ecently, one client reported one odd issue that some users with Lock status in CA PPM are auto flipped to Active status over night. A close investigation reveals the root reason because of the ODUM delink call limitation.
A user only has Active and Inactive status in Portal, but it has Active, Lock and Inactive status in CA PPM. When a user is Lock status in CA PPM, the user in Portal will be Active. Let us say that one user has Lock status in DEV, TEST and PROD CA PPMs while its status is Active in Portal. If you only want to delink the user from PROD in Portal, you have to make an ODUM delink call with below piece to maintain its existing associations with DEV and TEST:
<odum:appInstances>
<urn:item>Development</urn:item>
<urn:item>Testing</urn:item>
</odum:appInstances>
Unfortunately, the above ODUM delink call will trigger a process in Portal, called “Portal User Synch” to auto synchronize the user status between Portal and CA PPMs on DEV and TEST. As a result, you will see that the user status on DEV and TEST is updated from LOCK to ACTIVE automatically.
There is no solution for the issue now, and the best practice is not to run delink call on DEV and TEST in order to maintain the user status on PROD.