Ident_ADS_Sync

Workflow for Export from Identity Store and Import to ADS and backwards

Ident_ADS_Sync is the scheduled sample workflow for bidirectional synchronization between the Identity Store and an Active Directory domain represented by a target system of type ADS. It first sends account and group changes from the Identity Store to Active Directory and then reads account and group changes from Active Directory back into the Identity Store.

Use this workflow when you want a regular exchange in both directions instead of a one-way export or a validation-only run.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Ident_ADS_Sync

Category

Target Scheduled / ADS

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

Sync

Connected system / controller type

-

Configuration wizard

LDAP-LDAP,ADS

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Target Scheduled/ADS/Ident_ADS_Sync

Prerequisites

  • Configure ADSAgent for the connected directory of type ADS that points to the Active Directory domain.

  • Configure MetaCP for the corresponding target system, and make sure the ADS target system and its connected directory are linked correctly in the Identity Store.

Workflow and Activities

Step Activity Description Agent Runs after

1

Ident2ADS_SyncAccount_MetaCP

Export of accounts

MetaCP

start activity

2

Ident2ADS_SyncAccount_ADSAgent

Import of accounts

ADSAgent

Ident2ADS_SyncAccount_MetaCP

3

Ident2ADS_SyncGroup_MetaCP

Export of groups

MetaCP

Ident2ADS_SyncAccount_ADSAgent

4

Ident2ADS_SyncGroup_ADSAgent

Import of groups

ADSAgent

Ident2ADS_SyncGroup_MetaCP

5

ADS2Ident_SyncAccount_ADSAgent

export of accounts from ads

ADSAgent

Ident2ADS_SyncGroup_ADSAgent

6

ADS2Ident_SyncAccount_MetaCP

import of accounts to role

MetaCP

ADS2Ident_SyncAccount_ADSAgent

7

ADS2Ident_SyncGroup_ADSAgent

export of groups from ads

ADSAgent

ADS2Ident_SyncAccount_MetaCP

8

ADS2Ident_SyncGroup_MetaCP

import of groups to role

MetaCP

ADS2Ident_SyncGroup_ADSAgent

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Ident2ADS_SyncAccount_MetaCP

Ident2ADS_SyncAccount_MetaCP

MetaCP

Full Export

Ident2ADS_SyncAccount

OutData

Ident2ADS_SyncAccount_ADSAgent

Ident2ADS_SyncAccount_ADSAgent

ADSAgent

Full Import

InData

Ident2ADS_SyncAccount

Ident2ADS_SyncGroup_MetaCP

Ident2ADS_SyncGroup_MetaCP

MetaCP

Full Export

Ident2ADS_SyncGroup

OutData

Ident2ADS_SyncGroup_ADSAgent

Ident2ADS_SyncGroup_ADSAgent

ADSAgent

Full Import

InData

Ident2ADS_SyncGroup

ADS2Ident_SyncAccount_ADSAgent

ADS2Ident_SyncAccount_ADSAgent

ADSAgent

Delta Export

ADS2Ident_SyncAccount

OutData

ADS2Ident_SyncAccount_MetaCP

ADS2Ident_SyncAccount_MetaCP

MetaCP

Delta Import

InData

ADS2Ident_SyncAccount

ADS2Ident_SyncGroup_ADSAgent

ADS2Ident_SyncGroup_ADSAgent

ADSAgent

Delta Export

ADS2Ident_SyncGroup

OutData

ADS2Ident_SyncGroup_MetaCP

ADS2Ident_SyncGroup_MetaCP

MetaCP

Delta Import

InData

ADS2Ident_SyncGroup

Configuration Parameters

Table 1. Parameters of job Ident2ADS_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

delta-or-full

delta_on

1

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

0

trace_level

1

trace_recordcount

0
Table 2. Parameters of job Ident2ADS_SyncAccount_ADSAgent
Parameter Default value

delta_mode

full

delta_on

0

trace

1
Table 3. Parameters of job Ident2ADS_SyncGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

delta-or-full

delta_on

1

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

0

trace_level

1

trace_recordcount

0
Table 4. Parameters of job Ident2ADS_SyncGroup_ADSAgent
Parameter Default value

delta_mode

full

delta_on

0

trace

1
Table 5. Parameters of job ADS2Ident_SyncAccount_ADSAgent
Parameter Default value

delta_mode

delta-or-full

delta_on

1

trace

1
Table 6. Parameters of job ADS2Ident_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

trace_level

1

trace_recordcount

0
Table 7. Parameters of job ADS2Ident_SyncGroup_ADSAgent
Parameter Default value

delta_mode

delta-or-full

delta_on

1

trace

1
Table 8. Parameters of job ADS2Ident_SyncGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

trace_level

1

trace_recordcount

0

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

In this workflow, the C++-based Server runs these activities in sequence:

  1. Ident2ADS_SyncAccount_MetaCP exports account changes from the Identity Store.

  2. Ident2ADS_SyncAccount_ADSAgent imports those account changes into Active Directory.

  3. Ident2ADS_SyncGroup_MetaCP exports group changes from the Identity Store.

  4. Ident2ADS_SyncGroup_ADSAgent imports those group changes into Active Directory.

  5. ADS2Ident_SyncAccount_ADSAgent exports account changes from Active Directory.

  6. ADS2Ident_SyncAccount_MetaCP imports those account changes into the Identity Store.

  7. ADS2Ident_SyncGroup_ADSAgent exports group changes from Active Directory.

  8. ADS2Ident_SyncGroup_MetaCP imports those group changes into the Identity Store.

If one activity fails, the workflow stops at that point and the remaining activities do not run.

Operation

  1. Start Ident_ADS_Sync manually or on a schedule.

  2. The workflow begins with the Identity Store to Active Directory direction by exporting accounts with MetaCP and importing them with ADSAgent, then repeating the same pattern for groups.

  3. After the outbound pass finishes, the workflow changes direction and exports accounts from Active Directory with ADSAgent before importing them into the Identity Store with MetaCP.

  4. It then repeats the return pass for groups so that both object types are processed in both directions during the same run.

  5. When the workflow completes successfully, the scheduled run has applied outbound changes to Active Directory and has imported the latest returned account and group data into the Identity Store.