One Identity Manager 8.1.

Target System Synchronization

Reference Guide
Copyright 2020 One Identity LLC.
ALL RIGHTS RESERVED.
This guide contains proprietary information protected by copyright. The software described in this guide
is furnished under a software license or nondisclosure agreement. This software may be used or copied
only in accordance with the terms of the applicable agreement. No part of this guide may be reproduced
or transmitted in any form or by any means, electronic or mechanical, including photocopying and
recording for any purpose other than the purchaser’s personal use without the written permission of
One Identity LLC .
The information in this document is provided in connection with One Identity products. No license,
express or implied, by estoppel or otherwise, to any intellectual property right is granted by this
document or in connection with the sale of One Identity LLC products. EXCEPT AS SET FORTH IN THE
TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT,
ONE IDENTITY ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR
STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-
INFRINGEMENT. IN NO EVENT SHALL ONE IDENTITY BE LIABLE FOR ANY DIRECT, INDIRECT,
CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT
LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF
INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF
ONE IDENTITY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. One Identity makes no
representations or warranties with respect to the accuracy or completeness of the contents of this
document and reserves the right to make changes to specifications and product descriptions at any
time without notice. One Identity does not make any commitment to update the information
contained in this document.
If you have any questions regarding your potential use of this material, contact:
One Identity LLC.
Attn: LEGAL Dept
4 Polaris Way
Aliso Viejo, CA 92656
Refer to our Web site ([Link] for regional and international office information.
Patents
One Identity is proud of our advanced technology. Patents and pending patents may apply to this
product. For the most current information about applicable patents for this product, please visit our
website at [Link]
Trademarks
One Identity and the One Identity logo are trademarks and registered trademarks of One Identity
LLC. in the U.S.A. and other countries. For a complete list of One Identity trademarks, please visit
our website at [Link]/legal. All other trademarks are the property of their
respective owners.
Legend

WARNING: A WARNING icon highlights a potential risk of bodily injury or property

damage, for which industry-standard safety precautions are advised. This icon is
often associated with electrical hazards related to hardware.

CAUTION: A CAUTION icon indicates potential damage to hardware or loss of data if

instructions are not followed.

One Identity Manager Target System Synchronization Reference Guide

Updated - January 2020
Version - 8.1.2
Contents

Target system synchronization with the Synchronization Editor 9

Architecture 9
Synchronization and provisioning 10

Working with the Synchronization Editor 12

Synchronization Editor views 13
Status bar information 13
Menu items 14
Customizing the program settings 18
Wizard for entering filters 19
Support for scripting 21
Save changes permanently 23
Establish remote connection 23
Working with an encrypted database 26
Changing a synchronization user's password 28

Basics of target system synchronization 30

Synchronization Editor communications 31
How are schemas mapped 31
What are filters? 34
What is a scope? 37
How does revision filtering work? 38
How does dependency resolution work? 40
Unresolvable references 42
Direction of synchronization and mapping 44
Mapping against the direction of synchronization 45
Detecting rogue modifications 47
Synchronizing user data with different systems 50
Deleting objects in One Identity Manager 51
How to remove unnecessary project data 53
Updating schemas 54
Synchronizing and provisioning memberships 55
Changing a membership label 55

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide
3
 Single membership provisioning 57
Performance and memory optimization 58
Improving loading performance 59

Setting up synchronization 60
Starting the Synchronization Editor 60
Creating a synchronization project 61
How to create a synchronization project 62
How to edit a synchronization project 62
How to delete a synchronization project 63
General properties of a synchronization project 63
Specifying the script language in synchronization projects 64
Templates for creating synchronization projects 65
Restricting system access 66
Configuring synchronization 66
Setting up mappings 67
Mapping editor 68
How to create a mapping 70
How to edit a mapping 71
How to delete a mapping 71
Properties of a mapping 71
Schema class properties 73
Edit schema properties 76
Editing property mapping rules 78
Editing object matching rules 83
Setting up synchronization workflows 87
Toolbars in the workflow editor 87
How to create a workflow 88
How to edit a workflow 88
How to copy a workflow 88
How to delete a workflow 89
Creating workflows with the workflow wizard 89
Properties of a workflow 90
Editing synchronization steps 92
Show execution plan 103
Connecting systems 103

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide
4
 How to edit system connection properties 103
System connection properties 104
Configuring the synchronization log 106
Editing the scope 107
How to edit a scope 107
How to delete a scope 108
Scope properties 108
Creating hierarchy filters 109
Using variables and variable sets 110
How to create variables 111
How to edit variables 112
How to delete variables 113
How to create specialized variable sets 113
How to delete specialized variable sets 113
Variable properties 113
Using scripts in variables 114
Setting up start up configurations 115
How to create start up configurations 115
How to edit start up configurations 116
How to delete start up configurations 116
Start up configuration properties 116
Grouping 117
Maintenance modes 119
Specifying a schedule 119
Setting up base objects 122
How to create base objects 122
How to edit base objects 124
How to delete base objects 124
Properties of base objects 124
Overview of schema classes 125
How to add schema classes 125
How to edit schema classes 126
How to delete schema classes 126
Customizing the synchronization configuration 127
Checking the consistency of the synchronization configuration 127

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide
5
Activating the synchronization project 128
Defining start up sequences 129
Creating start up sequences 130
Editing start up sequences 130
Deleting start up sequences 131
Start up sequence properties 131

Running synchronization 134

Simulating synchronization 135
Starting synchronization manually 135
Executing start up sequences 136
Monitoring start up sequences 136
Handling unexpected termination of synchronization 137
Resetting revisions 138

Synchronization analysis 140

Toolbars in the log view 140
How to display synchronization logs 140
Target system synchronization 141
Deleting memberships 143
Help for the analysis of synchronization issues 144

Setting up synchronization with default connectors 145

Updating existing synchronization projects 147

Applying patches 148
Automatic patches 150

Script library for synchronization projects 151

Views in the script library 151
Adding scripts to script libraries 153
Editing scripts in the script library 154
Using scripts across projects 155

Additional information for experts 157

Additional properties of a mapping 157
Extended properties for start up configuration 158
Using the local cache 159
Schema browser 160

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide
6
Schema editor 160
Using custom project templates 161
Creating project templates 162
Creating synchronization projects from a custom project template 163
Managing project templates 165
Include custom tables in the synchronization 166
Validating scripts 168
Starting synchronization 169
Defining downstream processes 170
Processing synchronization steps 171
Exporting a synchronization configuration 172
Operations for provisioning and single object synchronization 173
Load balancing during provisioning and single object synchronization 174
Automatically create and update synchronization projects 176
Customizing the configuration file 178
Parameter definitions 180
Global definitions 181
Defining the editor for new synchronization projects 181
Defining the editor for existing synchronization projects 182
Synchronization Editor Command Line Interface 183
Synchronization Editor Module for Windows PowerShell 186
Maintaining the data store 188
Troubleshooting 189
Error log 189

Resolving errors when connecting target systems 190

Incorrect mapping of object hierarchy after synchronization 190

Appendix: Configuration parameters for target system synchronization 193

Appendix: Configuration file examples 194

Configuration file for creating new synchronization projects 194
Configuration file for updating existing synchronization projects 196

About us 198
Contacting us 198
Technical support resources 198

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide
7
Glossary 199

Index 207

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide
8
 1

Target system synchronization with

the Synchronization Editor

The main feature of One Identity Manager is to map employees together with the master
data and permissions available to them in different target systems. To achieve this,
information about user accounts and permissions can be read from the target system into
the One Identity Manager database and linked to employees. This provides an overview of
the permissions for each employees in all of the connected target systems. One Identity
Manager offers the option of managing user accounts and their permissions. You can
provision modifications in the target systems. Employees are supplied with the necessary
permissions in the connected target systems according to their function in the company.
Regular synchronization keeps data consistent between target systems and the One
Identity Manager database.
One Identity Manager instantiates connecting the various target systems to the
Synchronization Editor. Use this tool to configure data synchronization for any target
system and specify which target system data is mapped to the One Identity Manager
database. You also define the object properties mapping and the synchronization sequence
as a workflow.
One Identity Manager provides default mappings and workflows for synchronizing all target
systems which are supported by the installed modules.

Architecture
Use the Synchronization Editor to configure synchronization between the One Identity
Manager database and a target system. A system connector takes over the connection to
and communication with the target system. The system connector prepares target system
objects, properties, and methods such that they can be read and written by the One
Identity Manager. The system connector communicates with the target system and carries
out all read and write operations.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 9
Target system synchronization with the Synchronization Editor
Figure 1: One Identity Manager Target system synchronization components

Synchronization and provisioning

During target system synchronization with the One Identity Manager database, system
objects and their properties are compared with one another. Synchronization results in the
target system and One Identity Manager database having an identical data structure. Some
target systems are supported by default. For these target systems, One Identity Manager
provides default processes and workflows.

Provisioning

In addition, changes to One Identity Manager database objects can be promptly

provisioned in the connected target systems. For standard target systems, One Identity
Manager provides default processes and workflows for provisioning.
The same workflows and mappings can be used for provisioning as for synchronization. The
processing methods defined in the synchronization step are only executed during
provisioning if the condition defined in the processing method is fulfilled and the
synchronization and mapping directions for the object to process match.
Object changes are not provisioned in target system connections with read-access only.

Synchronization of single objects

For standard target systems, Changes made to individual objects in the target system can
be immediately applied in the One Identity Manager database without having to start a full
synchronization of the target system environment. provides dOne Identity Managerefault
processes and workflows for synchronizing single objects.
The same workflows and mappings can be used for single object synchronization as for
synchronization. The processing methods defined in the synchronization step are only

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 10
Target system synchronization with the Synchronization Editor
executed during single object synchronization if the condition defined in the processing
method is fulfilled and the synchronization and mapping directions for the object to process
match.
Individual objects can only be synchronized if the object is already present in the One
Identity Manager database. The changes are applied to the mapped object properties. If a
member list is belongs to one of these properties, then the entries in the allocation table
will also be updated. If the object is no longer present in the target system, then it is
deleted from the One Identity Manager database.

Related topics

l Direction of synchronization and mapping on page 44

l System connection properties on page 104

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 11
Target system synchronization with the Synchronization Editor
 2

Working with the Synchronization

Editor

The Synchronization Editor is the One Identity Manager tool you use to configure
synchronization of the One Identity Manager database on the one side and any target
system on the other. The Synchronization Editor provides a homogeneous interface for all
target systems to be controlled.
You can run the following tasks with the Synchronization Editor:

l Set up a connection to any target system

l Load target system schema and mapping with the One Identity Manager database
schema (called "One Identity Manager schema" in the following)
l Specify key object properties based on which the other associated objects are
identified during synchronization (object matching rules).
l Specify the base object and scope of synchronization
l Define filters to limit the number of objects to synchronize
l Specify the direction of synchronization
l Define the synchronization workflow
l Select schema classes to be synchronized
l Specifying processing methods
l Define the sequence of synchronization steps
l Specify the time and frequency of synchronization

There are different ways to start the Synchronization Editor.

l From the Windows start menu using the entry One Identity | One Identity
Manager | Configuration | Synchronization Editor.
l From the Launchpad.
l In the Manager

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 12
Working with the Synchronization Editor
Synchronization Editor views
The Synchronization Editor has several views for showing the synchronization configuration
of the connected systems.

Table 1: Views in the Synchronization Editor

View Description

Navigation The navigation view is made up of suggested entry points for the interface
view navigation.

Document The document view shows the form or editor selected through the navigation
view view respectively. The forms and editors are displayed on different tabs.

Start page The start page shows an overview of all synchronization projects. You can
add new synchronization projects here.

Mapping You can edit maps in the mapping editor. The mapping editor is divided into
editor two schema view and two rule views. Each mapping editor view has its own
toolbar.

Schema Views in the mapping editor.

view The One Identity Manager schema and schema property details are
displayed in the left-hand area of the mapping editor. The target system
schema and schema property details are displayed on the right side.

Rule view Views in the mapping editor.

Property mapping and object matching rules are displayed in the middle of
the mapping editor.

Workflow Synchronization steps are organized and displayed as workflows in the

editor workflow editor. The workflow editor is divided in to two views: a general
properties view and the workflow view.

Workflow View in the workflow editor in which synchronization steps are handled. The
view workflow view has its own toolbar.

Patch view The patch view, displays all installation patches for new functions and solved
issues in One Identity Manager, which effect target system synchronization.
Patches can be applied to existing synchronization projects.

Log view The log view displays the error log.

Status bar information

The following information is shown in the status bar.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 13
Working with the Synchronization Editor
Table 2: Status bar icons

Icon Meaning

Current user and system user.

Connected database in the notation <server>\<database (description)>.

Synchronization project open.

A warning has been written to the error log.

An error message has been written to the error log.

Database status (database activity such as loading or saving objects).

Menu items
The Synchronization Editor user interface contains the following menu items and toolbars:

Table 3: Meaning of items in the menu bar

Menu Menu Item Meaning Shortcut

Database New connection Establishes a database connection. Ctrl +

Shift + N

Close connection Closes the current database connection.

Settings For configuring general program settings.

Changing a synchron- The password for the system user

ization user's password Synchronization can be changed.

Exit Exits the program. Alt + F4

Edit How to Edit a Synchron- Properties of the loaded synchronization

ization Project project can be edited.

Update synchronization System connector updates can be applied

project to existing synchronization projects.

Create template Creates a template for a new

synchronization project.
This menu item is only available in expert
mode.

Help Community Opens the One Identity Manager

community website.

Support portal Opens the One Identity Manager product

support website.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 14
Working with the Synchronization Editor
Menu Menu Item Meaning Shortcut

Training Opens the One Identity Manager training

portal website.

Online documentation Opens the One Identity Manager

documentation website.

Search Opens the search dialog box.

Help Opens the help for this form. F1

Info Shows the version information for

program.

Generate synchron- Generates a synchronization analysis

ization analysis report report.

Table 4: Meaning of the icons in the toolbar

Icon Meaning

Commit Saves changes permanently.

to To save changes with change labels, open the submenu and click Commit
database and assign a change label. For detailed information about working with
change labels, see the One Identity Manager Operational Guide.

Shows technical names.

Technical
view

Shows additional properties.

Additional
data

remote Shows additional properties.

connection

Enabled Variable set used in the Synchronization Editor to connect to the target
variable system. This menu item is only enabled if more than one variable set is
set defined.
To select another variable set, open the submenu.

Table 5: Meaning of icons in the navigation view

Icon Meaning

Create a new workflow with the workflow wizard.

Creates a new mapping/workflow.

Edits mapping/workflow.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 15
Working with the Synchronization Editor
Icon Meaning

Deletes mapping/workflow.

Reload the data.

Display synchronization log.

Display provisioning log.

Table 6: Meaning of icons in the schema tool bar

Icon Meaning

Add schema property.

Edit selected schema property.

Delete selected schema property.

Filter schema properties.

Search schema properties.

Filter schema properties with similar names in other schema respectively.

Table 7: Meaning of icons in the rule tool bar

Icon Meaning

Add rule.

Edit selected rule.

Delete selected rule.

Filter rules.

Transform selected property mapping rule into an object matching rule.

Sorts object matching rule.

Tests object matching rule.

Create new rules with help of the mapping wizard.

Table 8: Meaning of icons in the workflow view

Icon Meaning

Adds new step.

Shows execution plan.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 16
Working with the Synchronization Editor
Icon Meaning

Opens detail view of all synchronization steps.

Closes detail view of all synchronization steps.

Enable or disable synchronization steps.

Table 9: Meaning of icons in the variable set tool

bar

Icon Meaning

Add a variable/variable set.

Delete variable/variable set.

Rename variable set.

Convert variable to script.

Convert script variable to a plain variable.

Display variable usage.

Default value for restoring the selected variable.

Table 10: Meaning of icons in the rule tool bar

Icon Meaning

Fixes Shows patches with fixes.

Optional Shows all patches for optional features.

features

Shows all patches that are cannot be applied to the synchronization

project.

Shows all patches that are already applied to the synchronization

project.

Table 11: Meaning of icons in the error log

Icon Meaning

Logs all critical error messages. (Severity level = Fatal)

Logs all information. (Severity level = Info)

Logs all warnings. (Severity level = Warning)

Logs all error messages. (Severity level = error)

Logs debugger output. This setting should only be used for testing. (Severity level
= Debug)

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 17
Working with the Synchronization Editor
Icon Meaning

Logs highly detailed information. This setting should only be used for analysis
purposes. The log file quickly becomes large and cumbersome. (Severity level =
Trace)

Adds a custom filter condition.

Deletes filter condition.

Searches for term.

Searches next term.

Marks all messages with a specific term.

Buffer Sets the message buffer size. The buffer's level is displayed next to the field.
size

Deletes the buffer contents.

Stops logging.

Starts logging.

Saves log to file.

Specifies which column are displayed in the error log.

Copies selected messages to the clipboard.

Opens the error log with a text editor.

Customizing the program settings

To change the program settings

l Select the Database | Settings... menu item.

Set the following options on the General tab.

Table 12: General program settings

Setting Meaning

Language Language for the user interface. The initial program login uses the system
language for the user interface. Changes to the language settings take
effect after the program has been restarted.
The language is set globally for all One Identity Manager programs, which
means the language setting does not have to be configured for each
program individually.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 18
Working with the Synchronization Editor
Setting Meaning

Enable Specifies whether expert mode is used. If you set this option, functions
expert mode become available that should only be used by experienced Synchron-
ization Editor users. For more information, see Additional information for
experts on page 157.

Enable the Specifies whether technical captions are used in the Synchronization
technical Editor views. Disable this option to use display names.
view after
program
start

Show Specifies whether additional properties are displayed.

additional
data

Show hints Specified whether additional hint, like explanations, warnings, or

examples are displayed.

Set the following options on the Security tab.

Table 13: Security settings

Setting Meaning

Saved passwords List of all saved passwords that are saved locally-

Delete Deletes the selected value.

Delete all the synchronization Deletes all locally saved sensitive data in the
project's sensitive data current synchronization project.

Delete all saved passwords Deletes all the Synchronization Editor's locally
saved sensitive data.

Wizard for entering filters

At certain points you can define custom filter conditions. The filter conditions are
formulated like a condition (WHERE clause) for a database query.
You can enter database queries directly or put them together with a wizard. Use the and
button to switch to the relevant view.

l The comparison operators =, <>, <, >, <=, >=, and like are supported for defining
conditions.
l To link condition you can use the logical operators AND, OR, and NOT.
l You can use variables in your condition definitions. Variable must be masked.
Syntax: '$<variable>$'

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 19
Working with the Synchronization Editor
 NOTE: If the condition contains a dollar sign, which is not labeling a variable, it
must be masked with $.
Example: '300 $$' compared to the value '300 $'
TIP: If you enter a condition directly, you can access predefined variables with
the button.

Each condition is displayed in a special control in the wizard. The controls contain
connection points to logically join single conditions or delete single conditions. The
connection points are set if you mouse over the edge of the respective control.

Figure 2: Wizard for entering filters

To create a filter with a wizard

1. Click Create condition.

This inserts a control for the first condition.
2. Enter the condition.
a. Click the left-hand part of the condition and select the property to filter by.
The properties for filtering are listed. You can also define other properties and
use variables.
b. Specify the comparison operator. Click the comparison operator to change it.
The comparison operators =, <>, <, >, <=, >=, and like for defining conditions
are supported.
c. Specify the comparison value on the right-hand side of the condition.
You can enter a string for a comparison value or select a property from the list.
You can also use variables.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 20
Working with the Synchronization Editor
 NOTE: To switch back to the input field again, select Input field from
the menu.
3. To link condition you can use the logical operators AND, OR, and NOT.
a. Mouse over the edge of the control to which you wish to create a link.
The connection points appear.
b. Mouse over a connection point and select the connection.
This adds a new control for the next condition.
NOTE: To remove a control, select the Delete connection point.

Support for scripting

You can apply scripts at various points in the synchronization project; for example, when
defining the schema properties, in the object filter, or when you define data operations for
system connections through the native database [Link] can enter scripts in C# or
Visual Basic .NET depending on script's language, which was specified for the
synchronization project. You write scripts in a special editing dialog. It has an advanced
edit mode which provides additional actions.

To switch to advanced mode

l Press Ctrl + Alt + Enter or click the button at the bottom right.

Figure 3: Directly entering a database query

Table 14: Meaning of icon in advanced edit mode

Icon Meaning

Quits advanced edit mode.

Undoes last change.

Redoes last change.

Cuts selected code.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 21
Working with the Synchronization Editor
Icon Meaning

Copies selected code into clipboard.

Inserts code from clipboard.

Deletes selected code.

Decreases insert.

Increases insert.

Automatic text formatting.

Shows/hides line numbers.

Inserts code snippet.

Word wraps automatically.

Searches within code.

Additional input aids are provided for creating script code.

Syntax highlighting

The input fields support syntax highlighting depending on the syntax type.

Auto-completion

Auto-completion can be used when creating script code. The amount of scripted code to
enter is reduced by displaying the names of properties or functions that can be used. To
use auto-completion, use the shortcut Ctrl + SPACE in the relevant positions within the
input fields. The contents of the list is determined by the key words in the code. This way,
you can use scripts from the script library.

Entering code snippets

One Identity Manager provides code snippets for you to use as templates. You can insert
code snippets using the following options:

1. Using the icon

l Select the icon.
2. Using a shortcut
l Press F2.

NOTE: If you select a code snippet directly using a shortcut or the icon, a short
description and the shortcut name are displayed in a tooltip.
TIP: You can use custom code snippets. To do this, create a CustomSnippets directory in
the One Identity Manager installation directory to store the code snippets. Use Visual
Studio documentation to develop your own code snippets.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 22
Working with the Synchronization Editor
If the script tests a fixed value that contains at least two dollar characters, the dollar
characters must be masked.

Related topics

l Script library for synchronization projects on page 151

Save changes permanently

Different wizards are run to add new objects like synchronization projects, mappings, or
workflows with the Synchronization Editor. The data you enter is temporarily saved.
Changes to these objects are also saved only temporarily.

To save changes to the synchronization project permanently

l In the Synchronization Editor toolbar, click Commit to database.

- OR -
l To save the synchronization project with change labels, open the Commit to
database menu item and click Commit and assign a change label. For detailed
information about working with change labels, see the One Identity Manager
Operational Guide.

One Identity Manager compresses the schemas when the synchronization project is saved
for the first time. This removes schema data from the synchronization projects that is not
required in the synchronization configuration. This can speed up loading the
synchronization project.

Related topics

l How to remove unnecessary project data on page 53

Establish remote connection

To configure synchronization with a target system, One Identity Manager must load the
data from the target system. One Identity Manager communicates directly with the target
system to do this. Sometimes direct access from the workstation on which the
Synchronization Editor is installed is not possible, because of the firewall configuration, for
example, or because the workstation does not fulfill the necessary hardware and software
requirements. If direct access is not possible from the workstation, you can set up a
remote connection.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 23
Working with the Synchronization Editor
Prerequisite

The remote connection server and the workstation must be in the same Active
Directory domain.

To permit remote access to a target system

1. Provide a server installed with the following software.

l One Identity Manager Service with the RemoteConnectPlugin

Table 15: RemoteConnectPlugin parameters

Parameters Value Description

Authentication ADSGroup Method with which incoming queries can be

method authenticated.
Permitted values: ADGroup
Permitted AD Distinguished name or object SID of the Active
group Directory group whose members are permitted
to use a remote connection. This parameter is
only required for the ADGroup authentication
method.
Port 2880 Port for reaching the server.

NOTE: Authentication of a remote connection can only be done through an

Active Directory group.
For more information, see the One Identity Manager Configuration Guide.
l Target system connector
l Target specific client components as they must be installed on the
synchronization server.
For more information, see the administration guides for connecting target
systems.
2. Declare the remote connection server as Job server in One Identity Manager.
3. Start the One Identity Manager Service.

TIP: The remote connection server requires the same configuration as the
synchronization server (with regard to the installed software and entitlements). Use the
synchronization as remote connection server at the same time, by simply installing the
RemoteConnectPlugin as well.

To edit a Job server

1. In the Designer, select the Base Data | Installation | Job server category.
2. Enter a new Job server using Job servers | New.
3. Edit the Job server's master data.
4. Select View | Server functions and specify the server functionality.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 24
Working with the Synchronization Editor
 Select a minimum of the following server functions:

l <target system connector>

l One Identity Manager Service installed

5. Select the View | Machine roles menu item and assign roles to the server.
Select at least the following roles:
l Server/Jobserver/<target system>
6. Enter the queue name of the Job server in the configuration file of the One Identity
Manager Service.

For more information, see the One Identity Manager Configuration Guide and the
administration guides for connecting target systems.
Remote access may be necessary, if:

a. A synchronization project must be set up.

b. An existing synchronization project must be configured but there is generally no
direct access to the target system.
c. A existing synchronization project must be configured but there is temporarily no
direct access to the target system.
One Identity Manager requires a connection to the target system, for example, to
update the target system schema, to define the scope, or to test the object matching
rules. A message appears if you cannot connect to the target system when editing
the synchronization configuration. Then you can decide whether you want to connect
through a remote connection server, temporarily. In this case, a remote connection
dialog opens.
d. An existing synchronization project needs to be configured but some connection
data is encrypted and the encryption values are not known to the Synchronization
Editor user.

To set up a remote connection for a new synchronization project.

l Set the Connect using remote connection server option in the project wizard
on the System access page and select the server to use for the connection
under Job server.
The remote connection stays connected as long as the project wizard is open.

To set up a remote connection for an existing synchronization project.

1. Open the synchronization project.

2. In the Synchronization Editor toolbar, click Remote connection....
This opens the remote connection dialog.
3. Enter the remote connection properties.
4. Click Connect.
This sets up the remote connection. The connection remains in place for as long as
the synchronization project is open in the Synchronization Editor.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 25
Working with the Synchronization Editor
Table 16: Remote connection properties

Property Description

Select remote Select this option if you want the remote connection server to be
connection server selected automatically.
automatically

Job server In the menu, select the Job server you want for One Identity
Manager communicating with the target system.
All Job servers are displayed for which the server function One
Identity Manager Service installed is selected.

Select remote Select this option if you do not want the remote connection server
connection server to be selected automatically because, for example, the server
manually name cannot be resolved.

Server Enter the full server name or the server's IP address.

Port RemoteConnectPlugin uses the port 2880.

To close a remote connection

l In the Synchronization Editor toolbar, click Remote connection....

Related topics

l Creating a synchronization project on page 61

l Configuring synchronization on page 66
l Menu items on page 14
l Working with an encrypted database on page 26

Working with an encrypted database

When you set up a synchronization project in an encrypted One Identity Manager database,
sensitive data is encrypted. This affects passwords for connection data as well as variables
that are labeled as secret. The Synchronization Editor requires all connection data in
decrypted form in order to access connected systems. You can nevertheless open the
synchronization project and edit it partially.
If the Synchronization Editor now accesses the connection system, it cannot establish a
system connection because certain connection parameters are encrypted. The values can
be decrypted through an appropriately configured remote connection. Set up a remote
connection server to do this. For more information, see Establish remote connection on
page 23. Note here the relevant restrictions for setting up a remote connection server.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 26
Working with the Synchronization Editor
To enable the system connection despite encrypted connection data

1. Edit the system connection.

For more information, see How to edit system connection properties on page 103.
An extra dialog box is displayed.
2. Set the first option and click OK.
a. Enter the remote connection properties.
For more information, see Remote connection properties on page 26.
b. Click Connect.
This sets up the remote connection. The connection remains in place for as long
as the synchronization project is open in the Synchronization Editor.

NOTE: If a remote connection is not possible, you have the option, at this point, to enter
values for establishing the system connection.

l Set the second option for this and enter the missing values. Click OK.

To decrypt encrypted values by default when you open a synchronization

project

l In the Designer, set the "DPR | UI | EncryptedValueHandling" configuration

parameter and select the value "ByUser" on the Options tab.
The user can decide whether encrypted values should be ignored or not.

Table 17: Decryption dialog

Property Description

Encrypted Value required by the connector to establish a system connection.

value

Ignore this Specifies whether to ignore the value. The synchronization project can
value be selectively edited. However, all actions which required accessing the
connected system, cannot be executed.

Show values Specifies whether the values entered are shown. If this option is not set,
input is masked.

Remember Specifies whether the data entered is saved locally. The next time the
the values and synchronization project is opened, the stored values are applied and can
save locally be confirmed or altered.
IMPORTANT: If an encrypted value has been changed in the One
Identity Manager database, the changed value must also be changed
on the workstation as soon as the synchronization project is next
opened.
Otherwise, the value is overwritten by the locally stored data when the
synchronization project is saved. Modifications (of passwords, for
example) go missing this way!

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 27
Working with the Synchronization Editor
Property Description

To avoid overwriting

l Update the pre-set values and enable the Remember the

values and save locally option.

To delete locally saved data

1. Select the Database | Settings... menu item.

2. Select the Security tab.
3. Select a value and click Delete.

Ignore all Ignores encrypted values and open the synchronization project.

Changing a synchronization user's

password
One Identity Manager provides a system user with all the permissions necessary to set up
target system synchronization through an application server and to run it. When you set up
the One Identity Manager database, you entered a password for the Synchronization
system user. You can change this password in the Synchronization Editor. The password
must then be changed in all synchronization projects that connect to the database through
an application server. One Identity Manager can try to update these passwords
automatically. If this is not possible, modify the synchronization projects manually.
IMPORTANT: The password may not be changed while synchronization is starting up or
running. Only change the password outside working hours!
Only passwords that are managed in One Identity Manager can be changed. There is no
menu item shown for externally managed passwords. For detailed information about
managing system user passwords, see the One Identity Manager Authorization and
Authentication Guide.

To change the system user's Password

1. Select Database | Change synchronization user password.

2. Enter the required data:
3. Click OK.

Table 18: Password data

Property Description

Old password Password valid until now.

New password New password for the system user to log on o the database.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 28
Working with the Synchronization Editor
Property Description

and password
confirmation

Show Passwords are not masked.

passwords

Try to update One Identity Manager checks all the synchronization projects and tries
existing to update the password. The password is only changed in synchron-
synchronization ization projects that are connected with the database through an applic-
projects ation server.

To manually update the database connection password

1. Open the synchronization project which needs to have its password updated.
2. Select Configuration | One Identity Manager Connection.
3. Confirm the prompt with OK.
Do not establish a remote connection.
4. Click Edit connection.
5. Select the Connection parameter page in the system connection wizard.
6. Enter the new password in Synchronization user's password.
7. Click Test.
8. If the connection is successfully established, click Next.
9. Close the system connection wizard.
10. Save the changes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 29
Working with the Synchronization Editor
 3

Basics of target system

synchronization

To configure target system synchronization you must have knowledge of the One Identity
Manager's basic procedure for synchronizing and provisioning data. These basics are
explained in the following sections.

