Source: projects/identity-management/oim-kb-update/runs/2026-04-27-14.md
> Source: projects/identity-management/oim-kb-update/runs/2026-04-27-14.md
OIM KB Update — Run 2026-04-27 (14)
Goal
- Make the “entitlement becomes shop-visible” mechanism concrete at DB level:
- which entitlement tables carry IT Shop flags
- which link tables / views connect entitlements to IT Shop nodes
- what is currently populated in the sandbox
What I did
- Live sandbox DB (SELECT-only):
- Listed
ITShopOrgHas*views andBaseTreeHas*link tables. - Enumerated which entitlement tables contain
IsForITShop/IsITShopOnly(and whereAccProduct.IsToHideFromITShoplives). - Counted how many
BaseTreeHasADSGroup/BaseTreeHasESet/BaseTreeHasQERReuserows currently point into the IT Shop subtree. - Sandbox host (WinRM read-only):
- Confirmed
BaseTreeHasESet/ITShopOrgHasESetare shipped in QER module content dumps (no AutoPublishESetparameter hit in the scanned files).
Findings (new/confirmed)
- DB shape: “IT Shop availability” is not just the entitlement flags. The placement into the shop structure is modeled with
BaseTreeHas<type>link tables, exposed asITShopOrgHas<type>views. - System roles are first-class IT Shop candidates:
ESethasIsForITShop/IsITShopOnly, and the schema shipsBaseTreeHasESet+ITShopOrgHasESet. - Current sandbox state: the IT Shop structure is populated with
QERReuseplacements (BaseTreeHasQERReuse= 10 in subtree), but noADSGrouporESetplacements exist inQER-V-ITShopOrgyet (both 0).
Evidence
- Live DB:
projects/identity-management/oim-kb-update/sandbox-db/2026-04-27-itshop-entitlement-link-tables-db-evidence.md - Host artifacts (existing, updated earlier today):
projects/identity-management/oim-kb-update/sandbox-host/2026-04-27-itshop-file-hints.md
Open questions / next experiment ideas
- What is the smallest supported UI/API operation that creates
BaseTreeHasADSGroupand/orBaseTreeHasESetrows (or otherwise results in newPRnodes) after enabling AutoPublish for the entitlement type? - Does OneIM create
BaseTreeHas<type>links directly onBOshelves, or only onPRproduct nodes, and then derive the product nodes via DBQueue?