Ident_LDAPXXL_Sync

Workflow for synchronization to LDAP

Ident_LDAPXXL_Sync is the scheduled LDAP synchronization variant for large installations. It propagates changes from the Identity Store to a connected LDAP directory and processes groups first, then accounts.

Both activities run with MetaCP. The workflow stays in the Identity Store to LDAP direction for the whole run and is designed for the LDAPXXL target-system family.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Ident_LDAPXXL_Sync

Category

Target Scheduled / LDAPXXL

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

Sync

Connected system / controller type

-

Configuration wizard

LDAP-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Target Scheduled/LDAPXXL/Ident_LDAPXXL_Sync

Prerequisites

  • Configure MetaCP with the LDAP connector for the large LDAP installation represented by the LDAPXXL connected directory.

  • Create and configure the LDAPXXL connected directory and the corresponding target system subtree in the Identity Store.

Workflow and Activities

Step Activity Description Agent Runs after

1

Ident_LDAP_SyncGroup_MetaCP

Synchronization of groups

MetaCP

start activity

2

Ident_LDAP_SyncAccount_MetaCP

Synchronization of accounts

MetaCP

Ident_LDAP_SyncGroup_MetaCP

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Ident_LDAP_SyncGroup_MetaCP

Ident_LDAPXXL_SyncGroup_MetaCP

MetaCP

Full Export

Ident2LDAPXXL_SyncGroupNew

Ident2LDAPXXL_SyncGroupNew

Ident_LDAP_SyncAccount_MetaCP

Ident_LDAPXXL_SyncAccount_MetaCP

MetaCP

Full Export

Ident2LDAPXXL_SyncAccount

Ident2LDAPXXL_SyncAccount

Configuration Parameters

Table 1. Parameters of job Ident_LDAPXXL_SyncGroup_MetaCP
Parameter Default value

block_size

100

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

notify_not_ok

0

page_size

100

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

0

trace_level

1

trace_recordcount

0
Table 2. Parameters of job Ident_LDAPXXL_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

0

trace_level

1

trace_recordcount

0

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

In this workflow, the C++-based Server runs these activities in sequence:

  1. Ident_LDAP_SyncGroup_MetaCP exports group changes from the Identity Store and applies them to the LDAP directory.

  2. Ident_LDAP_SyncAccount_MetaCP exports account changes from the Identity Store and applies them to the LDAP directory.

If one activity fails, the workflow stops at that point and the remaining activities do not run.

Operation

  1. Start Ident_LDAPXXL_Sync manually or on a schedule.

  2. The workflow first runs Ident_LDAP_SyncGroup_MetaCP, so group changes are applied before account changes in the same run.

  3. It then runs Ident_LDAP_SyncAccount_MetaCP to propagate the account changes to the connected LDAP directory.

  4. Because both activities use MetaCP, the workflow remains a one-way export from the Identity Store to LDAP.

  5. A successful run updates the connected LDAPXXL directory with the scheduled group and account changes from the Identity Store.