Import Users from Database

Sample workflow to import users from a database via the Service Layer Connector

Import Users from Database is a source workflow that reads users and user-role assignments from the connected directory UserDB and writes them into the Identity Store. On this page, the TS port is the JDBC source, while the IdentityDomain port is the DirX Identity destination that is accessed through the Service Layer Connector.

The workflow uses the User, user-roles and setPassword channels to import account data, manual role assignments and password changes into DirX Identity. The Role Assignment Filter on the TS port prepares source-side assignment data for the workflow.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Import Users from Database

Category

Source Realtime / JDBC

Technology

Java-based real-time workflow

LDAP object class

dxmIDMWorkflowDefinition

Workflow type

ProvisionTS

Connected system / controller type

not applicable

Configuration wizard

JDBC-LDAP

Active in the factory data

TRUE

Factory data version

8.7

Factory data path

Workflows/Default/Source Realtime/JDBC/Import Users from Database

Prerequisites

  • You need a connected directory UserDB that is configured for the JDBCConnector and uses the bind profile JDBC Database Admin.

  • You need the connected directory Identity Store for the IdentityDomain port, accessed through the Service Layer Connector with the bind profile Domain_Admin.

  • The Java-based Server that runs the workflow must be able to reach the database, the Identity Store service layer, and the JMS and mail infrastructure that the event, notify and error ports use.

  • Configure the source and destination mappings so that the User, user-roles and setPassword channels can process the intended data.

Workflow and Activities

Activity Type Component description Description Ports

error

error

provisioningActivity

Error Activity

Message

join

ProvisionTS

provisioningActivity

Join activity for the provision-to-TS workflow

event, IdentityDomain, notify, ts

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

error

Message

errorPort

ErrorNotifyMailConnector

-

-

not set

join

event

notificationPort

JmsConnector

-

-

not set

join

IdentityDomain

provisioningPort

SvcLayerConnector

Identity Store

Domain_Admin

not set

join

notify

notificationPort

NotifyMailConnector

-

-

not set

join

TS

provisioningPort

JDBCConnector

UserDB

JDBC Database Admin

not set

Channels

Table 1. Channels of port IdentityDomain (activity join)
Channel Description Reference type Delta type

setPassword

Channel for setting a password in DirX identity

OneToOne

SearchAttributes

User

Channel for users in DirX Identity

OneToOne

SearchAttributes

user-roles

Channel for user-role manual assignments

OneToOne

SearchAttributes
Table 2. Channels of port TS (activity join)
Channel Description Reference type Delta type

User

Channel for users in UserDB

OneToOne

SearchAttributes

user-roles

Channel for user-role assignments

OneToOne

SearchAttributes

Filters

Port Filter Description Sequence

TS

Role Assignment Filter

handles user-role assignments with a role parameter

1

Configuration Parameters

Table 3. Workflow parameters of Import Users from Database
Parameter Default value

timeout

P0Y0M4DT0H0M0S
Table 4. Parameters of activity error
Parameter Default value

resourcefamily

Mail

retrylimit

3

timeout

P0Y0M1DT0H0M0S

waitbeforeretry

P0Y0M0DT2H0M0S
Table 5. Parameters of port Message (activity error)
Parameter Default value

decrypt.attribute

dxmPassword
Table 6. Parameters of activity join
Parameter Default value

resourcefamily

JDBC

retrylimit

3

timeout

P0Y0M1DT0H0M0S

waitbeforeretry

P0Y0M0DT0H30M0S
Table 7. Parameters of port event (activity join)
Parameter Default value

appid

event

decrypt.attribute

userPassword

jmsprovidertype

MQSERIES

tgtisjmsclient

false
Table 8. Parameters of port IdentityDomain (activity join)
Parameter Default value

decrypt.attribute

userPassword

suppresspwdevent

FALSE
Table 9. Parameters of port notify (activity join)
Parameter Default value

decrypt.attribute

userPassword

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The join activity performs the import. Its TS port reads User and user-roles data from UserDB, and its IdentityDomain port writes the corresponding users, assignments and password changes into the Identity Store over the User, user-roles and setPassword channels. The Role Assignment Filter on the TS port handles assignment records that carry a role parameter, and the event port is configured to use MQSERIES as its JMS provider type.

A request that fails is retried up to three times (retrylimit) with 30 minutes between attempts (waitbeforeretry). If it still fails, the error activity takes it over and reports it through the Message port; the workflow parameter timeout gives a request four days before it is discarded.

Operation

  1. A change for the User or user-roles channels reaches the workflow through the event port.

  2. The Java-based Server passes the resulting request to the join activity.

  3. The TS port reads the affected user and any related assignment data from UserDB.

  4. The IdentityDomain port creates or updates the user in the Identity Store over User, applies assignments over user-roles, and uses setPassword when the request contains password data.

  5. The notify port sends the configured notifications, and the event port publishes the resulting workflow event.

  6. Requests that fail permanently are handed to the error activity, which reports them by e-mail.

The workflow is delivered active (dxmActive is TRUE). After you configure the connected directory and the related infrastructure, you can use it directly.