Functionalities

This connector only supports Provisioning.

The connector supports reading or writing provisioning data as an ASCII text file in either:

• LDIF (LDAP Data Interchange File) format.
• CSV format. Uses commas (,) or pipes (|) as delimiters. 

Provisioning Integration

DataFormats Supported

  

Prerequisites

• The Web server must run under an administrative account to perform some functionality.
• This account can be a member of the local Administrators group or a member of the domain Administrators group.

Creating and Managing the Connected System

Connected system can be managed from both Admin UI and Workflow and Connectivity studio. The step by step explanation to create is provided in the following sub sections. Clicking on the connected system from the listing page(admin UI)/selecting the desired system and clicking on View button(Studio) will take you to a detail page where you can can manage the connected system.

Create from Admin UI

1. Log in to Identity Administration and click the Systems tab.
   
   
2. On the Connected System View page, click the Add button and select the Flat File connected system from the Type drop-down list. The Connected System Details page displays the default values:
   
   
   

3. Enter the desired information:

   Definition
   Supported Connectors	Displays whether the connected system is Identity only, Provisioning only, or both.
   Password Policy	Displays the name of the password policy associated with the connected system.
   Connected System Group	Displays the name of the system group that includes this connected system. Note: If a password policy is associated with a connected system and then the connected system is placed in a group, the group’s password policy will override the connected system’s password policy. The password policy will be removed from the connected system.
   Type	Select the connected system type.
   Locale	Select the preferred language (default: English). Locale specific information such as Display Name and Description can be added only while modifying the connected system.
   Name	The name for this connected system. Note: The name cannot be modified later.
   Display Name	The display name of the new connected system.
   Description	The description of the connected system.
   Associated With	Select how the connector associated with this system will run: Server (default) - Runs locally on the Provisioning/Identity Server. Global Identity Gateway - Runs remotely on a Global Identity Gateway cluster member. Note: Only GIG clusters that have at least one registered and enabled member will display in this list. See Using the Global Identity Gateway with Connected Systems for additional information.
   Password Reset By	Enables administrators to configure password management functions normally available to Users and OBO (On Behalf Of) Users: OBO User Only - Connected system and account association information is displayed only in Self-Service user management (for OBO Users). OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/disable, validate, associate user, and password reset). End users will not see their accounts on this connected system in Self-Service and Kiosk; therefore, they cannot reset passwords for accounts on this connected system. Users and OBO User - Connected system and account association information is displayed in Self-Service password reset, Self-Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/disable, validate, associate user, and password reset). External - Connected system and account association information is not displayed in Self-Service password reset, Self-Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users cannot reset passwords for accounts on this connected system. Note: When user management configuration enables OBO Users to perform password resets, this definition must be set to OBO User Only or Users and OBO User. For connectors that support Provisioning only, there is no password reset capability.
   Provisioning Option	Select the provisioning option: Automated (default) - The connected system functions as a normal connected system; there are no restrictions. Administrative - The connected system cannot be used as an object in a workflow.
   Enable HPAM Support	Select to make the connected system HPAM enabled (default: cleared). Note: This can only be set for systems that support Identity.
   Connection Information
   Flat File Directory Root	The subdirectory location where the file(s) of the specified type reside. This must be the absolute name of the directory (e.g., C:\Fischer\Provisioning\dataforum\sampledata). Note: The subdirectory must reside on the server that is performing the provisioning. For example, if the connector is running through a GIG, then the Flat File Directory Root must reside on the Shared Folder of the GIG cluster.
   System Owner	Add or Remove users assigned as the owners of the system. Displays the Connected System Owner Search page for selecting users. The HPAM column indicates whether the system owner is authorized to use the HPAM feature. The Approvers column indicates whether the system owner is an approver in the approval process.

4. (Optional) To select owners of the system, click the System Owner Add button. The Connected System Owner Search page displays:
   

   1. Select the owners and then click the Select button. The system owner displays under the System Owner section:
      
      
      Note: More than one user can be assigned as an owner.
      
