Documentation: iSeries Username Assignment & Update-Username Function

Summary

This issue documents how iSeries usernames are assigned during provisioning workflows and how the Update-Username PowerShell function works for comprehensive username changes across all IAM systems.

---

Part 1: iSeries Username Assignment Process

Overview

When an MA_OS or MA_APP account is requested through the XMLAOProvisioning workflow, the iSeries username is generated by the ps_Attribute_iSeries_ProfileName stored procedure.

Username Generation Priority

The stored procedure checks these sources in order:

| Priority | Source | Description |
|----------|--------|-------------|
| 1 | ps_HistoricalLookup | Check if user previously had an iSeries account |
| 2 | Profile.TAOAnswer04 | Check if iSeries username already stored |
| 3 | Profile.CustomAttrStr5 (AD Username) | Use first 10 chars of AD username |
| 4 | Generate New | Create new username using collision rules |

Username Generation Rules (Collision Handling)

If no existing username is found, the stored procedure generates one:

| Rule | Pattern | Example |
|------|---------|---------|
| 1 | LEFT(FirstInitial + LastName, 10) | MGARCIA |
| 2 | LEFT(First + Second Initial + LastName, 10) | MAGARCIA |
| 3 | LEFT(First 3 Initials + LastName, 10) | MARGARCIA |
| 4 | LEFT(LastTry, 9) + Number | MGARCIA2, MGARCIA3, ... MGARCIA999 |

Collision Check

Each generated username is checked against three sources:

• IdentityMap - Existing user mappings
• SubRequestItem - Pending provisioning requests
• ps_vw_Mapping_Account - Account mapping view

Data Flow

Request Submitted
       ↓
ps_Attribute_iSeries_ProfileName (generates username)
       ↓
Profile.TAOAnswer04 (stores username)
       ↓
ps_HistoricalLookup (audit record with AttributeName='iSeries_Profile')
       ↓
SubRequestItem (Username field populated)
       ↓
IBM-OS400-V4R5 Adapter (provisions account)
       ↓
IdentityMap (records MA_OS/MA_APP mapping)

iSeries Target Systems

| TargetID | System | Purpose |
|----------|--------|---------|
| MA_OS | Manhattan Associates OS | iSeries user profile |
| MA_APP | Manhattan Associates WMS | Application account |
| MA_EU_OS | European MA OS | EU iSeries profile |
| MA_EU_APP | European MA WMS | EU application account |
| RLM_OS | RLM OS | RLM iSeries profile |
| RLM_APP | RLM Application | RLM app account |
| JDA_OS | JDA OS | JDA iSeries profile |
| JDA_APP | JDA Application | JDA app account |

---

Part 2: Update-Username Function

Purpose

The Update-Username function performs comprehensive username changes across all IAM systems when a user needs their username modified.

Location

D:/Scripts/Modules/Courion/Public/Update-Username.ps1

Parameters

| Parameter | Required | Description |
|-----------|----------|-------------|
| ProfileUID | Yes | 8-digit IAM Profile UID |
| NewADUsername | Yes | New AD sAMAccountName (e.g., 'MGarcia6') |
| NewiSeriesUsername | No | New iSeries username (defaults to uppercase AD username) |
| NewUPN | Yes | New UserPrincipalName (e.g., 'Maria.Garcia6@MichaelKors.com') |
| TargetID | No | AD domain (default: AD) |
| RemoveOldADAccount | No | Switch to remove old AD account |
| ResubmitISeries | No | Switch to resubmit iSeries requests |
| WhatIf | No | Preview changes without executing |

What It Updates

Step 1: Profile Table

Updates these columns:

• CustomAttrStr5 → AD username
• TAOAnswer02 → UPN
• TAOAnswer04 → iSeries username
• Email → Email address (same as UPN)

Step 2: ps_HistoricalLookup (Audit)

Creates records for all 4 tracked attributes:

• AD_AccountName
• AD_Prewindows2000LogonName
• AD_userPrincpleName
• iSeries_Profile

Also updates existing historical records to maintain consistency.

Step 3: IdentityMap

Updates username mappings for:

• AD target (e.g., AD, AD_KC)
• EXCH (Exchange)
• AzureAD

Step 4: iam.Staging_AD

Updates:

• sAMAccountName
• userPrincipalName

Step 5: Active Directory (Direct)

If AD account exists:

• Updates UPN via Set-ADUser
• Updates DisplayName via Set-ADUser
• Renames CN via Rename-ADObject

Step 6 (Optional): iSeries Resubmission

If -ResubmitISeries switch is used:

• Clears iSeries IdentityMap entries
• Resets SubRequestItem status to "Ready"
• Executes iam_ProcessNonAutomatedRequests

Example Usage

# Preview changes (recommended first)
Update-Username -ProfileUID '03579668' -NewADUsername 'MGarcia6' -NewUPN 'Maria.Garcia6@MichaelKors.com' -WhatIf

# Full execution with AD removal and iSeries resubmission
Update-Username -ProfileUID '03579668' -NewADUsername 'MGarcia6' -NewiSeriesUsername 'MGARCIA6' -NewUPN 'Maria.Garcia6@MichaelKors.com' -RemoveOldADAccount -ResubmitISeries

Audit Trail

The function creates comprehensive audit records in:

• ps_HistoricalLookup - For each attribute changed
• dbo.Ticketing - For each action taken

Important Notes

1. Workflow Reset Issue: The XMLAOProvisioning workflow may recalculate UPN from stored procedures. Step 5b directly updates AD to ensure correct values persist.

1. Historical Record Updates: The function updates existing ps_HistoricalLookup records to maintain data consistency.

1. Collision Check: The function validates that the new username is not already in use before proceeding.

1. WhatIf Support: Always run with -WhatIf first to preview changes.

---

Related Documentation

• Workflow: XMLAOProvisioning
• Stored Procedure: dbo.ps_Attribute_iSeries_ProfileName
• Resubmission Guide: docs/workflows/iSeries-Request-Resubmission-CONSOLIDATED.md
• Function: Invoke-iSeriesRequestResubmit (for targeted resubmissions)

---

Labels

• documentation
• IAM
• iSeries
• username-management