Role Definition Import Failure Due to Invalid eTORAUserLocked Value

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

When importing role definitions in Identity Manager, the process may fail with a "Value 'U' not found in boolValues (Unlocked / Locked)" error. This issue occurs when account template data, specifically from older product versions, contains deprecated or invalid character values in the eTORAUserLocked attribute.

Environment

Identity Manager 14.x

Cause

The error is caused by invalid values ("L" or "U") stored in the eTORAUserLocked attribute. The Identity Manager data dictionary expects boolean-mapped values ("Locked" or "Unlocked").

Resolution

To resolve this issue, all affected account templates must be updated to the valid "Unlocked" status. You can apply this change either manually or by using the etautil command-line utility.

Option 1: Command-Line (Mass Update) Use the etautil utility to perform a mass change on all account templates within your container:

1. Open a command prompt on the Provisioning Server.
2. Run the following command (replace USER and PASSWORD with your credentials):

   etautil -u USER -p PASSWORD masschange 'eTORAPolicyContainerName=Oracle Policies,eTNamespaceName=CommonObjects' eTORAPolicy eTORAPolicyName=* to eTORAUserLocked='Unlocked'

Option 2: Manual Update If you prefer not to perform a mass change, you can manually navigate to each affected Oracle Account Template via the Provisioning Manager and ensure the eTORAUserLocked attribute is set to Unlocked.

 

Important Note Always test these changes in a non-production environment before applying them to your production environment.