A synchronization project collects all the information required for synchronizing the One Identity Manager database with a target system. Connection data for target systems, schema types and properties, mapping, and synchronization workflows all belong to this.
Make the following information available for setting up a custom synchronization project for synchronizing with the One Identity Manager connector.
Table 6: Information required to set up a synchronization project
|
Synchronization server |
All One Identity Manager Service actions are run against the target system environment on the synchronization server. Data entries required for synchronization and administration with the One Identity Manager database are processed by the synchronization server.
Installed components:
The synchronization server must be declared as a Job server in One Identity Manager. The Job server name is required.
For more information, see Setting up the synchronization server. |
|
Remote connection server |
To configure synchronization with a target system, One Identity Manager must load the data from the target system. One Identity Manager communicates directly with the target system to do this. Sometimes direct access from the workstation, on which the Synchronization Editor is installed, is not possible. For example, because of the firewall configuration or the workstation does not fulfill the necessary hardware and software requirements. If direct access is not possible from the workstation, you can set up a remote connection.
The remote connection server and the workstation must be in the same Active Directory domain.
Remote connection server configuration:
The remote connection server must be declared as a Job server in One Identity Manager. The Job server name is required.
TIP: The remote connection server requires the same configuration as the synchronization server (with regard to the installed software and entitlements). Use the synchronization as remote connection server at the same time by installing the RemoteConnectPlugin as well.
For more detailed information about establishing a remote connection, see the One Identity Manager Target System Synchronization Reference Guide. |
|
Synchronization workflow |
Set the Data import option in the synchronization step if synchronization data is imported from a secondary system. You cannot select the MarkAsOutstanding processing method for these synchronization steps. This option takes effect in both directions, meaning also for synchronization to the target system.
For more detailed information about synchronizing user data with different systems, see the One Identity Manager Target System Synchronization Reference Guide. |
|
Base object |
You cannot normally specify a base object for synchronizing with database connectors. In this case, assignment of one base table and the synchronization server is sufficient.
-
Select the table from the Base table menu in which to load the objects. The base table can be used to defined downstream processes for synchronization. For more information about downstream processes, see the One Identity Manager Target System Synchronization Reference Guide.
-
The Synchronization servers menu displays all Job servers with an enabled One Identity Manager connector server function. |
|
Variable set |
If you implement specialized variable sets, ensure that the start up configuration and the base object use the same variable set. |
To configure synchronization with the One Identity Manager connector
-
Use the Synchronization Editor to create a new synchronization project.
-
Add mappings. Define property mapping rules and object matching rules.
-
Create synchronization workflows.
-
Create a start up configuration.
-
Define the synchronization scope.
-
Specify the base object of the synchronization.
-
Specify the extent of the synchronization log.
-
Run a consistency check.
-
Activate the synchronization project.
-
Save the new synchronization project in the database.
Detailed information about this topic
There is a wizard to assist you with setting up a synchronization project. This wizard takes you through all the steps you need to set up initial synchronization with a target system. Click Next once you have entered all the data for a step.
NOTE: The following sequence describes how to configure a synchronization project if the Synchronization Editor is both:
If you run the project wizard in expert mode or directly from the Synchronization Editor, additional configuration settings can be made. Follow the project wizard instructions through these steps.
To set up a synchronization project
-
Start the Launchpad and log in on the One Identity Manager database.
NOTE: If synchronization is run by an application server, connect the database through the application server.
-
Select the One Identity Manager connector entry and click Start.
This starts the Synchronization Editor's project wizard.
-
On the System access page, specify how One Identity Manager can access the target system.
-
If access is possible from the workstation on which you started the Synchronization Editor, do not change any settings.
-
If access is not possible from the workstation on which you started the Synchronization Editor, you can set up a remote connection.
Enable the Connect using remote connection server option and select the server to be used for the connection under Job server.
-
Select the database system to which you want to connect on the Select database system page.
-
Direct database connection: Specifies whether to connect directly to the central database.
-
Application server: Specifies whether the central database should be connected through an application server.
Set this option if modules other than in the work database are installed in the central database, or if the central database is running with an older version of One Identity Manager.
-
Use application server REST API: Specifies whether to use the application server's REST API for communicating with the central database.
IMPORTANT: Enable this option if the central database is operated with an older version of One Identity Manager.
-
On the Connection parameters page, enter the database credentials for the central database.
-
Enter the following data connecting directly to the database:
-
Server: Database server.
-
(Optional) Windows Authentication: Specifies whether the integrated Windows authentication is used. This type of authentication is not recommended. If you decide to use it anyway, ensure that your environment supports Windows authentication.
-
User: The user's SQL Server login name.
-
Password: Password for the user's SQL Server login.
-
Database: Select the database.
-
To connect through an application server, enter the URL and Synchronization user password.
-
To enter additional information about the database connection, click Advanced options.
-
Click Test.
-
Enter the private key for encrypting the database on the Encryption page.
-
On the Additional settings page, you define additional settings to customize the behavior of the connector.
-
Try to ignore data errors: Specifies whether objects with erroneous data should be synchronized with the central database.
By default, objects with incorrect data are not synchronized. These objects can be synchronized once the data has been corrected. In certain situations, however, it might be necessary to synchronize objects like these and ignore the data properties that have errors.
