Managing DirX Identity Connectivity

Managing DirX Identity Connectivity consists of the following tasks:

  • Managing connected directories

  • Managing Provisioning workflows

  • Managing passwords

  • Managing DirX Identity servers

  • Managing the Connectivity system

The next sections give a brief overview of each of these tasks and provide introductory information about Java-based and Tcl-based DirX Identity component and Provisioning workflow configuration objects.

Managing Connected Directories

A connected directory represents all necessary information to access source or target systems correctly.We use the term connected directory for DirX Identity Connectivity and the term target system for DirX Identity Provisioning (see the DirX Identity Provisioning Administration Guide for more information).

Connected directory management consists of these tasks:

  • Setting up and maintaining the connected directory structure

  • Setting up and maintaining the authentication information (bind profiles)

  • Setting up and maintaining the schema and attribute configuration

Administrators carry out these tasks with the DirX Identity Manager.

Managing Provisioning Workflows

Provisioning workflows load data from source systems or update identities in source systems.They can also perform initial load, synchronization and validation on target systems.

Provisioning workflow management consists of these tasks:

  • Setting up and maintaining the scenario structure

  • Copying, changing and deleting workflows (including jobs for Tcl-based workflows)

  • Creating, changing and deleting schedules

Administrators carry out these tasks with DirX Identity Manager.

Note that you can copy workflows as a sub-task of the target system wizard when creating a new target system.See the DirX Identity Provisioning Administration Guide for more information.

Managing Passwords

The relevant topic for password management in the Connectivity views group is password synchronization.

Password synchronization consists of these tasks:

  • Setting up and maintaining the password scenario structure

  • Setting up and maintaining the password workflows

Administrators carry out these tasks with the DirX Identity Manager.

Note that you can copy workflows as a sub-task of the target system wizard when creating a new target system.See the DirX Identity Provisioning Administration Guide for more information.

Managing DirX Identity Servers

DirX Identity servers handle all automated tasks within the Identity environment.Server management tasks include:

  • Installing servers

  • Configuring and maintaining servers and services, including auditing and logging

  • Setting up maintenance scripts

Administrators carry out these tasks with DirX Identity Manager or with operating system-specific tools.

You can also set up distributed environments for DirX Identity servers to distribute the DirX Identity processing workload.Managing a distributed environment includes the following tasks:

  • Distributed installation of components; for example, servers

  • Maintaining the distributed Identity system

Administrators carry out these tasks with DirX Identity Manager or with operating system-specific tools.

Managing the Connectivity System

You may need to perform some additional tasks to run the Connectivity system with the Provisioning system.These Connectivity system management tasks include:

  • Managing administrative accounts

  • Setting up and maintaining the features that guarantee data security, including key management for data encryption and signature as well as the creation of secure connections

Administrators carry out these tasks with the DirX Identity Manager or with operating system-specific tools.

About Java-based Configuration Objects

Java-based configuration objects apply to the operation of all DirX Identity components that are relevant for Java-based Provisioning workflow operations.The following figure shows the main configuration objects for Java-based Provisioning workflows and their most important relationships.

Java-based Configuration Objects and their Relationships
Figure 1. Java-based Configuration Objects and their Relationships

The description of these objects given in the context-sensitive help for DirX Identity provides information about the standard properties assigned to the object that are supplied with DirX Identity.Some of the configuration objects - for example, connected directories - can be customized to support additional customer-specific properties.

Java-based configuration objects contain information about:

  • Scenario configuration objects: combine sets of connected directories and synchronization workflows and represent them graphically for a better overview and easier configuration.

  • Connected directory configuration objects that represent either source or target system instances including the Identity Store. Bind profiles hold the user and password information for a specific target system access. If you assign the connected system to a Java-based server, then this server runs the Java-based provisioning and import workflows.

  • Java-based workflow configuration objects that consist of activities: procedures that transfer data from source to target connected directories.