      
   2. To add additional system owners, click the Add button.
      
      
5. On the Connected System Details page, click the Add button to save the configured connected system. The Object Category Association page displays a list of categories that are already associated and/or can be selected to add additional associations to this connected system:
   
   
   
   1. Select one or more available object categories or provide search criteria and click the Search button to find specific categories to select. If there are no available categories to select, proceed to Step 6.
   2. Click the Add Association button to associate the selected object categories to the connected system.
      
      
6. Click the Back button to return to the Connected System View page. The new connected system displays in the list.

 See Copying, Modifying, and Deleting Connected Systems for additional information.

Creating from Studio

1. Log in to the Workflow and Connectivity Studio and click Connectivity _ Add Systems on the menu bar. The Add Connected Systems window displays.
   
   
2. Select the Flat File connected system from the Type drop-down list. The default values display:
   
   
   

3. Enter the desired information:
   
   

   Definition
   Type	Select the connected system type.
   Name	The name for this connected system. Note: The name cannot be modified later.
   Display Name	The display name of the new connected system.
   Description	The description of the connected system.
   Supported Connectors	Displays whether the connected system is Identity only, Provisioning only, or both. Only connectors that support Provisioning are available here.
   Associated With	Select how the connector associated with this system will run: Server (default) - Runs locally on the Provisioning/Identity Server. Global Identity Gateway - Runs remotely on a Global Identity Gateway cluster member. Note: Only GIG clusters that have at least one registered and enabled member will display in this list. See the Using the Global Identity Gateway with Connected Systems for additional information.
   Password Reset By	Enables administrators to configure password management functions normally available to Users and OBO (On Behalf Of) Users: OBO User Only - Connected system and account association information is displayed only in Self-Service user management (for OBO Users). OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/disable, validate, associate user, and password reset). End users will not see their accounts on this connected system in Self-Service and Kiosk; therefore, they cannot reset passwords for accounts on this connected system. Users and OBO User - Connected system and account association information is displayed in Self-Service password reset, Self-Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users can reset passwords for accounts on this connected system. Administrators can perform all user management functions for this connected system (e.g., enable/disable, validate, associate user, and password reset). External - Connected system and account association information is not displayed in Self-Service password reset, Self-Service - Kiosk, and Self-Service user management. Self-Service users, Kiosk users, and OBO Users cannot reset passwords for accounts on this connected system. Note: When user management configuration enables OBO Users to perform password resets, this definition must be set to OBO User Only or Users and OBO User. For connectors that support Provisioning only, there is no password reset capability.
   Provisioning Option	Select the provisioning option: Automated (default) - The connected system functions as a normal connected system; there are no restrictions. Administrative - The connected system cannot be used as an object in a workflow.
   Enable HPAM Support	Select to make the connected system HPAM enabled (default: cleared). Note: This can only be set for systems that support Identity.
   Connection Information
   Flat File Directory Root	The subdirectory location where the file(s) of the specified type reside. This must be the absolute name of the directory (e.g., C:\Fischer\Provisioning\dataforum\sampledata). Note: The subdirectory must reside on the server that is performing the provisioning. For example, if the connector is running through a GIG, then the Flat File Directory Root must reside on the Shared Folder of the GIG cluster.

4. Click the Apply button to apply changes. The Category Association window displays.

   1. Select one or more object categories from the Available Categories list or enter a category name and click the Search button to find a specific category to select. If there are no available categories to select, proceed to Step 5.

   2. Click the Add button to associate the selected object categories to the connected system.
      
      

5. Click OK to accept selected categories.

 See Copying, Modifying, and Deleting Connected Systems for additional information.

