ODBC2Ident+Maintenance

Extended creation workflow with policy execution and privilege resolution. - copy the required creation workflow - copy this workflow (uncheck the nested copy flag) - link the creation workflow to the first activity of the copied workflow

ODBC2Ident+Maintenance extends an identity-creation workflow with follow-up maintenance steps. You use it when an ODBC-based import should be followed immediately by policy execution and privilege resolution in the Identity Store.

This workflow is a template rather than a standalone import. You copy the required creation workflow, copy ODBC2Ident+Maintenance without nested copies, and then link your creation workflow to the first activity before you use it.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

ODBC2Ident+Maintenance

Category

Source Scheduled

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

-

Connected system / controller type

-

Configuration wizard

ODBC-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Source Scheduled/ODBC2Ident+Maintenance

Prerequisites

  • A copied creation workflow linked as Creation workflow, typically based on ODBC2Ident or another import workflow.

  • An agent that can run PolicyAgent.

  • An agent that can run ServiceAgent.

Workflow and Activities

Step Activity Description Agent Runs after

1

Creation workflow

This activity imports the identities from the source

-

start activity

2

PolicyExecution

Performs a policy execution with provisioning rules

PolicyAgent

Creation workflow

3

PrivilegeResolution

Performs a privilege resolution

ServiceAgent

PolicyExecution

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Creation workflow

ODBC2Ident

-

not set

-

-

PolicyExecution

PolicyExecution

PolicyAgent

Full Import

PolicyExecution in

PolicyExecution out

PrivilegeResolution

PrivilegeResolution

ServiceAgent

Full Import

Default

PrivilegeResolution out

Configuration Parameters

Table 1. Parameters of job PolicyExecution
Parameter Default value

delta_mode

full

delta_on

0

mode

AssignOnly

request

process

trace

2
Table 2. Parameters of job PrivilegeResolution
Parameter Default value

delta_mode

full

delta_on

0

ldaptrace

FALSE

ldaptracelines

0

request

resolution

trace

1

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

The workflow runs in three stages. The linked Creation workflow imports the source identities, PolicyExecution applies provisioning rules, and PrivilegeResolution resolves privileges after the policy step has finished.

If the linked creation workflow fails, neither maintenance step runs. If PolicyExecution fails, PrivilegeResolution does not start.

Operation

  1. The workflow starts the linked Creation workflow, which performs the source import that you attach to this template.

  2. After a successful import, PolicyExecution runs with mode set to AssignOnly and request set to process, so the workflow performs policy processing on the imported result.

  3. PrivilegeResolution then runs with request set to resolution to resolve privileges after policy execution has completed.

  4. The workflow finishes only when all three stages succeed.