  • Java-based activity configuration objects: process steps that are combined to make a workflow. A Java-based workflow is built from a join and an error activity. The join activity is responsible for synchronizing the data between two connected systems. The error activity in event-triggered workflows receives just the entries that could not be provisioned and typically sends an email with the error information. The type of provisioning workflow and how the data are synchronized is determined by the controller configured in the join activity.

  • Java-based job configuration objects are not visible at the user interface level but they exist as part of the XML configuration files. They implement the activity; for example, a join operation or error handling.

  • Port configuration objects represent the access to a connected system for a workflow. Such a connected system might not only be a target system, but also the message broker and an email server. The port especially configures the connector to access the connected system. A provisioning port combines several channel configuration objects for all the object types that must be provisioned in or from the connected system.

  • Java-based channel configuration objects. A channel represents an object type or an object-to-object relation for a provisioning workflow to a connected system. Typical channels are for accounts and groups and for account-group memberships. A channel describes how to find objects of this type in the connected system, which attributes to read and write, and how to map them from the other connected system.

  • Schedule configuration objects that define when to run workflows.

These configuration objects refer to other configuration objects in the central configuration folder:

  • Connector type objects and the XML files that describe their presentation at the user interface level.

  • The Java-based Identity Servers (IdS-J servers) that run the workflows.

  • The server objects that refer to service and system objects to define important information for access.

  • The messaging service that allows for transferring Java Messaging Service (JMS) messages between DirX Identity components.

  • Resource family objects that allow for distributing provisioning activities over several Java-based Identity servers.

  • Topic configuration objects that define JMS message types.

Note: Some of these objects are marked with a red border and the text "This object might be shared because it belongs to the Configuration folder".Be careful when editing these objects because your changes can affect other objects, too.For details about the Configuration folder, see the topic "(Central) Configuration" in the context-sensitive help.

About Tcl-based Configuration Objects

Tcl-based configuration objects apply to the operation of all DirX Identity components that are relevant for Tcl-based Provisioning workflow operation.The following figure shows the main configuration objects for Tcl-based Provisioning workflows and their most important interrelationships.

Tcl-based Configuration Objects and their Relationships
Figure 2. Tcl-based Configuration Objects and their Relationships

The description of each configuration object given in the context-sensitive help for DirX Identity provides information about the standard properties assigned the object that are supplied with DirX Identity.Some of the configuration objects - for example, connected directories and jobs - can be customized to support additional customer-specific properties.

Tcl-based configuration objects contain information about:

  • Scenario configuration objects: specific sets of connected directories and synchronization workflows used for Tcl-based workflows.

  • Connected directory configuration objects that represent either source or target system instances including the Identity Store. Bind profiles hold the user and password information for a specific target system access.

  • Tcl-based workflow configuration objects that consist of activities: procedures that transfer data from source to target connected directories.

  • Tcl-based activity configuration objects: sequential process steps that are combined to make a workflow. Tcl-based activities can represent jobs or complete workflows.

  • Tcl-based job configuration objects: fully configured agents that can be used by Tcl-based activities in workflows.

  • Agent configuration objects defined by an agent type: un-configured programs or procedures that are called by a job. The meta controller acts as special agent and represents the join engine.

  • Tcl-based channel configuration objects.

  • Schedule configuration objects that define when Tcl-based workflows are to run.

All these configuration objects access specific configuration in the central configuration folder:

  • Agent type objects and the XML files that describe their presentation at the user interface level.

  • All central notification definitions used by meta controller jobs.

  • Definitions for standard files that are recognized by the agent controller.

  • Central Tcl files used by meta controller jobs.

  • C-based Identity Servers (IdS-C servers) - the DirX Identity component that must exist on each host server on which an agent or a C connector is to run.

  • The server objects that refer to service and system objects to define important information for access.

  • The messaging service that allows for the transfer of JMS messages between DirX Identity components.

Some of these objects are marked with a red border and the text "This object might be shared because it belongs to the Configuration folder". Be careful when editing these objects because your changes can affect other objects, too. For details about the Configuration folder, see the topic "(Central) Configuration" in the context-sensitive help.