CleanupObjects

Regular cleanup of deleted or outdated objects in the Identity Store

CleanupObjects removes or marks as deleted the entries in the Identity Store that have been logically deleted or have passed their configured retention period. The PolicyAgent runs the cleanup policy against the CleanupDeletedObjects channels, which identify stale entries through policy rules and process each one according to the configured cleanup action.

Run this workflow regularly — for example nightly — so that the Identity Store does not accumulate large numbers of deleted entries that increase LDAP search times and complicate reporting.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

CleanupObjects

Category

Identity Store

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

8.0

Factory data path

Workflows/Default/Identity Store/CleanupObjects

Prerequisites

  • The Identity Store must contain the policies that define which entries qualify for cleanup.

  • The CleanupDeletedObjects In and CleanupDeletedObjects Out channels must be configured in the C++-based Server.

Workflow and Activities

Step Activity Description Agent Runs after

1

CleanupObjects

Regular cleanup of deleted or outdated objects in the Identity Store

PolicyAgent

start activity

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

CleanupObjects

CleanupObjects

PolicyAgent

Full Import

CleanupDeletedObjects In

CleanupDeletedObjects Out

Configuration Parameters

Table 1. Parameters of job CleanupObjects
Parameter Default value

delta_mode

full

delta_on

0

mode

AssignOnly

request

process

trace

2

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow has a single activity, CleanupObjects, which runs the PolicyAgent job with the CleanupDeletedObjects In input channel and the CleanupDeletedObjects Out output channel. The mode is AssignOnly and the request is process, so the agent evaluates and applies the configured cleanup policies without performing any additional assignment steps.

Operation

  1. You start the workflow manually from the Identity Manager or attach it to a schedule.

  2. The C++-based Server starts the CleanupObjects activity and launches the PolicyAgent job.

  3. The agent reads entries from the Identity Store through the CleanupDeletedObjects In input channel; the channel filter selects logically deleted or expired entries.

  4. The configured cleanup policies are evaluated for each matching entry and the cleanup action (for example, physical deletion or state change) is applied.

  5. The results are written back through the CleanupDeletedObjects Out output channel.