Table 19: Basic synchronization terminology

Term Described in

Dependency resolution How does dependency resolution work? on page 40

Outstanding objects Deleting objects in One Identity Manager on page 51

Synchronization of single Synchronization and provisioning on page 10

objects

Filter What are filters? on page 34

Mapping direction Direction of synchronization and mapping on page 44

Mapping against the direction of synchronization on page
45

Primary and secondary Synchronizing user data with different systems on page
systems 50

Provisioning Synchronization and provisioning on page 10

Revision filter How does revision filtering work? on page 38

Schema How are schemas mapped on page 31

Scope What is a scope? on page 37

Direction of synchronization Direction of synchronization and mapping on page 44

Rogue modification Detecting rogue modifications on page 47

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 30
Basics of target system synchronization
Synchronization Editor communications
A server installed with the One Identity Manager Service and, if necessary, other target
system specific software, is required for synchronization. This server (named the
synchronization server in the following) requires direct access to the target system. The
synchronization server communicates directly with the One Identity Manager database by
default. You can also set up a connection over an application server for this.

Figure 4: Communication paths for synchronization

To configure synchronization with a target system, One Identity Manager must load the
data from the target system. One Identity Manager communicates directly with the target
system to do this. Sometimes direct access from the workstation on which the
Synchronization Editor is installed is not possible, because of the firewall configuration, for
example, or because the workstation does not fulfill the necessary hardware and software
requirements. If direct access is not possible from the workstation, you can set up a
remote connection.

Figure 5: Communication paths for synchronization project configuration

Related topics

l Establish remote connection on page 23

How are schemas mapped

To synchronize a target system with the One Identity Manager database, you must first
map the data models of both systems to each other. The data models (schema) are

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 31
Basics of target system synchronization
different for each system. They must be extended in such a way that they can be uniquely
mapped.
The One Identity Manager distinguishes between four sorts of schema: One Identity
Manager schema, target system schema, connector schema, extended schema. Each
schema is characterized through schema types and schema properties. You can
extend schema with schema classes and schema properties such that they can be
mapped uniquely.
Just how the schema are mapped to each other is defined in mappings. Mappings group
together the rules used to map the schema properties of two connected systems. Object
matching rules assign schema properties through which system objects can be uniquely
identified. Property mapping rules describe how the target system schema properties are
mapped in the One Identity Manager schema.

Figure 6: Schema mapping

Table 20: Terms for schema mapping

Term Explanation

Schema Data model of a connected system. The schema describes all the master data
from the connected system.
The One Identity Manager distinguishes between four sorts of schema: One
Identity Manager schema, target system schema, connector schema,
extended schema.

One The One Identity Manager data model.

Identity
Manager
schema

Target Data model of a specific target system.

system
schema

Connector The system connector extends the target system schema with additional
schema information which is required for mapping in the Synchronization Editor. This
includes:
l Information about which schema properties map memberships

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 32
Basics of target system synchronization
Term Explanation

l Information about which schema properties represent references to

other objects
l Virtual properties that the system connector creates

If a target system does not deliver its own schema, the system connector
generates the connector schema based on the imported data structure, for
example, the import of CSV files by the CSV connector.

Extended A schema can be customized in the Synchronization Editor, for example, to

schema allow or simplify mapping of complex schema properties. The following
options are available:
l Add new schema classes
l Define user-specific virtual schema properties
l Derive schema properties

Label the modified schema as "extended schema".

Schema Defines an object type within a schema. A schema type refers to exactly one
type table or view of the database based schema or exactly one object type of the
non-database based schema.

Schema Subset of a schema type. The result list of a schema type is filtered by
class defined criteria. The number of objects found is limited thus.
Example: Active Directory contacts (schema class) are Active Directory user
accounts (schema type) with their own object class = 'CONTACT' (filter
criteria).

Schema Property of a schema type. A schema property refers to exactly one column
property of a table or view of the database based schema or exactly one object type
property of the non-database based schema. There are two different sorts of
schema property:
l Schema properties of schema types from the target system and One
Identity Manager schema.
l Virtual schema properties,
l added by the user to extend the target system schema or the One
Identity Manager schema
l added by the user to extend the connector schema or the One
Identity Manager schema

Virtual Schema class property added by the system connector or the user.
schema Virtual schema properties extend the basic schema with additional data
properties required for the mapping. You can use virtual schema properties to represent
combinations of schema properties as well as processing step results as
schema properties.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 33
Basics of target system synchronization
Term Explanation

Object Specifies how a concrete object of a target system schema class can be set in
matching relation to a concrete object of a One Identity Manager schema class. An
rule object matching rule encompasses the target system schema property based
on which the target system objects can be uniquely identified.

Property Describes how a target system schema property is mapped in the One
mapping Identity Manager schema.
rule

Related topics

l Setting up mappings on page 67

What are filters?

You can define different filters in the Synchronization Editor. You can use filters to define
the scope of a synchronization project, define schema classes or to create virtual schema
properties. There are three sorts of filter that differ in their effect and way they are
defined. The number of objects to be synchronized can also be limited by a revision filter.

Table 21: Sorts of filter

Filter Description

System This filter limits the number of objects to load in the connected system. It is
filter more effective than the object filter and object matcher because the system
connector only load the objects that are really required. You cannot link more
than one filter criteria with logical operators.
The filter is given in system specific notation, for example, as LDAP filter for
an LDAP system.
The following connected systems support system filters: Active Directory,
LDAP, Microsoft Exchange, and One Identity Manager databases.

A special form of the system filter is the hierarchy filter. The hierarchy filter is
built based on the target system's real objects. All the objects to be filtered
are selected from the object hierarchy.
The hierarchy filter can be used in the definition of the scope of certain target
systems.

Object The filter affects objects already loaded. All schema properties of the schema
filter can be used as filter criteria and linked with logical operators.
The filter is formulated as a query applied to loaded objects. It can be used
when the scope is defined and by virtual schema properties.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 34
Basics of target system synchronization
Filter Description

Object The filter affects objects already loaded. All schema properties of the schema
selection can be used as filter criteria and linked with logical operators. In order to
ensure that the filter returns the desired results when provisioning single
objects, you must add additional system filter criteria to the filter condition.
The filter is formulated as a query applied to loaded objects. It can be
implemented in the schema class definition.

Revision This filter determines all object that have changed since the last synchron-
filter ization run. The deciding factor being the revision property modification.
The filter can be applied to workflows and start up configurations.

It is recommended you combine system filter and object filter/schema class filter to utilize
the advantages of the various filters.
If scope, schema class, and virtual schema property filters are defined in the
synchronization configuration and revision filtering is permitted, the number of objects to
be synchronized results from the combination of all filters.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 35
Basics of target system synchronization
Figure 7: Effects of the filter

Variables can be used in the filter conditions. This enables the same synchronization
project to be used for synchronizing different target systems or different objects within the
same target system.

Related topics

l What is a scope? on page 37

l Schema class properties on page 73
l How does revision filtering work? on page 38

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 36
Basics of target system synchronization
 l Using variables and variable sets on page 110
l Wizard for entering filters on page 19

What is a scope?
The scope specifies which parts of the connected system should be synchronized. The
scope is set for the target system to be synchronized as well as for the One Identity
Manager schema. If no scope is defined, all objects in the connected system are
synchronized.
Example:
Active Directory domains "xyz" and "uvw" are managed through One Identity Manager. The
containers "abc", "def", and "ghi" from the Active Directory domain "xyz" should be
synchronized. A scope is defined for the target system connection and the One Identity
Manager database connection which filters only these objects. The Active Directory domain
"uvw" should initially not be synchronized.

Figure 8: Example for scope definition

To specify a scope, define a system filter and object filter.

Hierarchy filter

Some target systems offer an additional option to specify the scope: the hierarchy filter.
This filter limits the number of objects to load in the connected system. It is therefore
effectively the same as a system filter. The hierarchy filter is built based on the target
system's real objects. The objects are displayed in their hierarchical structure. All objects
included in the scope are marked in the hierarchy. All objects that are not marked remain
outside the scope and are not included in the synchronization. The hierarchy filter can only
be applied to objects and not to their schema properties. Create an additional object filter
to include schema properties as criteria in the scope definition.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 37
Basics of target system synchronization
A fully defined hierarchy filter can be transformed into a variable. Thus the filter can be
redefined in a specialized variable set and used for other synchronization configurations.

Reference scope

References to objects in different target systems can be mapped in the One Identity
Manager database. In order to solve these references, the target system scope must be
extended to include the referenced target systems. For this, you can additionally define a
reference scope for each system connection. You can enter the reference scope for the
database in the same way. This means that references to parts of the One Identity Manager
database can be resolved which are not included in the general scope.
If no reference scope is defined, the general scope is also used for the reference
resolution.
Example:
Active Directory domains "xyz" and "uvw" are trusted domains. User accounts from both
domains are members in Active Directory groups in the Active Directory domain "xyz".
Define a reference scope to assign referenced user accounts of the domain "uvw" during
group membership synchronization. In the reference scope, specify that referenced objects
should also be searched for in the Active Directory domain "uvw".
If you have not defined a reference scope, Active Directory SIDs are determined for Active
Directory domain "uvw" user accounts during Active Directory domain "uvw" group
membership synchronization and entered in the One Identity Manager data store.

Related topics

l Editing the scope on page 107

l What are filters? on page 34
l Using variables and variable sets on page 110

How does revision filtering work?

When you start synchronization, all synchronization objects are loaded. Some of these
objects have not be modified since the last synchronization and, therefore, must not be
processed. Synchronization is accelerated by only loading those object pairs that have
changed since the last synchronization. One Identity Manager uses revision filtering to
accelerate synchronization.

Prerequisites

l The target system supports revision filtering.

This data is supplied by the system connector.
l Schema types own a schema property which is labeled as a revision counter.
This schema property stores the information about the last object modifications.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 38
Basics of target system synchronization
 Example of an Active Directory group:
l In the target system schema: UNS Changed
l In the One Identity Manager schema: Revision Date
l Revision filtering permitted for this synchronization workflow.

Revision filtering can be applied to workflows and start up configuration. The workflow
setting is valid for all synchronizations with this workflow. In order to synchronize with the
same workflow at different times, with, and without revision filtering, create different start
up configurations and specify revision filtering for them.

To permit revision filtering on a workflow

l Open the synchronization project in the Synchronization Editor.

l Edit the workflow properties. Select the Use revision filter item from Revision
filtering menu.

For more information, see How to edit a workflow on page 88.

To permit revision filtering for a start up configuration

l Open the synchronization project in the Synchronization Editor.

l Edit the start up configuration properties. Select the Use revision filter item from
the Revision filtering menu.

For more information, see How to edit start up configurations on page 116.
Normally, each object keeps information about the last changes made. The highest
change data value of all synchronized objects of a schema type is taken as the revision
in the One Identity Manager database (DPRRevisionStore table, DPRRevisionStore column).
This value is used as a comparison for revision filtering when the same workflow is
synchronized the next time. This means that when this workflow is next synchronized,
the object change data is compared with the revision saved in the One Identity Manager
database. This involves finding object pairs where one has newer change data than the
last time it was synchronized. Thus, only objects that have changed since the last
synchronization are updated.
The reference parameter for revision filtering is also the last schema type synchronization
with the same workflow. The table DPRRevisionStore contains one entry per workflow and
schema type.
NOTE: One Identity Manager supplies a scheduled process plan, which regularly cleans
up the contents of the DPRAttachedDataStore table. Entries for schema types that are no
longer used in the synchronization configuration are deleted in the process. The process
plan is executed during daily maintenance.

Related topics

l Properties of a workflow on page 90

l Setting up start up configurations on page 115

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 39
Basics of target system synchronization
 l What are filters? on page 34
l Resetting revisions on page 138

How does dependency resolution work?

Dependencies can arise between schema classes that require synchronization steps to
be repeated. For example, object references can not be set until the reference object
has been added. Dependencies can also arise between schema properties within a
schema class.

Figure 9: Example of a workflow with dependent schema classes and

schema properties

One Identity Manager can automatically resolve such dependencies. In this case, the
synchronization steps are group together such that the referenced objects are synchronized
first and them the dependent objects next. If dependencies exist within a schema class,
additional synchronization steps are inserted to synchronize the dependent schema
properties. The final sequence of synchronization steps can be viewed in the report
"Execution Plan".
NOTE: If dependencies exist between schema classes, the schema classes must be
synchronized by the same workflow so that dependencies can be automatically resolved.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 40
Basics of target system synchronization
Figure 10: Example of a workflow with automatic dependency resolution

To set up automatic resolution of dependencies

l Edit the workflow properties. Select the following option:

Dependency resolution: Automatic

For more information, see How to edit a workflow on page 88.

Use automatic dependency resolution by default. Only select manual dependency

resolution if individual dependencies cannot be resolved automatically. This might be
necessary, for example, if two objects reference each other as mandatory properties.
NOTE: If dependency resolution is set to "Manual", One Identity Manager does not check
whether dependencies exits between schema classes and schema properties during
synchronization. The synchronization steps are processed sequentially in the order
displayed in the workflow view.
Synchronization exits with an error if dependencies exist that cannot be resolved!

To resolve dependencies manually

1. Find the schema properties between which dependencies exist.

2. Create a workflow with synchronization steps which take the following criteria into
account:
a. Synchronization steps which synchronize independent and references objects.
Property mapping rules for dependent schema properties must be
excluded for this.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 41
Basics of target system synchronization
 b. Synchronization steps which reference dependent objects.
Property mapping rules for dependent schema properties must be
included for this.
3. Specify the synchronization step sequence such that all synchronization steps for a)
are executed first and them the synchronization steps for b).
4. Edit the workflow properties. Select the following option:

Dependency resolution: Manual

For more information, see How to edit a workflow on page 88.

Related topics

l Show execution plan on page 103

l Properties of a workflow on page 90
l Rule filters on page 101
l Editing synchronization steps on page 92

Unresolvable references
If a reference object does not exist in the One Identity Manager database, the object
reference cannot be resolved by synchronizing. Unresolvable object references are written
in a buffer called the data store (table DPRAttachedDataStore). This ensures that these
references remain intact and are not deleted in the target system by provisioning.
Example:
An Active Directory group has an account manager, which owns a domain not in the
current synchronization run. The account manager is not in the One Identity Manager
database either.
Synchronization cannot assign an account manager. In order to retain the
assignment, the object reference is saved with the account manager's distinguished
name in the data store.
During each synchronization One Identity Manager tries to clean up the data store. If
referenced objects in the One Identity Manager database exist, the references can be
resolved and the entries are deleted from the data store. The data store is cleaned up
depending on the synchronization type (with or without revision filter) and the
maintenance mode.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 42
Basics of target system synchronization
Table 22: Maintenance for unresolved object references

Maintenance Synchronization without Synchronization with revision filer

mode revision filer

The following Object references of all Only object references for modified
applies synchronization objects are objects are cleaned up.
depending on cleaned up if they exist in the
the mainten- One Identity Manager
ance mode: database.

No mainten- There is no additional task of clearing up the data store.

ance

Always No effect. The filter is removed on objects with

synchronize unresolved references. Therefore, refer-
affected ences are also cleaned if the objects
objects have not been changed since the last
synchronization.

Full mainten- One Identity Manager tries to One Identity Manager tries to resolve
ance after resolve object references object references following synchron-
every synchron- following synchronization. As ization. As a result, unresolved refer-
ization a result, unresolved refer- ences are processed that arose during
ences are processed that this synchronization run. Object refer-
arose during this synchron- ences that were not modified are also
ization run. cleaned up.

You can enter the number of retries for resolving object references. It may be necessary to
try several times to resolve an object if it maps a hierarchy with several levels. One
hierarchy level at a time can be resolved with each attempt to resolve an object.

To set up maintenance mode

l Edit the start up configuration properties. Select the Maintenance tab.

For more information, see How to edit start up configurations on page 116.

NOTE: One Identity Manager supplies a scheduled process plan, which regularly cleans
up the contents of the table DPRAttachedDataStore. Object entries, which no longer exist in
the One Identity Manager database are deleted. The process plan is executed during daily
maintenance.

Related topics

l Maintenance modes on page 119

l Maintaining the data store on page 188

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 43
Basics of target system synchronization
Direction of synchronization and
mapping
To synchronize a target system with One Identity Manager, you must specify which of the
connected systems is the data master. Specify the master system in the synchronization
configuration with the direction of synchronization. The direction in which schema
properties are mapped may differ from this. Therefore, the permitted mapping direction
must be given in the schema properties mapping.

Table 23: Direction of synchronization

Defined on Direction of synchronization specifies

Start configuration In which direction a specific synchronization is executed

Workflow In which direction synchronizations are executed

synchronization step By which synchronization direction the step is executed

Table 24: Permitted mapping direction

Defined on Specifies the mapping direction

Mapping By which synchronization direction property mapping rules are

used

Property mapping By which synchronization direction this property mapping rule is

rule used

One Identity Manager synchronizes two connection systems in the direction given in the
start up configuration or in the workflow. A synchronization step is only executed in this
case, if the direction of synchronization stored with the step matches with the direction of
the current synchronization. If the mapping direction stored with the mapping corresponds
to the current direction of synchronization, the system object from this schema class are
synchronized. Thus, One Identity Manager checks which property mapping rule can be used
in the current synchronization direction. This property mapping rule is ignored if the
mapping direction of the property mapping rule differs from the current direction of
synchronization.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 44
Basics of target system synchronization
Figure 11: Example showing effect of specified synchronization direction and
permitted mapping direction

Related topics

l Setting up start up configurations on page 115

l Properties of a workflow on page 90
l General properties of a synchronization step on page 94
l Properties of a mapping on page 71
l Editing property mapping rules on page 78

Mapping against the direction of

synchronization
For certain schema properties, it may be necessary to copy the schema property value
immediately from the connected system into the master synchronization system each time
synchronization is run. There is a property mapping rule for these schema properties
whose direction of mapping is opposite to the direction of synchronization. These rules are
not executed by default. To transfer these schema property values during synchronization,

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 45
Basics of target system synchronization
you must force execution of these rules. This behavior is configured in the property
mapping rules.

Prerequisites

l The Detecting rogue modifications option is disabled on the property

mapping rule.

To force mapping a schema property against the direction of synchronization

l Edit the property mapping rule.

Set Force mapping against direction of synchronization.
For more information, see How to edit property mapping rules on page 79.

Property mapping rules with this option set are executed after the synchronization step is
completed. This copies changes from the connected system against the direction of
synchronization into the master system.

Synchronization Sequence

1. All property mapping rules whose mapping direction is the opposite to the direction
of synchronization are ignored whilst a synchronization step is being executed.
Property mapping rules whose mapping direction corresponds to the direction of
synchronization are run.
2. All changes to the connection system are saved when the synchronization step
is complete.
3. All property mapping rules with the option Force mapping against direction of
synchronization set are executed again. For those schema properties involved, the
changes are copied from the connected system into the master system.
NOTE: The property mapping rules are also rerun after completion of the
synchronization step if there are no processing methods given in the
synchronization step.

Use the Force mapping against direction of synchronization option for schema
properties that cannot be edited in the master system due to technical limitations.
NOTE: This option is also taken into account when object changes are provisioned.

Example

An Active Directory environment should be administrated through One Identity

Manager. One Identity Manager is the master system for synchronizing both
systems. The user account object GUIDs are, however, not mapped in One Identity
Manager but in the Active Directory environment. This means the mapping direction
is different for a user account object GUID. To copy the object GUID from the target

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 46
Basics of target system synchronization
 system to One Identity Manager during synchronization, the mapping must be forced
in the opposite direction of synchronization for this schema property.

Table 25: Synchronization configuration

Configuration Setting Value

Direction of Synchronization: To the target system

Property mapping rule for schema [Link] -

properties: [Link]

Mapping direction: To the One Identity Manager

Force mapping against direction of Enabled

synchronization

Synchronization Sequence
Scenario: A new Active Directory user account was added in One Identity Manager.

1. The user account is added in the target system through synchronization.

2. The property mapping rule for the object GUID is ignored because of the
opposing the mapping direction.
3. Once all property mapping rules of the synchronization step have been
processed, the user account is saved in the target system. A value is
calculated in the target system for [Link].
4. Once the synchronization step is complete the property mapping rule for the
object GUID is run again. The object GUID is copied from Active Directory to
One Identity Manager.

Related topics

l Editing property mapping rules on page 78

Detecting rogue modifications

To map single schema properties, it could be necessary to declare one of the connected
systems as the data master. Property mapping rules for these schema properties all have
the same direction of mapping. If editing these schema properties is not technically
restricted in any of the connected systems, you can also change their values in a system
that is not the data master.
If the direction of synchronization matches the direction of mapping these changes are
overwritten by the next synchronization.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 47
Basics of target system synchronization
If the direction of synchronization is opposite to the direction of mapping, data that cannot
be corrected by synchronization becomes inconsistent because the property mapping rules
are not executed. Change like this are consider to be “rogue modifications”. In this case, a
modification is considered to be any difference between the object properties of the
connected systems, irrespective of the system the object was actually modified.
Synchronization can identify (rogue detection), log, and correct (rogue correction) rogue
modifications. You can configure the respective behavior in the property mapping rules.

Prerequisites

l The direction of mapping target system or One Identity Manager is set in the
property mapping rule.
l The Force mapping against direction of synchronization option is not set in the
property mapping rule.

To detect and log rogue modifications

l Edit the property mapping rule.

Set the Detect rogue modifications option.
For more information, see How to edit property mapping rules on page 79.

To correct rogue modifications

l In addition, set the Correct rogue modifications option in the property

mapping rule.

NOTE: Rogue modifications can only be corrected if there is write access for schema
property to be corrected.

Synchronization Sequence with Modification Detection

1. A property mapping rule is detected whose mapping direct is opposite to the actual
direction of synchronization.
2. If Detect rogue modifications is set, One Identity Manager checks the object of
the connected system for rogue modifications. Rogue modification are logged.
The log can be evaluated after synchronization. For more information, see
Synchronization analysis on page 140.
3. If the Correct rogue modifications option is set, One Identity Manager executes
the property mapping rule. The object property in the connected system is
overwritten with the value from the data master.

NOTE: Rogue modifications are also handled when object modifications are provisioned.
Modification detection can be usefully applied if a synchronization workflow and a
provisioning workflow are configured, which means, the direction of synchronization is
One Identity Manager and for certain schema properties the direction of mapping is the
target system. In this case, only changes made to the schema properties that were made
in the target system are detected as rogue modifications.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 48
Basics of target system synchronization
 Example

The synchronization direction One Identity Manager is specified for synchronizing

Active Directory groups. The groups and their properties are created, edited, and
deleted in Active Directory. Only the group’s account manager is going to be
assigned and changed in One Identity Manager.

Table 26: Synchronization Configuration

Configuration Setting Value

Direction of Synchronization: To the One Identity Manager

Property mapping rule for schema [Link] - [Link] of

properties: manager

Mapping direction: To the target system

Detecting rogue modifications: Set

Correct rogue modifications: Set

Synchronization adds new groups in One Identity Manager. An account manager

is assigned in One Identity Manager. This modification is provisioned in the
target system.
There is no technical restriction to editing the account manager in the target
system. If the account manager is changed in Active Directory, there is a
discrepancy in the data, meaning a rogue modification. This change is detected,
logged, and reverted by the next synchronization. The property matching rule is
executed and the value in the target system is overwritten with the value from the
One Identity Manager database.

It may make sense to use modification detection together with the Ignore mapping
direction restrictions on adding option. As in the example, a new group is added in
Active Directory. This initially assigned an account manager.
By synchronizing, the group is added in One Identity Manager but the account manager
remains empty because the property mapping rule is not executed.
Before the account manager is assigned in One Identity Manager, the Active Directory is
synchronized again. This detects a rogue modification (empty value in the database -
account manager assigned in the target system). As a result, the value in the target system
is corrected, deleting the account manager.
To avoid such situations, set the Ignore mapping direction restrictions on adding
option. This means, the property mapping rule for the account manager is executed when
the group is added and the account manager is assigned in the database. The subsequent
synchronization does not detect a rogue modification because the account manager is
identical in both systems.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 49
Basics of target system synchronization
To execute a property mapping rule on adding

l Edit the property mapping rule.

Set the Ignore mapping direction restrictions on adding option.
For more information, see How to edit property mapping rules on page 79.

Related topics

l Property mapping rule details on page 79

Synchronizing user data with different

systems
The source for the user data and permissions managed by One Identity Manager may be
different systems. For example, SAP R/3 user accounts are managed in One Identity
Manager. The associated employee data, however, is imported into the database through
the CSV connector from another system.
The CSV import may cause the objects coming from another target system through
synchronization to be modified. For example, the first and last names of an SAP user
account change when the first and last names of an employee change through the CSV
import. Changes to the SAP user account should be immediately provisioned in SAP R/3. To
illustrate this, the connected systems will be named "primary systems" in the following;
the systems whose data is synchronized with the CSV connector as "secondary systems".

Figure 12: Example of synchronizing user data with different systems

You can specify whether the data comes from a secondary system in the synchronization
steps. In this case, changes are provisioned immediately (actually during synchronization)
in the primary system. Conversely, the provisioning process may not start if primary
systems are being synchronized.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 50
Basics of target system synchronization
To configure immediate provisioning when synchronizing a secondary system

1. Open the synchronization project for the secondary system.

For more information, see How to edit a synchronization project on page 62.
2. Edit the synchronization step properties.
Set the Import data option on the General tab.
For more information, see How to edit synchronization steps on page 93.

NOTE: To prevent immediately provisioning of a primary system during synchronization,

open the primary system synchronization project and disable the Import data option in
the synchronization step.
The session variable FullSync=FALSE is set if the Data import option is enabled. The
session variable is set to FullSync=TRUE if the option is disabled. Different processes,
scripts, and templates are only executed in the One Identity Manager database if
FullSync=FALSE. In this context it means they are only synchronized with a secondary
system. Synchronizing with a primary system ignores processes, scripts, and templates.

Related topics

l General properties of a synchronization step on page 94

Deleting objects in One Identity

Manager
You have two options for deleting objects in the One Identity Manager, which do not exist in
the target system, by using synchronization.

1. The objects are deleted immediately on synchronization.

You can view the synchronization log to see which objects have been deleted.
NOTE: Memberships that exist based on an inheritance cannot be deleted
immediately. They are always marked as outstanding.
2. The objects are marked as outstanding by synchronization.
Outstanding objects must be post-processed separately in One Identity Manager.
They can either be deleted or published in the target system in the process. This
prevents objects being deleted because of an incorrect data situation or an incorrect
synchronization configuration.
Outstanding objects
l Cannot be edited in One Identity Manager.
l Are ignored by subsequent synchronization.
l Are ignored by inheritance calculations.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 51
Basics of target system synchronization
 This means, all memberships and assignments remain intact until the outstanding
objects have been processed.

To delete objects immediately in One Identity Manager

1. Edit the synchronization step properties.

For more information, see How to edit synchronization steps on page 93.
2. Select the Processing tab.
3. Specify the processing method. Select the following options as appropriate:

For synchronization from the target systems Processing Method

to One Identity Manager (technical name)

Objects that are only found in One Identity Manager: Delete

To mark object as outstanding in One Identity Manager

1. Edit the synchronization step properties.

For more information, see How to edit synchronization steps on page 93.
2. Select the Processing tab.
3. Specify the processing method. Select the following options as appropriate:

For synchronization from the target systems Processing Method

to One Identity Manager (technical name)

Objects that are only found in One Identity Manager: MarkAsOutstanding

Outstanding objects cannot be editing in One Identity Manager until they have been
verified. They are ignored by every other synchronization.

To delete outstanding objects in the One Identity Manager

1. Start the Manager.

2. Select the <target system type> | Target system synchronization: <target
system type> | <table> category.

3. Select the objects you want to delete. Multi-select is possible.

4. Click .
5. Confirm the security prompt with Yes.
The selected objects are immediately deleted in the One Identity Manager database.
Deferred deletion is not taken into account. The "outstanding" label is removed from
the objects.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 52
Basics of target system synchronization
Related topics

l Specifying processing methods on page 95

l Target system synchronization on page 141
l Include custom tables in the synchronization on page 166
l Synchronizing user data with different systems on page 50
l General properties of a synchronization step on page 94
l Deleting memberships on page 143

How to remove unnecessary project

data
All the schema data (schema types and schema properties) of the target system schema
and the One Identity Manager schema are available when you are editing a synchronization
project. Only a part of this data is really needed for configuring synchronization. If a
synchronization project is finished, the schema is compressed to remove unnecessary data
from the synchronization project. This can speed up loading the synchronization project.

l Activating the Synchronization Project

Unnecessary schema data is automatically removed from the synchronization project
on activation.
l Shrink schema
a. Schemas are shrunk when the synchronization project is saved for the
first time.
b. Each time the system is connected, you have the option to shrink the schema.
All the schema types that are not currently in use are displayed in a dialog. You
may remove these from the synchronization project. Here you can select the
schema types that should remain available for you to use later.

To shrink the system connection schema

1. Select Configuration | Target system.

- OR -
Select Configuration | One Identity Manager connection.
2. Click Shrink schema... in the General view.
3. Mark all the schema types that should not be removed.
These schema types remain there and can still be used in the synchronization
configuration.
4. Click OK.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 53
Basics of target system synchronization
You can add the deleted schema data back into the synchronization project again later. To
do this you must update the respective schema.

Related topics

l How to edit system connection properties on page 103

l Activating the synchronization project on page 128
l Save changes permanently on page 23
l Updating schemas on page 54

Updating schemas
To include schema data that have been deleted through compressing and schema
modifications in the synchronization project, update each schema in the synchronization
project. This may be necessary if:

l A schema was changed by:

l Changes to a target system schema
l Customizations to the One Identity Manager schema
l A One Identity Manager update migration
l A schema in the synchronization project was shrunk by:
l Enabling the synchronization project
l Saving the synchronization project for the first time
l Compressing a schema

To update a system connection schema

1. Select the Configuration | Target system category.

- OR -
Select the Configuration | One Identity Manager connection category.
2. Select the General view and click Update schema.
3. Confirm the security prompt with Yes.
This reloads the schema data.

Then you can add the changes to the schema property mapping.
NOTE: The synchronization is deactivated if the schema of an activated synchronization
project is updated. Reactivate the synchronization project to synchronize.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 54
Basics of target system synchronization
Related topics

l System connection properties on page 104

l How to remove unnecessary project data on page 53
l Setting up mappings on page 67
l Activating the synchronization project on page 128

Synchronizing and provisioning

memberships
Memberships, for example, user accounts in groups, are saved in assignment tables in One
Identity Manager database. Membership lists are commonly maintained as an object
property in the target system. If a membership is modified in One Identity Manager, the
object must be updated.

Changing a membership label

To label whether a membership was changed, a base table assignment is maintained,
which maintains information about the last change of membership in the Dependencies
modification date column (XDateSubItem). During provisioning of modified memberships,
One Identity Manager decided which objects must be updated based on this date. In the
case of synchronization with revision filtering, the highest value from XDateSubItem and
XDateUpdated is used as a revision counter for the database objects.
If a membership is changed in One Identity Manager, the change date for dependencies
must updated so that the modification can be provisioned.

Prerequisites

l The base table has the XDateSubItem column.

NOTE: If this column does not exist in the assignment's base table, you can extend
the base table. Create the CCC_XDateSubItem column to do this.
l The Update dependencies modification date property is true in the table relation
between assignment and base table ([Link] = TRUE).

