LDAP2Ident_Validation

Workflow for Validation between LDAP and MetaRole

A validation workflow compares the content of the connected system with the state that DirX Identity holds for the corresponding target system. It runs in one of two modes, controlled by the mode parameter of the workflow:

InitialLoad - exports all accounts and groups and their relationships from the connected system and imports them into the target system subtree of the Identity Store in replace mode. Use this mode when you take a target system into operation.
Validation - detects deviations between the state known in DirX Identity and the state in the connected system, for example accounts or groups that were created or deleted outside of DirX Identity, and writes a message about each deviation into the "to do" field (dxrToDo) of the affected target system object.

Both modes update the dxrTSState attribute and the group member attributes of the affected target system objects.

LDAP2Ident_Validation validates a connected LDAP directory against the corresponding target system subtree in the Identity Store. Both activities run with MetaCP, first for accounts and then for groups.

Use this workflow when you want scheduled validation of LDAP data without a separate connector-specific export agent.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

LDAP2Ident_Validation

Prerequisites

Configure MetaCP for the LDAP connected directory.
Create and configure the LDAP connected directory and the corresponding target system subtree in the Identity Store.

Workflow and Activities

Step Activity Description Agent Runs after

Step	Activity	Description	Agent	Runs after
1	`LDAP2Ident_ValAccount_MetaCP`	import of accounts	`MetaCP`	start activity
2	`LDAP2Ident_ValGroup_MetaCP`	Import of groups	`MetaCP`	`LDAP2Ident_ValAccount_MetaCP`

LDAP2Ident_ValAccount_MetaCP

import of accounts

MetaCP

start activity

LDAP2Ident_ValGroup_MetaCP

Import of groups

MetaCP

LDAP2Ident_ValAccount_MetaCP

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Activity	Job	Agent	Operation	Input channel	Output channel
`LDAP2Ident_ValAccount_MetaCP`	`LDAP2Ident_ValAccount_MetaCP`	`MetaCP`	Delta Import	`LDAP2Ident_ValAccount`	`LDAP2Ident_ValAccount`
`LDAP2Ident_ValGroup_MetaCP`	`LDAP2Ident_ValGroup_MetaCP`	`MetaCP`	Delta Import	`LDAP2Ident_ValGroup`	`LDAP2Ident_ValGroup`

LDAP2Ident_ValAccount_MetaCP

MetaCP

Delta Import

LDAP2Ident_ValAccount

LDAP2Ident_ValGroup_MetaCP

MetaCP

Delta Import

LDAP2Ident_ValGroup

Configuration Parameters

Table 1. Workflow parameters of `LDAP2Ident_Validation`
Parameter	Default value
`mode`	InitialLoad

Table 2. Parameters of job `LDAP2Ident_ValAccount_MetaCP`
Parameter	Default value
`debug_trace`	0
`delta_mode`	full
`delta_on`	0
`exact_action`	FALSE
`init_mode`	REAL
`max_trace_entries`	10
`notify_not_ok`	0
`statistics`	TRUE
`test_mapping_only`	FALSE
`trace_level`	1
`trace_recordcount`	0

Table 3. Parameters of job `LDAP2Ident_ValGroup_MetaCP`
Parameter	Default value
`debug_trace`	0
`delta_mode`	full
`delta_on`	0
`exact_action`	FALSE
`init_mode`	REAL
`max_trace_entries`	10
`notify_not_ok`	0
`statistics`	TRUE
`test_mapping_only`	FALSE
`trace_level`	1
`trace_recordcount`	0

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

In this workflow, the C++-based Server runs these activities in sequence:

LDAP2Ident_ValAccount_MetaCP validates and imports LDAP account data into the Identity Store validation flow.
LDAP2Ident_ValGroup_MetaCP validates and imports LDAP group data into the Identity Store validation flow.

If one activity fails, the workflow stops at that point and the remaining activities do not run.

Operation

Start LDAP2Ident_Validation manually or on a schedule.
The workflow first processes accounts through LDAP2Ident_ValAccount_MetaCP and then processes groups through LDAP2Ident_ValGroup_MetaCP.
Because both steps run with MetaCP, the workflow performs the whole validation pass through the LDAP connector configuration of the target system.
Depending on the selected mode, the run either refreshes the target system subtree from LDAP or records deviations between LDAP and the Identity Store on the affected target system objects.
When the workflow completes successfully, the LDAP validation pass has covered both accounts and groups.

LDAP2Ident_Validation

At a Glance

Prerequisites

Workflow and Activities

Jobs and Agents

Configuration Parameters

Operation

Related Topics