IMPORTANT: If data errors are ignored, performance will be affected. Synchronization can also lead to data loss. Only set this option in the exceptional circumstance of not being able to correct the data before synchronization.
NOTE:
-
The option cannot be enabled if the REST API of the application server is used.
-
This option is only effective if Continue on error is set in the synchronization workflow.
-
Default columns, such as primary keys, UID columns, or mandatory input columns cannot be ignored.
-
On the last page of the system connection wizard, you can save the connection data.
- Set the Save connection locally option to save the connection data. This can be reused when you set up other synchronization projects.
- Click Finish, to end the system connection wizard and return to the project wizard.
-
On the One Identity Manager Connection tab, test the data for connecting to the One Identity Manager database. The data is loaded from the connected database. Reenter the password.
NOTE:
-
If you use an unencrypted One Identity Manager database and have not yet saved any synchronization projects to the database, you need to enter all connection data again.
-
This page is not shown if a synchronization project already exists.
-
The wizard loads the target system schema. This may take a few minutes depending on the type of target system access and the size of the target system.
-
On the Select project template page, select a project template to use for setting up the synchronization configuration.
NOTE: The One Identity Manager connector does not provide a default project template for setting up synchronization. If you have created your own project template, you can select it to configure the synchronization project. Otherwise, select Create blank project.
-
Enter the general setting for the synchronization project under General.
Table 7: General properties of the synchronization project
|
Display name |
Display name for the synchronization project. |
|
Description |
Text field for additional explanation. |
- To close the project wizard, click Finish.
- Save the synchronization project in the database.
Related topics
All the schema data (schema types and schema properties) of the target system schema and the One Identity Manager schema are available when you are editing a synchronization project. Only a part of this data is really needed for configuring synchronization. If a synchronization project is finished, the schema is compressed to remove unnecessary data from the synchronization project. This can speed up the loading of the synchronization project. Deleted schema data can be added to the synchronization configuration again at a later point.
If the target system schema or the One Identity Manager schema has changed, these changes must also be added to the synchronization configuration. Then the changes can be added to the schema property mapping.
To include schema data that have been deleted through compression and schema modifications in the synchronization project, update each schema in the synchronization project. This may be necessary if:
To update a system connection schema
-
In the Synchronization Editor, open the synchronization project.
-
Select the Configuration > Target system category.
- OR -
Select the Configuration > One Identity Manager connection category.
-
Select the General view and click Update schema.
- Confirm the security prompt with Yes.
This reloads the schema data.
To edit a mapping
-
In the Synchronization Editor, open the synchronization project.
-
Select the Mappings category.
-
Select a mapping in the navigation view.
Opens the Mapping Editor. For more information about mappings, see the One Identity Manager Target System Synchronization Reference Guide.
NOTE: The synchronization is deactivated if the schema of an activated synchronization project is updated. Reactivate the synchronization project to synchronize.
Memberships, such as user accounts in groups, are saved in assignment tables in the One Identity Manager database. During provisioning of modified memberships, changes made in the target system may be overwritten. This behavior can occur under the following conditions:
-
Memberships are saved as an object property in list form in the target system.
-
Memberships can be modified in either of the connected systems.
-
A provisioning workflow and provisioning processes are set up.
If one membership in One Identity Manager changes, by default, the complete list of members is transferred to the target system. Therefore, memberships that were previously added to the target system are removed in the process and previously deleted memberships are added again.
To prevent this, provisioning can be configured such that only the modified membership is provisioned in the target system. The corresponding behavior is configured separately for each assignment table.
To allow separate provisioning of memberships
-
In the Manager, select the Data Synchronization > Basic configuration data > Target system types category.
-
In the result list, select the target system type.
-
Select the Configure tables for publishing task.
-
Select the assignment tables that you want to set up for single provisioning. Multi-select is possible.
-
Click Merge mode.
NOTE:
-
This option can only be enabled for assignment tables that have a base table with a XDateSubItem column.
-
Assignment tables that are grouped together in a virtual schema property in the mapping must be marked identically.
- Save the changes.
For each assignment table labeled like this, the changes made in One Identity Manager are saved in a separate table. Therefore, only newly added and deleted assignments are processed. During modification provisioning, the members list in the target system is compared to the entries in this table. This means that only modified memberships are provisioned and not the entire members list.
NOTE: The complete members list is updated by synchronization. During this process, objects with changes but incomplete provisioning are not handled. These objects are logged in the synchronization log.
You can restrict single provisioning of memberships with a condition. Once merge mode has been disabled for a table, the condition is deleted. Tables that have had the condition deleted or edited are marked with the following icon: 
. You can restore the original condition at any time.
To restore the original condition
-
Select the auxiliary table for which you want to restore the condition.
-
Right-click on the selected row and select the Restore original values context menu item.
- Save the changes.
NOTE: To create the reference to the added or deleted assignments in the condition, use the i table alias.
Example of a condition on the UNSAccountBInUNSGroupB assignment table:
exists (select top 1 1 from UNSGroupB g
where g.UID_UNSGroupB = i.UID_UNSGroupB
and <limiting condition>)
For more information about provisioning memberships, see the One Identity Manager Target System Synchronization Reference Guide.
