A server installed with the One Identity Manager Service
Figure 4: Communication paths for synchronization
To configure synchronization with a target system, One Identity Manager must load the data from the target system. One Identity Manager communicates directly with the target system to do this. Sometimes direct access from the workstation, on which the Synchronization Editor
Figure 5: Communication paths for synchronization project
To synchronize
The One Identity Manager distinguishes between four sorts of schema: One Identity Manager schema, target system schema, connector schema, extended schema. Each schema is characterized through schema types and schema properties. You can extend schema with schema classes and schema properties such that they can be mapped uniquely.
Just how the schema are mapped to each other is defined in mappings. Mappings group together the rules used to map the schema properties of two connected systems
Figure 6: Schema
| Term | Explanation |
|---|---|
| Schema | Data model of a connected system. The schema describes all the main data from the connected system.
The One Identity Manager distinguishes between four sorts of schema: One Identity Manager schema, target system schema, connector schema, extended schema. |
| One Identity Manager schema | The One Identity Manager data model. |
| Target system schemaData model of a specific target system. Describes all the data originating from the target system. |
Data model of a specific target system. |
| Connector schemaThe system connector extends the target system schema with additional information which is required for mapping in the Synchronization Editor. |
The system connector extends the target system schema with additional information which is required for mapping in the Synchronization EditorOne Identity Manager tool for configuring target system synchronizationPost processing of objects that were marked as outstanding by synchronization... This includes:
If a target system does not deliver its own schema, the system connector generates the connector schema based on the imported data structure, for example, the import of CSV files by the CSV connector |
| Extended schemaA schema can be customizedRuns processing logic which would normally be implemented in the object code, such as mutual exclusion of properties. The Customizer contains special methods and has side effects on the table columns. Several customizers can be defined for one table. in the Synchronization Editor, for example, to allow or simplify mapping of complex schema properties. Label the modified schema as "extended schema". |
A schema can be customized in the Synchronization Editor, for example, to allow or simplify mapping of complex schema properties. The following options are available:
Label the modified schema as "extended schema". |
| Schema typeDefines an object type within a schema. Refers to exactly one table or view of the database based schema or exactly one object type of the non-database based schema. |
Defines an object type within a schema. A schema type refers to exactly one table or view of the database based schema or exactly one object type of the non-database based schema. |
| Schema classSubset of a schema type. The result list of a schema type is filtered by defined criteria. Example: Active Directory contacts are Active Directory user accounts with the property objectclass = "CONTACT". |
Subset of a schema type. The result list of a schema type is filtered by defined criteria. The number of objects found is limited thus.
Example: Active Directory contacts (schema class) are Active Directory user accounts (schema type) with their own object class = 'CONTACT' (filter criteria). |
| Schema propertyProperty of a schema type. Refers to exactly one column of a table or view of the database based schema or exactly one object type property of the non-database based schema. |
Property of a schema type. A schema property refers to exactly one column of a table or view of the database based schema or exactly one object type property of the non-database based schema. There are two different sorts of schema property:
|
| Virtual schema properties | Schema class property added by the system connector or the user.
Virtual schema properties extend the basic schema with additional data required for the mapping. You can use virtual schema properties to represent combinations of schema properties as well as processing step |
| Object matching ruleSpecifies how a concrete object of a target system schema class can be set in relation to a concrete schema class object of a One Identity Manager schema. An object matching rule encompasses the target system schema property based on which the target system objects can be uniquely identified. A distinction is made between primary and alternative object matching rules. |
Specifies how a concrete object of a target system schema class can be set in relation to a concrete object of a One Identity Manager schema class. An object matching rule encompasses the target system schema property based on which the target system objects can be uniquely identified. |
| Property mapping ruleDescribes how a target system schema property is mapped in the One Identity Manager schema. |
Describes how a target system schema property is mapped in the One Identity Manager schema. |
You can define different filters in the Synchronization Editor
| Filtersee revision filter; see object filter; see system filter; see object selection |
Description |
|---|---|
| System filterUsed to limit the number of objects to synchronize in the connected systemSystem the objects and their properties are transferred to during synchronization. The connected system is defined by the synchronization direction. Example of synchronization direction "Target system" (One Identity Manager -> Active Directory): Here Active Directory is the connected system and One Identity Manager is the primary system of synchronization.. The connector only loads the object found through this filter. |
This filter limits the number of objects to load in the connected system. It is more effective than the object filter and object matcher because the system connector only load the objects that are really required. You cannot link more than one filter criteria with logical operators.
