In the default configuration of processes and synchronization behavior, the integrated connector works without input from workflows. Changes are published immediately in Active Directory. An administrative user account. which is member in the group is required for default behavior.
The One Identity Manager connector integrated in does, however, allow workflows to be controlled. That means, every operation in the that is linked to a workflow starts that workflow.
If the connector is supposed to trigger workflows, you may have to customize processes so that they wait for the workflows to run and the changes to be made in Active Directory. This is necessary because the One Identity Manager processes defined in the Active Directory are run synchronously. The connector is provided with additional functions to support you when querying the status of workflows.
The domain configuration and One Identity Manager Service user account permissions determine whether workflows are triggered.
NOTE: If the One Identity Manager Service's user account is a member in the administrators group, workflows are always bypassed irrespective of the option setting.
For more information about workflows, see your One Identity Active Roles documentation.
The following table show the correlation.
Table 5: Correlation to workflow control
|
Yes |
Yes |
No |
The operation is run immediately. |
|
Yes |
No |
No |
The operation is run immediately. |
|
Yes |
Yes |
Yes |
The operation is run immediately without input from workflows. |
|
Yes |
No |
Yes |
The operation is run immediately without input from workflows. |
|
No |
Yes |
No |
The operation is run immediately. |
|
No |
No |
No |
The operation is run immediately. |
|
No |
Yes |
Yes |
The Operation triggers workflows and depends on the final status. |
|
No |
No |
Yes |
The operation quits with an error message. |
Related topics
NOTE: One Identity Manager sets up the domains in the Synchronization Editor database.
To edit main data of an Active Directory domain
-
In the Manager, select the Active Directory > Domains category.
-
Select the domain in the result list and run the Change main data task.
-
On the tab, enter the following data for utilizing workflows.
Table 6: Extended properties for applying workflows
|
Run workflows |
Specifies whether to run workflows. For more information about workflows, see your One Identity Active Roles documentation.
If this option is set, workflows can be controlled by the integrated connector. You may need to define custom processes in One Identity Manager to use this functionality.
If this option is not set, One Identity Manager works without input from workflows (default configuration). Default behavior requires an administrative account.
NOTE: If the One Identity Manager Service user account is a member in the administrators group, workflows are always bypassed independent of the option. |
|
User accounts deleted by workflows |
Specifies whether user accounts are deleted in through deprovisioning workflows. |
|
Groups deleted by workflows |
Specifies whether groups are deleted in through deprovisioning workflows. |
- Save the changes.
Related topics
The ID found by the connector is returned in the LastOperationID output parameter of each change operation in Active Directory. The operation status passed from is returned in the LastOperationStatus parameter. If no workflow is triggered and the operation is successful, the status Completed is returned. If a workflow is triggered, then the status Pending is returned. You can use these task parameters in follow-up processes to wait for the workflows to be run.
The schema is provided with additional virtual properties for querying the current status of workflows.
NOTE:Virtual properties do not require any extension to the Active Directory schema. behaves as though these properties really exist.
These virtual properties are defined as read-only and exist for all objects but are not mapped in the default project template. To use this functionality, you must adapt the custom mapping.
When the properties are read, the connector runs an OperationSearchRequest call to . To limit the impact on performance, the result of the queries is held for 30 seconds in cache.
Table 7: Virtual properties for the connector
|
vrtLastOperationID |
ID of the last operation in . |
|
vrtLastOperationStatus |
Status of the last operation in . Possible statuses are Unknown, Pending, Completed, Rejected, Failed, and Canceled. |
For more information, see your One Identity Active Roles documentation.