Using the Connected System for Provisioning

Perform these procedures to configure the connector:

• Configuring for Export
• Configuring for Import

 Note: If the number of records to be processed exceeds one thousand, we recommend configuring the workflow to use bulk mode, which lowers the memory consumption of the system by streaming data to files. Because data is streamed for every task, performance of the workflow execution will be decreased due to increased read-write operations. See the Workflow and Connectivity Studio document for details on how to configure bulk mode.

 Configuring for Export

Perform these procedures to configure the connector for data export:

• Configuring the Export Connector
• Configuring the Export Link

From the Workflow and Connectivity Studio, select the Flat File UserExport workflow listed under the projects folder.

If a workflow does not already exist, create an export workflow. See the Workflow and Connectivity Studio document for details on creating export workflows.

Configuring the Export Connector

1. In the Design pane, double-click the export object (the first workflow object after the Start object). The Configure Data Source window displays:
   

2. From the Configure Plug-in tab, set these properties as required:

   Name	Description
   Associated Connected System	Select the connected system from the list. The export operation will be done from this connected system.
   Data Formats	Select the type of data format to use: Profiles (default) or ChangeLog.
   Delimiter	The delimiter for the file. The supported delimiters are comma (,) and pipe (|). Note: This property is available in CSV data format only
   DeltaExportMode	Select the type of attribute to export if a change takes place (this works in conjunction with ExportMode when DeltaExport is selected): OnlyChangedAttributes - Performs a partial export of only the changed attributes from the last time the query was run. ChangedAndMandatoryAttributes (default) - Performs a partial export of both changed and mandatory attributes from the last time the query was run. Mandatory attributes are exported whether they have been changed or not. AllAttributes - Performs a full export of all attributes that contain a value.
   DynamicConnectedSystem	Select the global variable to use as the dynamic connected system name. This works in conjunction with DynamicConnectedSystemOption when GlobalVariable is selected.
   DynamicConnectedSystemOption	Select how to control Dynamic System Support (DSS): None - There will not be any Dynamic System Support. Transaction-SystemName - The value of the Transaction-SystemName attribute in data will be used as the dynamic connected system. The connected system name must be passed as the value of the attribute Transaction-SystemName; if it is missing in data, the operation will fail. GlobalVariable - Select a global variable to use as the dynamic connected system name from the property DynamicConnectedSystem.
   DynamicFileNameDateSuffix	To select the date format for the Dynamic File Name suffix.
   EnableDynamicFileNameSupport	Boolean property to determine whether to build the file name dynamically or not.
   ExportFileArchiveAppendDateFormat	To select the dateformat to append to the archived file.
   ExportFileArchiveDeleteSourceFiles	Boolean property to specify whether the source file has to be deleted after archiving it.
   ExportFileArchiveFolder	Name of the folder in which the archived file is stored.
   ExprotFileArchiveOption	Property to specify archive options. The options are: None - No archiving. Compressed - Archive the file after compressing (.zip)it. Append Date - Archive the file by appending current date to the file name. Append Date and Compressed - Archive the file by appending current date to the file name and compressing it.
   ExportMode	Select the type of data to export: FullExport - Exports all attributes. DeltaExport - Exports changed, mandatory, or all attributes, depending on the DeltaExportMode property setting.
   ExportSheetIndex	Enter the value to represent the index of the Excel sheet that will be exported. Note: This property is available in ExcelSheet only.
   ExportSheetIndexes	Enter the value to represent the indexes of the Excel sheet that will be exported (default: 0). If data is required from multiple sheets, list them in a comma delimited format (e.g., 1, 3). Enter * for all sheets. Note: This property is available in Excel (*.xlsx) data format only.
   FFSubDirectoryName	The name of the subdirectory relative to the FFDirectoryRoot that was specified during creation of the connector. This may be blank if the file is in the root directory itself. If a directory name is provided, the search for the file starts from: FFDirectoryRoot + FFSubDirectoryName For example, if: FFDirectoryRoot          = C:\Fischer\Provisioning\dataforum\sampledata FFSubDirectoryName = data The search for a file begins from the directory: C:\Fischer\Provisioning\dataforum\sampledata\data
   File Encoding	Select the encoding to be used during export and Import of CSV files: Default - Java VM's encoding is used for file operations. UTF-8 - UTF8 encoding is used for operations. Note: This property is available in CSV data format only.
   Filter	Specify search criteria to determine the objects to be exported from the container specified in ExportDN. Use the Set Filter button that becomes active to create a filter. See "Set Filter" on page 34 for additional information.
   FirstRowIsHeader	Property to specify whether first row is the header row. Note: This property is available in CSV data format only.
   FlatFileName	The name of a file of the selected file type specified in the data format option. The name can contain standard wild-card characters such as (*) and (?).
   MaxResults	Select the maximum number of results to be returned (default: 1000).
   SearchSubDirectory	Specify whether to search subdirectories: TRUE - The subdirectories specified are searched while locating files that match the FlatFileName. FALSE - The subdirectories are not searched while locating files that match the FlatFileName.
   TableIndex	Enter the Word table to be exported (the minimum value is the default: 1). Note: This property is available in WordTable (*.docx) data format only.
   UseFlattenedAttributeSchema	Property to control whether to use multi-level attribute schema or flattened attribute schema. Note: This property is available in XML data format only.
   Note: Hover the pointer over a property to view its description.