Figure 13: Memberships in the One Identity Manager database

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 55
Basics of target system synchronization
If a membership changes (through insertion, deletion, or resetting of status "Outstanding")
a task for updating the XDateSubItem column of the base table is queued in the DBQueue
(QBM-K-XDateSubItemUpdate). If necessary, more processing tasks, for example, calculating
inheritance, are queued in the DBQueue. These tasks are handled first. The QBM-K-
XDateSubItemUpdate task is deferred until all the processing tasks for the modified object
and the module to which it belongs, have been handled. If other memberships in this
module are changed in the meantime, these changes are collected by the existing task for
updating the XDateSubItem column and subsequently handled together. Once the QBM-K-
XDateSubItemUpdate task is run, an update task for the XDateSubItem column is queued in the
Job queue. The column value is updated. The task for provisioning changed memberships is
then placed in the Job queue.

Figure 14: Processing a membership change in One Identity Manager

Example

Active Directory user account membership in an Active Directory group is deleted in One
Identity Manager (ADSAccountInADSGroup table). The change date for dependencies is
updated on the Active Directory group ([Link]). The change to the
membership for this Active Directory group is provisioned in the target system. The next
time synchronization with revision filtering is run, XDateSubItem is taken as the highest
change date for the revision counter and is compared to the schema type's revision.

Related topics

l How does revision filtering work? on page 38

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 56
Basics of target system synchronization
Single membership provisioning
During the membership provisioning, changes made in the target system will probably be
overwritten. This behavior can occur under the following conditions:

l Memberships are saved in the target system as an object property in list form
(Example: List of user accounts in the Members property of an Active Directory group).
l Memberships can be modified in either of the connected systems.
l A provisioning workflow and provisioning processes are set up.

If a membership in One Identity Manager changes, the complete list of members is

transferred to the target system by default. Memberships, previously added to the target
system are removed by this; previously deleted memberships are added again.
To prevent this, provisioning can be configured such that only the modified membership is
provisioned in the target system. To do this, you must set the Enable merging option on
the assignment table ([Link] = TRUE). For
more detailed information about setting this option, see the administration guides for
connecting each target systems.
Additional processing steps are executed for tables with this option enabled.

1. A task is set up in the DBQueue Processor to update the DPRMemberShipAction table.

This table contains the modified objects and operations to be run.
2. The membership list of modified objects is compared to the DPRMemberShipAction
table. Therefore, if only one membership changes, not the entire members list in the
target system has to be updated. Only each modified membership is transferred to
the members list. Changes to memberships of the modified object, which were made
in the target system in the meantime, are therefore not overwritten.
3. Once the change has been successfully provisioned in the target system, the entry is
deleted from the DPRMemberShipAction table. If an error occurs during provisioning,
the entry remains in the table.

Table 27: Handling entries in the DPRMemberShipAction table

Provisioning Entry in Comment

Process DPRMemberShipAction

Success Deleted

Fail Remains intact A new modification to the object is reprocessed by

provisioning and deleted on success.

Re-enabled Reprocessed

Failed and Remains intact Deleted during daily maintenance.

deleted All entries without a provisioning task in the Job
queue are deleted in the process of these
maintenance jobs.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 57
Basics of target system synchronization
 NOTE: The complete members list is updated by synchronization. During this process,
objects with changes but incomplete provisioning are not handled. These objects are
logged in the synchronization log.

Performance and memory optimization

During synchronization, data packets are loaded in to memory to process synchronization
objects in parallel. The size of these data packets can be increased to speed up
synchronization but this required more memory. By default, the size of the data packet is
selected such that the ratio of memory to performance is balanced out. However, memory
issues can still occur during synchronization. This often depends on the configuration of the
system environment, the amount of data to synchronize and the exact synchronization
configuration. You can control memory usage to avoid such problems. The degree of
change is determined with the performance/memory factor.
The performance/memory factor can be set for each synchronization step separately
because the amount of data varies from object to object. The first thing to do if a memory
problem occurs during synchronization, is to find the affected synchronization step. Reduce
the performance/memory factor for this synchronization step until you find the optimal
balance between memory requirements and performance.

To adjust the performance/memory factor for a synchronization step

1. Edit the synchronization step properties.

For more information, see How to edit synchronization steps on page 93.
2. Select the Extended tab.
3. Use the slider to set the performance/memory factor.
l Move the slider to the left to reduce memory usage. This reduces performance.
- OR -
l To increase performance, move the slider to the right. This requires
more memory.
4. Click OK.

TIP: You can adjust the memory requirements for all the data to be processed in the
start-up configuration. You can set the reload threshold, partition size, and bulk level
here. These setting are only possible in expert mode. For more information, see
Extended properties for start up configuration on page 158.
The performance/memory factor specifies the percentage with which the reload threshold,
partition size, and bulk level are applied to an object type.

Related topics

l Extended synchronization step properties on page 101

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 58
Basics of target system synchronization
Improving loading performance
To improve performance when loading a synchronization project, you can save the
synchronization project’s configuration data as a shadow copy in the One Identity Manager
database. After that, the synchronization project is only loaded from the shadow copy. The
project loads noticeably faster. The shadow copy is saved in the Configuration data
column ([Link]).
If you want to use this option, take note of the following:

l The shadow copy does not contain any changes that were made directly in the
database and not in the Synchronization Editor.
l If the One Identity Manager database is encrypted or decrypted with the Crypto
Configuration program, the shadow copy is deleted.
l If changes to the synchronization project in another database are exported, the
shadow copy is deleted in the other database. This ensures that the shadow copy
does not contain outdated configuration data.
Prerequisite: The transport package was created with the Transport of
synchronization projects export criteria.
l If the Enable shadow copy option is set, the daily maintenance tasks check
whether a shadow copy is saved or not. If the shadow copy is missing, it is created.

To enable the shadow copy

1. Edit the synchronization project’s properties.

a. Select General on the start page.

b. Click Edit.
2. On the General tab, set the Enable shadow copy option.
3. (Optional) If the shadow copy on needs to create if the synchronization project is
active, set the Only if the synchronization project is active option.
4. Click OK.

Related topics

l General properties of a synchronization project on page 63

l Exporting a synchronization configuration on page 172

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 59
Basics of target system synchronization
 4

Setting up synchronization

Use the Synchronization Editor to configure connections for different target system in One
Identity Manager. The components of a synchronization configuration are used for both
synchronization and for provisioning and synchronizing single objects. Synchronization can
be configured so it can be used for connecting different target systems of the same target
system type.

Table 28: Synchronization configuration components

Term Described in

base object Setting up base objects on page 122

Mapping Setting up mappings on page 67

Start configuration Setting up start up configurations on page 115

Synchronization project Creating a synchronization project on page 61

Variable set Using variables and variable sets on page 110

Workflow Setting up synchronization workflows on page 87

Starting the Synchronization Editor

There are different ways to start the Synchronization Editor.

l From the Windows start menu using the entry One Identity | One Identity
Manager | Configuration | Synchronization Editor.
l From the Launchpad.
l In the Manager

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 60
Setting up synchronization
Creating a synchronization project
A synchronization project collects all the information required for synchronizing the One
Identity Manager database with a target system. Connection data for target systems,
schema types and properties, mapping, and synchronization workflows all belong to this.

Prerequisites

l A synchronization server is set up and declared in the One Identity Manager

database.

There is an wizard to assist you with setting up a synchronization project. This wizard takes
you all the steps you need to set up initial synchronization with a target system. The
project wizard takes over the following tasks:

l Connecting to the Target System

l Connecting to the One Identity Manager database
l Defining synchronization behavior
The synchronization behavior can be configured based on target system-specific
project templates. Project templates are supplied by One Identity Manager for
certain target systems, The project wizard copies the project template data. This can
be modified with the project wizard to suit the new synchronization project. Just one
synchronization project can be created per target system and default project
template used.

After saving the synchronization project, you can alter the synchronization configuration.

To complete synchronization configuration

1. Check the mappings, workflows, start up configuration, and system connection that
the wizard has added.
2. Assign a schedule to the start up configuration.
3. If you want to use the synchronization project to synchronize different target
systems, specify variables, and variable sets.
4. Activate the synchronization project. The synchronization cannot be started until
these are resolved.

NOTE: The current synchronization project is closed when you open another
synchronization project.

Detailed information about this topic

l How to create a synchronization project on page 62

l How to edit a synchronization project on page 62
l Templates for creating synchronization projects on page 65
l Specifying a schedule on page 119

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 61
Setting up synchronization
 l Using variables and variable sets on page 110
l Activating the synchronization project on page 128

How to create a synchronization project

NOTE: The current synchronization project is closed when you open another
synchronization project.

To create a new synchronization project

a. Select the synchronization project view on the start page.

b. Click Start a new synchronization project.
This starts the project wizard.
c. Follow the project wizard instructions.
d. Click Commit to database to save the new project.

How to edit a synchronization project

NOTE: The current synchronization project is closed when you open another
synchronization project.

To open a synchronization project

1. Select the synchronization project view on the start page.

2. Select the synchronization project you want to load by double-clicking on it.
TIP: To limit the list of synchronization projects displayed, select the target system
connection you want on the left-hand side of the project selection view.
3. If the connection data is encrypted, enter the values required to establish the system
connection and click OK.
4. Edit the mappings, workflows, and other components of the synchronization
configuration.

To edit synchronization project properties

1. Select the synchronization project view on the start page.

2. Select the synchronization project you want to load by double-clicking on it.
3. If the connection data is encrypted, enter the values required to establish the system
connection and click OK.
4. Click Edit....
5. Edit the display name and the synchronization project description.
6. Click OK.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 62
Setting up synchronization
Detailed information about this topic

l Working with an encrypted database on page 26

How to delete a synchronization project

NOTE: The current synchronization project is closed when you open another
synchronization project.

To delete a synchronization project

1. Select the synchronization project view on the start page.

2. Select the synchronization project to delete.
TIP: To limit the list of synchronization projects displayed, select the target system
connection you want on the left-hand side of the project selection view.
3. Click in the project selection view toolbar.
4. Confirm the security prompt with Yes.

The schedule assigned to this synchronization project is also deleted if it is not used by any
other database object.

General properties of a synchronization

project
You can edit the synchronization project's display names and description on the
General tab.

Table 29: General properties of a synchronization project

Property Description

Display name Display name for the synchronization project.

Script language Language in which the scripts for this synchronization project are
written.
Enable shadow The synchronization project can be additionally saved in the database
copy as an XML definition. Afterward, the synchronization project is only
loaded from this XML definition. The project loads noticeably faster.
NOTE: The shadow copy does not contain any changes that were
made directly in the database and not in the Synchronization Editor.

Only if the The shadow copy is only created if the synchronization project is active.
synchronization
project is

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 63
Setting up synchronization
Property Description

active

Description Spare field for additional explanation.

On the Migration tab, you can see the migration versions of the One Identity Manager
module required for the synchronization project. All the patches already installed are also
listed. Migration data is only available for synchronization projects that were created with
One Identity Manager version 7.1.

Table 30: Synchronization project migration data

Property Description

Origin Information about the project template used to create the synchronization
project.

Context Module or connected system for which the synchronization project is valid.

Current The currently installed version of the program.

version

Patches Patches that have been applied to the synchronization project since the One
added later Identity Manager was installed or updated.

Related topics

l Applying patches on page 148

l Improving loading performance on page 59
l Specifying the script language in synchronization projects on page 64

Specifying the script language in

synchronization projects
You can apply scripts at various points in the synchronization project; for example, when
defining the schema properties, in the object filter, or when you define data operations for
system connections through the native database connector.
When you define a synchronization project with the project wizard, you specify a script
language in which to create the script. You can select either C# or Visual Basic .NET. You
can only use project templates in the synchronization wizard that support the selected
script language.
NOTE: If you want to create a synchronization project using a template, check whether
the project template supports the selected script language.
NOTE: You cannot change the script language once the project wizard is finished!
Create a new synchronization project to change the script language later.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 64
Setting up synchronization
Related topics

l Edit schema properties on page 76

l Scope properties on page 108
l Schema class properties on page 73

Templates for creating synchronization

projects
Some system connectors provide template which you can use to configure a complete
synchronization project with the project wizard, The project templates add the following
components to the synchronization configuration in the synchronization project, depending
on the target system type.

l The scope
l A start up configuration (without schedule)
l The default variable set
l A base object
The synchronization base object, e.g. the actual Active Directory domain that you
want to synchronize, is added as an object in the One Identity Manager database.
l A synchronization workflow for the initial import of the target system into the One
Identity Manager database
The workflow has the following characteristics:
l Direction of synchronization is "One Identity Manager".
l Processing methods in the synchronization steps are only defined in
synchronization direction "One Identity Manager".
l A provisioning workflow
This workflow is only created if the Read/write access to target system.
Provisioning available. option is selected on the Restrict target system access
page of the project wizard.
The workflow has the following characteristics:
l Synchronization in the direction of the "Target system".
l Processing methods are only defined in the synchronization steps in
synchronization direction "Target system".
l Synchronization steps are only created for such schema classes whose schema
types have write access.
l The schema classes required
l Mappings for all schema classes required
These include:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 65
Setting up synchronization
 l Required virtual schema properties
l Property mapping rules
l Object matching rules

Also created is:

l Operations for provisioning and single object synchronization

Once a synchronization project has been created from a project template, you can check
the settings assign a schedule and start synchronization.

Restricting system access

When you set up a synchronization project with the project wizard, you decide whether the
target system is only read in or whether One Identity Manager can also make changes. If
you select the Target system has read-only access option, only modifications in the
target system are transferred to the One Identity Manager database. Changes in the One
Identity Manager database are not written to the target system. This means:

l Direction of synchronization is "One Identity Manager".

l The project wizard only creates one synchronization workflow. A provisioning
workflow is not added.
l Processing methods in the synchronization steps are only defined in synchronization
direction "One Identity Manager".

Related topics

l Templates for creating synchronization projects on page 65

l Specifying processing methods on page 95
l Direction of synchronization and mapping on page 44

Configuring synchronization
Not all system connectors provide a project template for creating a full configured
synchronization project. Therefore, you can also create a synchronization project
manually. In this case, the project wizard sets up the system connection. All other
synchronization configuration components must be configured after you have saved the
synchronization project.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 66
Setting up synchronization
To manually set up synchronization of the One Identity Manager database with
a target system

1. Install and configure a synchronization server and declare the server as Job server in
One Identity Manager.
2. Create a new synchronization project.
l The project wizard sets up the system connection.
l On the Select project template page, select Create blank project.

3. Add mappings. Define property mapping rules and object matching rules.
4. Create synchronization workflows.
5. Create a start up configuration.
6. Define the synchronization scope.
7. Specify the base object of the synchronization.
8. Specify the extent of the synchronization log.
9. Run a consistency check.
10. Activate the synchronization project.
11. Save the new synchronization project in the database.

Detailed information about this topic

l How to create a synchronization project on page 62

l Setting up mappings on page 67
l Setting up synchronization workflows on page 87
l Setting up start up configurations on page 115
l Editing the scope on page 107
l Setting up base objects on page 122
l Configuring the synchronization log on page 106
l Activating the synchronization project on page 128

Setting up mappings
Mappings group together the rules used to map the schema properties of two connected
systems. For this, a schema class is created for every schema type which requires
mapping. A schema class limits the result list of a schema type through defined filer
criteria. A mapping maps schema properties from exactly one target system schema class
to the schema properties of exactly one schema class in the One Identity Manager schema.
A schema class without a filter condition represents the schema type.
Property mapping rules describe how the target system schema properties are mapped in
the One Identity Manager schema. Object matching rules assign schema properties through

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 67
Setting up synchronization
which system objects can be uniquely identified. For example, Active Directory groups can
be uniquely identified by the schema properties DistinguishedName and ObjectGUID.
You specify in the mapping, which mapping direction is permitted for the connected schema
classes. Furthermore, you can also specify the permitted mapping direction for individual
property mapping rules.
Default mappings for target system synchronization are added if the synchronization
project was created with a default project template. You can edit or delete these mappings
or create new mappings. If the synchronization project was created without a project
template, no mappings are set up.
The schema property mapping is edited with the mapping editor.

Detailed information about this topic

l How are schemas mapped on page 31

Mapping editor
The schema property mapping is edited with the mapping editor. The mapping editor is
divided into two schema view and two rule views. Each mapping editor view has its
own toolbar.

Figure 15: Views in the mapping editor

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 68
Setting up synchronization
TIP:

To display mapped schema properties of a shelf

l Select a property mapping rule or an object mapping rule in the shelf view.
All the schema properties mapped by this shelf are displayed.
- OR -
l Select the schema property in the schema view.
All the property mapping and object mapping rules mapped by this schema
property are marked.

Table 31: Meaning of icons

in the navigation view

Icon Meaning

Create a new mapping.

Edit mapping.

Delete mapping.

Table 32: Meaning of icons in the schema tool bar

Icon Meaning

Add schema property.

Edit selected schema property.

Delete selected schema property.

Filter schema properties.

Search schema properties.

Filter schema properties with similar names in other schema respectively.

Table 33: Meaning of icons in the rule tool bar

Icon Meaning

Add rule.

Edit selected rule.

Delete selected rule.

Filter rules.

Transform selected property mapping rule into an object matching rule.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 69
Setting up synchronization
Icon Meaning

Sorts object matching rule.

Tests object matching rule.

Create new rules with help of the mapping wizard.

Table 34: Meaning of icons in the schema view

Icon Meaning

The schema property is a unique key.

The schema property references another schema property.

Schema property with a special feature.

User-defined virtual schema property.

The schema property contains several values.

Mandatory property.

Rule based mandatory property.

The schema property is read-only.

The schema property is write-only.

The value of the schema property is calculated automatically.

Table 35: Meaning of icons in the rule view

Icon Meaning

Direction of synchronization: One Identity Manager.

Direction of synchronization: target system.

A condition limited use of the rule.

Mapping in the opposite direction of synchronization is permitted.

Indicates configuration errors. Mouse over the icon to display the error descrip-
tion.

How to create a mapping

To create a mapping

1. Select the Mappings category.

2. Click in the navigation view.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 70
Setting up synchronization
 3. Enter the general properties of a mapping and create the required schema classes.
4. Click OK.

How to edit a mapping

To edit the general properties of a mapping

1. Select the Mappings.

2. Select a mapping in the navigation view.
3. Click in the navigation view toolbar.
4. Click Edit [Link] enable the properties available for editing.
5. Edit the mapping's properties.
6. Click OK.

How to delete a mapping

To delete a mapping

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the navigation view.
4. Confirm the security prompt with Yes.
5. Save the changes.

Properties of a mapping
Enter the following properties for a mapping.

Table 36: Properties of a mapping

Properties Meaning

Mapping name Display name for the mapping. The name must be unique within a
synchronization project. Mapping name is used as key. It cannot be
changed after saving.

Mapping Mapping direction permitted for all property mapping rules.

direction

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 71
Setting up synchronization
Properties Meaning

Both Property mapping rules are applied to synchronization in

directions both the direction of the target system and One Identity
Manager.
Target Property mapping rules are only used for synchronizing in
system the direction of the target system.
One Property mapping rules are only used for synchronizing in
Identity the direction of One Identity Manager.
Manager

Description Spare field for additional explanation.

Hierarchy Specifies whether the mapping is part of the hierarchy. This option is
synchronization important for optimizing synchronization.
Example:
In Active Directory, all the objects in one container are subordinate.
Therefore, the containers map a part of the object hierarchy. Set the
Hierarchy synchronization option in the container mapping.

Only suitable Specifies whether schema class objects are never added during
for updates synchronization but only updated or deleted.
This option can be used, for example, if not all target system type
mandatory properties in One Identity Manager are editable. Example:
Active Directory domains.

Can map Specifies whether mapping by multi-reference rule should be used to

through mapped referenced objects.
multiply
This option must be set, if more than one mapping is set up for a
referenced
schema type and the schema type is used as a member in a multiple
objects
reference rule. You must decide which of these mappings is going to
used to map schema properties and to identify the system objects,
Normally, the schema type's default mapping is used.
The option can only be set on one mapping of each schema type.
If more than one mapping is defined for a schema type and the option is
not set on any mapping, a message appears on all property mapping
rules that the schema type uses.

Schema class One Identity Manager schema class valid for this mapping. Displays all
in One Identity schema classes with a configured mapping, in the menu.
Manager
l Click to edit schema class properties.

Create a new schema class to set up a mapping for another schema

type.

l Click to create a new schema class.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 72
Setting up synchronization
Properties Meaning

Schema class Target system schema class valid for this mapping. Displays all schema
in the target classes with a configured mapping, in the menu.
system
l Click to edit schema class properties.

Create a new schema class to set up a mapping for another schema

type.

l Click to create a new schema class.

Detailed information about this topic

l Direction of synchronization and mapping on page 44

l Schema class properties on page 73

Schema class properties

Enter the following properties for a schema class:

Table 37: Schema class properties

Property Meaning

Class types Types of schema classes. The class type can only be specified when a new
schema class is added.

Generic Schema classes without a native filter function.

schema
class
Unique Schema classes, which filter objects based on unique values
objects from different properties. Only distinct objects are filtered. This
prevents the system connector from trying to add objects that
already exist.

Schema Select the schema type for which you want to create a schema class.
type

Display Schema class display name.

name

Class Unique schema class identifier By default, the class name is based on the
name schema type. The class name must be unique within a schema type.

Description Spare field for additional explanation.

Distinction Schema properties, which form a unique value when combined.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 73
Setting up synchronization
Property Meaning

This only applies to schema classes with the class type "Unique objects"

CAUTION: The schema class filters objects in an undefined

order. Therefore, the result may not be the same each time
the filter is used.
Only use this class type for mapping in the direct of One
Identity Manager. Otherwise, you cannot guarantee that the
same object is updated every time the CSV file is written.

Filter

System Filter that immediately affects the connection system.

filter
Enter the filter in system specific notation, for example, as Where clause for
a database system or as LDAP filter for an LDAP system.
If tested against a fixed value that contains at least two dollar characters,
the dollar characters must be masked.
NOTE: The system filter does not work, if changes are being provisioned.
Therefore, it may not filter more objects than the object selection.

Object Filter that affects loaded objects.

selection
Condition Formulate a query for loaded objects. Use the wizard for
entering filter.
Script You can also store a script which determines system objects.
The script must be written in the script language specified in
the synchronization project.

NOTE: Object selection must include the filter criteria of the system filter
so that One Identity Manager can also assign schema class object when
provisioning.

Related topics

l Support for scripting on page 21

l Use cases for class types on page 74

Use cases for class types

You want to import employee and organization data from an external personnel
management system into One Identity Manager. All the data is provided in a CSV file
and transferred to the database through the CSV connector in the One Identity
Manager database.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 74
Setting up synchronization
Table 38: Example of a CSV file

Lastname FirstName Department Location

1 Harris Clara Marketing London

2 Bloggs Jan Marketing Berlin
3 King Jenny Marketing London
4 Basset Jenny Sales Berlin
5 King Ben Sales London
6 Harris Ben Sales Berlin

Employee objects, departments, and location will be added to the One Identity Manager
database from this data. The CSV synchronization exits with an error when a second object
with the same name is added because the names of the departments and location are not
unique. This can be prevented.
Which objects should be created?

1. Employees with the LastName and FirstName properties. Object can be uniquely
identified through these two properties. The file contain six different objects.
2. Departments with the Department and Location properties. The file contains four
different objects.
3. Location with the Location property. The file contains two different objects.

For 2. and 3. distinct objects must be supplied Therefore, schema classes with the class
type "Unique objects" are created in the mapping.

To set up the mappings

1. Create a mapping for employees.

l Create a new schema class in the target system.
Select the Generic schema class class type and enter the mandatory data.
2. Create a mapping for the department.
l Create a new schema class in the target system.
a. Select the Unique objects class type and enter the mandatory data.
b. Enable Department and Location on the Distinction tab.
The schema class filters exactly those objects from the CSV file that are
unique identifiable by the combination of Department and Location.
3. Create a mapping for the location.
l Create a new schema class in the target system.
a. Select the Unique objects class type and enter the mandatory data.
b. Enable Location on the Distinction tab.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 75
Setting up synchronization
 The schema class filters exactly those objects from the CSV file that are
unique identifiable by the Location property.
4. Check the filter results in the target system browser.

Table 39: Schema class definition results

Schema class Filtered Objects

Employees Harris; Clara

Bloggs; Jan
King; Jenny
Basset; Jenny
King; Ben
Harris; Ben

Departments Marketing; London

Marketing; Berlin
Sales; London
Sales; Berlin

Locations London
Berlin

Edit schema properties

IMPORTANT: Schema properties should only be added, modified, or deleted by
experienced Synchronization Editor users and system administrators.
All schema properties of a schema class are displayed in the mapping editor's schema
view. There are two different sorts of schema property:

l Schema properties of schema types from the target system and One Identity
Manager schema.
l Virtual schema properties,
l added by the user to extend the target system schema or the One Identity
Manager schema
l added by the user to extend the connector schema or the One Identity
Manager schema

You can use virtual schema properties to represent combinations of schema properties as
well as processing step results as schema properties. They are used amongst other things
to map lists of members to One Identity Manager database auxiliary tables. Some virtual
schema properties are added by the system connector when you set up the synchronization
project. You can create user specific schema properties. You can use these, for example, to
include custom One Identity Manager database schema extensions in the mapping.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 76
Setting up synchronization
NOTE: Virtual schema properties are only saved in the synchronization project. They do
not modify basic One Identity Manager schema or target system schema.
NOTE You can use variables with fixed values in schema properties. In this case, variable
names with dollar signed are included. If the schema property value contains a dollar
sign, which is not used to label a variable, it must be masked with $.
Example: Enter the value '300 $$' for a variable with the value '300 $$'.

Related topics

l Schema editor on page 160

How to add virtual schema properties

IMPORTANT: Schema properties should only be added, modified, or deleted by
experienced Synchronization Editor users and system administrators.

To add a virtual schema property

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the schema view menu bar.
4. Enter details for the virtual schema property.
5. Click OK.
The icon marks custom virtual schema properties in the schema view.

How to display and edit schema properties

IMPORTANT: Schema properties should only be added, modified, or deleted by
experienced Synchronization Editor users and system administrators.

To edit a virtual schema property

NOTE: Only user specific virtual schema properties can be edited.

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Double-click on the schema property in the schema view.
4. Edit the schema property details.
5. Click OK.

How to delete virtual schema properties

IMPORTANT: Schema properties should only be added, modified, or deleted by
experienced Synchronization Editor users and system administrators.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 77
Setting up synchronization
To delete a virtual schema property
NOTE: Only user specific virtual schema properties can be deleted.

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Select the virtual schema property in the schema view.
4. Click in the schema view menu bar.
5. Confirm the security prompt with Yes.

Editing property mapping rules

Property mapping rules describe how the target system schema properties are mapped in
the One Identity Manager schema. You can specify whether the permitted mapping
direction is taken over from the mapping for each property mapping rule. You can also
specify a different mapping direction than the one in the mapping.

How to create property mapping rules

To create a property mapping rule

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the rule view menu bar for property mapping rules.
4. Select a rule type and enter the rule details.
5. To create a rule from a template, click .
6. Click OK.

To create a property mapping rule by "drag and drop".

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Select the schema property to map in the schema view.
4. Drag the schema property with the mouse from one schema view onto the schema
property in the other schema view.
5. If the schema property data types match, a property mapping rule is added for the
selected schema property. You can edit the rule details later.
If the schema property data types do not match, the conflict wizard is started which
helps you create the property mapping rules.

One Identity Manager helps you to set up new property mapping rules based on existing
rules. Use the mapping wizard for this.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 78
Setting up synchronization
To create a property mapping rule with the mapping wizard

1. Select the Mappings category.

2. In the navigation view, select a mapping.
3. Click in the rule view menu bar for property mapping rules.
4. Follow the mapping wizard's instructions.
5. Test the new rule.

How to edit property mapping rules

To edit a property mapping rule

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Double-click on the property mapping rule you want to edit in the rule view.
4. Edit the rule details.
5. Click OK.

How to delete property mapping rules

To delete a property mapping rule

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the rule view menu bar for property mapping rules.
4. Confirm the security prompt with Yes.

Property mapping rule details

Enter the following details for a property mapping rule.
TIP: To create a rule from a template, click .

Table 40: Property mapping rule details

Detail Description

Rule Types Select the rule type for a new rule.

Value Compares the schema property value of the One Identity

compare Manager schema with the value of a target system schema.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 79
Setting up synchronization
Detail Description

rule
Multiple Compares multi-value schema properties. The value list are
reference compared element by element. Missing values are added;
rule superfluous value are deleted.

Rule name Name for the rule. The rule name must be unique within a mapping.
Click to change rule names. The rule name is used as key. Changes to the
rule name may cause errors.

Display Rule display name.

name

Mapping Specify the permitted mapping direction for mapping selected schema
direction properties.

Both direc- Property mapping rule is applied for both synchronization in

tions the direction of the target system and synchronization
direction One Identity Manager.
To the Property mapping rule is only used for synchronizing in the
target direction of the target system.
system
To the One Property mapping rule is only used for synchronizing in the
Identity direction of the One Identity Manager.
Manager
Do not The property mapping rule is ignored.
assign
You can set this value to disable a property mapping rule.
Taken The mapping direction applies which is fixed in the mapping.
from
mapping

Ignore Specifies whether the given direction of mapping is ignored when new
mapping objects are added.
direction
If this option is set, the property mapping rule can also be run if the
restrictions
synchronization mapping is in the opposite direction. Property mapping
on adding
rules not assigned a mapping direction are also ignore when new objects are
added.
If this option is not set, the specify mapping direction is valid when new
objects are added.

Example:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 80
Setting up synchronization
Detail Description

A telephone system is managed with One Identity Manager. The

telephone system is the data master when the telephone numbers are
synchronized. The direction of mapping is set to One Identity
Manager. The telephone number is a mandatory value in the target
system.
In One Identity Manager, a new employee is added. Each employee is
given and initial telephone number. These employees should be added
to the target system by synchronizing them. So that the telephone
numbers are written to the target system during synchronization, the
Ignore mapping direction restrictions on adding option must be
set on the property mapping rule.

For more information, see Detecting rogue modifications on page 47.

Description Spare field for additional explanation.

Schema Select the schema properties to be mapped.

property

Do not The schema property value is only changed by synchronization if the

overwrite schema property does not contain a value.

Mapping Condition under which the property mapping rule is used.

condition
Click Create condition to create the condition with the wizard. For more
information, see Wizard for entering filters on page 19.
Example: [Link] = 'Managed Service Accounts'
The property mapping rule is applied to all objects assigned to the container
"Managed Service Accounts" in One Identity Manager.

Table 41: Additional detail of a value compare rule

Detail Description

Force mapping If this option is set, the property mapping rule can also be applied if
against direction the synchronization mapping is in the opposite direction. For more
of synchron- information, see Mapping against the direction of synchronization on
ization page 45.
The option can only be set if:

l Detecting rogue modifications is disabled.

l The direction of mapping is Target system or One Identity
Manager.

The property mapping rule may not be executed in both directions.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 81
Setting up synchronization
Detail Description

Detecting rogue Specifies whether rogue modifications are identified and logged if the
modifications direction of synchronization is opposite to the mapping direction.
The option can only be set if:

l The direction of mapping is Target system or One Identity

Manager.
l Force mapping against direction of synchronization is
disabled.

If this option is set, rogue modifications are detected and logged. The
log can be evaluated after synchronization. For more information, see
Synchronization analysis on page 140.
If the option is not set, the property mapping rule is ignored by
synchronization.
For more information, see Detecting rogue modifications on page 47.

