Identity Manager 9.2.1 - One Identity Manager Connector User Guide

To be able to successfully run system synchronization, some properties must be set on the work database. You can run the SQL queries listed here with a suitable program.

Using the GUID module

The Module GUID permitted table property (DialogTable.IsModuleGUIDAllowed) table property must be set on all the tables you want to synchronize. To enable this option, run the following query on the central database first and then on the work database.

-- transfer customized configuration DialogTable.IsModuleGUIDAllowed from your central database 

-- => manual process required

select UID_DialogTable, 'Update DialogTable set IsModuleGUIDAllowed = 1 

    where IsModuleGUIDAllowed = 0 and UID_DialogTable = '''+UID_DialogTable+''' ' as ChangeStatement 

    from DialogTable where IsModuleGUIDAllowed = 1

--if you got an result, copy the commands and execute them in your work database

Disabling all provisioning processes

Since there are no target systems associated with the work database, the standard provisioning processes should not be run here. Run the queries for this on the work database.

The following query disables all processes for the tables:

• PersonHasTSBAccountDef

• PersonHasQERResource

• TSBAccountDef (TSB_TSBAccountDef_AutoAssignToPerson and TSB_TSBAccountDef_AutoRemoveFromPerson)

-- deactivate all predefined provisioning processes

update JobChain set NoGenerate = 1, XDateUpdated = GETUTCDATE(), XUserUpdated = 'SysSyncInitialConfig' from JobChain JC 

    join JobEventGen JEG on JEG.UID_JobChain = JC.UID_JobChain 

    join QBMEvent JE on JE.UID_QBMEvent = JEG.UID_QBMEvent where 

        (

        JE.EventName in ('Insert', 'Update', 'Delete', 'Assign', 'Remove') 

        or JC.UID_DialogTable in ('TSB-T-PersonHasTSBAccountDef', 'QER-T-PersonHasQERResource') 

        or UID_JobChain in ('TSB-F9E8F1B2DA86E847A254E70A572A3832','TSB-EB76885961C6404FB7BB73FC1AC83153')

        ) 

        and dbo.QBM_FCVGUIDToModuleOwner(JC.UID_JobChain) <> 'CCC' 

        and NoGenerate = 0

The following query disables the merge mode of single membership provisioning for all assignment tables.

-- deactivate merge for provisioning (DPRMemberShipAction) for all synchronized tables

update DPRNameSpaceHasDialogTable set IsAdHocSingleMemberShip = 0, WhereClause = Null

The following query prevents dependencies' modification dates from updating on assignment base tables.

-- deactivate XDateSubItem behavior for all synchronized tables

update QBMRelation set IsForUpdateXDateSubItem = 0 where UID_QBMRelation in 

    (

    select UID_QBMRelation from QBM_VQBMRelation r 

        join DialogTable t on r.UID_DialogTableChild=t.UID_DialogTable or r.UID_DialogTableParent=t.UID_DialogTable 

            where t.SystemSyncMode > 0 and r.IsForUpdateXDateSubItem = 1

    )

Disabling schedules

The following query disables all schedules except for custom schedules and system schedules. Modify this query for the purposes of the work database. Run the query on the work database.

-- deactivate all not required schedules

-- allow only system and custom schedules as well as such ones belonging to reports and attestation

-- but disable all synchronization schedules except the system synchronization

update DialogSchedule 

    set Enabled = 0, XDateUpdated = GETUTCDATE(), XUserUpdated = 'SysSyncInitialConfig' 

        where Enabled = 1 and 

            (

            dbo.QBM_FCVGUIDToModuleOwner(UID_DialogSchedule) not in ('CCC','QBM','QER','RPS','ATT') 

            or (Name like '%execution of Initial Synchronization%' and Name not like 'System Synchronization%')

            )

Disabling DBQueue Processor tasks for SAP objects

Since there are no target systems associated with the work database, DBQueue Processor tasks for processing SAP objects can be disabled. Run the query on the work database.

-- disable SAP/SBW DBQueueTask for generation SAPUserMandant and SAPBWUser

update QBMDBQueueTask 

    set ProcedureName = 'QBM_ZDBQueueVoidTask', CountParameter = 0, MaxInstance = 1, IsBulkEnabled = 0, QueryForRecalculate = Null 

        where UID_Task in ('SAP-K-SAPUserMandant', 'SBW-K-SAPBWUser')

Disabling recalculation of dynamic roles

If dynamic roles are synchronized, the assignments should not be recalculated on the work database as it is possible that not all the required data is available here yet. The memberships and assignments are calculated only on the central database and transferred to the working database by synchronization.

To prevent assignments to synchronized dynamic roles being calculated

1. In the Designer, select the One Identity Manager Schema > Tables > Table category.

2. Select the DynamicGroup table and click the Show table definition task to start the Schema Editor.

3. In the Table properties view, select the Table scripts tab.

4. In the Script (OnSaving) field, enter the following script.

   If CBool(Connection.Variables("Transport")) AndAlso CBool(Connection.Variables("Projector")) Then

   Base.PutValue("IsRecalculationDeactivated", 1)

   End If

5. Select the Database > Commit to database and click Save.

This prevents recalculation of assignments for dynamic roles that are imported into the work database by synchronization. The role memberships in effect are those from the central database that synchronized with the work database.

Related topics

• Setting up system synchronization