3. Select the Attributes tab. Only standard attributes display:
   
   

4. Select the Attributes for a data format of .csv:
   
   
   

   Three options are provided to generate the attribute names. The attribute name must be a value which can be used as an XML element. It should not contain spaces or special characters and must not start with a numerical value.

   Static Names	To generate static names. Define number of columns and click the "Build" button
   Header of Target File	To generate attribute names using header row of the target file.
   Header of Sample File	To generate the attribute names from a sample .csv file. Browse and select the .csv file

5. Select the Attributes for a data format of .xlsx:
   
   
   The number of columns can be defined. Column Type supports the following formats:

   • Text
   • Number
   • Integer
   • Boolean
   • Date
   • Formula

   Note: Formula - Set the cell type as Formula during export, if an excel cell has formula and it has to be exported.

6. Select the Attributes for a data format of XML:
   
   Browse and select a sample Data XML. Select a node and click the "Set Entry Node" to set the entry node.

7. Select the Attributes for a data format of ldif:
   
   
   

   Modify schema attributes using these buttons:

   Add	Adds additional attributes to the list. The Add New Attribute dialog displays.
   Export	Exports the schema list to an XML file.
   Import	Imports the schema list from an XML file.
   Refresh Schema	Dynamically discovers the schema from the connected system. It also includes local as well as global attributes added in the Studio.
   Reset Schema	Resets the schema definition to the default schema prepackaged with the IdM Suite, plus any global variable added.

8. (Optional) Select the Appearance tab to change how the Connected System object displays in the Design pane.
   
   
9. Click OK to save any changes and return to the Workflow and Connectivity Studio window.

Configuring the Export Link

1. In the Design pane, double-click the export link between the export object (the first workflow object after the Start object) and the Data Mapper object. This Configure Link window displays:

   

   Find	To find the attribute from the Source attributes list.
   Source Attributes	Select the attributes to export.
   Selected Attributes	Displays default attributes and those attributes that have been selected from the Source Attributes. Check the box of any selected attribute required for a delta export.
   Advanced Settings	Displays the Configure Attributes window for selecting any attributes that need to be encrypted.
   Key Attribute	Displays the attribute designated as the key attribute. For CSV and Excel (*.xlsx) data format, multiple attributes can be set as Key Attribute. The key value is generated by concatenating the value of key attributes in the order it is set.

   Note: In the source attributes list, "SheetName" will be listed for xlsx format.

2. From the Attribute Selection tab, select attributes to export.
   
   
3. Click OK to save any changes and return to the Workflow and Connectivity Studio window.
   
   
4. Deploy the workflow by selecting Deploy ► New Deployment.
   See the Workflow and Connectivity Studio document for details of deployment options.
   