Correct rogue Specifies whether rogue modifications are corrected if the direction of
modifications synchronization is opposite to the mapping direction.
The option can only be set if:

l Detecting rogue modifications is enabled.

l The direction of mapping is Target system or One Identity
Manager.
l Force mapping against direction of synchronization is
disabled.

If the option is set, the property mapping rule is executed by

synchronization. The object property in the connected system is
overwritten with the value from the data master. Thus rogue changes
are ignored.
If the option is not set, rogue changes are only logged.
For more information, see Detecting rogue modifications on page 47.

Ignore case Specifies whether changes that only differ through case are ignored
by the mapping. This option affects only schema properties with the
String data type.

Deal with the first If a multi-value schema property is mapped using a value compare
value of the rule, the first value from the value list is taken into account by
property as a synchronization.
single value

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 82
Setting up synchronization
Table 42: Additional detail of a multi-reference mapping rule

Member Description
filter

Only include Select all members in the value list to be mapped to the schema property
these of the connected system.

Exclude Select all members in the value list not to be mapped to the schema
these property of the connected system.

Editing object matching rules

Object matching rules assign schema properties through which system objects can be
uniquely identified. For example, Active Directory groups can be uniquely identified by the
DistinguishedName and ObjectGUID schema properties.
Object matching rules can be added or created from property mapping rules. If system
objects can only be identified through several schema properties, different property
matching rules can be linked with logical operators to form an object matching rule.
NOTE: Using object matching rules of this type can slow down synchronization. Instead,
use a virtual schema property to link the schema properties required for matching and
create an object matching rule with it.
If several object matching rules are set up, they are executed in the order in which they
are listed in the rule view. The rule at the top is the primary rule, all other are marked as
alternatives. If a system object can be identified uniquely by the primary rule, the
alternative rule are not executed. If a system object cannot be identified by the primary
rule, One Identity Manager uses the next alternative rule to determine a suitable system
object. If non of the rules can identify a suitable system object, the object does not have a
partner can is handled as new or deleted.

Example

The following object matching rules are defined for mapping Active Directory
groups:

l Object GUID <-> Object GUID (primary rule)

l Distinguished name <-> Obj-Dist-Name (alternative rule)
l Object SID <-> Object-Sid (alternative rule no. 2)

Properties of an Active Directory group are modified in One Identity Manager. During
provisioning, the Active Directory connector tries to identify the group in the target
system by using the object GUID. It does not find an object with this object GUID so
the alternative object matching rule is applied. The connector identifies an object
with the same distinguished name and updates this object in the target system.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 83
Setting up synchronization
 NOTE:

l Object matching rules must use schema properties with read-access. Write-only
schema properties are not suitable for identification of system objects.
l Schema property that are only used for identifying system objects are not mapped
by default.
l Schema properties used to identify system objects must contain a value. If a
schema property contains is empty, the object mapping rule is ignored and the
next alternative rule is applied.
l If several system objects that fulfill the matching criteria are found, a
message appears in the synchronization log. These objects are ignored as
processing continues.
If several system objects are found, either there is corrupt data in connected
systems or the matching critera is not unique. Clean up the data in the connected
systems and adjust the object matching rules.

How to create object matching rules

To create an object matching rule from a property mapping rule

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Select the property mapping rule in the rule view.
4. Click in the rule view toolbar.
A message appears.
5. To convert the property mapping rule to an object matching rule, click No in the
message dialog.
- OR -
To convert the property mapping rule into an object matching rule and create a copy
of the property mapping rule, click Yes in the message dialog.

To create a new object matching rule

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the rule view toolbar for object matching rules.
4. Select a rule type and enter the rule details.
5. Click OK.

One Identity Manager helps you to set up new object matching rules based on existing
rules. Use the mapping wizard for this.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 84
Setting up synchronization
To create an object matching rules with the mapping wizard

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the menu bar for the object matching rule view.
4. Follow the mapping wizard's instructions.
5. Test the new rule.

How to edit object matching rules

To edit an object matching rule

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Double-click on the object matching rule you want to edit.
4. Edit the rule details.
5. Click OK.

How to delete object matching rules

To delete an object matching rule

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the rule view menu bar for object matching rules.
4. Confirm the security prompt with Yes.

Object matching rule details

Enter the following details for an object mapping rule.

Table 43: Object matching rule details

Detail Description

Rule Types Select the rule type for a new rule.

Value Compares the schema property value of the One Identity

compare Manager schema with the value of a target system schema.
rule

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 85
Setting up synchronization
Detail Description

Logical Evaluates the logical connective of several rules.

Expression Use this rule type to identify if you can only identify system
Rule objects using several schema properties.

Rule name Name for the rule. The rule name must be unique within a mapping.

Display Rule display name.

name

Case Specifies whether upper and lowercase are taken into account when system
sensitive objects are being identified.

Description Spare field for additional explanation.

Table 44: Additional detail of a value compare rule

Detail Description

Schema Select the schema properties which uniquely identify the system
property objects.

Table 45: Additional details of a logical expression rule

Detail Description

Expression Links the existing rules to each other using logical operators. Permitted
operators are AND, OR, and NOT as well as brackets.
Syntax: <rule name> {AND | OR | NOT | ()} <rule name> ...
Click to select an existing rule.

Testing object matching rules

You can test which results the object matching rules return in the rule editor. This displays
all object pairs found by one of the rules. In addition, objects are shown that are only found
in one of the connected systems.
The test uses the variable set that is selected in the Synchronization Editor's toolbar.

To test object matching rules

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Click in the rule view toolbar for object matching rules.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 86
Setting up synchronization
Setting up synchronization workflows
The synchronization sequence is controlled by a workflow. Use workflows to combine the
synchronization steps to be executed. The number of synchronization projects can be
limited by using revision filters and quotas. You can set up different workflows within a
synchronization project which map different purposes of the synchronization.
Define workflows:

l Direction of synchronization
l Number and order of synchronization steps
l Objects to compare (revision filter)

Default workflows for target system synchronization are added if the synchronization
project was created with a default project template. You can edit these workflows with the
workflow editor and set up new workflows. If the synchronization project was created
without a project template, no workflows are set up.

Toolbars in the workflow editor

Both workflow and navigation views have their own toolbars.

Table 46: Meaning of icons in the navigation view

Icon Meaning

Create a new workflow with the workflow wizard.

Create a new workflow.

Edit a workflow.

Delete a workflow.

Copy selected workflow.

Table 47: Meaning of icons in the workflow

view

Icon Meaning

Adds new step.

Shows execution plan.

Opens detail view of all synchronization steps.

Closes detail view of all synchronization steps.

Enable or disable synchronization steps.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 87
Setting up synchronization
How to create a workflow
To create a workflow

1. Select the Workflows category.

2. Click in the navigation view.
3. Enter a name and description for the workflow.
4. Click OK.
Default values are saved for the other workflow properties. To modify these values,
edit the workflow properties.

To create a workflow with the workflow wizard

1. Select the Workflows category.

2. Click in the navigation view.
3. Follow the workflow wizard instructions.

How to edit a workflow

To edit workflow properties

1. Select the Workflows.

2. Select a workflow in the navigation view.
3. Select the General view in the Workflow Editor and click Edit category.
4. Edit the workflow properties.
5. Click OK.

How to copy a workflow

To copy a workflow

1. Select the Workflows category.

2. Select the workflow in the navigation view.
3. Click in the navigation view.
4. Edit the workflow properties.
5. Click OK.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 88
Setting up synchronization
How to delete a workflow
To delete a workflow

1. Select the Workflows category.

2. Select the workflow in the navigation view.
3. Click in the navigation view.
4. Confirm the security prompt with Yes.

Creating workflows with the workflow wizard

The project wizard creates a synchronization workflow for initially loading the target
system objects into the One Identity Manager database. You can use the workflow wizard
to set up more workflows. The workflow wizard specifies workflows for the direction of
synchronization "target system".

To create a workflow with the workflow wizard

1. Select the Workflows category.

2. Click in the navigation view.
This starts the workflow wizard.
Click Next.
3. Enter the following workflow properties

Table 48: General workflow properties

Property Description

Display name Enter a display name for the workflow.

Description Spare field for additional explanation.

Click Next.
4. Select the mapping to be handled by the workflow.
All mappings are enabled by default.
To disable a mapping, double-click .
To enable a mapping, double-click .
NOTE: The Part of hierarchy displays which mappings form part of the object
hierarchy. To prevent errors, all mappings, which map the object hierarchy, must
be entirely selected or entirely de-selected.
5. Specify the mappings for which revision filtering is permitted.
Revision filtering is permitted for all mappings, by default.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 89
Setting up synchronization
 Click Next.
6. Specify synchronization behavior for the object pair whose properties have changed.
a. In the Database method column, select the processing method to be
executed in the One Identity Manager database.
- OR -
b. In the Target system method column, select the processing method to be
executed in the target system.
Click Next.
7. Specify synchronization behavior for the objects that only exist in the One Identity
Manager database.
a. In the Database method column, select the processing method to be
executed in the One Identity Manager database.
- OR -
b. In the Target system method column, select the processing method to be
executed in the target system.
Click Next.
8. Specify synchronization behavior for objects that only exist in the target system.
a. In the Database method column, select the processing method to be
executed in the One Identity Manager database.
- OR -
b. In the Target system method column, select the processing method to be
executed in the target system.
Click Next.
9. Click Close to end the workflow wizard.
This creates the workflow. You can check the properties of the Workflow and the
synchronization steps with the workflow editor and rework them.

NOTE: A disabled synchronization step is added if no processing methods have been

specified for a mapping.

Detailed information about this topic

l Properties of a mapping on page 71

l Specifying processing methods on page 95

Properties of a workflow
Enter the following properties for a workflow.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 90
Setting up synchronization
Table 49: General workflow properties

Properties Meaning

Workflow Workflow display name.

Direction of Select the direction in which synchronization should take place.

synchronization
l Defined by execution: The synchronization direction is defined
in the start up configuration.
For more information, see Start up configuration properties on
page 116.
l Target system: One Identity Manager is the master system for
synchronization.
l One Identity Manager The target system is the master system
for synchronization.

Revision The revision filtering can be used to limit synchronization to just the
filtering objects that have been modified since the last synchronization.
For more information, see How does revision filtering work? on page
38.

l Defined by execution: The required behavior is defined in the

start up configuration.
l Use revision filter: Only modified objects are synchronized.
l Do not use revision filter: All objects are synchronized.

Error Handling Specify whether synchronization should be continued if an error occurs

during processing of synchronization objects (adding, deleting,
updating, and reloading objects). Object processing is continued using
the next object; the error is logged.
To optimize error localization, you can abort synchronization if an error
occurs during the processing of synchronization objects. In this case, no
further synchronization objects are processed.
NOTE: This property does not affect configuration, network, or
general synchronization errors (for example, if it is not possible to
resolve a reference). The effectiveness of this property depends on
the actual error, error position, the target system, and the imple-
mentation of the target system connectors.

l Continue on error: Processing continues with the next object.

Errors are logged.
This option should be used for productive systems.
l Break on error: Synchronization is aborted.
This option should only be used to find errors, for example in
going live processes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 91
Setting up synchronization
Properties Meaning

Dependency Specify how dependencies between synchronization step are resolved.

resolution
For more information, see How does dependency resolution work? on
page 40.

l Automatic: Dependencies are resolved automatically.

One Identity Manager determines the sequence of the
synchronization steps automatically. It takes into account
dependencies between schema classes to synchronize and
schema properties.
l Manual: Dependencies are not resolved.
The synchronization steps are processed sequentially in the order
listed in the workflow view. Dependencies between the schema
classes and the schema properties must be taken into account
when compiling the synchronization steps.

Description Spare field for additional explanation.

Editing synchronization steps

The synchronization steps in a workflow specify which mappings are processed in which
order during synchronization. There may be dependencies between synchronization steps.
These must be resolved automatically or manually.
Synchronization steps are displayed in the workflow view. Here, you can edit
synchronization step properties and their order.
Defining synchronization steps:

l Mappings to be processed
l Property mapping rules to apply
l Processing methods
l Number of objects to compare
l Objects to compare (revision filter)
l Direction of synchronization

Detailed information about this topic

l How does dependency resolution work? on page 40

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 92
Setting up synchronization
How to create synchronization steps
To create a synchronization step

1. Select the Workflows category.

2. Select a workflow in the navigation view.
3. In the workflow view, click .
4. Enter the synchronization step properties.
5. Click OK.

How to edit synchronization steps

To edit synchronization step properties

1. Select the Workflows category.

2. Select a workflow in the navigation view.
3. Double-click on the synchronization step in the workflow.
4. Edit the synchronization step properties.
5. Click OK.

To manually specify the order of synchronization steps

1. Select the Workflows category.

2. Select a workflow in the navigation view.
3. Click in the workflow view toolbar to open all the synchronization steps.
4. To change the order of the synchronization steps, click and on the
synchronization step.

To enable or disable synchronization steps

1. Select the Workflows category.

2. Select a workflow in the navigation view.
3. Click in the workflow view's toolbar.
4. Check the boxes for all synchronization steps that you want to disable.
- OR -
Uncheck the boxes for all synchronization steps that you want to enable.
Multi-select is possible.
5. Click OK.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 93
Setting up synchronization
How to delete synchronization steps
To delete a synchronization step

1. Select the Workflows category.

2. Select a workflow in the navigation view.
3. Click in the synchronization step in the workflow view to open the synchronization
step dialog box.
4. Click .
5. Confirm the security prompt with Yes.

General properties of a synchronization step

Enter the following general properties for a synchronization step.

Table 50: General properties of a synchronization step

Property Meaning

Name An arbitrary name for the synchronization step. The name must be
unique within a synchronization workflow.

Mapping Select the mapping to be processed by the synchronization step.

Direction of Select the direction in which synchronization should take place.

synchronization
Use workflow The direction of synchronization is defined in
template the workflow.
For more information, see Properties of a
workflow on page 90.

To the target system One Identity Manager is the master system for
synchronization.
To the One Identity The target system is the master system for
Manager synchronization.

Revision The revision filtering can be used to limit synchronization to just the
filtering objects that have been modified since the last synchronization.
For more information, see How does revision filtering work? on page
38.

Use workflow The desired behavior is specified with the

template workflow.
Use revision filter Only modified object are synchronized.
Do not use revision All objects are synchronized.
filter

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 94
Setting up synchronization
Property Meaning

Error Handling Specify whether synchronization should be continued if an error occurs

during processing of synchronization objects (adding, deleting,
updating, and reloading objects). Object processing is continued using
the next object; the error is logged.
To optimize error localization, you can abort synchronization if an error
occurs during the processing of synchronization objects. In this case, no
further synchronization objects are processed.
NOTE: This property does not affect configuration, network, or
general synchronization errors (for example, if it is not possible to
resolve a reference). The effectiveness of this property depends on
the actual error, error position, the target system, and the imple-
mentation of the target system connectors.

Use workflow The desired behavior is specified with the workflow.

template
Continue on Processing is continued with the next object. Errors
error are logged.
This option should be used for productive systems.

Break on error The entire synchronization is aborted.

This option should only be used to find errors, for
example in going live processes.

Data import Set this option if the synchronization step synchronizes a secondary
system and changes are immediately provisioned in the primary
system.
Do not set this option if the synchronization step synchronizes a primary
system.
For more information, see Synchronizing user data with different
systems on page 50.

Description Spare field for additional explanation.

Deactivated If this option is set, the synchronization step is not synchronized.

Specifying processing methods

Specify how changes to system objects should be handled on the Processing tab. You can
select the following default methods. Furthermore, the schema types of the various target
systems provide additional processing methods if required.
The processing methods are defined for different sets of synchronization objects.

l Objects only found in the target system and missing in One Identity Manager.
l Objects only found in One Identity Manager and missing in the target system.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 95
Setting up synchronization
 l Objects with modified properties
This means there are object pairs whose objects differ.
l Objects without modifications
This means there are object pairs whose objects are identical.

Table 51: Default processing methods in a synchronization step

Processing Meaning
Method
(technical name)

Insert Objects that only exist in one of the connected system are added to
the other system.

Delete Objects that only exist in one of the connected system are deleted
from the system.
The following applies to synchronization in One Identity Manager.
The object is immediately deleted if it came from a primary system.
Deferred deletion is not taken into account. Deferred deletion is
taken into account if the object comes from a secondary system.
For more information, see Synchronizing user data with different
systems on page [Link] more information about deferred deletion,
see the One Identity Manager Configuration Guide.

Update Objects whose properties have change are updated.

MarkAsOutstanding Objects that only exist in the One Identity Manager are marked as
outstanding during synchronizing in the direction of One Identity
Manager. These objects can be reworked after synchronization is
complete. Objects marked as outstanding are ignored by
subsequent synchronization.

No processing No processing methods are executed.

Table 52: Meaning of the icons

Icon Meaning

Adds an extra processing method for the object set.

If you allow several processing methods for one object set, add conditions for
executing these methods.

Create a condition for executing the method.

All objects are processed the same way if you do not create a condition.

Moves the processing method forwards in the order of execution.

Moves the processing method backwards in the order of execution.

Deletes the processing method.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 96
Setting up synchronization
Detailed information about this topic

l Editing subsets on page 97

l Specifying additional processing methods on page 97
l For more information, see Specifying custom processing methods on page 99.
l Deleting objects in One Identity Manager on page 51

Specifying additional processing methods

Some target systems provide extra processing methods in addition to the default ones.
One Identity Manager can execute different processing methods in sequence for the same
set of objects.

To define different processing methods for a set of objects

1. Select a processing method from the menu for synchronizing an object set.
2. Click to specify another processing method for this object set. Select a processing
method from the menu.
3. Use and to specify the order in which to execute the processing methods.

Example

You can enter external user IDs for One Identity Manager user accounts in SAP. User
accounts that only exist in SAP are added if One Identity Manager user accounts from
SAP R/3 are synchronized with One Identity Manager. The associated external user
ID's are also transferred into the target system.

Object Set Processing Method

Objects only found in One Identity Manager are: Insert

AddExtID

Related topics

l Specifying processing methods on page 95

Editing subsets

Processing methods can be limited to a set of the objects. To do this, specify the condition
under which the processing method is to be executed. You can specify different processing
methods for different sets of objects. These are executed in the given order.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 97
Setting up synchronization
To define processing for different sets

1. Select a processing method from the menu for synchronizing an object set.
2. Click to specify another processing method for this object set. Select a processing
method from the menu.
3. Create the condition defining the execution point the processing method. Click next
to the method.
Enter the condition. You can use comparisons, logical operators, and variables. You
can write queries with a wizard or enter them directly.
l Use the following expression in the condition to access the schema properties
of the system in which you want the processing method to be executed:
Base.<schema property>
l To access the schema properties of the other system in the condition, use the
expression: Other.<schema property>
4. Use and to specify the order in which to execute the processing methods.

Example

All user accounts that only exist in Active Directory are processed as follows when
synchronizing Active Directory user accounts from One Identity Manager in the direction of
One Identity Manager:

Object Set Processing Condition

Method

All user accounts, connected to an MarkForDeletion Base.UID_Person <> ''

employee, are marked for
1 deletion.
All user accounts, not connected Delete Base.UID_Person = ''
with an employee, are deleted.

All user accounts, in container A, Delete Base.UID_ADSContainer =

are deleted. '4b53ff19-6ae4-4a87-86bd-
eca3ddf5ebf2'
2
All user accounts, not belonging to MarkForDeletion Base.UID_ADSContainer <>
container A, are marked for '4b53ff19-6ae4-4a87-86bd-
deletion. eca3ddf5ebf2'

Related topics

l Specifying processing methods on page 95

l Wizard for entering filters on page 19

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 98
Setting up synchronization
Specifying custom processing methods

Apart from a connector’s default and additional processing methods, the Synchronization
Editor can also use custom processing methods. This is done using custom scripts.

To set up and use a custom processing method

1. In the Designer, create a script to make the necessary modifications to the

loaded objects.
Script structure:

<Tag("Projector")>
<BaseObjectType("Table")>
Public Sub CCC_ScriptName(unit As IUnitOfWork, entity As IEntity())
'Steps to execute
...
End Sub

l <Tag("Projector")>: Labels the script to use as a processing method. This

enables the Synchronization Editor to identify the scripts to use as
processing methods.
l <BaseObjectType("Table")>: Defines the type of objects the script will be
applied to. Enter the table that contains the objects to be handled.
If the script can be applied to several object types, define a separate object
type for each table.
l CCC_ScriptName: Script name. In the Synchronization Editor, you can select the
script as the processing method under this name. Enter a name that uniquely
describes the processing method.
For detailed information about creating scripts with the Script Editor, see the One
Identity Manager Configuration Guide.
2. Compile the script.
3. Open the synchronization project in the Synchronization Editor.
4. Select the Configuration | One Identity Manager connection category and
update the One Identity Manager schema.
5. In the Workflows category, select the synchronization workflow in which you want
to use the new processing method.
6. Find the synchronization step and click Edit.
The synchronization step must handle the object type defined in the script.
7. On the Processing tab, you can select processing methods under the script name.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 99
Setting up synchronization
 Example script

The following example script removes the manager from all departments and
location that the script will be applied to as a processing method.

<Tag("Projector")>
<BaseObjectType("Department")>
<BaseObjectType("Locality")>
Public Sub CCC_Department_RemoveManager(unit As IUnitOfWork, entities As
IEntity())
For Each currEntity As IEntity In entities
If Not [Link]([Link]("UID_
PersonHead").ToString()) Then
[Link]("UID_PersonHead","")
[Link](currEntity)
End If
Next
End Sub

Related topics

l Specifying processing methods on page 95

Specifying quotas
Errors in the synchronization configuration can cause system objects to be processed
incorrectly. Errors in the data through incorrect configuration can be reduced. Often, it is
known how many system objects have been modified, added, or deleted in a connected
system. If this number is exceeded when a processing method is executed, a warning
appears and synchronization is aborted. The synchronization step and mapping
configurations can be checked and corrected before repeating synchronization.
A quota can be defined for each processing method in each synchronization step to specify
the part of the system objects to process. A quota provides the number of object to process
relative to the total number of all objects in the schema class to be synchronized. When a
synchronization step is executed, One Identity Manager calculates the number of objects to
process for each processing method with a quota. If this number exceeds the quota, the
synchronization step is aborted.
Quotas can only be defined for processing methods which modify data (for example,
Insert, Update, Delete).
NOTE: One Identity Manager takes total number objects to be synchronized into account
when it calculates the number of objects to process. Conditions defined for processing
methods are not taken into account!
Enter an higher quota for processing methods which limit the number of objects to
synchronize with a condition.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 100
Setting up synchronization
Table 53: Quotas for a synchronization step

Property Meaning

No quota If this is set, quotas are not included.

Use these Specify which processing methods include a quota. Enter the quota in
settings percent.
One Identity Manager specifies quotas for synchronization in the target
system in workflows created with the workflow wizard, by default. These
quotas can be changed later.

Processing Method quota

Update 75 %
Delete 10%

Rule filters
You can specify which Property mapping rules must be applied to each synchronization
step. For example, dependencies between schema class objects can be resolved this way.

Included Select the property mapping rule to be applied during synchronization.

rules:
Excluded Select the property mapping rules which should not be applied during
rules: synchronization.

NOTE: Unmarked rules are included automatically.

Detailed information about this topic

l How does dependency resolution work? on page 40

Extended synchronization step properties

You can optimize memory usage for processing synchronization step data on the
Extended tab.

Table 54: Extended synchronization step properties

Property Description

Performance/memory This controls the behavior of memory and performance in the

factor synchronization step. If more memory is available, you can
change the performance/memory factor in favor of performance.
Reduce the performance/memory factor if there are memory

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 101
Setting up synchronization
Property Description

problems.
The performance/memory factor specifies the percentage with
which the reload threshold, partition size, and bulk level are
applied to an object type.
Use the slider to set the performance/memory factor.

l Move the slider to the right to increase performance. This

requires more memory.
l Move the slider to the left to reduce the memory require-
ment. This also reduces the performance.

Reload threshold Specifies the maximum number of properties that can be loaded
by synchronization to prevent partitioned reloading. You can
increase this value to accelerate synchronization of target
systems with small mappings. However, more memory is
required.
The default value for all data to be processed is fixed in the start
up configuration. It can be specified separately for every
synchronization step.
To specify the threshold for a synchronization step

1. Disable Use start up configuration settings.

2. Change the preset reload threshold.

Mode Specifies whether changes in the in-memory object are

committed after the synchronization step has been executed.
This affects changes that are made through the property mapping
rule’s Force mapping against direction of synchronization
option.
This setting is required only for object-based synchronization, for
example, provisioning, when the object must be handled by more
than one synchronization step.

l None: No changes are committed.

l Automatic: It is decided automatically, which changes are
committed.
l UserDefined: Changes to the selected schema properties
are committed.
Under Commit changes for, enable the schema
properties whose changes are committed in the in-memory
object.

TIP: You can adjust the memory requirements for all the data to be processed in the
start-up configuration. You can set the reload threshold, partition size, and bulk level
here. These setting are only possible in expert mode. For more information, see

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 102
Setting up synchronization
 Extended properties for start up configuration on page 158.

Detailed information about this topic

l Performance and memory optimization on page 58

Show execution plan

The execution plan shows all synchronization steps of a workflow in the order in which they
will be executed. Dependencies between schema classes are resolved. Thus, additional
synchronization steps that are added automatically are also displayed.

To display a workflow execution plan

1. Select the Workflows category.

2. Select a workflow in the navigation view.
3. In the workflow view, click .
The execution plan is displayed as a report. You can save the report.

Detailed information about this topic

l How does dependency resolution work? on page 40

Connecting systems
You connect to the One Identity Manager database when you log into the Synchronization
Editor. You connect to the target system with the project wizard. The system connection is
automatically set up once One Identity Manager accesses the target system. The icon
Synchronization Editor is displayed in the status bar if a target system is connected.
Other system connection properties are saved in the synchronization project. You can edit
these properties in Synchronization Editor.

How to edit system connection properties

To edit database connection properties

1. Select the Configuration | One Identity Manager connection category.

The sections General, Scope, Connection parameters, and Schema classes are
displayed in the document view with the database connection properties.
2. To edit general properties of the database connection, select the General view and
click Setup....

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 103
Setting up synchronization
To edit target system connection properties

1. Select the Configuration | Target system category.

The sections General, Scope, Connection parameters, and Schema classes are
displayed in the document view with the target system connection properties.
2. To edit general properties of the target system connection, select the General view
and click Setup....

Detailed information about this topic

l System connection properties on page 104

System connection properties

The following information about system connections is mapped.

Table 55: System connection properties

Property Description

System Default display value for the system connection.

connection NOTE: If the connection parameters of the connected system differ from
the loaded schema, the schema's display name is also displayed. In this
case, the schema must be updated before the synchronization project
can be used.

Setup... Opens a dialog box for editing the system connection's general properties
and configuring the contents of the synchronization log.

Updating Updates the schema.

schemas The synchronization project is saved before the schema is updated. This
allows the existing schema to be reloaded if an error occurs during update.
NOTE: The synchronization is deactivated if the schema of an activated
synchronization project is updated. Reactivate the synchronization
project to synchronize.

Shrink All schema types of the respective schema, which cannot be used in the
schema... synchronization project, are deleted from it. You can select schema type
to be retained even though they are not used.

Browse... Start the Target System Browser.

Use the target system browser to view the target system data/One
Identity Manager database. You can add, change, and delete system
objects. You can test virtual schema properties.
The variable set selected in the Synchronization Editor's toolbar is used to
connect to the target system.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 104
Setting up synchronization
Property Description

Edit Starts the system connection wizard.

connection... The system connection wizard allows you to edit the connection
parameters of the current system connection, for example, if the
synchronization server has changed.
NOTE: Certain connection parameters correspond with the loaded
schema. If these connection parameters are changed, the schema must
be updated in the synchronization project so that synchronization can be
configured and run successfully. This is necessary, for example, if the
connection to another One Identity Manager database is established that
has a different schema to the connection database.

l Click Update schema before continuing to edit the synchron-

ization project.

Connection Lists all connection parameters. You can define connection parameter
parameter values as variables in order to use one synchronization configuration for
synchronizing different target systems.

Scope Specifies whether a scope is defined. You can edit the scope.

Schema All schema classes are listed in groups of schema types.

Classes

Schema This displays the target system schema with all its schema types and their
browser properties.
The schema browser is only available in expert mode.

Table 56: General properties of a system connection

Property Description

Schema Name of the schema.

Display name Schema display name.

Connection is If this option is set, the system connector only has read access to the
read-only target system. Write operations are not executed, only logged. Changes
to objects in the One Identity Manager database are not provisioned in
the target system.

Retry count Number of attempts at establishing the connection.

Delay between Time delay between retry attempts.

retries

Create Specifies whether a synchronization log with detailed information about

synchronization the synchronization object is created.
log

Data to log Data to be recorded in the synchronization log.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 105
Setting up synchronization
Detailed information about this topic

l Activating the synchronization project on page 128

l Using variables and variable sets on page 110
l Editing the scope on page 107
l Configuring the synchronization log on page 106
l Overview of schema classes on page 125

Configuring the synchronization log

All the information, tips, warnings, and errors that occur during synchronization are
recorded in the synchronization log. You can configure the type of information to record
separately for each system connection.

To configure the content of the synchronization log

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. To configure the synchronization log for target system connection, select the
Configuration | Target system category in Synchronization Editor.
- OR -
To configure the synchronization log for the database connection, select the
Configuration | Synchronization Editor connection category in One
Identity Manager.
3. Select the General view and click Configure.
4. Select the Synchronization log view and set Create synchronization log.
5. Enable the data to be logged.
NOTE: Some content generates a particularly large volume of log data!
The synchronization log should only contain data required for error analysis and
other analyzes.
6. Click OK.

Synchronization logs are stored for a fixed length of time.

To modify the retention period for synchronization logs

l In the Designer, enable the DPR | Journal | LifeTime configuration parameter and
enter the maximum retention period.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 106
Setting up synchronization
Editing the scope
In the general scope, you can specify system objects to be handled by synchronization.
This allows you to limit the number of objects to synchronize. If no general scope is
defined, all objects in the connected system are synchronized.
In the reference scope, you define which system objects are loaded for the reference
resolution. If no reference scope is defined, the general scope is also used for the
reference resolution.
TIP: If a general scope is defined, but you want all system objects of a target system
type to be available, create an empty reference scope. To do this, simply enter the
display name of the reference scope. This means that no scope is calculated in the
reference resolution.
If the synchronization project was creating using a default project template, a scope is
defined. You may edit this scope. A scope is not define if the synchronization project was
created without a project template.
NOTE: To avoid data inconsistencies, define the same scope in both of the
connected systems.

Detailed information about this topic

l What is a scope? on page 37

l What are filters? on page 34
l Scope properties on page 108

How to edit a scope

To edit the scope

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. Select the Scope view.
3. Click Edit scope.

To edit the reference scope

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. Select the Scope view.
3. Click Edit reference scope.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 107
Setting up synchronization
How to delete a scope
To delete the scope or scope reference.

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. Select the Scope view.
3. Click Delete.

Scope properties
Enter the following properties for a scope. Set a filter for the target system whose
object are referenced from the connection system. For more information, see What is a
scope? on page 37.

