Export Provisioning to FileSystem

Workflow to export provisioning data.

Export Provisioning to FileSystem exports provisioning data — such as roles, permissions, groups and their assignments — from a DirX Identity domain to the file system. Administrators use it to create a file-system snapshot of the provisioning configuration for archiving, offline analysis or migration.

The perform activity supports a simulation mode (simulationmode simulateLDIF) that writes a preview to simulationfilename without committing changes, alongside a diagnostic trace in tracefilename.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Export Provisioning to FileSystem

Prerequisites

The Java-based Server must have write access to the file-system directory where the export output files (tracefilename, simulationfilename) are written.
The domain parameter of the perform activity must point to the correct company DN (cn=My-Company by default).

Workflow and Activities

Activity Type Component description Description Ports

Activity	Type	Component description	Description	Ports
`error`	`error`	`provisioningActivity`	Error Activity	`Message`
`perform`	`Server`	`ldap2fsActivity`	Activity for performing the ldap to filesystem task	-

error

provisioningActivity

Error Activity

Message

perform

Server

ldap2fsActivity

Activity for performing the ldap to filesystem task

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

Activity	Port	Component description	Connector	Connected directory	Bind profile	SSL
`error`	`Message`	`errorPort`	`ErrorNotifyMailConnector`	-	-	not set

error

Message

errorPort

ErrorNotifyMailConnector

not set

Configuration Parameters

Table 1. Workflow parameters of `Export Provisioning to FileSystem`
Parameter	Default value
`timeout`	P0Y0M4DT0H0M0S

Table 2. Parameters of activity `error`
Parameter	Default value
`resourcefamily`	LDAP
`retrylimit`	0
`timeout`	P0Y0M1DT0H0M0S
`waitbeforeretry`	P0Y0M0DT0H0M0S

Table 3. Parameters of port `Message` (activity `error`)
Parameter	Default value
`decrypt.attribute`	dxmPassword

Table 4. Parameters of activity `perform`
Parameter	Default value
`domain`	cn=My-Company
`loglevel`	9
`resourcefamily`	workflowengine
`retrylimit`	0
`simulationfilename`	exportSim.txt
`simulationmode`	simulateLDIF
`timeout`	P0Y0M1DT0H0M0S
`tracefilename`	exportTrace.txt
`waitbeforeretry`	P0Y0M0DT0H0M0S

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The perform activity uses the ldap2fsActivity component with the Server type to carry out the export directly within the Java-based Server. It has no external connector ports. The domain parameter scopes the export to the company DN, and loglevel (9) controls diagnostic verbosity. When simulationmode is simulateLDIF (the default), the activity writes the simulated LDIF output to simulationfilename and a trace to tracefilename without committing changes.

Because retrylimit is 0, a failure is not retried: the request is passed immediately to the error activity, which sends a notification via the Message port.

Operation

An export request is submitted to the Export Provisioning to FileSystem workflow, typically through the Identity Manager.
The perform activity reads provisioning data (roles, permissions, groups and assignments) from the domain cn=My-Company and writes them to the file system.
When simulationmode is simulateLDIF, the activity writes a simulation file (exportSim.txt) and a trace file (exportTrace.txt) without making permanent changes.
If the export fails, the request is passed immediately to the error activity (retrylimit is 0), which reports the failure by e-mail through the Message port.

The workflow is delivered inactive (dxmActive is FALSE). Copy it into your own scenario, verify the domain parameter and output file paths, and activate the copy.