Ident_ODBC_Sync

Workflow for Export from Identity Store and Import to ODBC and backwards

Ident_ODBC_Sync is the scheduled sample workflow for comprehensive bidirectional synchronization between the Identity Store and an ODBC-connected system. It handles accounts, groups, group memberships, objects that must be deleted, and the follow-up synchronization that reads back ODBC-assigned keys after new objects are created.

The workflow calls the companion sub-workflows ODBC2Ident_Sync_NewAcc, ODBC2Ident_Sync_NewGroup, Ident2ODBC_SyncAccountDel, and Ident2ODBC_SyncGroupDel. Together, these steps complete the write cycle for newly created objects and remove objects that are already marked for deletion in the Identity Store.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Ident_ODBC_Sync

Category

Target Scheduled / ODBC

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

Sync

Connected system / controller type

-

Configuration wizard

LDAP-ODBC

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Target Scheduled/ODBC/Ident_ODBC_Sync

Prerequisites

  • Configure ODBCImport and ODBCExport for the ODBC-connected system or database that represents the target system.

  • Configure MetaCP for the corresponding target system subtree in the Identity Store.

  • Make sure the companion sub-workflows Ident2ODBC_SyncAccountDel, Ident2ODBC_SyncGroupDel, ODBC2Ident_Sync_NewAcc, and ODBC2Ident_Sync_NewGroup are available and configured for the same ODBC target system.

Workflow and Activities

Step Activity Description Agent Runs after

1

Ident2ODBC_SyncAccount_MetaCP

export Identity Store accounts with dxrTSState=NONE(new to ODBC)

MetaCP

start activity

2

Ident2ODBC_SyncAccount_ODBCImport

import new accounts to ODBC

ODBCImport

Ident2ODBC_SyncAccount_MetaCP

3

ODBC2Ident_SyncNewAccWF

synch back new accounts to Role to get the ODBC keys

-

Ident2ODBC_SyncAccount_ODBCImport

4

Ident2ODBC_SyncGroup_MetaCP

Export Identity Store Data via metacp Agent to file

MetaCP

ODBC2Ident_SyncNewAccWF

5

Ident2ODBC_SyncGroup_ODBCImport

Import data file to ODBC Directory

ODBCImport

Ident2ODBC_SyncGroup_MetaCP

6

ODBC2Ident_SyncNewGroupWF

synch back new groups to Role to get the ODBC keys

-

Ident2ODBC_SyncGroup_ODBCImport

7

Ident2ODBC_SyncGroupMembers_MetaCP

export memberships to create or to delete in TS

MetaCP

ODBC2Ident_SyncNewGroupWF

8

Ident2ODBC_SyncGroupMembers_ODBCImport

import new/deleted memberships

ODBCImport

Ident2ODBC_SyncGroupMembers_MetaCP

9

Ident2ODBC_SyncAccountDel

export accounts to be deleted in ODBC

-

Ident2ODBC_SyncGroupMembers_ODBCImport

10

Ident2ODBC_SyncGroupDel

export groups to be deleted in ODBC

-

Ident2ODBC_SyncAccountDel

11

ODBC2Ident_SyncGroup_ODBCExport

Export changed ODBC records

ODBCExport

Ident2ODBC_SyncGroupDel

12

ODBC2Ident_SyncGroup_MetaCP

import group/membership changes

MetaCP

ODBC2Ident_SyncGroup_ODBCExport

13

ODBC2Ident_SyncAcc_ODBCExport

export changed accounts

ODBCExport

ODBC2Ident_SyncGroup_MetaCP

14

ODBC2Ident_SyncAcc_MetaCP

import account changes

MetaCP

ODBC2Ident_SyncAcc_ODBCExport

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Ident2ODBC_SyncAccount_MetaCP

