted with thousands of orphaned profiles…

One way is to delete those users from LDAP (or remove a sync flag). But this is far too much effort and manual work.

The other way is to let TDI make this work for you.

The idea is to look into the profiles database (there is the table “PROFILE_LAST_LOGON” that always gets updated with the current date if you login any of the IBM Connections features) and check the date when the user logged into the system for the last time. Then you need to compare this with a desired “no logon limit”. If the user is beyond this date inactive the account in IBM Connections and remove sync flag and Password from LDAP (this would be only possible if the LDAP is not used for something else).

So especially for external users this makes absolutely sense to have an automation for this process.

Let`s see how I solved this:

First of all I created a property file to hold several properties that might change. As we use this assembly line in combination with our user manager, I called this property file UserManager.properties:


  • days_nologin_limit –> specify the amount of inactive days, the account should get inactivated
  • ldap_lc_attr –> If you use a flag to synchronize users you can specify this here (e.g. description=ic)
  • ldap_password_attr –> I want TDI to remove the password from LDAP when the user gets inactive
  • source_ldap_user_login –> LDAP user with write access
  • source_ldap_user_password –> Password for LDAP user with write access
  • sync_employee_column –> database cloumn that is used for synchronising (could be also email or guid)
  • sync_ldap_attr –> ldap attribute used for synchronising users between LDAP and database (could be also email or guid)

Now we start a new assembly line



The iterator creates a database connection to the profiles database (What ever feature you use to login the profiles database table PROFILE_LAST_LOGIN always gets updated with a new timestamp)


we query the EMPINST schema and table PROFILE_LAST_LOGIN

As PROFILE_LAST_LOGIN only contains the PROF_KEY which is not readable or useable in combination with your LDAP, we need to do a joined database query:



SELECT e.{property:UserManager.sync_employee_column} as profile_uid, p.prof_last_login as last_login 
from EMPINST.employee e join  EMPINST.PROFILE_LAST_LOGIN p on e.prof_key = p.prof_key 
WHERE days(current date) - days(p.prof_last_login) > {property:UserManager.days_nologin_limit}
AND e.prof_mode=1

The query uses properties from its own property store (I explained it before). In this example, only external users are taken into account (you could change or remove prof_mode to also include internal users)

A script “log_and_set_attributes” is created


This script removes the content of the LDAP attribute used for synchronizing (e.g. you only synchronize users that have a flag “description=ic” set in LDAP). Furthermore the password attribute used in LDAP is overwritten with an empty value.

The LDAP connector “disable_user_in_ldap” uses the above attributes and writes empty strings into the sync attribute and the password field (removing the LDAP password is optional).

For this connector we use a custom shortcut to make use for the flexible attribute settings in the properties file:disableExt5

Now you can wait until “sync_all_dns” inactivates the user. Or use the profile connector to directly inactivate the corresponding user.

You can directly download the assembly line and the property file disableExtUsers

You might need to change some directory settings when you directly import the AL.