Table 57: Scope properties

Property Description

Schema Display name for the schema to which the scope will be applied.

Name Scope display name. The name must be unique within a synchronization
project.

Scope List of all schema types for the selected schema. To filter the list, click .
hierarchy
Show all object types All object types of the schema are displayed.
Only show hierarchically Only the object types of the schema that form
structured object types a hierarchical structure are displayed.

Is All schema types with a filter are marked.

filtered?
A filter is defined and effective.
A filter is effective.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 108
Setting up synchronization
Property Description

Condition Specify the filter condition for the scope. Select an object type in the scope
hierarchy for this.

System Filter that immediately affects the connection system.

filter
Enter the filter in system specific notation, for example, as Where
clause for a database system or as LDAP filter for an LDAP
system.
If tested against a fixed value that contains at least two dollar
characters, the dollar characters must be masked.
This filter is only effective when loading the system objects.
Object Filter that affects loaded objects.
filter
Condition Formulate a query for loaded objects. Use the wizard
for entering filter.
Script You can also store a script which determines system
objects. The script must be written in the script
language specified in the synchronization project.

Hierarchy Filter created on the bases of existing system objects. This filter limits the
filter number of objects to load in the connected system.
This filter is only available for individual target systems.
For more information, see Creating hierarchy filters on page 109.

Related topics

l Support for scripting on page 21

Creating hierarchy filters

Certain target systems support the definition of a scope based on the hierarchy of existing
target system objects. The hierarchy filter limits the number of objects to load in the
connected system. The hierarchy filter can only be applied to objects and not to their
schema properties.
The objects are displayed in their hierarchical structure on the right-hand side of the scope
view. The Synchronization Editor establishes a connection to the target system to do this.
using the variable set selected in the Synchronization Editor's toolbar.

To create a hierarchy filter

l Mark all the objects in this hierarchy which are included in the scope.
All unmarked objects remain outside the scope.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 109
Setting up synchronization
 If you enable the hierarchy's root note, new objects within the hierarchy are included
by the scope. If the root node is disabled, only the marked objects are within the
scope. New objects are not synchronized.

NOTE: Create an additional object filter to include schema properties as criteria in the
scope definition.
A fully defined hierarchy filter can be transformed into a variable. Thus the filter can be
redefined in a specialized variable set and used for other synchronization configurations.

To convert a variable into a hierarchy filter

1. Click Convert into a variable.

2. Confirm the security prompt with Yes.
The hierarchy filter is saved as variable. To change the filter, edit the variable.

Related topics

l What is a scope? on page 37

l Editing the scope on page 107
l Using variables and variable sets on page 110

Using variables and variable sets

You can use variables to create generally applicable synchronization configurations that
contain the necessary information about the synchronization objects when synchronization
starts. For example, you can use variables in the target system connection to synchronize
different Active Directory domains with the same synchronization project.
Variables can be used in the following Synchronization Editor definitions.

System connections in parameters

Scopes in the filter
Schema classes in the filter
Schema properties as defined value
Property mapping rules in the condition
Processing methods in the condition
Base objects in the definition

Variable sets are added for different instances of the variables. Each synchronization
project has a default variable set, which has all the variables with a default value. The start
up configuration contains a link to the variable set in use. If no variable set is given, the
default variable set is used.
NOTE: If synchronization projects are updated, connection parameters from the default

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 110
Setting up synchronization
 variable set are always used. Ensure that the variables in the default variable set contain
the correct values.
A default variable set is defined if the synchronization project was creating using a default
project template. You can add variables to this variable set. If the synchronization project
was created without a project template, no variable sets are set up.
Create a specialized variable set to use variables with other values. You can change the
values of the variables individually. Assign the specialized variable set to a start up
configuration in order to use it.
The default variable set contains all variables that are required in the synchronization
project. New variables are created in the default variable set. They are automatically
added to all specialized variable sets, with their default values. A variable's value can also
be found with a script, for example, for reading a system user's password from an external
password management system.

Table 58: Meaning of icons in the variable set tool

bar

Icon Meaning

Add a variable/variable set.

Delete variable/variable set.

Rename variable set.

Convert variable to script.

Convert script variable to a plain variable.

Display variable usage.

Default value for restoring the selected variable.

How to create variables

To create a variable in the default variable set

1. Select the Configuration | Variables.

The default variable set is displayed with all available variables in the upper part of
the document view.
2. Click in the upper view's toolbar.
3. Edit the variable's properties.
4. Save the changes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 111
Setting up synchronization
To create variables from connection parameters

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. Open the Connection parameters view.
3. Select the parameter whose value should be converted and click Convert category.
This button is not available if the parameter has already been converted into a
variable. The variable name is displayed instead.
4. Save the changes.

Related topics

l Using scripts in variables on page 114

How to edit variables

NOTE: Variable labeled as system variables cannot be modified.

To edit a variable in the default variable set

1. Select the Configuration | Variables category.

The default variable set is displayed with all available variables in the upper part of
the document view.
2. Select a variable in the default variable set.
3. Edit the variable's properties.
4. Save the changes.

To edit a variable in the specialized variable set

1. Select the Configuration | Variables category.

All specialized variable sets are shown in the lower part of the document view.
2. Open a specialized variable set in the variable set view.
3. Select a variable and enter a new value.
4. Save the changes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 112
Setting up synchronization
How to delete variables
To delete a variable in the default variable set

1. Select the Configuration | Variables category.

The default variable set is displayed with all available variables in the upper part of
the document view.
2. Click in the upper view's toolbar.

How to create specialized variable sets

To create a specialized variable set

1. Select the Configuration | Variables category.

All specialized variable sets are shown in the lower part of the document view.
2. Click in the variable set view toolbar.
3. Click in the variable set toolbar to rename the variable set and enter the
new name.
4. Select a variable and enter a new value.
Edit all the variable values which take on another characteristic.
5. Save the changes.

How to delete specialized variable sets

To delete a specialized variable set

1. Select the Configuration | Variables category.

All specialized variable sets are shown in the lower part of the document view.
2. Select a specialized variable set in the variable set view.
3. Click in the variable set view toolbar.

Variable properties
NOTE: Variable labeled as system variables cannot be modified.
Enter the following properties for a variable in the default variable set.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 113
Setting up synchronization
Table 59: Variable properties

Property Description

Name Variable name. The name must be unique within a variable set.

Display Display name of the variable.

name

Value Default value of the variable.

l To display and edit the value of a hierarchy filter, click Edit....
l To display and edit the script of a script variable, click Edit....

Secret value Specifies whether the variable in the Synchronization Editor may be
displayed.
If this option is set, the value is not displayed.

In use Specifies whether the variable is used in a Synchronization Editor function.

Description Spare field for additional explanation.

To show all definition used in a variable set

1. Select a variable in the default variable set.

2. Click in the toolbar.

To restore a variable's default value in a specialized variable set

1. Select a variable in the specialized variable set.

2. Click in the toolbar.

Related topics

l Using scripts in variables on page 114

l Creating hierarchy filters on page 109

Using scripts in variables

You can write scripts for finding variable values. You can use scripts, for example, for
reading a system user's password from an external password management system.
NOTE: The External password management option must be set for a system user in
order to use their password from an external password management system. For
detailed information about editing system users, see the One Identity Manager
Authorization and Authentication Guide.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 114
Setting up synchronization
To create a script variable.

1. Create the variable in the default variable set.

2. Select the variable and click in the toolbar.
3. In the Value input field, click Edit.
4. Enter the script and click OK.
5. Save the changes.

In this way, you can convert existing variables into script variables.

To convert script variables into simple variables.

1. Select the script variable in the default variable set.

2. Click in the toolbar.
3. Confirm the security prompt with Yes.

Related topics

l Validating scripts on page 168

Setting up start up configurations

A start up configuration contains all the required properties and options for a tangible
synchronization. This specifies which synchronization configuration components
(workflows, mappings, variable sets) should be used for synchronization. Synchronization
is started with a schedule. Different start up configurations can be set up for different
synchronization targets.
If the synchronization project was creating using a default project template, a start up
configuration is added. You can edit this start up configuration and create new start up
configurations. If the synchronization project was created without a project template, start
up configuration is set up.

How to create start up configurations

To create a start up configuration

1. In the Synchronization Editor, select the Configuration | Start up

configurations category.
2. Click in the document view toolbar.
3. Edit the start up configuration's master data.
4. Click OK.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 115
Setting up synchronization
How to edit start up configurations
To edit a start up configuration

1. In the Synchronization Editor, select the Configuration | Start up

configurations category.
2. Select a start up configuration in the document view and click Edit....
3. Edit the start up configuration's master data.
4. Click OK.

How to delete start up configurations

To delete a start up configuration

1. In the Synchronization Editor, select the Configuration | Start up

configurations category.
2. Select a start up configuration in the document view.
3. Click Delete.
4. Confirm the security prompt with Yes.

Start up configuration properties

Enter the following general properties for a start up configuration.

Table 60: General properties of a start up configuration

Property Description

Display name Name of the start up configuration.

Workflow Workflow processed by this start up configuration.

Direction of Direction in which synchronization will be executed.

synchronization
Select a synchronization direction from the list if "Defined by execution"
and at least one synchronization step "Use workflow default" is saved
with the workflow. Otherwise the direction of the synchronization
workflow or synchronization step is used for synchronization.

To the target One Identity Manager is the master system for

system synchronization.
To One Identity The target system is the master system for
Manager synchronization.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 116
Setting up synchronization
Property Description

Revision The revision filtering can be used to limit synchronization to just the
filtering objects that have been modified since the last synchronization.
Select a value from the list if "Defined by execution" and at least one
synchronization step "Use workflow default" is saved with the workflow.
Otherwise the value of the workflow or synchronization step is used for
synchronization.

Use revision filter Only modified object are synchronized.

Do not use revision filter All objects are synchronized.

Schedule Schedule for starting synchronization.

Variable set Assign the variable set with which to run synchronization.
If no variable set is given, the default variable is used. If a specialized
variable set is assigned, a list of all variables with their values is
displayed.
If changes are provisioned from One Identity Manager to the target
system, each start up configuration must have a corresponding base
object that uses the same variable set.

Description Spare field for additional explanation.

Detailed information about this topic

l Direction of synchronization and mapping on page 44

l How does revision filtering work? on page 38
l Using variables and variable sets on page 110
l Setting up synchronization workflows on page 87
l Specifying a schedule on page 119

Grouping
Table 61: Configuration parameters for the delayed start of further
synchronizations

Configuration Meaning
parameter

Common | This configuration parameter specifies the wait time (latency) in

Jobservice | minutes before the Job server attempts to execute a process step
RedoDelayMinutes again.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 117
Setting up synchronization
You can group start up configurations logically on the Grouping tab. If you have several
start up configurations, you can group them together into a start up group. Specify the start
up behavior for each start up group. The same start up behavior applies to all start up
configurations belonging to the same start up group.

Table 62: Grouping start up configurations

Property Description

Name Name of the start up group.

l To create a new start up group, enter a name.

- OR -
l Select an existing start up group from the menu.

Concurrence One Identity Manager behavior if multiple start up configurations are

behavior executed simultaneously.

Ignore Multiple synchronization can be executed simultaneously.

NOTE: This behavior can cause synchronization errors or
loss of data.
Plan your start times carefully. If possible, specify your
start times so that synchronization does not overlap.
Stop on If synchronization is already running, each new synchron-
error ization attempt breaks off with an error. Check the One
Identity Manager Service log file for this.
Postpone If synchronization is already running, the each new
and wait synchronization is postponed until the first one has
finished. You can adjust the wait time using the Common
| Jobservice | RedoDelayMinutes configuration
parameter.
This configuration parameter specifies the wait time in
minutes before the Job server attempts to start synchron-
ization again. If the first synchronization is still running,
the start of a further synchronization is delayed for the
specified length of time. This configuration parameter is
only effective on grouped start up configurations whose
concurrence behavior is configured with the Postpone
and wait option. The default value is two minutes.

Related topics

l Running synchronization on page 134

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 118
Setting up synchronization
Maintenance modes
You set the maintenance mode for start up configuration on the Maintenance tab. Here,
you can specify how data can be maintained that could not be saved during
synchronization. Object references, which have not (yet) been loaded are included in this
(for example, cross-domain references). Complex hierarchies loaded through a CSV import
might also have to be reworked because reference objects could not be assigned to them.
Unresolvable object references are written to a data store. The synchronization buffer is
cleaned up by maintenance.

Table 63: Start up configuration maintenance mode

Property Description

Mode Maintenance mode for cleaning up the synchronization buffer.

No maintenance There is no additional task of clearing up the

synchronization buffer.
Always synchronize The filter is removed on objects with
affected objects unresolved references.
Full maintenance after One Identity Manager tries to resolve object
every synchronization references following synchronization.

Retries Number of retries resolving an object reference. It may be necessary to try

several times to resolve an object if it maps a hierarchy with several levels.

Detailed information about this topic

l Unresolvable references on page 42

Specifying a schedule
Synchronization is started using scheduled process plans. A scheduled process plan is
added once a start up configuration is assigned to a schedule. Use schedules to define
executing times for synchronization.
NOTE: Synchronization can only be started if the synchronization project is enabled.
IMPORTANT: As long as synchronization is running, you must not start another
synchronization for the same target system. This applies especially, if the same
synchronization objects would be processed.
If another synchronization is started with another start up configuration, that addresses
same target system, it may lead to synchronization error or loss of data. Plan your
start times carefully. If possible, specify your start times so that synchronization does
not overlap.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 119
Setting up synchronization
To assign an existing schedule to a start up configuration

1. Select the Configuration | Start up configurations category.

2. Select a start up configuration in the document view and click Edit.
3. Select a schedule from the Schedule menu.
All active schedules assigned to the table JobAutoStart are available for selection.
4. Click OK.

One Identity Manager specifies a process plan when changes are committed to the One
Identity Manager database. This process plan starts the synchronizing process.
NOTE: You can manage existing schedules with Designer. For more detailed information,
see the One Identity Manager Operational Guide.

How to set up schedules

To create a schedule

1. Select the Configuration | Start up configurations category.

2. Select a start up configuration in the document view and click Create schedule.
3. Edit the schedule properties.
4. Click OK.

One Identity Manager specifies a process plan when changes are committed to the One
Identity Manager database. This process plan starts the synchronizing process.

To edit a schedule

1. Open the synchronization project in the Synchronization Editor.

2. Select the Configuration | Start up configurations category.
3. Select a start up configuration in the document view and click Edit schedule.
4. Edit the schedule properties.
5. To enable the schedule, click Activate.
6. Click OK.

Related topics

l Properties of a schedule on page 120

Properties of a schedule
Enter the following properties for a schedule.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 120
Setting up synchronization
Table 64: Schedule properties

Property Meaning

Name Schedule ID. Translate the given text using the button.

Description Detailed description of the schedule. Translate the given text using the
button.

Enabled Specifies whether the schedule is enabled or not.

NOTE: Only active schedules are run.

Time zones Unique identifier for the time zone that is used for running the schedule.
Choose between Universal Time Code or one of the time zones in the
menu.
NOTE:
When you add a new schedule, the time zone is preset to that of the client
from which you started the Synchronization Editor.

Start The day on which the schedule should be run for the first time. If this day
(date) conflicts with the defined interval type, the first run is on the next available
day based on the start date.

Validity Period within which the schedule is run.

period
l If the schedule will be run for an unlimited period, select the
Unlimited duration option.
l To set a validity period, select the Limited duration option and enter
the day the schedule will be run for the last time in End (date).

Occurs Interval in which the task is run. Permitted interval types are Hourly,
Daily, Weekly, Monthly, and Yearly.
For the Weekly interval type, specify the precise weekday. For the
Monthly interval type, specify the day of the month (1st to 31st day of the
month). For the Yearly interval type, specify the day of the year (1st to
366th day of the year).
NOTE: If the schedule is not going to be run until next month because the
interval type is Monthly with sub-interval 29, 30, or 31, the last day of
the current month is used.
Example:
A schedule that is run on the 31st day of each month is run on 30th April.
In February, the schedule is run on the 28th (or 29th in leap year).
Schedules with the interval type Yearly with sub interval 366 are only
run in leap year.

Start time Fixed start type for the Daily, Weekly, Monthly, and Yearly interval
types. Enter the time in local format for the chosen time zone.
For the interval type Hourly, the start time is calculated from the rate of

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 121
Setting up synchronization
Property Meaning

occurrence and the interval type.

Repeat Rate of occurrence for running the schedule within the selected time
every interval. For the Weekly interval type, select at least one weekday.

Setting up base objects

Base objects contain data about the target system to be synchronized, its system
connection, and the synchronization server. Base objects form the basis for provisioning
changes in the target system and synchronizing single objects. A base object is, for
example, a specific Active Directory domain from the One Identity Manager database. The
connection parameters for logging into a target system are assigned through a variable
set. In addition, the synchronization server is declared in the base object.
Base objects are required for provisioning processes and single object synchronization of
all the target systems that are connected by default to the One Identity Manager. You
cannot normally specify a specific base object for provisioning and single object
synchronization with database connectors or the CSV connector. In this case, assignment
of one base table and the synchronization server is sufficient. You can only set up one
synchronization project in the One Identity Manager database per base object.
The base object is used to determine which provisioning workflow is suited to an object in
the One Identity Manager database. In order to find the correct workflow for provisioning
object modifications or for single object synchronization, you can only set up one
synchronization project per base object.
If the synchronization project was creating using a default project template, a base object
is added. You can edit this base object and create more base objects. If the synchronization
project was created without a project template, no base object is set up.
NOTE: You cannot add base objects until the synchronization project has been
permanently saved in the database.

How to create base objects

To add a base object using an existing database object

1. Select the Configuration | Base objects category.

2. Click in the document view toolbar.
3. Edit the base objects's master data.
4. Click OK.

If the base object does not yet exist in the One Identity Manager database, use the wizard
to create a base object.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 122
Setting up synchronization
 NOTE: The wizard is only available to target systems that are contained in One Identity
Manager as default modules. The wizard cannot be used in synchronization projects with
the CSV connector or the native database connector.

To add a base object using a wizard

1. Select the Configuration | Base objects category.

2. Click in the document view toolbar.
3. On the welcome page, click Next.
4. On the System access page, specify how One Identity Manager can access the
target system.
l If access is possible from the workstation on which you started
Synchronization Editor, you do not need to make any settings.
l If access is not possible from the workstation on which you started
Synchronization Editor, you can set up a remote connection.
Enable the Connect using remote connection server option and select the
server to be used for the connection under Job server.
5. Select the system connection for the new base object on the Create system
connection page.
Follow the system connection wizard instructions. For detailed information about
which connection parameter you required, see the administration guide for the
respective system.
6. On the Synchronization server page, select the synchronization server to execute
synchronization.
If the synchronization server is not declared as a Job server in the One Identity
Manager database yet, you can add a new Job server.
l Click to add a new Job server.
l Enter a name for the Job server and the full server name conforming to
DNS syntax.
l Click OK.
The synchronization server is declared as Job server for the target system in
the One Identity Manager database.
NOTE: After you save the synchronization project, ensure that this server is
set up as a synchronization server.
7. Click Finish to complete the wizard.

The wizard creates a variable set with the given connection parameters. It creates the
synchronization base object, for example, the actual Active Directory domain you want to
synchronize, as an object in the One Identity Manager database.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 123
Setting up synchronization
How to edit base objects
To edit a base object

1. Select the Configuration | Base objects category.

2. Select a base object in the document view and click .
3. Edit the base objects's master data.
4. Click OK.

How to delete base objects

To delete a base object

1. Select the Configuration | Base objects category.

2. Select a base object in the document view and click .
3. Confirm the security prompt with Yes.

Properties of base objects

Enter the following properties for a base object.

Table 65: Properties of base objects

Property Description

Synchronization Defines whether a specific base object is required for synchronization.

has no base
If this option is set, a specific object cannot be selected from the base
object
table.

Base table Select the table from which to select the base object, for example,
ADSDomain.

Base object Select the object from the base table formed by the base object for
synchronization and provisioning processes.

Synchronization Select the synchronization server.

server

Server function The server’s server function that synchronizes Single object
synchronization and provisioning types. This allows parallel editing.
If no server function is given, the synchronization server handles these
processes.
Assign a custom server function.

Variable set Select the variable set that contains the connection parameter which

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 124
Setting up synchronization
Property Description

corresponds with the base object. Variables from selected variable sets
are displayed.
For each base objects there must be a start up configuration, which
uses the same variable set.

Related topics

l Load balancing during provisioning and single object synchronization on page 174
l Using variables and variable sets on page 110

Overview of schema classes

Synchronization Editor displays a schema overview for each system connection. The
schema overview contains all schema types and the derived schema classes used in the
synchronization project. You can edit schema classes here.

To display the schema overview

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. Open the Schema classes view.
This displays the schema type and schema class structures.

How to add schema classes

To create a schema class

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. Open the Schema classes view.
3. Click in the schema overview menu bar.
4. Edit the schema class properties.
For more information, see Schema class properties on page 73.
5. Save the changes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 125
Setting up synchronization
To create a new mapping for a schema class

1. Create a new mapping.

For more information, see How to create a mapping on page 70.
2. Select One Identity Manager schema class or Target system schema class.
3. Click .
4. Edit the schema class properties.
For more information, see Schema class properties on page 73.
5. Save the changes.

How to edit schema classes

NOTE:

l You can only edit customized schema classes.

l Modifications to schema classes in use can cause errors!

To edit a schema class

1. Edit the system connection properties.

For more information, see How to edit system connection properties on page 103.
2. Open the Schema classes view.
3. Double-click on a schema class in the schema overview.
4. Edit the schema class properties.
For more information, see Schema class properties on page 73.
5. Save the changes.

How to delete schema classes

NOTE: Custom schema classes, which are not in use, can be deleted.

To delete a schema class

1. Remove the schema class from all mappings in which they are used.
For more information, see How to edit a mapping on page 71.
2. Edit the system connection properties.
For more information, see How to edit system connection properties on page 103.
3. Open the Schema classes view.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 126
Setting up synchronization
 4. Select the schema class in the schema overview and click in the toolbar.
If the schema class is still in use, the location is displayed.
5. Confirm the security prompt with Yes.

TIP: Compress the schema to remove unnecessary schema classes from the target
schema or the One Identity Manager schema from the synchronization project. For more
information, see How to remove unnecessary project data on page 53.

Customizing the synchronization

configuration
Having used the project wizard to set up a synchronization project for initial
synchronization of a target system, you can use the synchronization project to load target
system objects into the One Identity Manager database. These objects can be edited with
One Identity Manager tools. You must customize synchronization configuration in order to
compare the database with the target system regularly and to synchronize changes. You
can configure a synchronization project such that the necessary information about the
direction of synchronization, objects to synchronize, and the property mapping rules to be
applied, is made available when synchronization starts.
Edit the target system connection scope and the One Identity Manager database connection
to specify which target system and database object are handled by synchronization. To
prevent data inconsistencies, define the same scope in both systems. If no scope is
defined, all objects will be synchronized.
You can use variables to create generally applicable synchronization configurations that
contain the necessary information about the synchronization objects when synchronization
starts. Variables can be implemented in base objects, schema classes, or processing
methods, for example.
Use variables to set up a synchronization project for synchronizing different target
systems. For this, connection parameters for logging onto target systems are stored
as variables.

Checking the consistency of the

synchronization configuration
Before activating a synchronization project, check the consistency of the synchronization
configuration. The consistency check detects configuration errors which would lead to
errors during synchronization. The synchronization project cannot be activated until the
configuration error are corrected.
The consistency check amongst others whether:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 127
Setting up synchronization
 l All mandatory properties are mapped through property mapping rules.
l Dependencies can be automatically resolved in workflows.
l Different schema classes of a schema type are differentiated from one
another by filters.

To check consistency the loaded synchronization project

1. Select the General view on the start page.

2. Click on Verify project.

Activating the synchronization project

Once you have collected all the data in the synchronization project you require for
synchronizing from the One Identity Manager database to a target system, you must
activate the project. This optimizes the size of the synchronization project. Data is
removed which is not required, for example, unused schema types. Synchronization can be
run after activating.

Table 66: Meaning of icons on the start page

Icon Meaning

The synchronization project is activated.

The synchronization project is deactivated.

To activate the loaded synchronization project

1. Select General on the start page.

2. Click Activate project.
NOTE: This runs a consistency check. If consistency errors occurs, a message
appears. You can decide whether the project is activated or not.
Check the errors before you use the synchronization project. In the General view,
click Verify project.

An activated synchronization project can only be edited to a limited extend. The schema in
the synchronization project must be updated if schema modifications are required. The
synchronization project is deactivated in this case and can be edited again.
Furthermore, the synchronization project must be deactivated if synchronization should not
be started by any means (not even manually).

To deactivate the synchronization project

1. Open the synchronization project in the Synchronization Editor.

2. Select the General view on the start page.
3. Click Deactivate project.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 128
Setting up synchronization
Related topics

l Checking the consistency of the synchronization configuration on page 127

l System connection properties on page 104
l How to remove unnecessary project data on page 53
l Updating schemas on page 54

Defining start up sequences

In the Synchronization Editor, you can define start up sequences across synchronization
projects for full synchronization. Start up sequences order start up configurations for
different target systems into a sequence. The synchronization projects are executed
automatically in the given order.

Example

Shortly after synchronizing personnel planning data from an SAP HCM system,
always synchronize the SAP R/3, Active Directory, Privileged Account Management,
and G Suite systems. Personnel planning data should be synchronized daily.
To do this, the start up configuration for the SAP HCM system and the start up config-
uration for all other target system are group together in a start up sequence. The
start up configuration for SAP HCM is positioned at the top. A schedule is assigned
that starts the start up sequence daily.

Specify whether each start up configuration is allowed to start after the previous
synchronization has completed or at the same time as the previous start up configuration.

Detailed information about this topic

l Creating start up sequences on page 130

l Editing start up sequences on page 130
l Deleting start up sequences on page 131
l Start up sequence properties on page 131
l Executing start up sequences on page 136
l Monitoring start up sequences on page 136

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 129
Setting up synchronization
Creating start up sequences
To create a start up sequence

1. In the Synchronization Editor, select the Database | Manage start up

sequences menu item.
2. In the Sequences pane, click .
3. Enter the start up sequence’s master data.
4. Select the start up configuration to run by clicking .
5. To edit the start up configuration’s properties, click .
6. To save the start up sequence, click .

Detailed information about this topic

l Start up sequence properties on page 131

Editing start up sequences

To edit a start up sequence

1. In the Synchronization Editor, select the Database | Manage start up

sequences.
2. In the Sequences pane, double-click the start up sequence.
3. Edit the start up sequence’s master data.
4. To add a start up configuration to the start up sequence, select the start up
configuration and click .
5. To remove a start up configuration from the start up sequence, select the start up
configuration and click .
6. To edit the start up configuration’s properties, click .
7. To change the order of the start up configurations, select a start up configuration and
click or .
8. To save the changes, click .

Detailed information about this topic

l Start up sequence properties on page 131

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 130
Setting up synchronization
Deleting start up sequences
To delete a start up sequence

1. In the Synchronization Editor, select the Database | Manage start up

sequences.
2. In the Sequences pane, double-click the start up sequence.
3. In the Included start up information, click .
4. Confirm the security prompt with Yes.

This deletes all instances of the start up sequence.

Related topics

l Monitoring start up sequences on page 136

Start up sequence properties

Enter the following properties for a start up sequence.

Table 67: General start up sequence properties

Property Description

Name Name of the start up sequence.

Schedule Schedule for starting synchronization.

Ensure that start up configurations that are used in start up sequences are
not started individually at the same time. Assign the start up sequence to a
schedule that is not used in any of the start up configurations.

Allow Specifies whether this start up sequence can be started more than once.
multiple Ensure that no other synchronization is started for the same target system
starts as long as synchronization is running.
Example: A start up sequence is triggered daily. Even if the start up
sequence has not ended after 24 hours, it should be started again. If each
start up configuration synchronizes another target system, you can set the
Allow multiple starts option. If the option is not set, the start up
sequence is not restarted until the current instance is finished.

Description Spare field for additional explanation.

You can set the properties of each the selected start up configurations.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 131
Setting up synchronization
Table 68: Start up configuration properties in a start up sequence

Property Description

Runs simul- Specifies whether this start up configuration can be started at the same
taneously time as the previous start up configuration. Use this option to
synchronize projects in parallel that are started from different
synchronization servers.
Do not set this option if the start up configurations handle the same
target system objects.

Sequence quits Specifies whether the start up sequence is canceled if an error occurs
on error running this start up configuration.
If the option is set, instances of the start up sequence are still displayed
in the Synchronization Editor after synchronization has quit.

Example

Shortly after synchronizing personnel planning data from an SAP HCM system,
always synchronize the SAP R/3, Active Directory, Privileged Account Management,
and G Suite systems. Personnel planning data should be synchronized daily.
Even if the start up sequence has not ended after 24 hours, it should be
started again.
The target systems SAP R/3, Active Directory, Privileged Account Management, and
G Suite can be synchronized in parallel. They cannot, however, be started before
SAP HCM has finished synchronizing.
The start up sequence contains the following configuration:

l Schedule: daily
l Allow multiple starts: set
l Order of start up configurations:

1. SAP HCM System

Runs simultaneously: not set
2. SAP R/3 client
Runs simultaneously: not set
3. Active Directory domain
Runs simultaneously: set
4. One Identity Safeguard Appliance
Runs simultaneously: set

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 132
Setting up synchronization
 5. G Suite Domain
Runs simultaneously: set

Detailed information about this topic

l Specifying a schedule on page 119

l Monitoring start up sequences on page 136
l Running synchronization on page 134

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 133
Setting up synchronization
 5

Running synchronization

Synchronization is started using scheduled process plans. It is possible to start

synchronization manually in the Synchronization Editor. You can simulate synchronization
beforehand to estimate synchronization results and discover errors in the synchronization
configuration. If synchronization was terminated unexpectedly, you must reset the start
information to be able to restart synchronization.
IMPORTANT: As long as synchronization is running, you must not start another
synchronization for the same target system. This applies especially, if the same
synchronization objects would be processed.

l If another synchronization is started with the same start up configuration, this

process is stop and is assigned the Frozen execution status. An error message is
written to the One Identity Manager Service log file.
l Ensure that start up configurations that are used in start up sequences are
not started individually at the same time. Assign start up sequences and start
up configurations different schedules.
l If another synchronization is started with another start up configuration, that
addresses same target system, it may lead to synchronization error or loss of data.
Specify One Identity Manager behavior in this case, in the start up configuration.
l Use the schedule to ensure that the start up configurations are executed
in sequence.
l Group start up configurations with the same start up behavior.

If you want to specify the order in which target systems are synchronized, use the start up
sequence to run synchronization. In a start up sequence, you can combine start up
configurations from different synchronization projects and specify the order of execution.

