During the membership provisioning, changes made in the target system will probably be overwritten. This behavior can occur under the following conditions:

• Memberships are saved as an object propertyValue of a schema property for a specific object. in list form in the target system.

  Examples: List of user accounts in the Member property of a group - OR - List of profiles in the MemberOf property of a user account

• Memberships can be modified in either of the connected systemsSystem the objects and their properties are transferred to during synchronizationThe processSequence of process steps for mappingList of object matching rules and property mapping rules which map the schema properties of two connected systems to one another. an operational workflow. The process steps are connected to one another by predecessor/successor relationships. This functionality allows flexibility when linking up actions and sequences on object events. of comparing data between One Identity Manager and a target system. Objects and their properties are compared by fixed rules. Synchronization results in the identical data situation in the target system and One Identity Manager database.. The connected system is defined by the synchronization direction. Example of synchronization direction "Target system" (One Identity Manager -> Active Directory): Here Active Directory is the connected system and One Identity Manager is the primary system of synchronization..

• A provisioning workflowSpecifies the order in which the synchronization stepsSpecific rule for processing exactly two schema classes. are provisioned. and provisioning processes are set up.

If one membership in One Identity Manager changes, by default, the complete list of members is transferred to the target system. Therefore, memberships that were previously added to the target system are removed in the process and previously deleted memberships are added again.

To prevent this, provisioning can be configured such that only the modified membership is provisioned in the target system. To do this, you must set the Merge mode option on the assignment tableTable in which relationships between two tables are established. Both tables' objects are assigned to each other as a many-to-many relationship. For example, assignment tables are PersonInDepartment or ADSAccountInADSGroup. (DPRNameSpaceHasDialogTable.IsAdHocSingleMemberShip = TRUE). For more information about setting this option, see the administration guides for connecting each target systems.

Additional processing stepsRepresents one processing task in a process. are run for tables with this option enabled.

1. A task is set up in the DBQueue ProcessorComponent for asynchronous calculation of processing tasksTask to be run by a process. in the DBQueueList of tasks processed by the DBQueue Processor. The tasks queued in the DBQueue are the result of triggering, modifications to configuration parametersParameters for configuring the basic settings of One Identity Manager's system behavior. Preprocessor relevant configuration parameters are parameters that are linked to preprocessor conditions. If a preprocessor relevant configuration is changed, the database must be compiled. (for example, changes to a configuration parameter concerning inheritance) or running scheduledTask to run on a cyclical basis. Schedules control regular running of processes, calculation tasks, and other scheduled tasks. You define the start and interval times for the scheduled tasks. The activation time can be given in local time or Universal Time Code. A schedule can be in control of several tasks. tasks.. The DBQueue Processor also controls cyclically recurring tasks, such as the daily maintenancePost processing of data that could not be saved during synchronization. tasks for calculating statistics or indexing the database. to update the DPRMemberShipAction table. This table contains the modified objects and operations to be run.
2. The membership list of modified objects is compared to the DPRMemberShipAction table. Therefore, if only one membership changes, not the entire members list in the target system has to be updated. Only each modified membership is transferred to the members list. Changes to memberships of the modified object, which were made in the target system in the meantime, are therefore not overwritten.
3. Once the change has been successfully provisioned in the target system, the entry is deleted from the DPRMemberShipAction table. If an error occurs during provisioning, the entry remains in the table.

Table 28: Handling entries in the DPRMemberShipAction table

ProvisioningActual changes to an object in the One Identity Manager database (added, modified, deleted) are made immediately written to the target system. Process	Entry in DPRMemberShipAction	Comment
Success	Deleted
Fail	Remains intact	A new modification to the object is reprocessed by provisioning and deleted on success.
Re-enabled	Reprocessed
Failed and deleted	Remains intact	Deleted during daily maintenance. All entries without a provisioning task in the Job queueCentral store for generating and running process componentComponent available for use in process steps. actions. are deleted in the process of these maintenance jobs.