ImportTechnicalAccountsFromCSVExecutor

Long Running Task (LRT) that bulk-creates or updates Technical Accounts in CzechIdM by reading a semicolon-separated CSV file. Each CSV row represents one technical account. The task maps configurable column names to entity fields, supports dry-run mode, and never triggers unintended provisioning operations on existing accounts.

1. The task reads the attached CSV file line by line (first line = header).
2. For each data row it looks up an existing Technical Account by the value in the identifier column (matched against externalId).
3. Depending on whether the account exists and which behaviour flags are set, the account is created, updated, or skipped.
4. Optional columns assign identity/role guarantors, link the account to a provisioning system, and associate it with a Technical Asset.
5. All item-level results are written to the LRT task log.

Each parameter value is the exact name of a column in the CSV header (case-sensitive).

read identifier from identifiercolumn
  └─ find existing TechnicalAccount by externalId = identifier
       ├─ NOT FOUND + cancreate = false  →  skip (counter++)
       ├─ NOT FOUND + cancreate = true   →  create new account
       ├─ FOUND + canoverwrite = false   →  skip, log CSV_IMPORT_ACCOUNT_SKIPPED
       └─ FOUND + canoverwrite = true    →  update account fields

(after save)
  ├─ assign identity guarantors  (directidentitycolumn)
  ├─ assign role guarantors      (guaranteerolecolumn)
  ├─ assign technical asset      (technicalassetcodecolumn, only when canchangeta = true)
  └─ link provisioning system    (systemcolumn + mappingcolumn)
       ├─ NEW account  →  find or create AccAccount, create TechnicalAccountAccount link
       └─ EXISTING account
            ├─ AccAccount found by uid  →  create link if missing
            └─ AccAccount NOT found     →  log warning, skip (no provisioning triggered)

directidentitycolumn and guaranteerolecolumn can contain multiple values separated by the multi-value separator (default |). Whitespace around each value is trimmed.

Example cell value:

jnovak|pdvorak|mmaly

Each value is resolved independently. Values that cannot be resolved are skipped with a warning.

The system-linking step runs after the Technical Account is saved so that it always has a valid database ID.

The technicalassetcodecolumn column is only processed when canchangeta = true. When canchangeta = false the column is ignored even if it is present in the CSV and a matching Technical Asset exists in the system.

The task supports CzechIdM's built-in dry-run flag. When dry-run is enabled:

• No Technical Accounts are created or updated.
• No guarantors are assigned.
• No AccAccounts or TechnicalAccountAccount links are created.
• New accounts are not logged — because no entity is persisted there is no object to attach a log entry to. Only accounts that already exist in the system (updates/skips) produce item-level log entries.
• Would-be operations are written to the application log at INFO level (prefix [DRY-RUN]).
• The task counter still increments so you can verify the row count.

Only identifier and code columns — no system, guarantors, or asset.

identifiercolumn;codecolumn
svc-api-gateway;SVC_API_GATEWAY
svc-db-reader;SVC_DB_READER
svc-batch-runner;SVC_BATCH_RUNNER

Task configuration:

identifiercolumn;codecolumn;descriptioncolumn;validfromcolumn;validtillcolumn;systemcolumn;mappingcolumn;directidentitycolumn;guaranteerolecolumn;technicalassetcodecolumn
svc-ldap-reader;SVC_LDAP_READER;LDAP read-only service account;2024-01-01;;CMS AD - Users;AD users provisioning mapping tech.;jnovak|pdvorak;role-ldap-admin|role-infra-team;ASSET-001
svc-db-backup;SVC_DB_BACKUP;Database backup service account;2024-01-01;2026-12-31;CMS AD - Users;AD users provisioning mapping tech.;mpolak;role-dba;ASSET-002

Task configuration: