Profile the Resource

The following sections describe how to profile and define prerequisites for standard resource adapters and Active Sync-enabled adapters.

• Profiling a Standard Resource Adapter

• Profiling an Active Sync-Enabled Resource Adapter

Profiling a Standard Resource Adapter

Use the following information to create a profile and define prerequisites for a standard resource adapter:

• Select an Identity Manager adapter file that most closely resembles the resource type to which you are connecting.

  See Table 9–12 for a brief description of the default Identity Manager resource adapter files supplied with a standard Identity Manager configuration.

• Research user account characteristics and how these tasks are performed on the remote resource:

  • Authenticate access to the remote resource

  • Update users

  • Get details about the changed users

  • List all users on the system

  • List other system objects, such as groups, that are used in the listAllObjects method

• Identify the minimum attributes needed to perform an action and all supported attributes.

• Verify that you have the appropriate tools to support connection to the resource.

  Many resources ship with a published set of APIs or a complete toolkit that can be used to integrate outside applications to the resource. Determine whether your resource has a set of APIs or whether the toolkit provides documentation and tools to speed up integration with Identity Manager. For example, you must connect to a database through JDBC.

• Determine who can log in and search for users on the resource

  Most resource adapters require and run an administrative account to perform tasks such as searching for users and retrieving attributes. This account is typically a highly privileged or super user account, but can be a delegated administration account with read-only access.

• Determine whether you can extend the resource’s built-in attributes.

  For example, Active Directory and LDAP both allow you to create extended schema attributes, which are attributes other than the standard Identity Manager attributes.

  Decide which attributes you want to maintain in Identity Manager, determine what the attribute names are on the resource, and decide what to name the attributes in Identity Manager. These attribute names go in the schema map and are used as inputs to forms that are used to create a resource of that type.

Profiling an Active Sync-Enabled Resource Adapter

When profiling an Active Sync-Enabled resource adapter, use the following information in addition to the considerations described in Profiling a Standard Resource Adapter:

• When researching user account characteristics and how these tasks are performed on the remote resource, you must also:

  • Search for changes to users

  • Identify ways to search for changed users only

• Determine which resource attributes or actions create events.

  If the resource supports subscribing to notification messages when changes are made, identify which attribute changes you want to trigger the notification and which attributes you want in the message.

• Decide which of the following actions Identity Manager should perform when the adapter detects an event on the source.

  • Create, update, or delete a user

  • Disable or enable an account

  • Update the answers used to authenticate a user

  • Update a phone number

• Decide whether you want the adapter to be driven by events in the external resource or driven by specified polling intervals.

  ---

  Note –

  Before making your decision, you must understand how polling works in typical Identity Manager installations. Although some installations implement or are driven by external events, most Identity Manager deployment environments use a hybrid method.

  ---

  Choose one of the following approaches:

  • Set up polling intervals where an Active Sync Manager thread calls the poll interface at a configurable interval or on a specified schedule. You can set polling parameters, including settings such as faster polling if work was received, thread-per-adapter or common thread, and limits on the amount of concurrent operations.

  • Set up an event-driven environment where the adapter sets up a listening connection, such as an LDAP listener, and waits for messages from the remote system. You can implement the poll method to do nothing, and set the polling interval to an arbitrary value, such as once a week. If updates are event-driven, the updates must have a guaranteed delivery mechanism, such as MQ Series, or synchronization is lost.

  • Implement a hybrid solution where external events trigger smart polling and the regular poll routine can recover from missed messages.

    Smart polling adapts the poll rate to the change rate and polls infrequently unless changes are being made often. Smart polling balances the performance impact of frequent polling with the update delays of infrequent polling.

    In this model, incoming messages are queued and multiple updates for a single object are collapsed into a single update, which increases efficiency. For example, multiple attributes can be updated on a directory, and each attribute triggers a message. The poll routine examines the message queue and removes all duplicates. The routine then fetches the complete object to ensure that the latest data is synchronized and that updates are handled efficiently.