This section lists the data objects supported by the SCIM Connector, along with the data operations you can perform on those objects via the SCIM Connector.
|
Object |
Read |
Create |
Delete |
Update |
|
Core user |
Yes | Yes | Yes | Yes |
|
Group |
Yes | Yes | Yes | Yes |
|
Enterprise |
Yes |
Yes | Yes | Yes |
|
Object |
Read |
Create |
Delete |
Update |
|
User |
Yes | Yes | Yes | Yes |
|
Group |
Yes | Yes | Yes | Yes |
Once you configured a connection with the Generic SCIM Connector as described in Configuring the Generic SCIM Connector for Starling Connect connections, you can configure import-based data synchronization tasks to import data from the SCIM-based SuccessFactors HR and ServiceNow connectors of Starling Connect to another target system supported by Active Roles Synchronization Service.
Creating such a SCIM-based sync workflow has two main steps:
Mapping objects by configuring one or more mapping pairs and mapping rules. By mapping objects, you can specify logic checks by which Active Roles Synchronization Service can identify if two data entries stored in two separate databases are the same or not.
With mapping pairs, you can establish a relationship between object types in two connected systems.
With mapping rules, you can define the conditions on how the objects specified in the mapping pair will be mapped during synchronization.
You can use object mapping, for example, to identify the same data entries between a SuccessFactors HR database (connected to Active Roles via a Generic SCIM Connector connection) and an SQL server (connected to Active Roles Synchronization Service via a Microsoft SQL Server Connector).
To do so, you can set up a mapping that compares the User ID value of the data entries in the two systems. If the data entries in the two systems share the same User ID, Active Roles will consider them the same.
For more information on object mapping, see Mapping objects. For an example mapping procedure using the Generic SCIM Connector, see Creating object mapping between a SCIM connection and an SQL connection.
Setting up a sync workflow based on the configured object mapping, so that you can automate creating, removing or deprovisioning specific data entries between the connected systems.
For more information on sync workflows, see Synchronizing identity data. For an example workflow configuration procedure using the Generic SCIM Connector, see Creating a sync workflow for synchronizing data from a SCIM-based Starling Connect connector.
The following chapters will provide an example for setting up a sync workflow that will import data from a SuccessFactors HR database via a Generic SCIM Connector connection, and synchronizing that data to an SQL database.
Once you configured a connection with the Generic SCIM Connector as described in Configuring the Generic SCIM Connector for Starling Connect connections, you can configure import-based data synchronization tasks to import data from the SCIM-based SuccessFactors HR and ServiceNow connectors of Starling Connect to another target system supported by Active Roles Synchronization Service.
The first step of creating this synchronization is mapping objects between the SCIM-based source system and a target system, so that Active Roles Synchronization Service can detect identical data entries between the two system for proper data synchronization.
By mapping objects, you can specify logic checks by which Active Roles Synchronization Service can identify if two data entries stored in two separate databases are the same or not.
With mapping pairs, you can establish a relationship between object types in two connected systems.
With mapping rules, you can define the conditions on how the objects specified in the mapping pair will be mapped during synchronization.
The following example procedures show how to create a mapping pair and a mapping rule between:
A SuccessFactors HR database connected to Active Roles Synchronization Service with the Generic SCIM Connector. The SuccessFactors HR database will be the source system from which Active Roles Synchronization Service imports the data.
An SQL database connected to Active Roles Synchronization Service with the Microsoft SQL Server Connector. The SQL database will act as the target system to which Active Roles Synchronization Service will synchronize the SuccessFactors HR data.
You can perform the following procedures only if Active Roles Synchronization Service already contains the following working connectors:
A Generic SCIM Connector connecting Active Roles Synchronization Service to the Starling Connect SuccessFactors HR connector. To configure such a connection, see Configuring the Generic SCIM Connector for Starling Connect connections. In this example procedure, this connection is called SCIM Connection to SuccessFactors HR.
A Microsoft SQL Server Connector providing connection to the SQL Server used in this example. To configure such a connection, see Creating a Microsoft SQL Server connection. In this example, this connection is called SQL Connection.
To configure a mapping pair between a SuccessFactors HR database and an SQL database
In Active Roles Synchronization Service, navigate to Mapping, then click the SCIM Connection to SuccessFactors HR connection.
Figure 7: Active Roles Synchronization Service – Selecting a connector for mapping objects
To start configuring a new object mapping with the Add mapping pair dialog, click Add mapping pair.
In the Specify source step, under Connected system object type, select the resource object type you want the object mapping to check. In this example, we are using the Employees data entry of the SuccessFactors HR database, so click Select, then in the Select Object Type step, select Employees.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
To apply your selection, click OK, then Next.
In the Specify target step, under Target connected system, configure the target system where the other resource object type is located. To do so, click Specify, and in the Add Connected System Wizard, select the Select existing connected system option, then the connector of the SQL server (in this example, SQL Connection). To apply your selection, click Finish.
Under Connected system object type, select sql-Object.
To create the mapping pair, click Finish.
