Ident_JDBC_Sync

Workflow for Export from Identity Store and Import to JDBC and backwards

Ident_JDBC_Sync is the scheduled sample workflow for comprehensive bidirectional synchronization between the Identity Store and a JDBC-connected database. It handles accounts, groups, group memberships, objects that must be deleted, and the follow-up synchronization that reads back database-assigned keys after new objects are created.

The workflow calls the companion sub-workflows JDBC2Ident_Sync_NewAcc, JDBC2Ident_Sync_NewGroup, Ident2JDBC_SyncAccountDel, and Ident2JDBC_SyncGroupDel. Together, these steps complete the write cycle for newly created objects and remove objects that are already marked for deletion in the Identity Store.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Ident_JDBC_Sync

Category

Target Scheduled / JDBC

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

Sync

Connected system / controller type

-

Configuration wizard

LDAP-JDBC

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Target Scheduled/JDBC/Ident_JDBC_Sync

Prerequisites

  • Configure JDBCImport and JDBCExport for the JDBC-connected database that represents the target system.

  • Configure MetaCP for the corresponding target system subtree in the Identity Store.

  • Make sure the companion sub-workflows Ident2JDBC_SyncAccountDel, Ident2JDBC_SyncGroupDel, JDBC2Ident_Sync_NewAcc, and JDBC2Ident_Sync_NewGroup are available and configured for the same JDBC target system.

Workflow and Activities

Step Activity Description Agent Runs after

1

Ident2JDBC_SyncAccount_MetaCP

export Identity Store accounts with dxrTSState=NONE(new to JDBC)

MetaCP

start activity

2

Ident2JDBC_SyncAccount_JDBCImport

import new accounts to JDBC

JDBCAgent

Ident2JDBC_SyncAccount_MetaCP

3

JDBC2Ident_SyncNewAccWF

synch back new accounts to Role to get the JDBC keys

-

Ident2JDBC_SyncAccount_JDBCImport

4

Ident2JDBC_SyncGroup_MetaCP

Export Identity Store Data via metacp Agent to file

MetaCP

JDBC2Ident_SyncNewAccWF

5

Ident2JDBC_SyncGroup_JDBCImport

Import data file to JDBC Directory

JDBCAgent

Ident2JDBC_SyncGroup_MetaCP

6

JDBC2Ident_SyncNewGroupWF

synch back new groups to Role to get the JDBC keys

-

Ident2JDBC_SyncGroup_JDBCImport

7

Ident2JDBC_SyncGroupMembers_MetaCP

export memberships to create or to delete in TS

MetaCP

JDBC2Ident_SyncNewGroupWF

8

Ident2JDBC_SyncGroupMembers_JDBCImport

import new/deleted memberships

JDBCAgent

Ident2JDBC_SyncGroupMembers_MetaCP

9

Ident2JDBC_SyncAccountDel

export accounts to be deleted in JDBC

-

Ident2JDBC_SyncGroupMembers_JDBCImport

10

Ident2JDBC_SyncGroupDel

export groups to be deleted in JDBC

-

Ident2JDBC_SyncAccountDel

11

JDBC2Ident_SyncGroup_JDBCExport

Export changed JDBC records

JDBCAgent

Ident2JDBC_SyncGroupDel

12

JDBC2Ident_SyncGroup_MetaCP

import group/membership changes

MetaCP

JDBC2Ident_SyncGroup_JDBCExport

13

JDBC2Ident_SyncAcc_JDBCExport

export changed accounts

JDBCAgent

JDBC2Ident_SyncGroup_MetaCP

14

JDBC2Ident_SyncAcc_MetaCP

import account changes

MetaCP

JDBC2Ident_SyncAcc_JDBCExport

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Ident2JDBC_SyncAccount_MetaCP

