How does Dependency Resolution Work

How does Dependency Resolution Work

Dependencies can arise between schema classes that require synchronization steps to be repeated. For example, object references can not be set until the reference object has been added. Dependencies can also arise between schema properties within a schema class.

Figure 9: Example of a WorkflowCollection of all the synchronization steps to be executed. with Dependent SchemaData model of a connected system. The schema describes all the master data from the connected system. see target system schema; see One Identity Manager schema; see connector schema; see extended schema Classes and Schema Properties

One Identity Manager can automatically resolve such dependencies. In this case, the synchronization steps are group together such that the referenced objects are synchronized first and them the dependent objects next. If dependencies exist within a schema class, additional synchronization steps are inserted to synchronize the dependent schema properties. The final sequence of synchronization steps can be viewed in the report "Execution Plan".

Figure 10: Example of a Workflow with Automatic Dependency Resolution

To set up automatic resolution of dependencies

• Edit the workflow properties. Select:

  Dependency resolution:

  Automatic

  For more information, see How to Edit a Workflow.

Use automatic dependency resolution by default. Only select manual dependency resolution if individual dependencies cannot be resolved automatically. This might be necessary, for example, if two objects reference each other as mandatory properties.

To resolve dependencies manually

1. Find the schema properties between which dependencies exist.
2. Create a workflow with synchronization steps which take the following criteria into account:
   1. Synchronization steps which synchronize independent and references objects.

      Property mapping rules for dependent schema properties must be excluded for this.

   2. Synchronization steps which reference dependent objects.

      Property mapping rules for dependent schema properties must be included for this.

3. Specify the synchronization step sequence such that all synchronization steps for a) are executed first and them the synchronization steps for b).
4. Edit the workflow properties. Select:

   Dependency resolution:

   Manual

   For more information, see How to Edit a Workflow.

Related Topics

• Show Execution Plan
• Properties of a Workflow
• Rule Filter
• Editing Synchronization Steps

Unresolvable References

Unresolvable References

If a reference object does not exist in the One Identity Manager database, the object reference cannot be resolved by synchronizing. Unresolvable object references are written in a synchronization buffer (table DPRAttachedDataStore). This ensures that these references remain intact and are not deleted in the target system by provisioning.

Example:

A Active Directory group has an account manager, which owns a domain not in the current synchronization run. The account manager is not in the One Identity Manager database either.

SynchronizationThe process of comparing data between One Identity Manager and a target system. Objects and their properties are compared by fixed rules. Synchronization results in the identical data situation in the target system and One Identity Manager database. cannot assign an account manager. In order to retain the assignment, the object reference is saved with the account manager's distinguished name in the synchronization buffer.

During each synchronization One Identity Manager tries to clean up the synchronization buffer. If referenced objects in the One Identity Manager database exist, the references can be resolved and the entries are deleted from the synchronization buffer. The synchronization buffer is cleaned up depending on the synchronization type (with or without revision filter) and the maintenance mode.

You can enter the number of retries for resolving object references. It may be necessary to try several times to resolve an object if it maps a hierarchy with several levels. One hierarchy level at a time can be resolved with each attempt to resolve an object.

To set up maintenance mode

• Edit the start up configuration properties. Select the Maintenance tab.

  For more information, see How to Edit Start up Configurations.

Related Topics

• Maintenance Mode

Direction of Synchronization and Mapping

Direction of Synchronization and Mapping

To synchronize a target system with One Identity Manager, you must specify which of the connected systems is the data master. Specify the master system in the synchronization configuration with the direction of synchronization. The direction in which schema properties are mapped may differ from this. Therefore, the permitted mapping direction must be given in the schema properties mapping.

Table 24: Direction of synchronizationDirection in which synchronization is run. The master system is defined by the direction of synchronization.

Defined on	Direction of SynchronizationThe process of comparing data between One Identity Manager and a target system. Objects and their properties are compared by fixed rules. Synchronization results in the identical data situation in the target system and One Identity Manager database. Specifies
Start up configurationSpecifies which synchronization configuration components are used for a specific synchronization. Specifies the synchronization schedule.	In which direction a specific synchronization is executed
WorkflowCollection of all the synchronization steps to be executed.	In which direction synchronizations are executed
Synchronization stepSpecific rule for processing exactly two schema classes.	By which synchronization direction the step is executed

Table 25: Permitted mapping direction

Defined on	Specifies the MappingList of object matching rules and property mapping rules which map the schema properties of two connected systems to one another. Direction
Mapping	By which synchronization direction property mapping rules are used
Property mapping ruleDescribes how a target system schema property is mapped in the One Identity Manager schema.	By which synchronization direction this property mapping rule is used

One Identity Manager synchronizes two connection systems in the direction given in the start up configuration or in the workflow. A synchronization step is only executed in this case, if the direction of synchronization stored with the step matches with the direction of the current synchronization. If the mapping direction stored with the mapping corresponds to the current direction of synchronization, the system object from this schema class are synchronized. Thus, One Identity Manager checks which property mapping rule can be used in the current synchronization direction. This property mapping rule rule is ignored if the mapping direction of the property mapping rule differs from the current direction of synchronization.

Figure 11: Example showing Effect of Specified Synchronization Direction and Permitted Mapping Direction

Related Topics

• Setting up Start up Configurations
• Properties of a Workflow
• General Properties of a Synchronization Step
• Properties of a Mapping
• Editing Property Mapping Rules

Mapping against the Direction of Synchronization

Mapping against the Direction of Synchronization

For certain schema properties, it may be necessary to copy the schema property value from the connected system into the master synchronization system each time synchronization is run. In this case, the schema property must also be mapped in the opposing synchronization direction when synchronization is run. This behavior can be configured in the property mapping rule.

To force mapping a schema property against the direction of synchronization

• Edit the property mapping rule.

  Set Force mapping against direction of synchronization.

  For more information, see How to Edit Property Mapping Rules.

Property mapping rules with this option set are executed again after the synchronization step is completed. This copies changes from the connected system against the direction of synchronization into the master system.

SynchronizationThe process of comparing data between One Identity Manager and a target system. Objects and their properties are compared by fixed rules. Synchronization results in the identical data situation in the target system and One Identity Manager database. Sequence

1. All property mapping rules whose mapping direction is the opposite to the direction of synchronization are ignored whilst a synchronization step is being executed. Property mapping rules whose mapping direction corresponds to the direction of synchronization are run.
2. All changes to the connection system are saved when the synchronization step is complete.
3. All property mapping rules with the option Force mapping against direction of synchronization set are executed again. For those schema properties involved, the changes are copied from the connected system into the master system.

   NOTE: The property mapping rules are also rerun after completion of the synchronization step if there are no processing methods given in the synchronization step.

Example

An Active Directory environment should be administrated through One Identity Manager. One Identity Manager is the master system for synchronizing both systems. The user account object GUIDs are, however, not mapped in One Identity Manager but in the Active Directory environment. This means the mapping direction is different for a user account object GUID. To copy the object GUID from Active Directory to One Identity Manager during synchronization, the mapping must be forced in the opposite direction of synchronization for this schema property.

Synchronization Sequence

Scenario: A new Active Directory user account was added in One Identity Manager.

1. The user account is added in the target system through synchronization.
2. The property mapping rule for the object GUID is ignored because of the opposing the mapping direction.
3. Once all property mapping rules of the synchronization step have been processed, the user account is saved in the target system. The Active Directory finds a value for User.ObjectGUID.
4. Once the synchronization step is complete the property mapping rule for the object GUID is run again. The object GUID is copied from Active Directory to One Identity Manager.

Related Topics

• Editing Property Mapping Rules