How does revision filtering work?
When you start , all synchronization objects are loaded. Some of these objects have not be modified since the last synchronization and, therefore, must not be processed. Synchronization is accelerated by only loading those object pairs that have changed since the last synchronization. One Identity Manager uses revision filtering to accelerate synchronization.
Prerequisites
- The target system supports revision filtering.
This data is supplied by the system connector.
- types own a schema property which is labeled as a .
This schema property stores the information about the last object modifications.
Example of an Active Directory group:
- In the target system schema: UNS Changed
- In the One Identity Manager schema: Date
- permitted for this .
Revision filtering can be applied to workflows and start up configuration. The workflow setting is valid for all synchronizations with this workflow. In order to synchronize with the same workflow at different times, with, and without revision filtering, create different start up configurations and specify revision filtering for them.
To permit revision filtering on a workflow
-
In the , open the .
- Edit the workflow properties. Select the Use revision filter item from Revision filtering menu.
For more information, see How to edit a workflow.
To permit revision filtering for a start up configuration
For more information, see How to edit start up configurations.
Normally, each object keeps information about the last changes made. The highest change data value of all synchronized objects of a schema type is taken as the revision in the One Identity Manager database (DPRRevisionStore table, DPRRevisionStore column). This value is used as a comparison for revision filtering when the same workflow is synchronized the next time. This means that when this workflow is next synchronized, the object change data is compared with the revision saved in the One Identity Manager database. This involves finding object pairs where one has newer change data than the last time it was synchronized. Thus, only objects that have changed since the last synchronization are updated.
The reference parameter for revision filtering is also the last schema type synchronization with the same workflow. The table DPRRevisionStore contains one entry per workflow and schema type.
NOTE: One Identity Manager supplies a , which regularly cleans up the contents of the DPRAttachedDataStore table. Entries for schema types that are no longer used in the synchronization configuration are deleted in the process. The process plan is run during daily .
Related topics
How does dependency resolution work?
Dependencies can arise between schema classes that require to be repeated. For example, object references cannot be set until the reference object has been added. Dependencies can also arise between schema properties within a schema class.
Figure 9: Example of a workflow with dependent schema classes and schema properties
One Identity Manager can automatically resolve such dependencies. In this case, the steps are group together such that the referenced objects are synchronized first and them the dependent objects next. If dependencies exist within a schema class, additional synchronization steps are inserted to synchronize the dependent schema properties. The final sequence of synchronization steps can be viewed in the report "".
NOTE: If dependencies exist between schema classes, the schema classes must be synchronized by the same workflow so that dependencies can be automatically resolved.
Figure 10: Example of a workflow with automatic dependency resolution
To set up automatic resolution of dependencies
Use automatic dependency resolution by default. Only select manual dependency resolution if individual dependencies cannot be resolved automatically. This might be necessary, for example, if two objects reference each other as mandatory properties.
NOTE: If dependency resolution is set to "Manual", One Identity Manager does not check whether dependencies exits between schema classes and schema properties during synchronization. The synchronization steps are processed sequentially in the order displayed in the workflow view.
Synchronization exits with an error if dependencies exist that cannot be resolved!
To resolve dependencies manually
- Find the schema properties between which dependencies exist.
- Create a workflow with synchronization steps which take the following criteria into account:
- Synchronization steps which synchronize independent and references objects.
Property mapping rules for dependent schema properties must be excluded for this.
- Synchronization steps which reference dependent objects.
Property mapping rules for dependent schema properties must be included for this.
- Specify the synchronization step sequence such that all synchronization steps for a) are run first and them the synchronization steps for b).
- Edit the workflow properties. Select the following option:
| Dependency resolution: |
Manual |
For more information, see How to edit a workflow.
Related topics
Unresolvable references
If a reference object does not exist in the One Identity Manager database, the object reference cannot be resolved by . Unresolvable object references are written in a buffer called the data store (table DPRAttachedDataStore). This ensures that these references remain intact and are not deleted in the target system by provisioning.
Example
An Active Directory group has an account manager, which owns a domain not in the current synchronization run. The account manager is not in the One Identity Manager database either.
Synchronization cannot assign an account manager. In order to retain the assignment, the object reference is saved with the account manager's distinguished name in the data store.
During each synchronization One Identity Manager tries to clean up the data store. If referenced objects in the One Identity Manager database exist, the references can be resolved and the entries are deleted from the data store. The data store is cleaned up depending on the synchronization type (with or without revision filter) and the mode.
Table 23: Maintenance for unresolved object references
| The following applies depending on the maintenance mode: |
Object references of all synchronization objects are cleaned up if they exist in the One Identity Manager database. |
Only object references for modified objects are cleaned up. |
| No maintenance |
There is no additional task of clearing up the data store. |
| Always synchronize affected objects |
No effect. |
The filter is removed on objects with unresolved references. Therefore, references are also cleaned if the objects have not been changed since the last synchronization. |
| Full maintenance after every synchronization |
One Identity Manager tries to resolve object references following synchronization. As a result, unresolved references are processed that arose during this synchronization run. |
One Identity Manager tries to resolve object references following synchronization. As a result, unresolved references are processed that arose during this synchronization run. Object references that were not modified are also cleaned up. |
You can enter the number of retries for resolving object references. It may be necessary to try several times to resolve an object if it maps a hierarchy with several levels. One hierarchy level at a time can be resolved with each attempt to resolve an object.
To set up maintenance mode
NOTE: One Identity Manager supplies a , which regularly cleans up the contents of the table DPRAttachedDataStore. Object entries, which no longer exist in the One Identity Manager database are deleted. The process plan is run during daily maintenance.
Related topics
Direction of synchronization and mapping
To a target system with One Identity Manager, you must specify which of the is the primary system. The primary system is defined in the synchronization configuration by the synchronization direction. The direction in which schema properties are mapped may differ from this. Therefore, the permitted must be given in the schema properties mapping.
Table 24: Direction of synchronization
| |
In which direction a specific synchronization is run |
| |
In which direction synchronizations are run |
| synchronization step |
By which synchronization direction the step is run |
Table 25: Permitted mapping direction
| Mapping |
By which synchronization direction property mapping rules are used |
| |
By which synchronization direction this property mapping rule is used |
One Identity Manager synchronizes two connection systems in the direction given in the start up configuration or in the workflow. A synchronization step is only run in this case, if the direction of synchronization stored with the step matches with the direction of the current synchronization. If the mapping direction stored with the mapping corresponds to the current direction of synchronization, the system object from this schema class are synchronized. Thus, One Identity Manager checks which property mapping rule can be used in the current synchronization direction. This property mapping rule is ignored if the mapping direction of the property mapping rule differs from the current direction of synchronization.
Figure 11: Example showing effect of specified synchronization direction and permitted mapping direction
Related topics