(Optional) If needed, you can configure additional mapping pairs as well for your sync workflow. To do so, click Add mapping pair again, and repeat the procedure. This example procedure uses only one mapping pair.
Once the mapping pair is created, you can configure its associated mapping rule.
To configure a mapping rule between a SuccessFactors HR database and an SQL database
In Active Roles Synchronization Service, navigate to Mapping, then click the SCIM Connection to SuccessFactors HR connection.
The previously configured mapping pair appears. To open the available mapping pair settings, click the Employees object type in the mapping pair.
Figure 8: Active Roles Synchronization Service – Mapping pair in a configured SCIM connection
To start configuring a new mapping rule, in the Mapping pair window, click Add mapping rule.
In the Define Mapping Rule window, specify the source and target resource object types that must be equal so that Active Roles Synchronization Service can map the data pairs. In this example, we are using the UserID attribute for this purpose both in the SuccessFactors HR database and in the SQL database as well.
Therefore, at the Value generated for SCIM Connection to SuccessFactors HR by using field, click Attribute, then in the Select attribute window, select userId. This adds the userId object value to both the source and target fields.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
To finish adding the mapping rule, click OK.
Figure 9: Active Roles Synchronization Service – Mapping rule in a configured SCIM mapping pair
To start the mapping synchronization based on the configured value pair of the mapping rule, click Map now. Active Roles Synchronization Service offers two mapping types:
Quick Map, using local cached data to speed up the mapping process.
Full Map, retrieving data from the source and target data system for accuracy.
As this is the first time of running this mapping, perform a Full Map.
Once the mapping rule finishes running successfully, it will indicate the unmapped, changed and mapped objects, along with the objects that do not meet the scope conditions of the configured mapping rule.
Once you configured a connection with the Generic SCIM Connector as described in Configuring the Generic SCIM Connector for Starling Connect connections, you can configure import-based data synchronization tasks to import data from the SCIM-based SuccessFactors HR and ServiceNow connectors of Starling Connect to another target system supported by Active Roles Synchronization Service.
The second step of creating this synchronization task is setting up a sync workflow based on the object mapping configured in Creating object mapping between a SCIM connection and an SQL connection. By configuring a workflow, you can automate creating, removing or deprovisioning specific data entries between the connected systems.
The following example procedure shows how to create a workflow that creates and updates data synchronization between:
A SuccessFactors HR database connected to Active Roles Synchronization Service with the Generic SCIM Connector. The SuccessFactors HR database will be the source system from which Active Roles Synchronization Service imports the data.
An SQL database connected to Active Roles Synchronization Service with the Microsoft SQL Server Connector. The SQL database will act as the target system to which Active Roles Synchronization Service will synchronize the SuccessFactors HR data.
Before performing the procedure, make sure that the following conditions are met:
Active Roles Synchronization Service must already contain the following working connectors:
A Generic SCIM Connector connecting Active Roles Synchronization Service to the Starling Connect SuccessFactors HR connector. To configure such a connection, see Configuring the Generic SCIM Connector for Starling Connect connections. In this example procedure, this connection is called SCIM Connection to SuccessFactors HR.
A Microsoft SQL Server Connector providing connection to the SQL Server used in this example. To configure such a connection, see Creating a Microsoft SQL Server connection. In this example, this connection is called SQL Connection.
The mapping pair and mapping rule configured in Creating object mapping between a SCIM connection and an SQL connection are active and working.
To configure a data sync workflow between a SuccessFactors HR database and an SQL database
In Active Roles Synchronization Service, click Sync Workflows > Add sync workflow.
Figure 10: Active Roles Active Roles Synchronization Service – Adding a new sync workflow
In the Sync workflow name step, name the workflow (for example, SuccessFactors HR to SQL Server), then click OK.
The new workflow then appears in the Sync Workflows tab.
Configure a data synchronization creation step for the workflow. To do so, in Sync Workflows, click the name of the workflow (in this example, SuccessFactors HR to SQL Server), then click Add synchronization step.
Figure 11: Active Roles Synchronization Service – Adding a new synchronization step
In the Select an action step, select Creation, then click Next.
The Creation step of the workflow will be used to create the synchronized data entries of the SuccessFactors HR database in the target SQL database. The Creation step performs data synchronization only for data entries that do not exist in the target system. Because of this, you typically run this step only once.
In the Specify source and criteria step, configure the following settings:
Source connected system: Specify the SuccessFactors HR database connection here, created with the Generic SCIM Connector. To do so, click Specify > Select existing connected system, then select the SCIM-based connection (in this example, SCIM Connection to SuccessFactors HR).
Source object type: Specify the source object type here (in this example, the Employees object type). To do so, click Select, then in the Select Object Type window, select Employees, and click OK.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
(Optional) Creation Criteria: Specify additional conditions that the specified source object(s) must meet for synchronization in this workflow step. This setting is not used in this example.
In the Specify target step, configure the following settings:
Target connected system: Specify the SQL Server connection here, created with the Microsoft SQL Server Connector. To do so, click Specify > Select existing connected system, then select the SQL Server connection (in this example, SQL Connection).
