Export Provisioning Collections

Workflow to export provisioning collections. Exports a complete privilege tree including roles, permissions and groups

Export Provisioning Collections exports the complete privilege tree of a DirX Identity domain — including roles, permissions and groups — to an LDIF file. Administrators use it to capture the current provisioning configuration of one domain so that it can be imported into another domain or used as a backup of the provisioning collections.

The perform activity can run in simulation mode (simulationmode simulateLDIF) to produce a preview without writing to the target, and records a trace file (tracefilename exportTrace.txt) and a simulation output file (simulationfilename exportSim.txt) for review.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Export Provisioning Collections

Prerequisites

The Java-based Server must have write access to the directory where the export files (tracefilename, simulationfilename) are written.
The domain parameter of the perform activity must point to the correct company DN (cn=My-Company by default).

Workflow and Activities

Activity Type Component description Description Ports

Activity	Type	Component description	Description	Ports
`error`	`error`	`provisioningActivity`	Error Activity	`Message`
`perform`	`Server`	`transportActivity`	Activity for performing the transport task	-

error

provisioningActivity

Error Activity

Message

perform

Server

transportActivity

Activity for performing the transport task

Ports

Activity Port Component description Connector Connected directory Bind profile SSL

Activity	Port	Component description	Connector	Connected directory	Bind profile	SSL
`error`	`Message`	`errorPort`	`ErrorNotifyMailConnector`	-	-	not set

error

Message

errorPort

ErrorNotifyMailConnector

not set

Configuration Parameters

Table 1. Workflow parameters of `Export Provisioning Collections`
Parameter	Default value
`timeout`	P0Y0M4DT0H0M0S
`transport`	true

Table 2. Parameters of activity `error`
Parameter	Default value
`resourcefamily`	LDAP
`retrylimit`	0
`timeout`	P0Y0M1DT0H0M0S
`waitbeforeretry`	P0Y0M0DT0H0M0S

Table 3. Parameters of port `Message` (activity `error`)
Parameter	Default value
`decrypt.attribute`	dxmPassword

Table 4. Parameters of activity `perform`
Parameter	Default value
`domain`	cn=My-Company
`loglevel`	9
`resourcefamily`	workflowengine
`retrylimit`	0
`simulationfilename`	exportSim.txt
`simulationmode`	simulateLDIF
`timeout`	P0Y0M1DT0H0M0S
`tracefilename`	exportTrace.txt
`waitbeforeretry`	P0Y0M0DT0H0M0S

A Java-based real-time workflow runs as a permanently loaded configuration in the Java-based Server (IdS-J). It is triggered by a request or an event rather than by a schedule. Each workflow consists of activities; an activity opens one port per system it talks to, and each port uses a connector to reach that system.

Most provisioning workflows contain a join activity that performs the actual work and an error activity that receives requests which still fail after all retries and sends a notification about them. The retrylimit, waitbeforeretry and timeout parameters of an activity control how often and how long a failed request is retried before it is handed to the error activity.

The event port publishes change events over JMS, and the notify port sends e-mail notifications. Neither port is bound to a connected directory.

The perform activity uses the transportActivity component with the Server type to carry out the export directly within the Java-based Server. It has no external connector ports. The domain parameter scopes the export to the company DN, and loglevel (9) controls diagnostic verbosity. When simulationmode is simulateLDIF (the default), the activity writes the simulated LDIF output to simulationfilename and a trace to tracefilename without committing changes.

Because retrylimit is 0, a failure is not retried: the request is passed immediately to the error activity, which sends a notification via the Message port.

Operation

An export request is submitted to the Export Provisioning Collections workflow, typically through the Identity Manager.
The perform activity reads the provisioning collections (roles, permissions and groups) from the domain cn=My-Company and writes them to an LDIF output file.
When simulationmode is simulateLDIF, the activity writes a simulation file (exportSim.txt) and a trace file (exportTrace.txt) without making permanent changes.
If the export fails, the request is passed immediately to the error activity (retrylimit is 0), which reports the failure by e-mail through the Message port.

The workflow is delivered inactive (dxmActive is FALSE). Copy it into your own scenario, verify the domain parameter and the output file paths, and activate the copy.