Detailed information about this topic

l Simulating synchronization on page 135

l Starting synchronization manually on page 135
l Executing start up sequences on page 136
l Handling unexpected termination of synchronization on page 137
l Grouping on page 117

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 134
Running synchronization
Simulating synchronization
You can simulate synchronization before using a start up configuration to execute it.
Simulation allows you to estimate the result of synchronization. This means you can
recognize potential errors in the synchronization configuration, for example. Reactions
from the connected system and it consequences cannot be incorporated because simulation
cannot modify data.
Simulation executes the following actions:

l Creates execution plan

l Connects to the target system and One Identity Manager database
l Loads system objects
l Logs write operations for objects and their properties but does not execute

Dependent objects and schema properties cannot be resolved if the objects already exist in
the connected system. Unresolvable dependencies are logged.
IMPORTANT: Simulation changes data in neither One Identity Manager nor the target
system. However, large amounts of data are read from both systems. This can affect
system performance and processing.
All the data to be processed remains in the memory of the workstation running the
simulation until the simulation is complete. Demands on memory may be heavy
depending on the amount of data.

To start simulation

1. Select the Configuration | Start up configurations category.

2. Select a start up configuration in the document view and click Simulate....
3. Click Start simulation.
4. Confirm the security prompt with Yes.
A report is displayed after simulation has completed. You can save the report.

Starting synchronization manually

To start synchronization manually

1. Open the synchronization project in the Synchronization Editor.

2. Select the Configuration | Start up configurations category.
3. Select a start up configuration in the document view and click Execute.
4. Confirm the security prompt with Yes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 135
Running synchronization
Related topics

l Executing start up sequences on page 136

Executing start up sequences

By default, start up sequences are started using scheduled process plans. In the
Synchronization Editor, it is also possible to start a start up sequence manually.

To start a start up sequence manually

1. In the Synchronization Editor, select the Database | Manage start up

sequences.
2. In the Sequences pane, double-click the start up sequence.
3. In the Included start up information, click .

Related topics

l Defining start up sequences on page 129

l Monitoring start up sequences on page 136
l Starting synchronization manually on page 135

Monitoring start up sequences

Once a start up sequence is running, an instance of the start up sequence in added in the
DPRStartSequence table. This instance contains information about the runtime status and
errors of the entire start up sequence. A DPRStartSequenceHasProjection table is also saved
for every start up configuration that is run. This instance contains information about the
runtime status and errors of the current synchronization.
Instances can be shown and monitored in the Synchronization Editor. The following
instances are shown:

l Start up sequences that are still running.

l Start up sequences that quit on error assuming at least one start up configuration has
the Sequence quits on error option set.

To display a start sequence instance

1. In the Synchronization Editor, select the Database | Manage start up

sequences menu item.
2. In the Sequences pane, click .
3. Double-click on the start up sequence instance.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 136
Running synchronization
 In the Included startup information view, you can see the runtime status of all
the associated start up configurations.
4. To update the view, in the Sequences toolbar, click .

Table 69: Runtime status of an instance

Color Description Progress state

White The instance is created. Created

Green The start up configuration is waiting to run. Pending

Yellow Synchronization is running. Running

Gray Synchronization has successfully completed Processed

Red Synchronization ended with an error. Error

Instances of completed start up sequences are deleted after a specified time period. The
DPRStartSequence and DPRStartSequenceHasProjection tables are cleaned up in the process.
By default, completed instances are kept for seven days.

To change the retention period for completed instances

l In the Designer, set the DPR | StartSequnce | LifeTime configuration parameter

and enter the maximum retention period.

Related topics

l Deleting start up sequences on page 131

l Start up sequence properties on page 131

Handling unexpected termination of

synchronization
If synchronization is executed with a start up configuration, some One Identity Manager
processes are stopped. It is not possible to start this start up configuration again. The One
Identity Manager saves start information of the current synchronization in the database.
This start information is reset once synchronization is completely normally.
If synchronization was terminated unexpectedly, for example, a server was no
available, you must manually reset the start information. You can only restart
synchronization after this.
IMPORTANT: Start information may not be reset if synchronization is running normally.
Before you reset the start information, ensure that synchronization has really been
aborted.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 137
Running synchronization
To reset synchronization start information

1. Select the Configuration | Start up configurations category.

2. Select a start up configuration in the document view and click Reset.
3. Confirm the security prompt with Yes.
The status "Broken" is entered in the synchronization log.

NOTE: If necessary, start information can be reset automatically. To do this, customize

the process DPR_DPRProjectionStartInfo_Run_Synchronization. Changes made to the
process are applied to all target systems connected to the One Identity Manager
database when synchronization takes place.

Resetting revisions
Synchronization with revision filtering involves finding object pairs where one has newer
change information than the last time it was synchronized. It may also be necessary to
process those objects during synchronization, whose change information has not be
updated since the last synchronization. This might be required if changes to data were
made without the change information for the object being updated, for example. It is
possible that data in one of the connected systems was restored from a backup. This
means the change information for the objects is now older than before the last
synchronization. Such objects are not processed by synchronization with revision filtering.
One Identity Manager provides an option to reset revision numbers in a start up
configuration. The revision can be reset for one schema type or for all of a schema's types.
The next time synchronization is run with this start up configuration, all affected objects
are seen as changed.

To reset the revision number

1. Select the category Configuration | Start up configurations.

2. Select a start up-configuration in the document view and click Revisions...
This opens the Manage revisions... dialog window. which displays all the schema
types with their respective revision numbers. Schema types without a revision
number, are not displayed.
3. Select the schema for which you want to reset the revision number.
- OR -
From the target system schema or the One Identity Manager schema, select the
schema type for which you want to reset the revision.
4. Click Reset.
5. Select another schema type if required.
6. Click Apply.
7. Confirm the security prompt with Yes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 138
Running synchronization
 The revisions of the selected schema types are deleted from the start up
configuration.

Related topics

l How does revision filtering work? on page 38

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 139
Running synchronization
 6

Synchronization analysis

Synchronization results are summarized in the synchronization log. You can specify the
extent of the synchronization log for each system connection individually. One Identity
Manager provides several reports in which the synchronization results are organized under
different criteria.

Toolbars in the log view

The navigation view in the Logs category has its own toolbar.

Table 70: Meaning of icons in the navigation view

Icon Meaning

Reload the data.

Display synchronization log.

Display provisioning log.

Only display most recent logs. This display logs from within the past 24 hours.

Sort by execution time.

Sort by execution status.

How to display synchronization logs

To display a synchronization log

1. Open the synchronization project in the Synchronization Editor.

2. Select the Logs category.
3. Click

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 140
Synchronization analysis
 in the navigation view toolbar.
Logs for all completed synchronization runs are displayed in the navigation view.
4. Select a log by double-clicking it.
An analysis of the synchronization is shown as a report. You can save the report.

To display a provisioning log.

1. Open the synchronization project in the Synchronization Editor.

2. Select the Logs category.
3. Click in the navigation view toolbar.
Logs for all completed provisioning processes are displayed in the navigation view.
4. Select a log by double-clicking it.
An analysis of the provisioning is show as a report. You can save the report.

The log is marked in color in the navigation view. This mark shows you the execution status
of the synchronization/provisioning.
TIP: The logs are also displayed in the Manager under the <target system> |
synchronization log category.

Target system synchronization

Objects, which do not exist in the target system, can be marked as outstanding in One
Identity Manager by synchronizing. This prevents objects being deleted because of an
incorrect data situation or an incorrect synchronization configuration.
Outstanding objects

l Cannot be edited in One Identity Manager.

l Are ignored by subsequent synchronization.
l Are ignored by inheritance calculations.

This means, all memberships and assignments remain intact until the outstanding objects
have been processed.
Start target system synchronization to do this.

To post-process outstanding objects

1. Start the Manager.

2. Select the <target system type> | Target system synchronization: <target
system type> | <table> category.
TIP:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 141
Synchronization analysis
 To display object properties of an outstanding object
a. Select the object on the target system synchronization form.
b. Open the context menu and click Show object.

3. Select the objects you want to rework. Multi-select is possible.

4. Click one of the following icons in the form toolbar to execute the respective method.

Table 71: Methods for handling outstanding objects

Icon Method Description

Delete The object is immediately deleted in the One Identity Manager

database. Deferred deletion is not taken into account. The
Outstanding label is removed for the object.
Indirect memberships cannot be deleted.

Publish The object is added in the target system. The Outstanding label
is removed for the object.
The method triggers the HandleOutstanding event. This runs a
target system specific process that triggers the provisioning
process for the object.
Prerequisites:
l The table containing the object can be published.
l The target system connector has write access to the target
system.
l A custom process is set up for provisioning the object.

Reset The Outstanding label is removed for the object.

5. Confirm the security prompt with Yes.

NOTE: By default, the selected objects are processed in parallel, which speeds up
execution of the selected method. If an error occurs during processing, the action is
stopped and all changes are discarded.
Bulk processing of objects must be disabled if errors are to be localized, which means the
objects are processed sequentially. Failed objects are named in the error message. All
changes that were made up until the error occurred are saved.

To disable bulk processing

l Deactivate in the form toolbar.

For more detailed information about post-processing outstanding objects from connected
target systems, see the target system connection guides.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 142
Synchronization analysis
Deleting memberships
Membership of user accounts in groups, for example, can result from direct assignment or
through inheritance in One Identity Manager. The membership's origin is stored in the
XOrigin assignment table. Inherited memberships cannot be deleted as long as the
inheritance source still exists. If inherited memberships are deleted in the target system,
they are marked as outstanding by synchronization, depending on which processing
method was selected.
You can differentiate between the following cases of deleting membership through
synchronization:

Table 72: Deleting memberships

Membership Delete method MarkAsOutstanding

origin method

Only direct The membership is deleted immediately by The membership is

synchronization. marked as outstand-
ing by synchron-
ization.

Only The membership is marked as outstanding by The membership is

inherited synchronization. marked as outstand-
ing by synchron-
ization.

Direct and The membership is marked as outstanding by The membership is

inherited synchronization. The reference to direct assign- marked as outstand-
ment is removed (value in the XOrigin column is ing by synchron-
updated). ization.

Outstanding memberships must be post-processed separately. You can publish these

memberships if the inheritance source still exists or you set the status back and remove
the inheritance source.

Example

Ben King has an Active Directory user account that is a member of the Active Directory
group "Backup operators". This membership is loaded into the One Identity Manager
database by initial synchronization and saved as direct membership in the
ADSAccountInADSGroup table (XOrigin = '1'). Ben King is member of the business role
"Project A". This business role is assigned to the Active Directory group "Backup
operators". Therefore, Ben King becomes an indirect member of this Active Directory
group ([Link] = '3'). The group membership is deleted in the
target system. The deleted membership is immediately deleted in the One Identity
Manager database the next time synchronization is run ([Link] =
'2'). The membership is marked as outstanding because it remains in the One Identity
Manager database due to inheritance. The outstanding membership must be post-
processed in target system synchronization. There are two possible ways to do this:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 143
Synchronization analysis
 a. Assignments to the business role "Project A" are correct.
The method "Publish" is applied. Membership is re-added to the target system.
b. Mapping in the target system is correct.
l The method "Reset status" is applied.
l The assignment of the Active Directory group to the business role "Project A",
or Ben King’s membership of this business role must be deleted. The group
membership must also be deleted from ADSAccountInADSGroup table.

The method "Delete" cannot be applied.

Related topics

l Deleting objects in One Identity Manager on page 51

l Target system synchronization on page 141

Help for the analysis of

synchronization issues
You can generate a report for analyzing problems which occur during synchronization, for
example, insufficient performance. The report contains information such as:

l Consistency check results

l Revision filter settings
l Scope applied
l Analysis of the data store
l Object access times in the One Identity Manager database and in the target system

To generate a synchronization analysis report

1. Select the Help | Generate synchronization analysis report menu item and
click Yes in the security prompt.
The report may take a few minutes to generate. It is displayed in a separate window.
2. Print the report or save it in one of the available output formats.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 144
Synchronization analysis
 7

Setting up synchronization with

default connectors

One Identity Manager provides connectors for synchronizing with the following target
systems:

l Native supported target systems

Separate modules are provided for mapping and processing target system objects.
Each target system has its own connector. This includes, for example, the following
target systems:
l Active Directory
l SharePoint
l SAP R/3
Connectors for natively supported target systems are described in the administration
guides for the relevant modules.
l Cloud applications
Using the SCIM connector, Cloud applications can be connected to the Universal
Cloud Interface Module of the One Identity Manager. Cloud objects are transferred to
the Universal Cloud Interface over the Cloud Systems Management Module and can
be linked there to employees.
For detailed information, see the following guides:
l One Identity Manager Administration Guide for Connecting to Cloud
Applications
l One Identity Manager Administration Guide for Connecting to the Universal
Cloud Interface
l CSV files
The CSV connector can transfer data between CSV files and the One Identity Manager
database. In this context, the CSV files map the target system.
For more detailed information, see the One Identity Manager CSV Connector
User Guide.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 145
Setting up synchronization with default connectors
l One Identity Manager databases
Use the One Identity Manager connector to synchronize One Identity Manager
databases with the same product version.
For more detailed information, see the One Identity Manager User Guide for the One
Identity Manager Connector.
l Target systems that are not natively supported
You can use the Windows PowerShell connector to connect target systems to One
Identity Manager that do not have native support in One Identity Manager. Windows
PowerShell cmdlets are used to execute read/write operations in the target system.
For more detailed information, see the One Identity Manager Windows PowerShell
Connector User Guide.
l Native database systems
With this native database connector, you can synchronize external databases with
the One Identity Manager database.
For detailed information, see the following guides:
l One Identity Manager Native Database Connector User Guide for Connecting
DB2 (LUW) Databases
l One Identity Manager Native Database Connector User Guide for Connecting
MySQL Databases
l One Identity Manager Native Database Connector User Guide for Connecting
Oracle Databases
l One Identity Manager Native Database Connector User Guide for Connecting
SQLite Databases
l One Identity Manager Native Database Connector User Guide for Connecting
SQL Server Databases
l One Identity Manager Native Database Connector User Guide for the CData
[Link] Provider
l One Identity Manager Native Database Connector User Guide for the generic
[Link] Provider
l One Identity Manager Native Database Connector User Guide for Connecting
SAP HANA Databases

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 146
Setting up synchronization with default connectors
 8

Updating existing synchronization

projects

Any required changes to system connectors or the synchronization engine are made
available when you update One Identity Manager. These changes must be applied to
existing synchronization projects to prevent target system synchronizations that are
already set up, from failing. There are two way to do this:

l Apply the required patches to the existing synchronization projects.

Patches for new functions and resolved issues in One Identity Manager are installed
by hotfix packages and migration packages. You must apply these patches manually
for the changes to take effect in existing synchronization projects. The default
configuration of these synchronization projects is update in the process. Custom
modifications are not effected by the patches.
This method is recommended if the synchronization projects conform to the default
configuration and contain no, or only very little, customization.
l Delete existing synchronization projects and create them again.
This method is recommended if your synchronization projects contain extensive
customizations that might conflict with the modifications in the patches.

Detailed information about this topic

l Applying patches on page 148

l How to delete a synchronization project on page 63

For more detailed information about setting up synchronization projects, see the
administration guides for connecting target systems.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 147
Updating existing synchronization projects
Applying patches

CAUTION: Patches do not change customizations in synchronization

projects. This mean that conflicts may occur if patches are applied to
synchronization projects, which have been customized. This may cause
loss of data.
Before you apply a patch

1. Read the patch description to decide whether it provides necessary improve-

ments for the synchronization project.
2. Check whether conflict with customizations could occur.
3. Create a backup of the database so that you can restore the original state if
necessary.
4. Deactivate the synchronization project.

NOTE: If synchronization projects are updated, connection parameters from the default
variable set are always used. Ensure that the variables in the default variable set contain
the correct values.
One Identity Manager has three patch types. All patches that are applied are displayed in
the synchronization project's migration details. Once a milestone has been applied, the
associated patches are not listed separately in the migration details anymore.

Table 73: Patch types

Patch Description
type

Optional Patch for optional functionality

features

Fix Patch for solved problems.

Mile Milestones are provided with every new One Identity Manager version. A
stone milestone is provided for each context, which includes all the solved issues of
the previous version. It does not contain the optional features of the previous
version.

Patches can be dependent on each other. These dependencies determine the order in
which the patches are applied. When a patch is applied, the patches that are dependent on
it are also applied. If a new version of One Identity Manager is installed, all patches for
the version are consolidated into one milestone. If patches are available for different
version of the program, the older patches must always be applied first. Therefore, One
Identity Manager automatically applies all previous milestone once a patch for a later
version is selected.
Patches and their dependencies are displayed in the patch view. The left side shows the
patches that are available. The newest patches are at the top. Dependent patches are
displayed below. In this area, select the patches that you want to apply to the current

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 148
Updating existing synchronization projects
synchronization project. Then the patches are displayed on the right-hand side, with all
their predecessor in the order in which they will be applied.
Each patch contains a script which checks if the patch can be applied to the synchronization
project. Whether or not a patch can be applied depends on the concrete synchronization
configuration.

Table 74: Meaning of icons in the rule tool bar

Icon Meaning

Fixes Shows patches with fixes.

Optional Shows all patches for optional features.

features

Shows all patches that are cannot be applied to the synchronization

project.

Shows all patches that are already applied to the synchronization

project.

Some patches required user input during installation, for example, to confirm that you
really want a particular change to be executed.

To apply patches

1. Open the synchronization project in the Synchronization Editor.

2. Select Edit | Update synchronization project... from the menu.
3. Optional: Select the patches to be applied under Available patches. Multi-select
is possible.
In the patch detail view, patches are listed in the order in which they will be applied.
4. Click Apply selected patches.
5. Enter any user input as prompted.
6. If necessary, use the patch log to check whether customization need to be reworked.
7. If required, rework customizations in the synchronization configuration.
8. Run a consistency check.
9. Simulate the synchronization.
10. Activate the synchronization project.
11. Save the changes.

NOTE: A patch does not take effect until the changes associated with it are saved in the
database. If consistency check or simulation errors occur that cannot be corrected, you
can dismiss the patch changes by reloading the synchronization project without saving
the changes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 149
Updating existing synchronization projects
Related topics

l General properties of a synchronization project on page 63

l Automatic patches on page 150

Automatic patches
Patches can be labeled as automatic patches. All existing synchronization projects are
migrated after One Identity Manager is updated, for example, with a service pack. This
updates the One Identity Manager schema and applies automatic patches. A process is
queued in the Job queue to do this. After the One Identity Manager update, you should
check whether the process DPR_Migrate_Shell was run successfully. If a patch could not be
applied, for example because the target system was not available, you can apply the patch
manually later.
A Job server is found to migrate existing synchronization projects. To do this, the synchron-
ization server is determined from base object that is assigned to the synchronization
project’s default variable set. If a synchronization server cannot be found, the Job server
carries out the migration using the Update server server function. In order to execute the
migration process, the One Identity Manager Service must be started on all Job servers
found in this way.

Related topics

l Applying patches on page 148

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 150
Updating existing synchronization projects
 9

Script library for synchronization

projects

You can apply scripts at various points in the synchronization project; for example, when
defining the schema properties, in the object filter, or when you define data operations for
system connections through the native database connector. For each synchronization
project, you can build a separate script library. The scripts in these script libraries can be
used everywhere where scripts are implemented in the synchronization configuration. You
can create and maintain scripts centrally that are required for defining different
synchronization configuration components.
You can import scripts into other synchronization projects. Scripts that you use in different
synchronization projects you can label as script templates. The script templates are only
maintained in one synchronization project. You can transfer any modification to other
synchronization projects as required.
NOTE: Scripts from the One Identity Manager script library are not available in the
Synchronization Editor‘s script library. For detailed information about the One Identity
Manager script library, see One Identity Manager Configuration Guide.

To display a synchronization project’s script library

1. In the Synchronization Editor, open the synchronization project.

2. Select the Configuration | Script library category.

Detailed information about this topic

l Adding scripts to script libraries on page 153

l Editing scripts in the script library on page 154
l Using scripts across projects on page 155

Views in the script library

The Synchronization Editor‘s script library has two views. The Scripts view provides an
overview of all general properties of the scripts. The scripts are edited in the Editor view.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 151
Script library for synchronization projects
Script views

This lists all the scripts in the script library with all their general properties. You can update
scripts that were created from script templates.

Table 75: Icons in the script view

Icon Meaning

Add Create a new script.

Edit Edit the selected script’s general properties.
Delete Deletes the selected script.
Import Imports scripts from other synchronization projects.
Updates scripts with changes from script templates.

Table 76: General properties of scripts

Property Description

Script Name of script.

Description Spare field for additional explanation.
Schema type Schema type that the script is used on.
Is template Script can be used as a template for other synchronization projects.
Uses template Script was imported from another script template.
Updates available Script template used as basis for the script has changed.
Updates differences Shows the changes to the script template.
Updates apply Updates the script with the changes from the script template.

Editor view

Show the code of the selected script. It can be edited and compiled. For more information,
see Support for scripting on page 21.

Table 77: Icons in the editor view

Icon Meaning

Saves changes to the script.

Compile Compiles all the scripts in the script library.
Script was compiled without errors.
Script contains syntax errors.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 152
Script library for synchronization projects
Detailed information about this topic

l Adding scripts to script libraries on page 153

l Editing scripts in the script library on page 154
l Using scripts across projects on page 155

Adding scripts to script libraries

To add scripts to the Synchronization Editor‘s script library, create the scripts directly in
the script library or take them from script properties. You can import all scripts into other
synchronization projects.

To add a script to the script library

1. Open the script library.

2. In the Scripts view, click Add.
3. Enter the script’s general master data.

l Name: Unique script name.

l Schema type: Schema type that the script is applied to.
l Description: Spare field for additional explanation.
l Is template: Specifies whether the script can be used as a template for other
synchronization projects.
4. In the Editor view, edit the script.
For more information, see Support for scripting on page 21.
5. Click OK.

To import a script

1. Open the script library.

2. In the Scripts view, click Import.
3. Select the script to import.
This saves a copy of the script that you can customize to fit the project.

To copy script properties from other scripts

1. Select the Mappings category.

2. Select a mapping in the navigation view.
3. Double-click on the schema property in the schema view.
4. In the Edit property dialog, click Move to script library.
5. Confirm the security prompt with Yes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 153
Script library for synchronization projects
 6. Click OK.
This saves a new script in the script library. The name of the script is taken from the
technical name of the schema type and the name of the schema property. This
script contains a read-only schema property script as well as a write-only schema
property script.

Related topics

l Script library for synchronization projects on page 151

l Editing scripts in the script library on page 154

Editing scripts in the script library

To edit a script’s master data

1. Open the script library.

2. Select the script in the Script view.
3. Click Edit.
4. Edit the script’s general master data.

l Name: Unique script name.

l Schema type: Schema type that the script is applied to.
l Description: Spare field for additional explanation.
l Is template: Specifies whether the script can be used as a template for other
synchronization projects.
5. Click OK.

To edit the script

1. Open the script library.

2. Select the script in the Script view.
3. Edit the script in the Editor view.
For more information, see Support for scripting on page 21.
4. Click .

To compile the script.

1. Open the script library.

2. Click Compile.
This compiles all the scripts in the scrip library.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 154
Script library for synchronization projects
To remove a script from the scrip library.

1. Open the script library.

2. Select the script in the Script view.
3. Click Delete.
4. Confirm the security prompt with Yes.

Related topics

l Script library for synchronization projects on page 151

Using scripts across projects

You can import scripts can be imported into other synchronization projects and customize
them there. Sometimes you can use scripts for the same synchronization projects without
having to change them. Scripts like this are maintained centrally and changes are
transferred to the other synchronization projects as required. Mark scripts to use in across
projects as script templates.

To mark a script as a script template

1. Open the script library.

2. Select the script in the Script view.
3. Click Edit.
4. Edit the script’s general master data.
l Enable the Is template option.
5. Click OK.

To import a script template into another synchronization project

1. Open the synchronization project you want import the script template into.
2. Open the script library.
3. In the Scripts view, click Import.
4. Select the script template you want to import.
This saves a copy of the script.

You can see if the script template was changed in the script. You can decided if changes to
these copies are accepted.

To view the script template changes

1. Open the script library.

2. Select the imported script in the Scripts view.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 155
Script library for synchronization projects
 3. In the Updates | Differences column, click Show.

To apply script template changes to the copy

1. Open the script library.

2. Select the imported script in the Scripts view.
3. In the Updates | Apply column, click Apply.

To apply the all script templates changes

1. Open the script library.

2. In the Scripts view, click .
3. Confirm the security prompt with OK.

Related topics

l Script library for synchronization projects on page 151

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 156
Script library for synchronization projects
 10

Additional information for experts

NOTE: The following functions should only be carried out by experienced Synchronization
Editor users and system administrators.
The properties and processes described here are only available in expert mode.
IMPORTANT: Changes to properties described here may affect system performance.
Check the effects on system performance of you environment before you change
properties in expert mode.

To enable export mode

1. Select the Database | Settings... menu item.

2. EnableEnable expert mode.
3. Click OK.

Additional properties of a mapping

Enter the following additional property for a mapping when you are in expert mode.

Table 78: Properties of a mapping

Properties Meaning

Base Property mapping rules can be inherited from a existing mapping. Select a
mapping mapping from the menu for this. Inherited property mapping rules can only
be editing in the base mapping. Other property mapping rules can be
added.
This is only visible in expert mode.

Related topics

l Properties of a mapping on page 71

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 157
Additional information for experts
Extended properties for start up
configuration
In expert mode, the tab Advanced is displayed in the start up configuration dialog.

Table 79: Extended properties for start up configuration

Property Description

Failure Specifies how failed objects are handled during synchronization.

handling
l Repeat (default)
mode
Synchronization is repeated until the failed objects do not yield any
changes.
Advantage: This results in a full synchronization. Certain, highly
complex hierarchical structures cannot only be synchronized in this
mode.
Disadvantage: Synchronization in this mode takes considerably longer
if a failed object arises.
l Ignore
The synchronization ignores failed objects.
Advantage: Synchronization does not take longer because of failed
objects that cannot be corrected by repeating (data error).
Disadvantage: Errors, which can occur through complex data
dependencies, are no longer corrected. The synchronization results
may therefore not be complete.

NOTE: Repetitions of failed objects means a reduced synchronization.

It makes sense to ignore failed objects if synchronization with this start up
configuration is run frequently because the failed objects are processed
again by the next synchronization. This also achieves full synchronization
results and at the same time reduces the runtime of each synchronization.

Reload Specifies the maximum number of properties that can be loaded by

threshold synchronization to prevent partitioned reloading. You can increase this value
to accelerate synchronization of target systems with small mappings.
However, more memory is required.
The reload threshold can be specified separately for each synchronization
step.

Partition Specifies the number of objects and object pairs the can be processed at the
size same time. To prevent frequent reloading and to speed up synchronization,
you can increase the size of the partition. However, more memory is
required.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 158
Additional information for experts
Property Description

Bulk level Controls internal bulk processing of data For example, this is used to
calculate how much object data is buffered in main memory. Depending on
the operations to be run, a multiple of the value maybe applied.
Higher values speed up processing but require more memory. Smaller value
reduce memory usage. This value should only be reduced if synchronizing
causes memory problems.

Debug Sets debug mode. Processing steps are handled sequentially in debug mode.
mode This makes it much easier to find errors. Only set this option for finding
errors!

TIP: If memory problems occur, you should examine the reload threshold, partition size,
and bulk level together and adjust them.
The reload threshold, partition size, and the bulk level also depend on how the
performance/memory factor is configured in the synchronization steps. The
performance/memory factor specifies the percentage with which the reload threshold,
partition size, and bulk level are applied to an object type.

Detailed information about this topic

l Processing synchronization steps on page 171

l Performance and memory optimization on page 58

Related topics

l Setting up start up configurations on page 115

l Extended synchronization step properties on page 101

Using the local cache

Some connectors support the use of local cache. If you enable this cache, the connector
loads all the necessary data into a local database after the connection has been established
with the target system. The data is loaded for each schema type. The data required for
synchronization are then supplied by the local database.
The aim is, to replace numerous small single read accesses to the target system by one
large one. This can significantly increase the performance of target system synchronization
where individual accesses need a lot of time but list access can be relatively quickly
handled. This is generally the case for cloud-based target systems. Apart from that, the
cache reduces the number of queries to the target system. The cache should, therefore, be
used for target systems where the number of queries is limited through quotas.
It does not always make sense to use the cache. When synchronizing with revision
filtering, which is executed at short intervals, you can expect few accesses to the target

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 159
Additional information for experts
system. Filling the cache in this case, might cost more time than the sum of all system
accesses without caching.
TIP: Use the cache for initial and the next synchronization after that as well as
synchronization without revision filtering.
Cache is only used for synchronization.
The cache database is added in the user's 'temp' directory and deleted after the system is
disconnected. Schema type contents with sensitive data (if known) are encrypted with the
"Data Protection API" with the current user's key.
You specify whether the local is used in the target system connection settings. For more
information, see the One Identity Manager administration guides for connecting to target
systems that support local caching.

Schema browser
In addition to the schema overview, the Synchronization Editor provides a schema browser
in expert mode. The details of the connected target system's entire schema and the details
of the entire One Identity Manager schema are shown in the schema browser. Schema
types, schema properties, and the processing methods available are displayed in a
hierarchical structure. The schema can be saved as XML for error analysis.

To save a schema

1. Select Configuration | One Identity Manager connection.

- OR -
Select Configuration | Target system.
2. Open the Schema browser view.
This display the entire schema of the connected system in a hierarchical structure.
3. In the schema browser menu bar, click .
4. Enter a file name and repository.
5. Click Save.

Schema editor
A schema editor is integrated into the schema browser. It is only available in expert mode
and allows you to edit custom virtual schema properties.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 160
Additional information for experts
To open the schema editor

1. Select the Configuration | One Identity Manager connection category.

- OR -
Select the Configuration | Target system category.
2. Open the Schema browser view.
3. In the schema browser menu bar, click .

To add a custom schema property

1. Select the schema in the Schema view to which you want to add a new virtual
schema property.
2. Click Add schema property in the Action pane.
3. Select the schema property type and edit its details.
4. Click Create.
5. Click Commit to database to save the changes.

To edit a custom schema property

1. Select the schema property in the Schema view.

2. Edit the schema property details.
3. Click Apply changes.
4. Click Commit to database to save the changes.

To delete a custom schema property

1. Select the schema property in the Schema view.

2. Click Delete schema property in the Action bar.
3. Confirm the security prompt with Yes.
4. Click Commit to database to save the changes.

Detailed information about this topic

l Edit schema properties on page 76

Using custom project templates

You can make your own project templates based on existing synchronization projects. This
is particularly useful if you want to use customized mappings or synchronization workflows
in synchronization projects for other target systems. If you base a synchronization project
on a custom project template, it includes all settings of the underlying synchronization
project. To use the new project, you merely change the target system specific settings.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 161
Additional information for experts
Script language and supported scripts

A script language and the script languages, which are supported, are specified for the
project template. These properties have different functions and can therefore, have
different values.

Script Language that is used to write the project template's script.

language
Only change a project template's script language if the script needs to be
modified manually and a specific script language should be used to do this.
Supported Script languages to be used for scripts in synchronization projects created
script with this project template.
languages
l If a project template supports more than one script language, select
the script language to use when you set up the synchronization
project (only in expert mode).
l If you create a project template from an existing synchronization
project, it only supports the script language of the underlying
synchronization project.

