One Identity Manager 8.1.5 Unlock Active Directory Account via API

Question

I cannot find any documentation on how to do this. Trying to simply change the property to false does not work and I noticed in Manager there is a special task to unlock accounts. Is it possible to unlock a locked Active Directory Account via the API? If so - how?

Barry Jackson · Answer

Hi, 
 The issue you are facing may be that AccountLockedOut in OI is still false as a sync hasn't happened. Use SQLComponent - Execute SQL to fire an update command to set it to true. 
 Then you can use HandleObjectComponent - Update to set AccountLockedOut to false .... this will then provision to AD and unlock the account. 
 HTH, Barry.

joshua fellers_78468 · Answer

My solution in the end if it helps anyone. Based off your suggestion of setting it to true, then false. Might not be the best... but it works for me anyways. I call this from the API: 
 Public Sub CCC_UnlockAdAccount(ByVal UID_ADSAccount As String, ByVal ConnectionString As String) Dim conData As ConnectData = DbApp.Instance.Connect(ConnectionString) Using conData.Connection Dim cSQL As SqlExecutor = conData.Connection.CreateSqlExecutor(conData.PublicKey) cSQL.SqlExecuteNonQuery(String.Format("UPDATE ADSAccount set AccountLockedOut = 1 WHERE UID_ADSAccount = '{0}'", UID_ADSAccount)) End Using Dim ADSAccount As IEntity = Session.Source.Get("ADSAccount", UID_ADSAccount) Using uow = Session.StartUnitOfWork() ADSAccount.PutValue("AccountLockedOut", False) uow.Put(ADSAccount) uow.Commit() End Using End Sub

Markus Weiss-Ehlers · Answer

By looking at the processes at the Update event for the ADSAccount and digging down further to the unlock scripts, you have two options. 
 
 Option A: Set the connection variable UnLock_ForceSyncOf to AccountLockedOut using the REST API first. and then set the column AccountLockedOut to false. This forces the sync to use the value of AccountLocketOut even if it hasn't changed. 
 Option B: Check if AccountLockedOut is true, then just change it to false. If it is false, generate the UPDATE event for the ADSAccount while setting a parameter ForceSyncOf to AccountLockedOut

Endpoint Privilege Management

One Identity Manager 8.1.5 Unlock Active Directory Account via API