Ident2ODBC_SyncAccount_MetaCP

MetaCP

Full Export

Ident2ODBC_SyncAccount

OutData

Ident2ODBC_SyncAccount_ODBCImport

Ident2ODBC_SyncAccount_ODBCImport

ODBCImport

Full Import

InData

Ident2ODBC_SyncAccImport

ODBC2Ident_SyncNewAccWF

ODBC2Ident_Sync_NewAcc

-

not set

-

-

Ident2ODBC_SyncGroup_MetaCP

Ident2ODBC_SyncGroup_MetaCP

MetaCP

Full Export

Ident2ODBC_SyncNewGroup

OutData

Ident2ODBC_SyncGroup_ODBCImport

Ident2ODBC_SyncGroup_ODBCImport

ODBCImport

Full Import

InData

Ident2ODBC_SyncGroupImport

ODBC2Ident_SyncNewGroupWF

ODBC2Ident_Sync_NewGroup

-

not set

-

-

Ident2ODBC_SyncGroupMembers_MetaCP

Ident2ODBC_SyncGroupMembers_MetaCP

MetaCP

Full Export

Ident2ODBC_SyncGroupMembers

OutData

Ident2ODBC_SyncGroupMembers_ODBCImport

Ident2ODBC_SyncGroupMembers_ODBCImport

ODBCImport

Full Import

InData

Ident2ODBC_SyncGroupMembersImport

Ident2ODBC_SyncAccountDel

Ident2ODBC_SyncAccountDel

-

not set

-

-

Ident2ODBC_SyncGroupDel

Ident2ODBC_SyncGroupDel

-

not set

-

-

ODBC2Ident_SyncGroup_ODBCExport

ODBC2Ident_SyncGroup_ODBCExport

ODBCExport

Full Export

ODBC2Ident_SyncGroup

OutData

ODBC2Ident_SyncGroup_MetaCP

ODBC2Ident_SyncGroup_MetaCP

MetaCP

Full Export

InData

ODBC2Ident_SyncGroup

ODBC2Ident_SyncAcc_ODBCExport

ODBC2Ident_SyncAccount_ODBCExport

ODBCExport

Full Export

ODBC2Ident_SyncAcc

OutData

ODBC2Ident_SyncAcc_MetaCP

ODBC2Ident_SyncAccount_MetaCP

MetaCP

Full Export

InData

ODBC2Ident_SyncAccount

Configuration Parameters

Table 1. Parameters of job Ident2ODBC_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

delta-or-full

delta_on

1

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0
Table 2. Parameters of job Ident2ODBC_SyncAccount_ODBCImport
Parameter Default value

8bit

TRUE

datahash

4

delta_mode

full

delta_on

0

maxtracefiles

100

trace

1

traceflow

0

tracelevel

W S FS CA Stats SQL
Table 3. Parameters of job Ident2ODBC_SyncGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

FALSE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0
Table 4. Parameters of job Ident2ODBC_SyncGroup_ODBCImport
Parameter Default value

8bit

TRUE

datahash

4

delta_mode

full

delta_on

0

maxtracefiles

100

trace

1

traceflow

0

tracelevel

W S FS CA Stats SQL
Table 5. Parameters of job Ident2ODBC_SyncGroupMembers_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0
Table 6. Parameters of job Ident2ODBC_SyncGroupMembers_ODBCImport
Parameter Default value

8bit

TRUE

datahash

4

delta_mode

full

delta_on

0

maxtracefiles

100

trace

1

traceflow

0

tracelevel

W S FS CA Stats SQL
Table 7. Parameters of job ODBC2Ident_SyncGroup_ODBCExport
Parameter Default value

8bit

TRUE

datahash

4

delta_mode

delta-or-full

delta_on

1

maxtracefiles

100

trace

1

traceflow

0

tracelevel

W S FS CA Stats Ref
Table 8. Parameters of job ODBC2Ident_SyncGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0
Table 9. Parameters of job ODBC2Ident_SyncAccount_ODBCExport
Parameter Default value

8bit

TRUE

datahash

4

delta_mode

delta-or-full

delta_on

1

maxtracefiles

100

trace

1

traceflow

0

tracelevel

W S FS CA Stats Ref
Table 10. Parameters of job ODBC2Ident_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

10

trace_level

1

trace_recordcount

0

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

In this workflow, the C++-based Server runs these activities in sequence:

  1. Ident2ODBC_SyncAccount_MetaCP exports new or changed accounts from the Identity Store, and Ident2ODBC_SyncAccount_ODBCImport writes them to the ODBC side.

  2. ODBC2Ident_SyncNewAccWF then calls the companion workflow that reads back ODBC-assigned keys for newly created accounts.

  3. Ident2ODBC_SyncGroup_MetaCP exports groups from the Identity Store, Ident2ODBC_SyncGroup_ODBCImport writes them to the ODBC side, and ODBC2Ident_SyncNewGroupWF reads back ODBC-assigned keys for newly created groups.

  4. Ident2ODBC_SyncGroupMembers_MetaCP exports membership changes, and Ident2ODBC_SyncGroupMembers_ODBCImport applies those membership changes in the ODBC-connected system.

  5. Ident2ODBC_SyncAccountDel and Ident2ODBC_SyncGroupDel call the companion deletion workflows for objects in state TBDEL.

  6. ODBC2Ident_SyncGroup_ODBCExport and ODBC2Ident_SyncGroup_MetaCP synchronize changed groups from ODBC back to the Identity Store, and ODBC2Ident_SyncAcc_ODBCExport plus ODBC2Ident_SyncAcc_MetaCP do the same for accounts.

If one activity fails, the workflow stops at that point and the remaining activities do not run.

Operation

  1. Start Ident_ODBC_Sync manually or on a schedule.

  2. The workflow begins with the Identity Store to ODBC direction for accounts, immediately followed by the companion workflow that reads back ODBC-assigned keys for newly created accounts.

  3. It then repeats the same pattern for groups, synchronizes group memberships, and calls the dedicated deletion workflows for accounts and groups that are already in state TBDEL in the Identity Store.

  4. After the outbound work is complete, the workflow exports changed groups from the ODBC-connected system and imports them into the Identity Store, then does the same for changed accounts.

  5. If a main activity or called sub-workflow fails, the remaining steps do not run. When the workflow finishes successfully, the Identity Store has processed the returned ODBC data and holds the keys that the connected system assigned to newly created objects.