Related topics

l Creating project templates on page 162

l Creating synchronization projects from a custom project template on page 163
l Specifying the script language in synchronization projects on page 64

Creating project templates

Project templates can be created in expert mode from existing synchronization projects.
You can use these to create new synchronization projects with the project wizard.
TIP: Before you create a project template from an existing synchronization project, apply
all available patches to the synchronization project and save the changes. For more
information, see Applying patches on page 148.

To create a project template

1. Select Edit | Create template....

2. Enter the template properties.
The values are preset with the properties of the open synchronization project.
3. Click OK.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 162
Additional information for experts
Table 80: Project template properties

Property Description

Display Name of the project template to display in the project wizard.

name

Script Language that is used to write the project template's script. Only change
language this setting if you want to manually change the script in the project template
at a later date.

Description Spare field for additional explanation.

Related topics

l Creating synchronization projects from a custom project template on page 163

Creating synchronization projects from a

custom project template
Take note of the following advice before creating a synchronization project:
NOTE: It is possible that project templates created with an older version of One Identity
Manager are not compatible with the currently installed version. Errors may occur if
these project templates are used. Recreate the project templates with the currently
installed version of One Identity Manager.
NOTE: The script language of the synchronization project you want to set up, supports the
project template script language.
Custom project templates can also be used if expert mode is not enabled.

To create a synchronization project from a custom project template

1. Create a new synchronization project with the project wizard.

a. Select the custom project template on the Select project template page.
b. On the Synchronization base object page, select the base object that is
required for the synchronization and provisioning processes.
l Base object table: Table to select the base object from, for
example ADSDomain.
l Show more: Shows tables for other target system types in the base
table menu.
l Base object: Object from the base table that forms the base object for
synchronization and provisioning processes.
l Proceed without a base object: Synchronization does not require a

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 163
Additional information for experts
 specific base object.
Set this option, if the base object is not in the One Identity Manager
database yet.
c. On the Synchronization server page, select the synchronization server to
execute synchronization.
If the synchronization server is not declared as a Job server in the One Identity
Manager database yet, you can add a new Job server.
i. Click to add a new Job server.
ii. Enter a name for the Job server and the full server name conforming to
DNS syntax.
iii. Click OK.
The synchronization server is declared as Job server for the target
system in the One Identity Manager database.
NOTE: After you save the synchronization project, ensure that this
server is set up as a synchronization server.
d. Enter the general setting for the synchronization project under General.
l Display name: Display name for the synchronization project.
l Description: Spare field for additional explanation.
e. Disable the Activate and save the new synchronization project
automatically option on the last page of the project wizard.
The synchronization project should not be activated jet because it is not
completely configured.
2. Changed the display names and description of the synchronization project if required.
3. Save the synchronization project in the database.

To configure synchronization with this synchronization project

1. Select the variables in the default variable set. Modify at least the value of variables
with connection parameters.
2. Define the synchronization scope.
3. (Optional) If the base object does not yet exist in the One Identity Manager database,
add the synchronization base object in the Manager. This might be the specific Active
Directory domain to be synchronized, for example.
l Specify the synchronization base object in the Synchronization Editor.
Select the base table for the base object you just added and the
synchronization server.
4. (Optional) In the Designer, check if the operations for provisioning and single objects
synchronization have been added. This is the case if the base object was entered
when the synchronization project was created from the custom project template.
Otherwise, define the required single object operations in the Designer.
5. Specify the extent of the synchronization log.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 164
Additional information for experts
 6. Assign a schedule to the start up configuration.
7. Run a consistency check.
8. Activate the synchronization project.
9. Save the changes.

Detailed information about this topic

l How to edit variables on page 112

l How to create base objects on page 122
l How to edit a scope on page 107
l Specifying a schedule on page 119
l Configuring the synchronization log on page 106
l Checking the consistency of the synchronization configuration on page 127
l Activating the synchronization project on page 128
l Operations for provisioning and single object synchronization on page 173

Related topics

l Creating project templates on page 162

Managing project templates

The Synchronization Editor provides an overview of all available project templates. Here
you can edit display names and descriptions of custom project templates and delete project
templates you no longer need.

To display a list of project templates

1. Select Database | Manage templates....

This menu item is only displayed in export mode.
This opens the dialog window Manage templates....
2. To hide custom project templates, disable in the dialog box toolbar.
3. To hide default project templates, disable in the dialog box toolbar.

Table 81: Project template properties

Property Description

Project Name of the project template.

template

Target Type of target system, which applies to the project template.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 165
Additional information for experts
Property Description

system

Supported Version of the target system that are supported by this project template. If
versions no value is displayed, the project template supports every version that can
be connected with the target system connector. For detailed information,
see the administration manuals for connection to the respective target
system.

Description Description of the project template.

Last Date of the last change to the project template.

change

To edit a custom project template

1. Enable in the dialog box toolbar.

2. Select the project template.
3. Edit the display name or description in the Properties pane.
4. Click Save and close.
5. Confirm the security prompt with Yes.

To delete a custom project template

1. Enable in the dialog box toolbar.

2. Select the project template.
3. Click in the dialog box toolbar.
4. Confirm the security prompt with Yes.
5. Click Save and close.
6. Confirm the security prompt with Yes.

Include custom tables in the

synchronization
Custom schema extensions can be included in the synchronization configuration. Custom
columns are automatically assigned to additional schema properties which can be included
in the mapping. The following settings must be made in order to include custom tables that
were created using the default project templates in synchronization projects.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 166
Additional information for experts
To prepare a custom table for synchronization

1. In the Manager, assign a target system type to the custom table.

l Specify whether outstanding objects can be published in post-processing.
2. In the Synchronization Editor, select a synchronization project and create a schema
class for the custom table in the One Identity Manager schema.
3. In the Synchronization Editor, define the mapping and synchronization steps for the
schema class.

For detailed information about target system types and post-processing outstanding object,
see the target system connection guides.

Integrate a custom table into provisioning processes

l In the Designer, define the provisioning operations.

Use the settings from other operations for the same target system and modify the
following properties:
l Synchronization workflow: Select the provisioning workflow.
l Table: Select the custom table.

Configuring single object synchronization for a custom table

1. In the Designer, define the operations for single object synchronization.

Use the settings from other operations for the same target system and modify the
following properties:
l Name: Read
l Synchronization workflow: Select the synchronization workflow.
l Table: Select the custom table.
2. In the Designer, assign the custom table to customizer
[Link].
3. Create a process in the Designer for the custom table.
Use the settings from another read process for the same target system and modify
the following properties.
l Replace all references to the original table with a reference to the
custom table.
Process properties:
l Table: Select the custom table.
l Event: Read
l Pre-script for generating: Pass the defined single object operation as a
parameter to script DPR_GetAdHocData.
Process step properties:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 167
Additional information for experts
 l Process task: ProjectorComponent - UpdateProjection
l Process information term: Replace the display name of the object with the
display name of the custom table.
For detailed information about setting up processes, see the One Identity Manager
Configuration Guide.
4. Record the path to the base object of synchronization for the custom table in
the Manager.
For detailed information about this, please consult the manuals for connecting
target systems.

Detailed information about this topic

l How to add schema classes on page 125

l Operations for provisioning and single object synchronization on page 173

Related topics

l Deleting objects in One Identity Manager on page 51

Validating scripts
You can apply scripts at various points in the synchronization project; for example, when
defining the schema properties, in the object filter, or when you define data operations for
system connections through the native database connector. You can enter scripts in C# or
Visual Basic .NET depending on script's language, which was specified for the
synchronization project.
You can use the available compiling and debugging functions to troubleshoot script.

Table 82: Edit box buttons

Button Description

Opens advanced edit mode.

Checks the script's syntax.

Compile Script was compiled without errors.
Script contains syntax errors.

Export the current script to a Visual Studio project.

Debug This button is only available in "Edit schema properties” dialog window and in
the system connection wizard for the native database connector.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 168
Additional information for experts
Compile

To verify the script's syntax

1. Open the script in the Synchronization Editor.

2. Click Compile.

Compiler errors are shown immediately and written to in the Synchronization

Editor's error log.

Debug

The script is exported to a Visual Studio project for debugging. Once the project is run, the
Synchronization Editor starts in debug mode and the script is tested.

Prerequisites

l Visual Studio is installed on the workstation on which the Synchronization

Editor is running.
l All changes to the synchronization project are saved.
l The debugger can be used in scripts that are used in:
l Schema properties
l Script variables
l Data operations for system connections using the native database connector

To debug a script

1. Open the script in the Synchronization Editor.

2. Click Debug.
3. Confirm the prompt with OK.
4. Start debugging in the Visual Studio project.
5. If necessary, correct the script in the Synchronization Editor's default mode.
6. Save the changes.

Related topics

l Support for scripting on page 21

l Error log on page 189

Starting synchronization
You can also start synchronization manually by either running it on your workstation or
from the synchronization server. If you run synchronization from your workstation, you

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 169
Additional information for experts
cannot work with the Synchronization Editor until synchronization is complete. To be able
to continue working with the Synchronization Editor during synchronization, run
synchronization from the synchronization server.

To start synchronization manually

1. Open the synchronization project in the Synchronization Editor.

2. Select the Configuration | Start up configurations category.
3. Select a start up configuration in the document view and click Execute.
4. Confirm the security prompt with Yes.

Defining downstream processes

Certain actions must be executed in the One Identity Manager database after
synchronization has finished. For this, you can define additional processes in the tables,
which return base objects. These additional processes are executed through the "PostSync"
event, which is triggered in the process DPR_DPRProjectionStartInfo_Run_Synchronization.

To create a downstream process for synchronization

1. In the Designer, select the Process Orchestration category.

2. Start Process Editor using the Create a new process task.
This makes a new element for the process and opens it in the Process Editor.

3. Edit at least the following process properties.

Table: Table that returns the base object for the synchronization, for example
ADSDomain.

Event: PostSync

4. Create the required process steps.

For more information, see the One Identity Manager Configuration Guide.
5. Save the changes.

Examples

l To automatically assign employees to Active Directory user accounts, the table

ADSDomain contains the process ADS_ADSDomain_SearchAndCreate_FullSync. The process
is triggered by the event "PostSync".
l If group memberships cannot be resolved when an Active Directory domain is
synchronized, the One Identity Manager finds the Active Directory SIDs of the user
accounts. For this, there is the process ADS_ADSDomain_PostSync set on the table
ADSDomain. The process is triggered by the event "PostSync".

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 170
Additional information for experts
Processing synchronization steps
When a synchronization step is processed in a process plan, synchronization objects are
determined and processed as follows:

1. Load slim list of objects to be synchronized

Objects to be synchronized are loaded according to the object matching rules from
the target system and the One Identity Manager database. Only key properties, the
revision property (if exists) and individually specified schema properties in the
system connector are loaded in this case.
TIP: For systems whose schema type only have a few schema properties, this list
can already be loaded with all schema properties. This can speed up
synchronization.
You can configure the appropriate behavior in the start up configuration when in
expert mode. Modify the reload threshold to do this For more information, see
Extended properties for start up configuration on page 158.
2. Use revision filter
Modified object pairs are filtered, if revision filtering is permitted and the target
system supports revision filtering The revision filter is applied to the slim list, which
means objects that are already loaded. Therefore, objects that only exist in one of
the connected systems are also processed.
3. Load lists of object pairs with all schema properties
One Identity Manager loads list of object and object pairs to be synchronized with all
mapped schema properties. The lists are loaded in partitions with a fixed size. Once
a partition (for example 1000 object pairs) has been loaded, they are processed
asynchronously and at the same time the next partition is being loaded. Therefore, a
maximum of two partitions are located in main memory at any time.
TIP: In expert mode, you can define the partition size in the start configuration. For
more information, see Extended properties for start up configuration on page 158.
4. Use mapping
The moment a partition (for example, 1000 list pairs) have been loaded, the mapping
is used for all objects and object pairs. Processing methods are subsequently
executed according to the given condition.

Detailed information about this topic

l How does revision filtering work? on page 38

l Start up configuration properties on page 116
l Editing property mapping rules on page 78
l Specifying processing methods on page 95

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 171
Additional information for experts
Exporting a synchronization
configuration
Synchronization projects created for a test database, for example, can be transported to a
live database. You use the Database Transporter to do this. To use the synchronization
project in the target database, check the connection credentials and change the synchron-
ization configuration to match the target database’s requirements.

Prerequisite

l The schema of both One Identity Manager databases are identical. Customized
schema extensions used in the mapping exist in both databases.

To transport a synchronization project to another One Identity Manager

database

1. Create a transport package for the synchronization project using the Database
Transporter.
a. Set the Transport synchronization projects option.
b. To select the synchronization project, click Select.
l Enable the synchronization project in the tree view and click OK. Multi-
select is possible.
c. Click Next.
This exports the data.
NOTE: The transport package does not contain a root object, scheduled process
plans, or assignments of schedules to start up configurations.
2. Import the transport package into the target database with the Database
Transporter.
On the Import configuration page, configure the import.
a. If there is a synchronization project in the target database already, configure
here, which changes are imported into the target database.
l Do not change the start up configuration settings: Specifies
whether start up configurations, variables, and variable sets are
imported.
Set this option so that changes to these objects are not overwritten in the
target database. If this option is not set, changes made to these objects
in the target database are overwritten by the transport package.
l Details: Shows an overview of all the objects with their change status.
Click Details to show the overview.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 172
Additional information for experts
 To show details of the modification, expand the respective node in the
Objects column. To exclude certain object changes from the import
package, disable the object.
b. Click Next.
Then the transport package data is imported.
After importing is complete, the database is compiled.
3. Modify the synchronization project in the target database.
a. Modify the One Identity Manager database connection data and update
the schema.
b. Check the target system connection data and the variable set.
c. Configure the base object.
d. Assign a schedule to the start up configuration.
e. Configure the synchronization log.
f. Make any other necessary changes to the settings.
g. Run a consistency check.
h. Activate the synchronization project.

For more information about creating and importing transport packages, see the One
Identity Manager Operational Guide.

Detailed information about this topic

l How to edit system connection properties on page 103

l How to create base objects on page 122
l Specifying a schedule on page 119
l Configuring the synchronization log on page 106
l Checking the consistency of the synchronization configuration on page 127
l Activating the synchronization project on page 128

Operations for provisioning and single

object synchronization
In order to provision object modifications and perform single object synchronization, you
must specify which synchronization workflow should be used for this task. When setting up
the synchronization using the default project templates, the required single object
operations will be created. If you create your own provisioning processes or would like to
include custom tables in the provisioning or single object synchronization, then you need to
define your own single object operations.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 173
Additional information for experts
To define single object operations

1. Select the Process Orchestration | Provisioning process operations category

in the Designer.
2. Select the menu item Object | New.
3. Edit the operation properties.
4. Save the changes.
5. Use this operation in the pre-script to generate the provisioning process or process
for single object synchronization as a parameter for script DPR_GetAdHocData.

Table 83: Single object operations

Property Description

Name Name of the operation.

Synchronization Workflow that is to be used for provisioning or single object synchron-

workflow ization.

System connec- Target system connection of the target system to be used.

tion

Table Table for which the operation has been defined. Provisioning or single
object synchronization can only be run for the objects in this table.

Display name Operation display name in the One Identity Manager tools' user
interface.

Description Spare field for additional explanation.

Processing Only used internally by One Identity Manager.

status

Load balancing during provisioning and

single object synchronization
You can accelerate provisioning and single object synchronization by distributing processes
over several Job servers. To do this, you use the base objects to specify, which Job servers
will handle the objects in parallel.
Load balancing can be implemented to manage spikes in data traffic, for example, when
a college semester begins, numerous accounts must be added and provisioned in the
target system.
If a property of a user account is changed after restructuring in the target system, you can
use single object synchronization to select all the affected user accounts and load the
changed property into the One Identity Manager database.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 174
Additional information for experts
There are specific Job servers configured for cases like this. For each base object, a server
function is defined and assigned to the Job server. All Job servers with this attribute run
provisioning and single object synchronization processes in parallel.
NOTE: You should not implement load balancing for provisioning or single object
synchronization on a permanent basis. Parallel processing of objects might result in
dependencies not being resolved because referenced objects from another Job server
have not been completely processed.
Once load balancing is not longer required, ensure that the synchronization server
executes the provisioning processes and single object synchronization.

To configure load balancing for a target system

1. Configure the servers and declare them as Job servers in One Identity Manager.
l Assign the standard server function of the respective target system to these
Job servers.
All Job servers must be able to access the same target system as the
synchronization server for the respective base object. For detailed information
about setting up the synchronization server, see the administration guides for
connecting to target systems.
2. Use the Synchronization Editor to create a server function for the target system's
base object.
a. On the base object's master data form, click next to the Service
function field.
b. Enter a name for the server function.
c. Enable all the Job servers to which the server function will be assigned.
Only enable the Job servers that can access the same target system as the
base object's synchronization server.
d. Click OK.

To use the synchronization server without load balancing.

l In the Synchronization Editor, remove the server function from the base object.

Restrictions

Load balancing is only used if the number of maximum instances for the executed process
task or process component is set to 0 or >1.
If the maximum number of instances on the process function or process component is set
to 1 or -1, load balancing cannot take place. This affects processes, which use the following
process tasks:
l AdHocProjectionSingle
l AdHocProjectionSinglex86
l UpdateProjectionSingle
l UpdateProjectionSinglex86

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 175
Additional information for experts
These process tasks are used, for example, by different provisioning processes for the IBM
Notes and G Suite target system types.
For more information about these process tasks, see the One Identity Manager
Configuration Guide.

Detailed information about this topic

l How to edit base objects on page 124

l Properties of base objects on page 124

Automatically create and update

synchronization projects
You can create synchronization projects automatically. This can be particularly useful if you
want to set up synchronization projects for different Active Directory domains, which
require the same configuration. A new synchronization project is generated from the
command line or with a Windows PowerShell CmdLet using the configuration of a reference
project. The reference project's configuration is supplied in a configuration file. which you
can modify. You can define variable settings, like the target system to connect or
password, in parameters, which are used passed values when the command is called.
Existing synchronization projects for which patches are available can be updated in the
same way. A configuration file is made available using a reference project that contains a
list of all the patches that are to be applied. Only patches that do not require any user input
can be applied.

To set up automatic creation of synchronization projects:

1. Enable expert mode in the Synchronization Editor.

2. Create the reference project using the project wizard.
a. Create a new synchronization project.
b. Click Save configuration on the last page of the project wizard.
c. Select a repository for the configuration file and give it a name.
The file is saved as a Synchronization Editor workspace file with the
extension sews.
d. End the project wizard.
3. Customize the synchronization configuration in the configuration file.
l Check the saved settings and adjust the values.
l Create the parameters for changeable settings.
4. To create synchronization projects with this configuration

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 176
Additional information for experts
 l Open up the Synchronization Editor Command Line Interface.
- OR -
l Load the Synchronization Editor Module for Windows PowerShell.
5. To automatically create synchronization projects, use scripts which execute the
Synchronization Editor Command Line Interface or the Synchronization Editor Module
for Windows PowerShell.

To set up automatic updating of synchronization projects:

1. Enable expert mode in the Synchronization Editor.

2. Create the configuration file.
a. Open the reference project.
b. Select Edit | Update synchronization project from the menu.
c. Optional: Select the patches to be applied under Available patches. Select at
least one patch or milestone. Multi-select is possible.
d. Click Save configuration.
e. Select a repository for the configuration file and give it a name.
The file is saved as a Synchronization Editor workspace file with the
extension sews.
3. Customize the synchronization configuration in the configuration file.
l Check the saved settings and adjust the values.
l Create the parameters for changeable settings.
4. To update synchronization projects with this configuration:
l Open up the Synchronization Editor Command Line Interface.
- OR -
l Load the Synchronization Editor Module for Windows PowerShell.
5. To automatically update synchronization projects, use scripts which execute the
Synchronization Editor Command Line Interface or the Synchronization Editor Module
for Windows PowerShell.

TIP: A configuration file created for setting up new synchronization projects can also be
used for updating synchronization projects. Add the necessary editor and parameters to
the configuration file.

Detailed information about this topic

l How to create a synchronization project on page 62

l Customizing the configuration file on page 178
l Synchronization Editor Command Line Interface on page 183
l Synchronization Editor Module for Windows PowerShell on page 186
l Configuration file examples on page 194

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 177
Additional information for experts
Customizing the configuration file
All data required for creating or updating a synchronization project is saved in XML format.
The file is divided into three main sections:

l Parameter definitions
For more information, see Parameter definitions on page 180.
l Global definitions
For more information, see Global definitions on page 181.
l Editor Definitions
For more information, see Defining the editor for new synchronization projects on
page 181 or Defining the editor for existing synchronization projects on page 182.

Structure of the configuration file

<?xml version="1.0" encoding="utf-8"?>
<SynchronizationEditorWorkspace Version="1.0">
<Parameters>
...
</Parameters>
<Global>
...
</Global>
<Editors>
...
</Editors>
</SynchronizationEditorWorkspace>
Customize the settings to create or update a new synchronization project based on this
configuration file. Use parameters for all variable values if different synchronization
projects are going to be created or updated with this configuration file.

To Customize the configuration file

1. Decide on the variable values.

2. Define parameters for each of these values.
3. Replace the values with parameters.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 178
Additional information for experts
Example

Synchronization projects should be created for various Active Directory domains in

different One Identity Manager databases on one and the same database server. A
synchronization project has been created with the project wizard for one of these
domains. This reference project's configuration file must be adjusted such that it can
be used for all the other domains.
The following settings must be customized:

l Define parameters for the One Identity Manager database, database user,
system user and its password.
l Define parameter for the domain name, domain controller Active Directory
user and its password.
l Define a parameter for the synchronization project, if more than one
synchronization projects is going to added to one database.
l Replace the respective values in the global and editor sections with these
parameters.
IMPORTANT: The connection data for the One Identity Manager database in
the global definitions ([Link]) and in the editor defin-
itions ([Link]) must be identical. If you replace
these value with parameters, use the same parameter in each case.
The following table shows the required adjustments in the configuration file
based on a reference project from a SQL Server database. For detailed
information about the connection data for a SQL Server database, see the One
Identity Manager Installation Guide. For detailed information about One
Identity Manager authentication modules, see the One Identity Manager
Authorization and Authentication Guide.
Customizations to the configuration file for new synchronization projects:
l [Link]
data source=<database server>;initial catalog=<database>;
user id=<user>;pooling=False;Password=$DBPassword$
Replace <database> and <user> with parameters, such as $Database$
and $DBUser$.
l [Link]
Module=<authentication module>;User[VI.DB_USER]=<system user>;
(Password)Password[VI.DB_Password]=<password>
Replace <system user> and <password> with parameters, such as
$SystemUser$ and $SystemPassword$.
l [Link]

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 179
Additional information for experts
 Authentication=ProjectorAuthenticator;
data source=<database server>;DBFactory="[Link], [Link]";
initial catalog=<database>;password="<DBPassword>";pooling=False;
user id=<Nutzer>
Replace <system user> and <password> with parameters, such as
$SystemUser$ and $SystemPassword$.
l [Link]
ADAuthentication=<authentication type>;
ADEnableras=<Remote Access Service>;
ADEnablerecyclebin=<Active Directory recycle bin>;
ADEnableterminal=<terminal service>;
ADPort=<Port>;ADRootdn="<distinguished domain name>";
ADServer=<domain controller>;
ADTypeEnableExtensions=<type classes allowed>;
ADTypeExtensions=<type class definition>;
baseloginaccount=<Active Directory user>;
basepassword="<Active Directory password>"
Replace <distinguished domain name>, <domain controller>, <Active
Directory user> and <Active Directory password> with parameters.
l ShellDisplay
<synchronization project display name>
Replace the <synchronization project display name> with a parameter if
more than one synchronization projects are added to a database.

For more information, see Configuration file for creating new synchronization
projects on page 194.

Parameter definitions
First, define all the parameters for variable settings. You can use these parameters in the
global and editor definitions.

Table 84: Parameter definition

Attribute Description

Parameter name Name of the parameter.

Display Display name of the parameter.
IsQueryParameter Specifies whether the parameter's value is given by the user.

l False: the parameter value is pass on the command line.

l True: the parameter value is queried after the command is

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 180
Additional information for experts
Attribute Description

executed. The user must enter a value. This setting can be

used to input a password, for example.
IsSecret Specifies whether the parameter value is displayed or not.

l False: The parameter value is displayed when the user enters

it.
l True: the parameter is masked when the user enters it.
Example value Default value used if no value is entered on the command line or by
user input. If no default value is defined, a value must be passed on
the command line or entered by the user.

Global definitions
The global definitions contain the information required for logging into the One Identity
Manager database where the changes are to be made.

Table 85: Global definitions

Elements Description

[Link] Database server connection parameter.

Modify these settings or define a parameter if
adding new synchronization projects to a different
database.
[Link] Login data for the One Identity Manager database.
Modify these settings or define a parameter if
adding new synchronization projects to a different
database.
[Link] Supported database system. Only SQL Server is
supported at present ([Link], [Link]).
[Link] Unique ID of the synchronization project to be
loaded. Only required when making changes to
existing synchronization projects.

Defining the editor for new synchronization

projects
To create new synchronization projects,use the ShellWizard editor. The definition part of
this editor contains the following information:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 181
Additional information for experts
Table 86: ShellWizard editor definitions

Elements Description

TemplateUid Unique project template ID to be used.

This element does not exist if the reference project was
created without a project template.
ConnectedSystemIdentity Schema information, such as type, version, and schema
ID of the connected system.
ScriptLanguage Script language used in the synchronization project.
ShellDisplay Synchronization project display name.
ShellDescription Description of the synchronization project.
AutoCompletion Specifies whether the synchronization project is activated
immediately.
MainConnection The connection data for the One Identity Manager
database to be synchronized in this synchronization
project.
ConnectedSystemConnection Connection data for the target system to be synchronized
with this synchronization project.
TemplateConfiguration Additional settings that were made in the project wizard.
For example:

l Provisioning data
l Enabled revision filter
l Setting for the synchronization log
l Selected synchronization server

This element does not exist if the reference project was

created without a project template.

Defining the editor for existing synchronization

projects
To apply patches to existing synchronization projects, use the ShellPatchEditor. The
definition part of this editor contains the following information:

Table 87: ShellPatchEditor editor definitions

Elements Description

PatchesToApply Comma-separated list of patch numbers for all patches that are to be
applied.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 182
Additional information for experts
Elements Description

Only patches that do not require any user input can be applied.
Keywords can be specified in order to apply all available patches.

l AllFixes: Applies all patches for resoled issues.

l AllFeatures: Applies all patches for new features.

Example: <Data Name="PatchesToApply" Display="Patches to apply"

Type="[Link], mscorlib">AllFixes,AllFeatures</Data>
All dependent milestones will also be applied.

Synchronization Editor Command Line

Interface
Once you have created a configuration file and have customized it accordingly, you can
generate new synchronization projects or update existing synchronization projects with the
Synchronization Editor Command Line Interface. You can also opt to use the
Synchronization Editor Module for Windows PowerShell to do this. For more information,
see Synchronization Editor Module for Windows PowerShell on page 186.

To create synchronization projects with the Synchronization Editor Command

Line Interface

1. Start a command line editor.

2. Switch to the One Identity Manager installation directory.
3. Execute the Synchronization Editor Command Line Interface with the -V option and
set the parameter values.
[Link] --CreateShell {<Options>} <configuration file>
{<Parameter>}
NOTE: If the value of a parameter contains a space or special character, it must be
enclosed in quotes.
Example: [Link] --CreateShell -V
/Workspace=D:\[Link] /SetParam SyncProject="Synchronization
project for Active Directory domain XYZ"
4. Enter values for the parameters requiring user input.
l To enter an empty value, press ENTER.
l To transfer the default value defined in the configuration file, click Esc.
5. If no error occur, execute steps 3 and 4 with the -S option.
If the synchronization project was created with a project template, the schemas are
shrunk when saved.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 183
Additional information for experts
To update synchronization projects with the Synchronization Editor Command
Line Interface

1. Start a command line editor.

2. Switch to the One Identity Manager installation directory.
3. Execute the Synchronization Editor Command Line Interface with the -V option and
set the parameter values.
[Link] --PatchShell {<options>} <configuration file>
{<parameter>}
NOTE: If the value of a parameter contains a space or special character, it must be
enclosed in quotes.
Example: [Link] --PatchShell -V
/Workspace=D:\[Link] /SetParam SyncProject="CCC-
99D111DD1CF11111BCF11111E1111BE9" /SetParam Patches=AllFixes,Milestone_OneIM_
8.0.2017.1104,VPR#12345,VPR#23456,VPR#34567
l If the target system is accessed when the patch is applied and the connection
parameters in the default variable set contain encrypted values, you will be
prompted to enter the decrypted values. The names of the required
parameters are displayed.
TIP: Use these parameter names to add a parameter in the configuration file
for each encrypted connection parameter. This allows values for the
encrypted connection parameters to be passed to the Synchronization Editor
Command Line Interface when it is called.
The parameter names must conform to the following naming convention:
Decryption_DefaultVariableSet_<variable name>.
Example of a parameter definition: <Parameter Name="Decryption_
DefaultVariableSet_Password" Display="Password of target system user"
IsQueryParameter="False"</Parameter>
Example of a command line call: [Link] --
PatchShell -V /Workspace=D:\[Link] /SetParam
SyncProject="CCC-99D111DD1CF11111BCF11111E1111BE9" /SetParam
Patches=AllFixes /SetParam Decryption_DefaultVariableSet_Password="A123-
z987"
4. Enter values for the parameters requiring user input.
l To enter an empty value, press ENTER.
l To transfer the default value defined in the configuration file, click Esc.
5. If no error occur, execute steps 3 and 4 with the -S option.
If the synchronization project was created with a project template, the schemas are
shrunk when saved.

TIP: Run the [Link] without additional input to view help for the
Synchronization Editor Command Line Interface.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 184
Additional information for experts
Table 88: Synchronization Editor Command Line Interface commands

Command Description

--CreateShell Creates a new synchronization project using the data from the defined
workspace.
Short form: --CS

--PatchShell Applies patches to an existing synchronization project.

Short form: --PS

Table 89: Synchronization Editor Command Line Interface options

Option Description

-?|H Displays help.

-Q No alert before running irreversible actions.
-V The Synchronization Editor Command Line Interface is run in verbose mode.
Use this option for debugging.
-S Saves the new synchronization project in the database. If this option is not
given, creating the synchronization project is simulated.
-N Defines whether the Synchronization Editor Command Line Interface opens in
non-interactive mode. This may cause requests for parameter input to fail.
Missing encrypted values are also queried in non-interactive mode.

Table 90: Parameter declaration

Parameters Description

/Workspace Full or relative path of the configuration file.

/SetParam Sets the value of the parameter defined in the configuration file.
Overwrites default values.
Format: Parameter name=value
Pay attention to the upper and lower case characters in the parameter
name.
If a value contains a space or special character, it must be enclosed in
quotes. Multiple parameters are declared individually: /SetParam
ParamName1=Value1 /SetParam ParamName2=Value2

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 185
Additional information for experts
Synchronization Editor Module for Windows
PowerShell
Once you have created a configuration file and have customized it accordingly, you can
generate new synchronization projects or update existing synchronization projects with the
Synchronization Editor Module for Windows PowerShell. You can also opt to use the
Synchronization Editor Command Line Interface to do this. For more information, see
Synchronization Editor Command Line Interface on page 183.