   
5. Manage and run the deployed workflow from the Admin UI ► Server tab. See the Identity Suite Administration Guide for details.
   
   

Configuring for Import

Perform these procedures to configure the connector for data import:

• Configuring the Import Connector

• Configuring the Import Link

From the Workflow and Connectivity Studio, select the Flat File UserAdd, UserModify, or UserDelete workflow listed under the projects folder.

If a workflow does not already exist, create an import workflow. See the Workflow and Connectivity Studio document for details on creating import workflows.

Configuring the Import Connector

1. In the Design pane, double-click the import object (the last workflow object). The Configure Data Source window displays:
   

2. From the Configure Plug-in tab, set these properties as required:

   Associated Connected System	Select the connected system from the list. The import operation will be done to this connected system.
   Data Formats	Select the type of data format to use: CSV (default), Excel (*.xlsx), ExcelSheet, LDIF, Word (*.docx), WordTable (*.docx) or XML.
   AddIfEntryDoesNotExist	This is used when the changetype is add. Select whether to create an entry if the entry does not already exist (default: FALSE).
   Delimiter	The delimiter for the file. The supported delimiters are comma (,) and pipe (|).Note: This property is available in CSV data format only.
   DynamicConnectedSystem	Select the global variable to use as the dynamic connected sys- tem name. This works in conjunction with DynamicCon- nectedSystemOption when GlobalVariable is selected.
   DynamicConnectedSystemOption	Select how to control Dynamic System Support (DSS): None - There will not be any Dynamic System Support. Transaction-SystemName - The value of the Transaction- SystemName attribute in data will be used as the dynamic connected system. The connected system name must be passed as the value of the attribute Transaction- SystemName; if it is missing in data, the operation will fail. GlobalVariable - Select a global variable to use as the dynamic connected system name from the property DynamicConnectedSystem. See the Dynamic System Support appendix in the Workflow and Connectivity Studio document for additional information.
   DynamicFileNameDateSuffix	To select the date format for the Dynamic File Name suffix.
   EnableDynamicFileNameSupport	Boolean property to determine whether to build the file name dynamically or not.
   FFSubDirectoryName	The name of the subdirectory relative to the FFDirectoryRoot that was specified during creation of the connector. This may be blank if the file is in the root directory itself. If a directory name is provided, the search for the file starts from: FFDirectoryRoot + FFSubDirectoryName For example, if: FFDirectoryRoot          = C:\Fischer\Provisioning\dataforum\sampledata FFSubDirectoryName = data The search for a file begins from the directory: C:\Fischer\Provisioning\dataforum\sampledata\data
   File Encoding	Select the encoding to be used during export and Import of CSV files: Default - Java VM's encoding is used for file operations. UTF-8 - UTF8 encoding is used for operations. Note: This property is available in CSV data format only.
   FlatFileName	The name of a file of the selected file type specified in the data format setting. The name can contain standard wild-card characters such as (*) and (?).
   ImportSheetName	The value of the worksheet name to be imported. Note: This property is available in ExcelSheet data format only.
   IncludeHeaderForNewFile	Property to specify whether to add header row when a new .csv file is created.
   ModifyIfEntryExists	Select whether to perform a modify operation if an add operation fails (default: FALSE).
   ModifyIfOutputFileExists	Specify whether to modify the output file if it already exists: TRUE (default) - The agent will not overwrite the output file if it already exists, with the data being provided. FALSE - The agent will overwrite the output file if it exists.
   TableIndex	Enter the Word table where add, modify, or delete operations are to be performed. If the specified table does not exist, it will be created and data will be imported. If the changetype is add or modify and the table exists, then data will be modified or new row(s) will be appended at the end of the table. The minimum value is the default: 1.Note: This property is available in WordTable (*.docx) data format only.
   UniqueKeyValidationEnabled	Specify whether to check for unique key value during import. TRUE (default) - Checks for unique key value during import. FALSE - Will not check for unique key value during import and the entries are appended to the existing ones irrespective of the changetype. This can be used during load process where unique key validation can take time. Make sure to have uniquely generated key value in the data in order to avoid duplicate entries. Note: This property is available in CSV data format only.
   XML Header	Specify the XML header to be used. For example: <?xml version="1.0" encoding="ISO-8859-1" standalone="yes"?>Note: This property is available in XML data format only.
   Note: Hover the pointer over a property to view its description.