Target object type: Specify the target object type here. By default, when selecting an SQL Server connection in Target connected system, Active Roles Synchronization Service sets this setting to sql-Object, the object type used in this example.
In the Specify creation rules step, configure the logic (called forward synchronization rules) that Active Roles Synchronization Service will use to perform first-time synchronization and copy data entries from the SuccessFactors HR database over to the target SQL database.
To do so, specify one or more unique attributes that Active Roles Synchronization Service can use to link the corresponding data entries in the connected SuccessFactors HR and SQL data systems. In this example, four such SuccessFactors HR attributes are specified: userName, userId, emails.value and name.familyName.
To specify these creation rules:
Click Forward Sync Rule.
Click Source item > Attribute, and in the Select Object Attribute window, search for the user name attribute in the SuccessFactors HR database (for example, userName), then click OK.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
Click Target item > Attribute, and search for the applicable user name attribute pair in the SQL database (for example, userName), then click OK.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
Figure 12: Active Roles Synchronization Service – Mapping attributes for a forward synchronization rule
To apply the forward synchronization rule created for the specified user name attributes, click OK.
To configure synchronization rules for the userId, emails.value and name.familyName SuccessFactors HR data entries too, click Forward Sync Rule again, and repeat the previous sub-steps by selecting the source and target attributes applicable to these data entries.
Once all forward synchronization rules are configured, to finish configuring the Creation step, click Finish.
Figure 13: Active Roles Synchronization Service – Finalizing all forward synchronization rules
This creates the Creation step as the first step of the sync workflow.
Figure 14: Active Roles Synchronization Service – Step 1 created for the SuccessFactors HR / SQL server workflow
Now that the Creation step of the workflow is configured, configure the Update step. To do so, click Add synchronization step again.
The Update step of the workflow will be used to update existing data entries mapped between the SuccessFactors HR database and the target SQL database. The Update step performs data synchronization only for existing data entries: it does not create new ones. Because of this, you typically run this step after running the Creation step, and run only the Update step later once the data entries have been created with the Creation step.
In the Select an action step, select Update, then click Next.
In the Specify source and criteria step, configure the following settings:
Source connected system: Specify the SuccessFactors HR database connection here, created with the Generic SCIM Connector. To do so, click Specify > Select existing connected system, then select the SCIM-based connection (in this example, SCIM Connection to SuccessFactors HR).
Source object type: Specify the source object type here (in this example, the Employees object type). To do so, click Select, then in the Select Object Type window, select Employees, and click OK.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
(Optional) Creation Criteria: Specify additional conditions that the specified source object(s) must meet for synchronization in this workflow step. This setting is not used in this example.
In the Specify target step, configure the following settings:
Target connected system: Specify the SQL Server connection here, created with the Microsoft SQL Server Connector. To do so, click Specify > Select existing connected system, then select the SQL Server connection (in this example, SQL Connection).
Target object type: Specify the target object type here. By default, when selecting an SQL Server connection in Target connected system, Active Roles Synchronization Service sets this setting to sql-Object, the object type used in this example.
In the Specify update rules step, configure the forward synchronization rules that Active Roles Synchronization Service will use to update existing data entries in the target SQL database from the SuccessFactors HR database. In this example, four such attributes are specified: userName, userId, SuccessFactors HR ID (displayed as sfid) and metadata information (displayed as meta).
To specify these creation rules:
Click Forward Sync Rule.
Click Source item > Attribute, and in the Select Object Attribute window, search for the user name attribute in the SuccessFactors HR database (for example, userName), then click OK.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
Click Target item > Attribute, and search for the applicable user name attribute pair in the SQL database (for example, userName), then click OK.
TIP: If the data entry is hard to find due to the length of the list, use the Filter by name field to find it quicker.
To apply the forward synchronization rule created for the specified user name attributes, click OK.
To configure synchronization rules for the user ID, sfid and meta data entries too, click Forward Sync Rule again, and repeat the previous sub-steps by selecting the source and target attributes applicable to these data entries.
Once all forward synchronization rules are configured, to finish configuring the Update step, click Finish. The configured workflow will appear, containing both steps.
Start the workflow by clicking Run workflow. For the first-time run, select only Step 1 (Creation from SCIM Connection to SuccessFactors HR to SQL Connection), then select the running method:
Full Run fetches all data entries specified in the workflow steps directly from the source system. As such, One Identity recommends using this method when running the workflow the first time, even if the process takes longer than a Quick Run.
Quick Run uses cached data whenever possible, and is normally faster.
The run may take several minutes to complete.
Figure 15: Active Roles Synchronization Service – Running a configured sync workflow for the first time
Once Active Roles Synchronization Service found all mapped objects, apply the synchronization changes by clicking Commit.
Alternatively, to check detailed information about the processed objects, click the Processed objects number. The Objects processed in window then opens, listing all new data objects that Active Roles Synchronization Service will synchronize to the target SQL database.
© 2024 One Identity LLC. ALL RIGHTS RESERVED. 利用規約 プライバシー Cookie Preference Center