The filter is given in system specific notation, for example, as LDAP filter for an LDAP system. The following connected systems support system filters: Active Directory, LDAP, One Identity Manager databases. |
| A special form of the system filter is the hierarchy filterUsed to limit the number of objects to be loaded directly into the target system. It is built on the basis of the real structural objects of the target system. This filter can be used for defining the scope.. The hierarchy filter is built based on the target system's real objects. All the objects to be filtered are selected from the object hierarchy.
The hierarchy filter can be used in the definition of the scope of certain target systems. | |
| Object filterFilter to limit an object list that is already loaded. All schema properties of the schema (also virtual) can be used as filter criteria and linked with logical operators. |
The filter affects objects already loaded. All schema properties of the schema can be used as filter criteria and linked with logical operators.
The filter is formulated as a query applied to loaded objects. It can be used when the scope is defined and by virtual schema properties. |
| Object selectionFilter for limiting the number of objects to synchronize. For example, the system objects of an Active Directory domain are limited to one container. You can also filter single objects. |
The filter affects objects already loaded. All schema properties of the schema can be used as filter criteria and linked with logical operators. In order to ensure that the filter returns the desired results when provisioning single objects, you must add additional system filter criteria to the filter condition.
The filter is formulated as a query applied to loaded objects. It can be implemented in the schema class definition. |
| Revision filterFilters all system objects not changed since the last synchronization. The deciding factor being the revision propertySchema property containing the revision counterInformation about the last change to a system object. The revision counter is used to determine the objects that have changed since the last synchronization. of a system object. Example for revision properties of Active Directory groups: in the target system schema - UNS-Changed; in the One Identity Manager schema - Revision date. modification. Synchronization can be speeded up with revision filtering. |
This filter determines all object that have changed since the last synchronization run. The deciding factor being the revision property modification.
The filter can be applied to workflows and start up configurations. |
It is recommended you combine system filter and object filter/schema class filter to utilize the advantages of the various filters.
If scope, schema class, and virtual schema property filters are defined in the synchronization configuration and revision filtering is permitted, the number of objects to be synchronized results from the combination of all filters.
Figure 7: Effects of the filter
Variables can be used in the filter conditions. This enables the same synchronization project to be used for synchronizing different target systems or different objects within the same target system.
The scope specifies which parts of the connected system
Example:
Active Directory domains "xyz" and "uvw" are managed through One Identity Manager. The containers "abc", "def", and "ghi" from the Active Directory domain "xyz" should be synchronized. A scope is defined for the target system connection and the One Identity Manager database connection which filters only these objects. The Active Directory domain "uvw" should initially not be synchronized.
Figure 8: Example for scope definition
To specify a scope, define a system filter and object filter.
Some target systems offer an additional option to specify the scope: the hierarchy filter
A fully defined hierarchy filter can be transformed into a variable. Thus the filter can be redefined in a specialized variable set and used for other synchronization configurations.
References to objects in different target systems can be mapped in the One Identity Manager database. In order to solve these references, the target system scope must be extended to include the referenced target systems. For this, you can additionally define a reference scope for each system connection. You can enter the reference scope for the database in the same way. This means that references to parts of the One Identity Manager database can be resolved which are not included in the general scope.
If no reference scope is defined, the general scope is also used for the reference resolution.
Active Directory domains "xyz" and "uvw" are trusted domains. User accounts from both domains are members in Active Directory groups in the Active Directory domain "xyz". Define a reference scope to assign referenced user accounts of the domain "uvw" during group membership synchronization. In the reference scope, specify that referenced objects should also be searched for in the Active Directory domain "uvw".
If you have not defined a reference scope, Active Directory SIDs are determined for Active Directory domain "uvw" user accounts during Active Directory domain "uvw" group membership synchronization and entered in the One Identity Manager data store.
© ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center
