Source: projects/identity-management/oim-kb-update/runs/2026-04-27-claude-1.md

> Source: projects/identity-management/oim-kb-update/runs/2026-04-27-claude-1.md

OIM KB Update — Claude Run 1 (2026-04-27)

Goal

Fill the remaining gap in the IT Shop KB: the concrete minimal sequence to manually

publish a synced ADSGroup as a requestable item in the IT Shop.

Sources

• Sandbox DB OneIM on im.sandbox.local — SELECT-only queries
• No DML performed, no sandbox host file access needed

Queries Run

1. AccProduct — all 55 columns with nullability + defaults

2. ADSGroup IT Shop-relevant columns (IsForITShop, IsITShopOnly, UID_AccProduct)

3. ADS_TUAdsGroup trigger definition (IsForITShop section)

4. QER_PIsForITShopFlagCheck procedure definition (first 3000 chars)

5. ITShopOrgHasADSGroup view definition

6. BaseTreeHasADSGroup column schema

7. Seeded sandbox BO shelves (Sandbox Applications / Business Roles / Dist. Lists / System Role Bundles)

8. Seeded sandbox AccProductGroup UIDs

9. Confirm QER_PITShopProductNodeCreate and QER_PITShopProductNodeCreate_b both exist

Key Findings

AccProduct minimum INSERT

Only UID_AccProduct + XObjectKey are NOT NULL; everything else nullable or defaulted 0.

Ident_AccProduct + UID_AccProductGroup are strongly recommended but not enforced.

ADS_TUAdsGroup trigger

• IsForITShop/IsITShopOnly change → QER_PIsForITShopFlagCheck('AdsGroup', ...)
• UID_AccProduct change → QBM_PJobCreate_HOUpdate_B 'ITShopOrg' (refreshes existing PR nodes)

QER_PIsForITShopFlagCheck

Validates flag consistency using BaseTreeHasADSGroup join to BaseTree. Key rules:

• Setting IsForITShop=0 while group is placed in IT Shop shelf → RAISERROR
• Setting IsForITShop=1, IsITShopOnly=1 while also in non-IT-Shop BaseTree node → RAISERROR
• No BaseTreeHasADSGroup rows → flag can be set freely (no error)

Seeded sandbox objects confirmed (live DB)

BO shelves: 4 rows in BaseTree with ITShopInfo='BO', parented under QER-ITSHOPORG-DELEGATION-SH.

AccProductGroup: 4 rows (Sandbox Applications, Business Roles, Distribution Lists, System Role Bundles).

Minimal 5-step publish sequence

Documented in sandbox-db/2026-04-27-adsgroup-publish-sequence-db-evidence.md.

Also added as KB note section 8 in knowledge-base/oim-it-shop-structure-and-availability.md.

Target Questions Answered This Run

• "Which AccProduct columns must be populated?" → answered
• "What is the smallest valid SQL/API sequence to make a synced AD group requestable?" → answered
• "Which triggers/procs enforce IT Shop consistency?" → ADS_TUAdsGroup + QER_PIsForITShopFlagCheck detailed

Files Changed

• projects/identity-management/oim-kb-update/sandbox-db/2026-04-27-adsgroup-publish-sequence-db-evidence.md — new
• projects/identity-management/oim-kb-update/README.md — run link + answered questions marked ✅
• projects/identity-management/knowledge-base/oim-it-shop-structure-and-availability.md — new section 8
• coordination/journal.md — this run's entries