"Collision Strategy" Explanation (4235630)

"Collision Strategy" Explanation

Description of each available option for "Collision Strategy" with Integration.

The collision strategy runs the first time the container is discovered.

What to do for usernames that conflict with TPAM restricted usernames:

- "Report as Error": The appliance will do nothing and indicate that the account already exists in the log.

- "Create Unique": TPAM will create a new account and map it to that account of the Generic/LDAP system.  For example, if jsmith exists in TPAM, jsmith1 is created and it is mapped to jsmith from the Generic/LDAP system.

Username exists in TPAM:

"No Unique UserID mapping": No connection between the local account and the other system is found.

- "No Action": TPAM does nothing with the account.
- "Create Unique TPAM User": TPAM will create a new account and map it to that account of the Generic/LDAP system.
- "Map to Existing": TPAM creates as connection between existing users from TPAM and the Generic/LDAP server.
- "Report as Error": The appliance will do nothing and indicate that the account already exists in the log.

"Unique UserID mapping exists": A connection to a local account exists and an account on the system exists.

- "No Action": TPAM does nothing with the account.
- "Create Unique TPAM User": TPAM will create a new account and map it to that account of the Generic/LDAP system.
- "Report as Error": The appliance will do nothing and indicate that the account already exists in the log.

What to do when a user mapped to a TPAM User is removed from the source container:

- "Leave user, remove mapping": If a user is removed from the Integration system the user will remain as a local user on the appliance, but the mapping to the container will be removed.  Changes made outside of TPAM will not be reflected on this user account.
- "Disable User in TPAM": The user ID in TPAM will be disabled.
- "Report as Error":  TPAM will do nothing and indicate an error in the log.

BFER 7118

Note the following scenario: LDAP mapping 'Group A' with these options: Username Exist in TPAM No Distinguished Name mapping: No Action Distinguished Name mapping exist: No Action What to do when an LDAP Directory user mapped to a TPAM User is removed from the source container: Disable User in TPAM LDAP mapping 'Group B' with these options: Username Exist in TPAM: No Distinguished Name mapping: Map to existing Distinguished Name mapping exist: No Action What to do when an LDAP Directory user mapped to a TPAM User is removed from the source container: Leave User, remove mapping The results are: a) If the user has only Group A (with the Disable user when is not in source), then the user is disabled when is out of the group and enabled when is re-added. b) If the user has both groups (Group A and Group B) then the user is not disabled when its moved out of Group A. This is expected behaviour, and an enhancement BFER 7118 has been raised to handle multiple LDAP mappings for same user.