I hope you like it 😉

Feb 09, 2016
5 hits

Recent Blog Posts
Domino 10 – to be continued!
Mon, Nov 6th 2017 8:48a   GIS Techblog
Welcome to the first post about IBM Domino on our GIS AG Techblog! Here at GIS AG, we have a dedicated IBM Domino team made up of certified specialists for everything from development, to administration, support and beyond. On this blog we will be sharing the latest news and technical information about IBM Domino. If you have any questions or comments, please, feel free to write an Email to: frederik.potyka@gis-ag.com Visit our About Us page! Domino  10 – This year Notes and Domino 9.0
IBM Connections 6 – Following and Followers blank
Wed, Oct 25th 2017 8:42a   GIS Techblog
IBM Connections 6 – Following and Followers blank Hi, during the last weeks we had to deal with a strange problem in an IBM Connections 6 environment. The system was migrated from IC 5.5 to IC 6 and live for about 4 weeks when suddenly the following problem occurred: Neither users that I follow nor followers were shown in the UI. Despite installing the latest Fixes no bigger changes have been performed on the system. I was able to follow a user: Looks good: Then opening “Following
Exchange integration into WebSphere Portal (SSO – Kerberos)
Tue, Sep 26th 2017 12:03p   GIS Techblog
Exchange integration into WebSphere Portal (SSO – Kerberos) During the last years working with Portal I had several challenges with WebSphere Portals HTTP Outbound Proxy (aka. Ajax Proxy) in terms of authenticating backend calls to various other systems. What we`ve done so far in terms of SSO / backend authentication: – Authenticating using LTPAToken – Authenticating using SAML – Authenticating using SPNEGO / Kerberos (this was a new one for me) The challenge this time
User provisioning for IBM Connections Cloud – You have the choice
Mon, Aug 28th 2017 1:42p   GIS Techblog
User provisioning for IBM Connections Cloud – You have the choice Customers who use IBM Cloud for Connections, Sametime or other applications face the problem to manage their cloud accounts. For some single users you can use the Web frontend to add or change user accounts or to assign subscriptions and licenses to users. But in real world scenarios it is not possible to manage thousands of users manually or to keep them synchronized with an on-prem user repository or LDAP. This can be handled
SAML & IBM Connections 5.5 – not a dream team
Fri, Aug 18th 2017 7:45a   GIS Techblog
Hi all, last week we had to fight with an activation of SAML on a IC 5.5 CR3 environment. The setup was: IBM Connections 5.5 CR3 as test instance ADFS Server 3.0 (I know… it is only tested with ADFS 2.0 – but works with 3.0 too) We followed the instructions from the IBM Connections Knowledge Center. Smooth setup everything standard procedure. When testing this setup, the redirect to the IdP was initiated. After logging into the IdP the browser was redirected to IBM Connections ACS
IBM Docs – Migration from DB2 –> ORACLE
Fri, Jul 7th 2017 9:52a   GIS Techblog
IBM Docs – Migration from DB2 –> ORACLE Hi, within our last big project, we had the challenge to transfer the IBM Docs database from DB2 to ORACLE. Within this database comments and other document related data is stored. Officially there is no script available to perform this move using DBT (remove constraints / transfer / reapply constraints). We looked into the database and figured out how to perform this task using DBT – so we are not dependent on any other products. We m
IBM Connections – trouble adding additional nodes
Wed, May 31st 2017 2:52p   GIS Techblog
IBM Connections – trouble adding additional nodes Hi all, we are currently involved in a project where we installed a 1 node IBM Connections 6 Cluster and later added a second node to the cell. So far so good… Everything that needs to be done after adding the second node is described here … Everything? Yes, mainly… but not in the mandatory details as I think! Missing custom properties and other settings might result in non-functional nodes. Especially not setting httpSess
SNOUG 2017 Presentation – SikaConnect goes External
Thu, Mar 23rd 2017 1:06p   GIS Techblog
SNOUG 2017 Presentation – SikaConnect goes External Hi all, yesterday I was at SNouG in Zurich. I had a great time there – good speakers and a overall perfectly organized event (would we expect sth. else from Switzerland? ) Raymond Weber from SIKA Informationssysteme AG and I did a session about the SIKA Extranet Feature:
Whiteboard in IBM Sametime Meeting 9.0.1 removed
Fri, Mar 17th 2017 10:43a   GIS Techblog
Whiteboard in IBM Sametime Meeting 9.0.1 removed IBM implemented in Sametime Meeting 9.0.1 a whiteboard function as technical preview. Ben described in his articel how to enable this feature: https://collaborationben.com/2016/05/20/whiteboard-in-sametime-9-0-1/ With the current cumulative Fix 901-ST-General-FP-SMOL-AK4G43  for the Meeting Server IBM has removed this function. The response on my PMR was: “I can confirm The Meetings Whiteboard feature release is being put on hold indefinitely.
Wikis content not accessible…
Thu, Jan 26th 2017 10:54a   GIS Techblog
Wikis content not accessible… Hi, it`s been quite a long time; many projects at the moment so that blogging needs to wait Last week we had a very interesting problem at one customer’s environment. When accessing a Wiki, the page was displayed blank – no content was available. Browsing to older versions of this wikis worked. The error in the log: Parsing error… Wikis content (the body) gets store in the filesystem as xml files. If you access a Wiki there is a XML parser

Created and Maintained by Yancy Lent - About - Planet Lotus Blog - Advertising - Mobile Edition