CheckConsistency

CheckConsistency inspects the entire Identity Store for structural integrity problems. It checks users, roles, permissions, and target system accounts and groups according to the flags checkusers, checkrolespermissions and checktsaccountsgroups in the join activity parameters, and applies the provisioning rules from provisionrulesroot to bring affected entries back into a consistent state.

Use this workflow after bulk data changes, migrations or imports that may leave the Identity Store in an inconsistent state, or run it periodically to catch any drift that event-based maintenance workflows may have missed.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

CheckConsistency

Prerequisites

The Identity Store must contain the provisioning rules referenced by provisionrulesroot.
The user subtree configured in usersubtree must be present in the Identity Store.
Copy the workflow into your scenario, configure the base DNs (userbase, tsbase, permissionbase, rolebase) to match your domain layout, and activate the copy in the Java-based Server.

Workflow and Activities

Activity Type Component description Description Ports

Activity	Type	Component description	Description	Ports
`error`	`error`	`provisioningActivity`	Error Activity	`Message`
`join`	`PrivilegeResolutionController`	`PrivilegeResolutionActivity`	Activity for user resolution and account update.	-

error

provisioningActivity

Error Activity

Message

join

PrivilegeResolutionController

PrivilegeResolutionActivity

Activity for user resolution and account update.

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

Activity	Port	Component description	Connector	Connected directory	Bind profile	SSL
`error`	`Message`	`errorPort`	`ErrorNotifyMailConnector`	-	-	not set

error

Message

errorPort

ErrorNotifyMailConnector

not set

Configuration Parameters

Table 1. Workflow parameters of `CheckConsistency`
Parameter	Default value
`ispwdmanager`	FALSE
`timeout`	P0Y0M0DT0H0M0S
`tscluster`	*
`tsresource`	*

Table 2. Parameters of activity `error`
Parameter	Default value
`resourcefamily`	LDAP
`retrylimit`	3
`timeout`	P0Y0M1DT0H0M0S
`waitbeforeretry`	P0Y0M0DT2H0M0S

Table 3. Parameters of port `Message` (activity `error`)
Parameter	Default value
`decrypt.attribute`	dxmPassword

Table 4. Parameters of activity `join`
Parameter	Default value
`checkrolespermissions`	TRUE
`checktsaccountsgroups`	TRUE
`checkusers`	TRUE
`permissionbase`	cn=Permissions,cn=My-Company
`permissionfilter`	(objectclass=dxrPermission)
`privilegetobedeleted`	TRUE
`provisionrulesroot`	cn=domain_name,cn=Rules,cn=Policies,cn=domain_name
`resourcefamily`	ConsistencyCheck
`retrylimit`	3
`rolebase`	cn=RoleCatalogue,cn=My-Company
`rolefilter`	(objectclass=dxrRole)
`sortascending`	TRUE
`sortattribute`	cn
`timeout`	P0Y0M0DT0H15M0S
`tsbase`	cn=Targetsystems,cn=My-Company
`tsfilter`	(objectclass=dxrTargetSystem)
`userbase`	cn=Users,cn=My-Company
`userfilter`	(objectclass=dxrUser)
`userstorage.batch.accumulator.size`	500
`userstorage.cache.mru.size`	10000
`userstorage.cache.prefetch.size`	50
`userstorage.ldap.pagesize`	50
`usersubtree`	cn=subtree,cn=Users,cn=domain_name
`waitbeforeretry`	P0Y0M0DT0H30M0S

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The workflow has two activities. The join activity uses the PrivilegeResolutionActivity component to iterate over users, roles, permissions, and target system accounts and groups filtered by the corresponding base DN and LDAP filter parameters (userbase/userfilter, tsbase/tsfilter, permissionbase/permissionfilter, rolebase/rolefilter). It applies provisioning rules and marks inconsistent entries. Entries whose privileges are marked for deletion are handled when privilegetobedeleted is TRUE. Failed requests are retried up to three times (retrylimit); if all retries fail, the error activity sends a notification by e-mail through the Message port.

Operation

A request for a consistency check arrives at the Java-based Server, either triggered by the CombinedMaintenance workflow or from a direct invocation.
The join activity reads users, roles, permissions and target system entries from the Identity Store using the configured base DNs and LDAP filters.
For each entry the activity evaluates the provisioning rules from provisionrulesroot and checks that links to other entries are intact and the entry attributes are consistent.
Detected problems are corrected or flagged; privileges marked for deletion are removed when privilegetobedeleted is TRUE.
Failed requests are retried up to retrylimit (3) times with waitbeforeretry (30 minutes) between attempts; persistent failures are handed to the error activity for e-mail notification.
The workflow parameter ispwdmanager controls whether the check also covers password-manager specific attributes.