To create synchronization projects with the Synchronization Editor Module for

Windows PowerShell

1. Start Windows PowerShell.

2. Switch to the One Identity Manager installation directory.
3. Load the Synchronization Editor Module for Windows PowerShell.
Import-Module .\[Link]
4. Run the New-ProjectorShell CmdLet and set the value for the parameter.
New-ProjectorShell -Workspace <configuration file> {option} {parameter}
Example: New-ProjectorShell -Workspace D:\[Link] -
WorkspaceParameter @{SyncProject="Synchronization Project for Active Directory
Domain XYZ"}
NOTE: Mandatory parameter are queried one at a time if you execute the CmdLet
without additional input.
5. Enter values for the parameters requiring user input.
l To enter an empty value, press ENTER.
6. If no error occur, execute steps 3 and 4 with the -SaveToDatabase option.
If the synchronization project was created with a project template, the schemas are
shrunk when saved.

To update synchronization projects with the Synchronization Editor Module for

Windows PowerShell

1. Start Windows PowerShell.

2. Switch to the One Identity Manager installation directory.
3. Load the Synchronization Editor Module for Windows PowerShell.
Import-Module .\[Link]
4. Run the Update-ProjectorShell CmdLet and set the value for the parameter.
Update-ProjectorShell -Workspace <configuration_file> {option} {parameters}
Example: Update-ProjectorShell -Workspace D:\[Link] -
WorkspaceParameter @{SyncProject="CCC-

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 186
Additional information for experts
 99D111DD1CF11111BCF11111E1111BE9";Patches="AllFixes,Milestone_OneIM_
8.0.2017.1104,VPR#12345,VPR#23456,VPR#34567"}
NOTE: Mandatory parameter are queried one at a time if you execute the CmdLet
without additional input.
l If the target system is accessed when the patch is applied and the connection
parameters in the default variable set contain encrypted values, you will be
prompted to enter the decrypted values. The names of the required
parameters are displayed.
TIP: Use these parameter names to add a parameter in the config-
uration file for each encrypted connection parameter. This allows values
for the encrypted connection parameters to be passed to the CmdLet
when it is called.
The parameter names must conform to the following naming convention:
Decryption_DefaultVariableSet_<variable name>.
Example of a parameter definition: <Parameter Name="Decryption_
DefaultVariableSet_Password" Display="Password of target system user"
IsQueryParameter="False"</Parameter>
Example of a command line call: Update-ProjectorShell -Workspace
D:\[Link] -WorkspaceParameter @{SyncProject="CCC-
99D111DD1CF11111BCF11111E1111BE9";Patches="AllFixes";Decryption_
DefaultVariableSet_Password="A123-z987"}
5. Enter values for the parameters requiring user input.
l To enter an empty value, press ENTER.
6. If no error occur, execute steps 3 and 4 with the -SaveToDatabase option.
If the synchronization project was created with a project template, the schemas are
shrunk when saved.

Table 91: Synchronization Editor Module for Windows PowerShell CmdLets

CmdLet Description

New-ProjectorShell Creates a new synchronization project using the data from the
defined workspace.

Update-ProjectorShell Applies patches to an existing synchronization project.

Table 92: Options

Option Description

-? Displays help.
-Workspace Full or relative path of the configuration file.
-SaveToDatabase Saves the new synchronization project in the database. If this
option is not given, creating the synchronization project is
simulated.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 187
Additional information for experts
Option Description

-WorkspaceParameter Sets the value of the parameter defined in the configuration

file. Overwrites default values.
Format: @{Parameter name="value"}
Multiple parameters are separated with semicolons: -
WorkspaceParameter @
{ParamName1="Value1";ParamName2="Value2"}

Maintaining the data store

You set the maintenance mode in the start up configuration. Depending on the mode,
maintenance of the data store is done after each synchronization whereby One Identity
Manager attempts to clean up unresolved references. The contents of the data store can
also be displayed in the Synchronization Editor and you can start maintenance manually.
In this case, you decide if you want to run maintenance directly on the workstation that
the Synchronization Editor was started on, or if it should be run by the One Identity
Manager Service.
If the One Identity Manager connection is in expert mode, you also see the Data
store view.

To display the contents of the data store

1. Select the Configuration | One Identity Manager connection category.

2. Open the Data store view.
In the overview pane you can see the data store contents.

To start maintenance manually

1. In the Data store view, click Perform maintenance.

2. To allow maintenance to be run by the One Identity Manager Service, click Yes.
- OR -
To run maintenance on the current workstation, click No.

Related topics

l Unresolvable references on page 42

l Maintenance modes on page 119

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 188
Additional information for experts
Troubleshooting
One Identity Manager offers different options for logging errors. These logs help you to
analyze synchronization errors. These include:

l Synchronization logs
For more information, see How to display synchronization logs on page 140.
l One Identity Manager Service log files on the synchronization server
l synchronization analysis report
For more information, see Help for the analysis of synchronization issues on
page 144.
l Error log
For more information, see Error log on page 189.
l Messages logged with NLog
Configure the required security level in the [Link] file.

For detailed information and help on troubleshooting in One Identity Manager and
configuring log files, see the One Identity Manager Process Monitoring and
Troubleshooting Guide.

Error log
In expert mode, you can show the error log. In the error log, you can view all the errors
that have occurred since the program started up. The error log is reinitialized when the
Synchronization Editor restarts.

To display items from error log

l Enable expert mode.

By default, the error log is displayed in the lower section of the
Synchronization Editor.

For detailed information about functions in the error log, see the One Identity Manager
Process Monitoring and Troubleshooting Guide.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 189
Additional information for experts
 11

Resolving errors when connecting

target systems

Incorrect mapping of object hierarchy

after synchronization
If objects, which map a hierarchy, are synchronized the following errors can occur:

l Objects are mapped to the wrong position in the hierarchy.

l Objects are not loaded.

Probable reason

The parent objects could not be referenced. If the parent object is a mandatory property,
the child objects cannot be saved.
By default, objects are processed in blocks of 1024 each during synchronization. Objects
are loaded in random order. Therefore, a child object might be processed before its parent
object has been loaded. Thus the parent object cannot be assigned.

Example: Importing cost center with the CSV connector

Cost centers make up an object hierarchy. The respective parent object is assigned
through the UID_ParentProfitCenter column. The complete hierarchy path is kept in the
FullPath column.
During synchronization, a cost center might be loaded before its parent cost center.
Therefore, the parent cost center cannot be referenced. Because the parent cost center is
not a mandatory property, the object is loaded but appears at a strange place in the
hierarchy. A different full name is formatted in the database as given in the CSV file. If the
full name is the only matching criteria for identifying the object the objects cannot be
assigned uniquely.

Solution

NOTE:

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 190
Resolving errors when connecting target systems
 l The solution approach only applies for resolving references of the same
object type.
l Synchronization can get slower if the amount of data is large.
l The solution described is one way to prevent the error. There may be other
solutions depending on the actual data situation.

To prevent the error

l Label the column containing the hierarchy path as the sort criteria in the target
system schema and set the partition size to "1".
The objects are sorted by hierarchy path during synchronization and loaded one by
one in the database in this order. This ensures that the parent object is already
loaded and can be referenced.
l Ensure manual dependency resolution is set in the synchronization workflow.
This can be necessary in certain situations, for example, when synchronizing cost
centers. In this case, the full name is the only matching criteria. In the One Identity
Manager database this is put together from the cost center name (AccountNumber
column) and the full name of the parent object. In the case of automated dependency
resolution, the parent objects are not assigned until the second synchronization step.
Therefore, no parent objects are assigned after the first synchronization step. The
full name is only formatted from the cost center name. All child objects therefore,
have another full name in the database as in the target system. In the second
synchronization step, there objects can no longer be identified. Thus parent objects
cannot be assigned by it.
In the case of manual dependency resolution, all property mapping rules are
executed in one synchronization step. The parent object assigned immediately. This
way, the template finds the correct full names.

To mark a column as sort criterion

1. Edit the target system schema in the Synchronization Editor.

a. Select the Configuration | Target system category.
b. Click Edit connection.
This starts the system connection wizard.
2. Select the page where you can edit the Hierarchical sort order option.
NOTE: The system connection wizards of the various target systems display
different pages. For example, in the system connection wizard for CSV systems,
select the Display information page.
3. Select the column containing the hierarchy path.
4. Enable the Hierarchical sort order option.
5. Save the changes.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 191
Resolving errors when connecting target systems
To adjust the partition size

1. Enable expert mode in the Synchronization Editor.

a. Select the Database | Settings... menu.
b. Enable Enable expert mode.
c. Click OK.
2. Edit the start up configuration properties.
a. Select the Configuration | Start up configurations category.
b. Select the start up configuration in the document view and click Edit....
3. Select the Advanced tab.
4. Enter the value "1" in Partition size.
For detailed information about start up configuration advanced properties, see the
One Identity Manager Target System Synchronization Reference Guide.
5. Click OK.
6. Disable expert mode

To set manual dependency resolution

1. Edit the workflow properties.

a. Select the Workflows category.
b. Select the workflow in the navigation view.
c. Select the General view in the Workflow Editor and click Edit.
2. Select the value "Manual" in the Dependency resolution field.
3. Click OK.
4. Save the changes.
5. Activate the synchronization project.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 192
Resolving errors when connecting target systems
 Appendix A

Appendix : Configuration parameters for target

system synchronization

The following configuration parameters are additionally available in One Identity Manager
after the module has been installed.

Table 93: Configuration parameters for target system synchronization

Configuration Meaning if Set

parameters

DPR General configuration parameter for target system

synchronization.

DPR | Journal General parameter for configuring the synchronization log.

DPR | Journal | LifeTime This configuration parameter specifies the synchronization

log's retention period (in days). Older logs are deleted from the
database.

DPR | StartSequence General parameter for configuring synchronization start up

sequences.

DPR | StartSequence | Configuration parameter for specifying the retention period (in
LifeTime days) for completed synchronization start up sequences. Older
entries are deleted from the database.

DPR | UI Synchronization Editor user interface configuration.

DPR | UI | The configuration parameter defines the Synchronization Editor

EncryptedValueHandling behavior when handling encrypted values.

l ByUser: Shows encryption dialog when the

synchronization project opens.
l IgnoreAll: Does not show encryption dialog when the
synchronization project opens. All encrypted values are
ignored by default. (default)

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 193
Appendix: Configuration parameters for target system synchronization
 Appendix B

Appendix : Configuration file examples

The following examples demonstrate the modifications required in the configuration files in
order to automatically create or update synchronization projects.

Detailed information about this topic

l Configuration file for creating new synchronization projects on page 194

l Configuration file for updating existing synchronization projects on page 196
l Automatically create and update synchronization projects on page 176

Configuration file for creating new

synchronization projects
The following extract from a configuration file contains the changes required for the
example in section Customizing the configuration file on page 178.
<?xml version="1.0" encoding="utf-8"?>
<SynchronizationEditorWorkspace Version="1.0">
<Parameters>
<Parameter Name="Database" Display="Connected database"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="DBUser" Display="Database server user"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="DBPassword" Display="Database server password"
IsQueryParameter="true" IsSecret="true"></Parameter>
<Parameter Name="SystemUser" Display="One Identity Manager system user"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="SystemPassword" Display="Password of system user"
IsQueryParameter="true" IsSecret="true"></Parameter>

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 194
Appendix: Configuration file examples
 <Parameter Name="Domain" Display="Distinguished name of the domain"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="DomainController" Display="Distinguished name of the
domain controller" IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="ADUser" Display="Active Directory user"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="ADUserPassword" Display="Password of Active Directory
user" IsQueryParameter="true" IsSecret="true"></Parameter>
<Parameter Name="SyncProject" Display="Synchronization Project"
IsQueryParameter="false" IsSecret="false"></Parameter>
</Parameters>
<Global>
<Data Name="[Link]" Display="Connection string"
Type="[Link], mscorlib">data source=Datenbankserver;initial
catalog=$Database$;user
id=$DBUser$;pooling=false;Password=$DBPassword$</Data>
<Data Name="[Link]" Display="Authentication
string" Type="[Link],
mscorlib">Module=Authentifizierungsverfahren;User[VI.DB_USER]=$SystemUser$;
(Password)Password[VI.DB_Password]=$SystemPassword$</Data>
<!-- … -->
</Global>
<Editors>
<Editor Name="ShellWizard" Type="[Link],
[Link]">
<!-- … -->
<Data Name="ShellDisplay" Display="Script display name"
Type="[Link] mscorlib">$SyncProject$</Data>
<!-- … -->
<Data Name="[Link]" Display="Connection
parameter" Type="[Link],
mscorlib">Authentication=ProjectorAuthenticator;data
source=databaseserver; DBFactory="[Link], [Link]";initial
catalog=$Database$;password=$DBPassword$; pooling=False;user
id=$DBUser$</Data>
<!-- … -->
<Data Name="[Link]"
Display="Connection parameter" Type="[Link],
mscorlib">ADAuthentication=1;ADEnableras=False;ADEnablerecyclebin=Fals
e;
ADEnableterminal=True;ADPort=389;ADRootdn=$Domain$;ADServer=$DomainCon
troller$;

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 195
Appendix: Configuration file examples
 ADTypeEnableExtensions=True;ADTypeExtensions=;baseloginaccount=$ADUser
$; basepassword=$ADUserPassword$</Data>
<!-- … -->
</Editor>
</Editors>
</SynchronizationEditorWorkspace>

Configuration file for updating existing

synchronization projects
The following except from a configuration file contains the changes required for
applying patches.
<?xml version="1.0" encoding="utf-8"?>
<SynchronizationEditorWorkspace Version="1.0">
<Parameters>
<Parameter Name="Database" Display="Connected database"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="DBUser" Display="Database server user"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="DBPassword" Display="Database server password"
IsQueryParameter="true" IsSecret="true"></Parameter>
<Parameter Name="SystemUser" Display="One Identity Manager system user"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="SystemPassword" Display="Password of system user"
IsQueryParameter="true" IsSecret="true"></Parameter>
<Parameter Name="SyncProject" Display="Synchronization Project"
IsQueryParameter="false" IsSecret="false"></Parameter>
<Parameter Name="Patches" Display="Comma separated list of patches to
apply" IsQueryParameter="True"></Parameter>
<Parameter Name="Decryption_DefaultVariableSet_Password" Display="Password
of target system user" IsQueryParameter="False"</Parameter>
</Parameters>
<Global>
<Data Name="[Link]" Display="Connection string"
Type="[Link], mscorlib">data source=Datenbankserver;initial
catalog=$Database$;user
id=$DBUser$;pooling=false;Password=$DBPassword$</Data>

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 196
Appendix: Configuration file examples
 <Data Name="[Link]" Display="Authentication
string" Type="[Link],
mscorlib">Module=Authentifizierungsverfahren;User[VI.DB_USER]=$SystemUser$;
(Password)Password[VI.DB_Password]=$SystemPassword$</Data>
<Data Name="[Link]" Display="Database factory"
Type="[Link], mscorlib">[Link], [Link]</Data>
<Data Name="[Link]" Display="Loaded shell" Type="[Link],
mscorlib">$SyncProject$</Data>
</Global>
<Editors>
<Editor Name="ShellPatchEditor"
Type="[Link],
[Link]">
<Data Name="PatchesToApply" Display="Patches to apply"
Type="[Link], mscorlib">$Patches$</Data>
</Editor>
</Editors>
</SynchronizationEditorWorkspace>

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 197
Appendix: Configuration file examples
 About us

About us

One Identity solutions eliminate the complexities and time-consuming processes often
required to govern identities, manage privileged accounts and control access. Our solutions
enhance business agility while addressing your IAM challenges with on-premises, cloud and
hybrid environments.

Contacting us
For sales and other inquiries, such as licensing, support, and renewals, visit
[Link]

Technical support resources

Technical support is available to One Identity customers with a valid maintenance contract
and customers who have trial versions. You can access the Support Portal at
[Link]
The Support Portal provides self-help tools you can use to solve problems quickly and
independently, 24 hours a day, 365 days a year. The Support Portal enables you to:

l Submit and manage a Service Request

l View Knowledge Base articles
l Sign up for product notifications
l Download software and technical documentation
l View how-to videos at [Link]/OneIdentity
l Engage in community discussions
l Chat with support engineers online
l View services to assist you with your product

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 198
About us
 Glossary

Glo s s ar y

A
Active Directory connector
System connector for connecting to an Active Directory system.

Active Roles connector

System connector for connecting to an Active Directory system though One Identity
Active Roles.

Azure Active Directory connector

System connector for connecting to an Azure Active Directory system.

B
Base mapping
Mapping from which to inherit a mapping.

Base object
Base objects contain data about the target system to be synchronized, its system
connection and the synchronization server.

C
Cloud application
Mapping a cloud application in the One Identity Manager's Universal Cloud
Interface Module.

Connector schema
The system connector extends the target system schema with additional
information which is required for mapping in the Synchronization Editor.

CSV connector
System connector which allow data to be imported from CSV files.

D
Database connection
System connection to the One Identity Manager database.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 199
Glossary
Direction of synchronization
Direction in which synchronization is run. The master system is defined by the
direction of synchronization.

E
Exchange Online connector
System connector for connecting to an Exchange Online system.

Extended schema
A schema can be customized in the Synchronization Editor, for example, to allow
or simplify mapping of complex schema properties. Label the modified schema as
"extended schema".

F
Filter
see revision filter; see object filter; see system filter; see object selection

G
G Suite connector
System connector for connecting to an G Suite.

H
Hierarchy filter
Used to limit the number of objects to be loaded directly into the target system. It
is based on the real objects of the target system. This filter can be used for
defining the scope.

I
IBM Notes connector
System connector for connecting to an IBM Notes system.

Intersection
Objects which occur in both of the connected systems

J
Job server
Server with the One Identity Manager Service installed.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 200
Glossary
L
LDAP connector
System connector for connecting to an LDAP system.

M
Maintenance
Post processing of data that could not be saved during synchronization.

Mapping
List of object matching rules and property mapping rules which map the schema
properties of two connected systems to one another.

Mapping direction
Direction of synchronization permitted for mapping schema properties.

Microsoft Exchange connector

System connector for connecting to an Microsoft Exchange system.

N
Native database connector
System connector for connecting to an external database.

O
Object filter
Filter for limiting the results of the scope. For example, the system objects of an
Active Directory domain are limited to one container.

Object matching rule

Specifies how a concrete object of a target system schema class can be set in
relation to a concrete schema class object of a One Identity Manager schema. An
object matching rule encompasses the target system schema property based on
which the target system objects can be uniquely identified.

Object selection
Filter for limiting the number of objects to synchronize. For example, the
system objects of an domain are limited to one container. You can also filter
single objects.

One Identity Manager connector

System connector for connecting to a One Identity Manager database.

One Identity Manager schema

The One Identity Manager data model.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 201
Glossary
Oracle E-Business Suite connector
System connector for connecting to an Oracle E-Business Suite.

P
Performance/memory factor
Percentage with which the reload threshold, partition size and bulk level are
applied to an object type.

Processing Method
Method used to process objects within a synchronization step. Example: Add object
(insert), update object (update), delete object (delete). Processing methods and
their mandatory parameters are define with the schema type.

Project wizard
Wizard which aids configuration of synchronization projects.

Property mapping rule

Describes how a target system schema property is mapped in the One Identity
Manager schema.

Provisioning
Actual changes to an object in the One Identity Manager database (added,
modified, deleted) are made immediately written to the target system.

Q
quota
A set of system object that can be processed in a synchronization step with a
particular processing method.

R
Reference scope
Used to resolve reference between objects of different systems. The reference
scope specifies the system in which objects for resolving references may be found.

Relative complement
Objects that only occur in one of the two system systems involved in
synchronizing.

Remote connection server

Job server installed with the RemoteConnectPlugin and the target system
connector is installed. If direct access to the target system is not possible, a
remote connection can be set up. Communication between the Synchronization
Editor and Target System is done through a remote connection server.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 202
Glossary
Revision
Highest value for change data for all system objects to be synchronized when
synchronization is run. This value is saved in the table "DPRRevisionStore",
column "value".

Revision filter
Filters all system objects not changed since the last synchronization. The deciding
factor being the revision property modification. Synchronization can be speeded up
with revision filtering.

Revision property
Schema property containing the revision counter of a system object. Objects
that have not changed since the last synchronization are found through the
revision property.

Rogue modification
A change that was not made in the synchronization master system. Example: the
direction of synchronization is define as "target system". This makes One Identity
Manager the master system for synchronization. Changes to the target system are
identified as invalid.

S
SAP R/3 connector
System connector for connecting to an SAP R/3 system.

Schema
Data model of a connected system. The schema describes all the master data from
the connected system. see target system schema; see One Identity Manager
schema; see connector schema; see extended schema

Schema Browser
The component of Synchronization Editor which shows details of the connected
target system's entire schema and the details of the entire One Identity
Manager schema.

Schema class
Subset of a schema type. The result list of a schema type is filtered by defined
criteria. Example: Active Directory contacts are Active Directory user accounts
with the property objectclass = "CONTACT".

Schema Editor
The component of the schema browser which can be used to edit user-specific
virtual schema properties.

Schema property
Property of a schema type. Property of a schema type. Refers to exactly one
column of a table or view of the database based schema or exactly one object type
property of the non-database based schema.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 203
Glossary
Schema type
Defines an object type within a schema. Refers to exactly one table or view of
the database based schema or exactly one object type of the non-database
based schema.

SCIM connector
System connector, which connects a cloud application using the System for Cross-
domain Identity Management specification.

Scope
Section of a connected system which should be synchronized. The scope is defined
with a filter.

SharePoint connector
System connector for connecting to a SharePoint farm.

SharePoint Online connector

System connector for connecting to a SharePoint Online farm.

Start up configuration
Specifies which synchronization configuration components are used for a specific
synchronization. Specifies the synchronization schedule.

Synchronization
The process of comparing data between One Identity Manager and a target
system. Objects and their properties are compared by fixed rules. Synchronization
results in the identical data situation in the target system and One Identity
Manager database.

Synchronization buffer
One Identity Manager table with information about referenced objects which could
not be assigned by synchronization.

Synchronization Editor
One Identity Manager tool for configuring target system synchronization.

Synchronization Editor Command Line Interface

Synchronization Editor components with which synchronization projects can be
created on the command line.

Synchronization Editor Module for Windows PowerShell

Synchronization Editor components with which synchronization projects can be
created by Windows PowerShell CmdLet.

Synchronization engine
One Identity Manager component which executes synchronization and
provisioning tasks.

Synchronization master
System which is verified as data master. The master system is specified by the
direction of synchronization.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 204
Glossary
Synchronization of single objects
Recent changes to an object in the target system (modified, deleted) are
immediately written to the One Identity Manager database.

Synchronization project
A collection of all data required for synchronizing and provisioning a target
system. Connection data, schema classes and properties, mappings, and
synchronization workflows all belongs to this.

Synchronization server
Job server installed with the target system connector. All One Identity Manager
actions are executed against the target system environment on the
synchronization server.

Synchronization step
Specific rule for processing exactly two schema classes.

Synchronization workflow
see Workflow

System connector
Software interface for accessing a connected system.

System filter
Used to limit the number of objects to synchronize in the connected system. The
connector only loads the object found through this filter.

System object
Object from the target system. A system object always belongs to a schema class.

T
Target System
An instance of a target system in which the employees managed by One Identity
Manager have access to network resources. Example: An Active Directory domain
X for target system type "Active Directory", a directory Y for target system type
"LDAP", a client Z for target system type "SAP R/3".

Target System Browser

The component of Synchronization Editor with which objects in the connected
system can be viewed and edited.

Target system schema

Data model of a specific target system. Describes all the data originating from the
target system.

Target System Synchronization

Post processing of objects that were marked as outstanding by synchronization.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 205
Glossary
Target system type
Grouping similar target systems. Example: Active Directory, LDAP, SharePoint.

Template
Template used by the project wizard to create a preconfigured
synchronization project.

U
Universal Cloud Interface connector
System connector for connecting to the Universal Cloud Interface.

V
Variable set
Used to configure synchronization configuration for different systems. Each
variable set contains at least the variables for the system connection parameter.
The value of the variables are redefined for different uses.

Virtual schema properties

Schema class property added by the system connector or the user.

W
Windows PowerShell connector
System connector for connecting non-native supported target systems.
Windows PowerShell cmdlets are used to execute read/write operations in the
target system.

Workflow
Collection of all the synchronization steps to be executed.

Workflow wizard
Wizard which aids configuration of synchronization workflows.

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 206
Glossary
 Index
I ndex

B connection parameter 124, 127

base mapping 157 encrypt 26

base object 122, 124 connector schema 31

add 122 consistency check 127

delete 124 create filter setting 19

edit 124 CSV connector 145

base table 124 CSV import 50

bulk processing 158

D
C database connection 104

cache 159 edit 103

calculation schedule 119 encrypted 26

create 120 database connector 145

delete 119 debug mode 158

edit 119 decryption dialog 26

enable 120 default variable set 111

start time 120 delete

change direct group membership 143

provision 50 inherited group membership 143

rogue 47 dependency resolution 40, 90

change label 23 direction of synchronization 90, 94, 116

class type 73-74 current 44

configuration file 178 opposite mapping direction 45, 79

editor definition 181-182 downstream process 170

example 194, 196 DPRAttachedDataStore 42

global definition 181

parameter 180 E
project wizard definition 181
editor definition 181-182
ShellPatchEditor 182
error analysis 189
configuration parameter 193
error log 189

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 207
Index
execution plan 103 logging 189
expert mode 157
export M
synchronization project 172
maintenance 42, 119
extended schema 31
start manually 188
mapping 31, 67
F create 70
filter 34, 37, 108 delete 71
wizard 19 edit 71
force mapping against synchronization properties 71, 157
direction 45
mapping direction
FullSync 50
permitted 44
specify 71, 79
G Mapping Editor 68

global definition 181 mapping rule 78

mapping wizard 78, 84
MarkAsOutstanding 95
H
master system 44-45
hierarchy filter 37, 108, 113
matching criteria 83
create 109
matching rule 83
membership
I delete 143
ignore mapping direction restrictions on modify provisioning 55
adding 47 synchronizing 55
import 94 memory 58
synchronization project 172 mile stone 148
IsForUpdateXDateSubItem 55 multiple reference rule 79

J N
Job server NLog 189
load balancing 174

O
L
object
load balancing 174 delete 51

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 208
Index
 delete immediately 141 processing
outstanding 51, 141 restrict 97
process 171 processing method 95, 97
publish 141 condition 97
object filter 34, 108 define 99
object matching rule 31, 83 project template 65
create 84 create 162
delete 85 delete 165
edit 85 edit 165
link 85 target system version 165
sort order 85 user defined 161, 163
test 86 project wizard 61
object selection 34 project wizard definition 181
One Identity Manager connector 145 property mapping rule 31, 78
One Identity Manager schema 31 create 78
operation 173 delete 79
operators, logical 85 details 79
outstanding membership 143 edit 79
outstanding object 51, 141 exclusion 101
include 101

P transform object matching rule 84

provisioning 10, 50, 173
parameter
accelerate 174
configuration file 180
members list 57
define value 183, 186
operation 163, 173
partition size 158
schema extension 166
patch 63, 148
apply automatically 150
predecessor 148 Q
Patchtyp 148 quota 100
performance
optimize 58, 159 R
performance / memory factor 58, 101
read-only connection 66, 104
process
read-only mode 66, 104
downstream 170

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 209
Index
reference delete 126
solve 42 edit 126
unsolvable 42, 188 filter 73
reference scope 38, 108 general 73
reload threshold 101, 158 resolve dependencies 40
remote access 31 unique object 73-74
remote connection Schema Editor 160
close 23 schema extension
create 23 include in synchronization 166
decrypt connection parameter 26 set up provisioning 166
set up 23 set up single object
synchronization 166
remote connection server 23
schema overview 125
RemoteConnectPlugin 23
schema property 31
reset revision 138
create 77, 160
resolve dependencies 40
delete 77, 160
revision counter 38
edit 76-77, 160
revision filter 34, 38
schema type 31, 73, 125
revision filtering 90, 94, 116
scope 34, 37, 108, 127
revision property 38
create 107
rogue correction 47
delete 108
rogue detection 47
edit 107
rogue modification 79
scope hierarchy 108
correct 47
script
identify 47
compile 168
rule filter 101
create 153
rule type 79, 85
debug 168
delete 154
S
edit 154
save schema 160 import 153
schema 31 log 21
reload 53 master data 153-154
shrink 53 use code snippet 21
update 53-54 script language 64
schema class 31, 125 supported 161
create 71, 125

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 210
Index
 synchronization project 63 retention period 136
script library 151 start manually 136
script template 153-154 start up sequence instance 136
script variable 110, 114 status bar 13
session variable FullSync 50 synchronization
shadow copy 59 abort 137
simulation 135 accelerate 38
single object synchronization 10, 173 configure 66, 163
accelerate 174 memory requirement 58, 101
operation 173 performance 58, 101
schema extension 166 process objects 171
sort of schema 31 simulate 135
start information simultaneous start 117
reset 137 start 119, 135-136, 169
start up behavior start up behavior 117
on simultaneous start 117 synchronization project
start up configuration 42, 115, 136 create 176
calculation schedule 119 synchronization analysis report 144
create 115 synchronization buffer 42, 188
delete 116 synchronization configuration 60
edit 116 customize 127
group 117 export 172
maintenance mode 119 import 172
properties 116, 158 patch 150
reset 137 update 150
sort order 129-130 Synchronization Editor 9
start up group 117 menu 14
start up sequence 129 settings 18
create 130 start 60
delete 131 status bar 13
delete instance 136 toolbar 14
edit 130 Synchronization Editor Command Line
Interface 183
execute 136
synchronization log 140
instance 136
configure 104
monitor 136

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 211
Index
 contents 106 custom processing method 99
create 106 data import 50
display 140 delete 94
synchronization project disable 93-94
applied patches 63 edit 93
applying patches 183 execute 171
automatically apply patches 176 processing method 95, 97
close 61 resolve dependencies 40, 103
complete 128 sort 93
configuration file 178 sort order 103
consistency check 127 synchronization user
create 61-62, 163 change password 28
automated 176, 183, 186 synchronization workflow 87
simulate 183, 186 synchronize hierarchy 71
create by template 65 system
create with command line 176 primary 50
create with Windows PowerShell 176 secondary 50
delete 63 system connection
disable 128 change 104
edit properties 62 reestablish connection 104
enable 53, 128 system connection wizard 104
export 172 system connector 9
import 172 system filter 34, 108
load 61 system user
origin 63 Synchronization 28
save 23
shadow copy 63 T
update 147
target system connection 104
automated 176, 183
edit 103
simulate 183
target system schema 31
update from command line 176
template 50
update with Windows PowerShell 176
transport package
synchronization server 31, 124
synchronization project 172
synchronization step 92
create 93

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 212
Index
V
value compare rule 79, 85
variable 110, 127
create 111
delete 113
edit 112
value 113
variable set 110, 116, 124
create 113
delete 113

W
workflow 87, 116
copy 88
create 88
delete 89
dependency resolution 40
edit 88
for single object synchronization 173
provisioning 173
workflow wizard 88-89

X
XDateSubItem 55

One Identity Manager 8.1.2 Target System Synchronization Reference

Guide 213
Index