3. Select the Attributes for a data format of .csv:

   

   Three options are provided to generate the attribute names. The attribute name must be a value which can be used as an XML element. It should not contain spaces or special characters and must not start with a numerical value.

   Static Names	To generate static names. Define number of columns and click the "Build" button
   Header of Target File	To generate attribute names using header row of the target file.
   Header of Sample File	To generate the attribute names from a sample .csv file. Browse and select the .csv file

4. Select the Attributes for a data format of .xlsx:
   
   
   

   The number of columns can be defined. Column Type supports the following formats:

   • Text
   • Number
   • Integer
   • Boolean
   • Date
   • Formula
   • FormulaExec

   Note: Formula - Set the cell type as Formula during import, if a formula is to be set for the cell. The value of this attribute must be a valid excel cell formula.

   FormulaExec - Set the cell type as FormulaExec during import, if an excel cell has formula and the formula is to be executed during import.

5. Select the Attributes for a data format of XML

   

   
   Browse and select a sample Data XML. Select a node and click the "Set Entry Node" to set the entry node.

6. Select the Attributes for a data format of ldif:
   
   
   

   Add	Adds additional attributes to the list. The Add New Attribute dialog displays.
   Export	Exports the schema list to an XML file.
   Import	Imports the schema list from an XML file.
   Refresh Schema	Dynamically discovers the schema from the connected system. It also includes local as well as global attributes added in the Studio.
   Reset Schema	Resets the schema definition to the default schema prepackaged with the IdM Suite, plus any global variable added.

7. (Optional) Select the Appearance tab to change how the Connected System object displays in the Design pane.
   
   
8. Click OK to save any changes and return to the Workflow and Connectivity Studio window.

Configuring the Import Link

1. In the Design pane, double-click the import link between the Data Mapper object and the import object (the last workflow object). This Configure Link window displays:
   
    Here you can select the attributes to be imported.
   
   

   Find	To find the attribute from the Source attributes list.
   Source Attributes	Select the attributes to import.
   Check for attribute-level auditing.	If auditing is enabled and these attributes below are checked, Provisioning will log all events for auditing purposes.
   Selected Attributes	Displays default attributes and those attributes that have been selected from the Source Attributes. Check the box of any attribute required for attribute-level auditing. Note: The default attributes are those that are commonly used to create a new user.
   Advanced Settings	Displays the Configure Attributes window for selecting any attributes that need to be encrypted.
   Selected Attributes	Displays default attributes and those attributes that have been selected from the Source Attributes. Check the box of any attribute required for attribute-level auditing. Note: The default attributes are those that are commonly used to create a new user.
   Advanced Settings	Displays the Configure Attributes window for selecting any attributes that need to be encrypted.
   Key Attribute	Displays the attribute designated as the key attribute. For CSV and Excel (*.xlsx) data format, multiple attributes can be set as Key Attribute. The key value is generated by concatenating the value of key attributes in the order it is set.

2. From the Attribute Selection tab, select attributes to import.
   
   
3. Click OK to save any changes and return to the Workflow and Connectivity Studio window.
   
   
4. Deploy the workflow by selecting Deploy ► New Deployment.
   See the Workflow and Connectivity Studio document for details of deployment options.
   
   
5. Manage and run the deployed workflow from the Admin UI ► Server tab.
   See the Identity Suite Administration Guide for details.