Ident2JDBC_SyncAccount_MetaCP

MetaCP

Full Export

Ident2JDBC_SyncAccount3

OutData

Ident2JDBC_SyncAccount_JDBCImport

Ident2JDBC_SyncAccount_JDBCImport

JDBCAgent

Full Import

InData

Ident2JDBC_SyncAccImport1

JDBC2Ident_SyncNewAccWF

JDBC2Ident_Sync_NewAcc

-

not set

-

-

Ident2JDBC_SyncGroup_MetaCP

Ident2JDBC_SyncGroup_MetaCP

MetaCP

Full Export

Ident2JDBC_SyncNewGroup1

OutData

Ident2JDBC_SyncGroup_JDBCImport

Ident2JDBC_SyncGroup_JDBCImport

JDBCAgent

Full Import

InData

Ident2JDBC_SyncGroupImport

JDBC2Ident_SyncNewGroupWF

JDBC2Ident_Sync_NewGroup

-

not set

-

-

Ident2JDBC_SyncGroupMembers_MetaCP

Ident2JDBC_SyncGroupMembers_MetaCP

MetaCP

Full Export

Ident2JDBC_SyncGroupMembers1

OutData

Ident2JDBC_SyncGroupMembers_JDBCImport

Ident2JDBC_SyncGroupMembers_JDBCImport

JDBCAgent

Full Import

InData

Ident2JDBC_SyncGroupMembersImport

Ident2JDBC_SyncAccountDel

Ident2JDBC_SyncAccountDel

-

not set

-

-

Ident2JDBC_SyncGroupDel

Ident2JDBC_SyncGroupDel

-

not set

-

-

JDBC2Ident_SyncGroup_JDBCExport

JDBC2Ident_SyncGroup_JDBCExport

JDBCAgent

Full Export

JDBC2Ident_SyncGroup

OutData

JDBC2Ident_SyncGroup_MetaCP

JDBC2Ident_SyncGroup_MetaCP

MetaCP

Full Export

InData

JDBC2Ident_SyncGroup3

JDBC2Ident_SyncAcc_JDBCExport

JDBC2Ident_SyncAccount_JDBCExport

JDBCAgent

Full Export

JDBC2Ident_SyncAcc

OutData

JDBC2Ident_SyncAcc_MetaCP

JDBC2Ident_SyncAccount_MetaCP

MetaCP

Full Export

InData

JDBC2Ident_SyncAccount11

Configuration Parameters

Table 1. Parameters of job Ident2JDBC_SyncAccount_MetaCP
Parameter Default value

debug_trace

13

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

2

trace_recordcount

0
Table 2. Parameters of job Ident2JDBC_SyncAccount_JDBCImport
Parameter Default value

controller_tracelevel

9
Table 3. Parameters of job Ident2JDBC_SyncGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

FALSE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0
Table 4. Parameters of job Ident2JDBC_SyncGroup_JDBCImport
Parameter Default value

controller_tracelevel

9

delta_mode

full

delta_on

0
Table 5. Parameters of job Ident2JDBC_SyncGroupMembers_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0
Table 6. Parameters of job Ident2JDBC_SyncGroupMembers_JDBCImport
Parameter Default value

controller_tracelevel

9

delta_mode

full

delta_on

0
Table 7. Parameters of job JDBC2Ident_SyncGroup_JDBCExport
Parameter Default value

controller_tracelevel

9

delta_mode

delta-or-full

delta_on

1
Table 8. Parameters of job JDBC2Ident_SyncGroup_MetaCP
Parameter Default value

debug_trace

9

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

2

trace_recordcount

0
Table 9. Parameters of job JDBC2Ident_SyncAccount_JDBCExport
Parameter Default value

controller_tracelevel

9

delta_mode

delta-or-full

delta_on

1
Table 10. Parameters of job JDBC2Ident_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

In this workflow, the C++-based Server runs these activities in sequence:

  1. Ident2JDBC_SyncAccount_MetaCP exports new or changed accounts from the Identity Store, and Ident2JDBC_SyncAccount_JDBCImport writes them to the JDBC side.

  2. JDBC2Ident_SyncNewAccWF then calls the companion workflow that reads back JDBC-assigned keys for newly created accounts.

  3. Ident2JDBC_SyncGroup_MetaCP exports groups from the Identity Store, Ident2JDBC_SyncGroup_JDBCImport writes them to the JDBC side, and JDBC2Ident_SyncNewGroupWF reads back JDBC-assigned keys for newly created groups.

  4. Ident2JDBC_SyncGroupMembers_MetaCP exports membership changes, and Ident2JDBC_SyncGroupMembers_JDBCImport applies those membership changes in the JDBC-connected database.

  5. Ident2JDBC_SyncAccountDel and Ident2JDBC_SyncGroupDel call the companion deletion workflows for objects in state TBDEL.

  6. JDBC2Ident_SyncGroup_JDBCExport and JDBC2Ident_SyncGroup_MetaCP synchronize changed groups from JDBC back to the Identity Store, and JDBC2Ident_SyncAcc_JDBCExport plus JDBC2Ident_SyncAcc_MetaCP do the same for accounts.

If one activity fails, the workflow stops at that point and the remaining activities do not run.

Operation

  1. Start Ident_JDBC_Sync manually or on a schedule.

  2. The workflow begins with the Identity Store to JDBC direction for accounts, immediately followed by the companion workflow that reads back JDBC-assigned keys for newly created accounts.

  3. It then repeats the same pattern for groups, synchronizes group memberships, and calls the dedicated deletion workflows for accounts and groups that are already in state TBDEL in the Identity Store.

  4. After the outbound work is complete, the workflow exports changed groups from the JDBC-connected database and imports them into the Identity Store, then does the same for changed accounts.

  5. If a main activity or called sub-workflow fails, the remaining steps do not run. When the workflow finishes successfully, the Identity Store has processed the returned JDBC data and holds the keys that the database assigned to newly created objects.