System Components

Identity Synchronization for Windows consists of a set of Core components and any number of individual connectors and connector subcomponents that allow for the synchronization of password and user attribute updates between Sun Java System Directory Server and Windows directories.

Figure 3–1 System Components

This section defines and describes each of the Identity Synchronization for Windows components and is organized as follows:

• Watchdog Process

• Core

• Connectors

• Connector Subcomponents

Watchdog Process

The Watchdog is an Identity Synchronization for Windows Java process that is responsible for starting, restarting, and stopping individual background Java processes. The Watchdog launches and monitors the central logger, system manager, and connectors (but does not monitor subcomponents, Message Queue, or the Identity Synchronization for Windows Console).

The Watchdog is installed anywhere you install Core and it can be started as a Solaris daemon, Linux daemon, or a Windows service. (For information about starting and stopping services, see Starting and Stopping Services.)

Core

When you install Identity Synchronization for Windows, you install the Core component first, and then you configure it to match your environment.

The core component consists of the following components, which are each separate Java processes. A description each component, begins on the referenced page:

• Configuration Directory

• Console

• Command Line Utilities

• System Manager

• Central Logger

Configuration Directory

Identity Synchronization for Windows stores its configuration data in a Directory Server configuration directory (the program does not install a configuration directory).

The console, system manager, command line utility, and the installer all read and write the product’s configuration data to and from the configuration directory, including:

• Installation information about each component’s health

• Configuration information for every directory, domain, connector, and Directory Server Plug-in

• Connector status

• Synchronization settings that describe the direction of user or group's creations, deletions, and attribute modifications

• Attributes to be synchronized and attribute mappings between the two directory environments Active Directory and Directory Server or Windows NT and Directory Server

• Synchronization User Lists in each directory topology

• Log settings

Console

The Identity Synchronization for Windows provides a Console that centralizes all of the product’s component configuration and administration tasks.

You can use the console to do the following:

• Configure directory sources to be synchronized

• Define mappings for user entry attributes to be synchronized, in addition to passwords

• Specify which users and attributes within a directory or domain topology will be (or will not be) synchronized

• Monitor system status

• Start and stop synchronization

Command Line Utilities

Identity Synchronization for Windows also provides command line utilities that enable you to perform the following tasks directly from the command line:

• Display certificate information based on your configuration and SSL settings

• Change the Identity Synchronization for Windows configuration password

• Configure the Directory Server plug-in for a specified Directory Server source.

• Prepare a Sun Java System Directory Server source for use by Identity Synchronization for Windows

• Display the steps you must perform to complete the installation or configuration process and view the status of installed connectors, the system manager, and Message Queue

• Reset connector states in the configuration directory to uninstalled

• Synchronize and link existing users in two directories, and pre-populate directories as part of the installation process

• Enable or disable account lockout

• Enable or disable group synchronization

• Start and stop synchronization

For a detailed description of the product’s command line utilities and how to use them, see Appendix A, Using the Identity Synchronization for Windows Command Line Utilities

System Manager

The Identity Synchronization for Windows system manager is a separate Java process that:

• Leverages the product’s back-end networked facilities to dynamically deliver configuration updates to connectors

• Keeps status of each connector and all connector subcomponents

• Coordinates idsync resync operations that are used to initially synchronize two directories

Central Logger

Connectors may be installed so that they are widely distributed across remote geographical locations; therefore, it is of great administrative value to have all logging information centralized, which allows the administrator to monitor synchronization activity, detect errors, and evaluate the health of the entire system from a single location.

Administrators can use the central logger logs to:

• Verify that the system is running correctly

• Detect and resolve individual component and system-wide problems

• Audit individual and system-wide synchronization activity

• Track a user’s password synchronization between directory environments

There are two different types of logs:

• The audit log provides information about the system’s day-to-day activities, which includes important events such as a user’s password being synchronized between directories. You can control the level of information that is logged in the audit log by increasing or decreasing the detail provided in the log messages.

Identity Synchronization for Windows also writes all of the error log messages to the audit log to facilitate easy correlation with other events.

• The error log provides information about conditions qualified as severe errors and warnings. All error log entries are worthy of attention, so you cannot prevent errors from being logged. If an error condition takes place, it will always be documented in the error log.

Connectors

A connector is a Java process that manages the synchronization process in a single data source type. A connector detects user changes in the data source, and publishes these changes to remote connectors over Message Queue.

Identity Synchronization for Windows provides the following directory-specific connectors, which are responsible for bidirectionally synchronizing user attributes and password updates between directories and domains:

• Directory Server Connector: Supports a single root suffix (for example suffix/database) in a Directory Server

• Active Directory Connector: Supports a single instance in a Windows 2000 or Windows 2003 Server Active Directory environment. You may use multiple connectors for additional domains

• Windows NT Connector: Supports a single domain in a Windows NT environment

The Watchdog is installed anywhere you install a connector, and it is responsible for starting, restarting, and stopping the connectors. For more information, see Watchdog Process.

Connector Subcomponents

A subcomponent is a lightweight process or library that runs separately from the connector. Connectors use subcomponents to access native resources that cannot be accessed remotely, such as capturing passwords inside Directory Server or Windows NT.

The following connector subcomponents are configured or installed with the directory being synchronized and communicated with the corresponding connector over an encrypted connection.

• Directory Server Plug-in

• Windows NT Connector Subcomponents

Active Directory Connectors do not require subcomponents.

Directory Server Plug-in

The Directory Server Plug-in is a subcomponent of the Directory Server Connector. You configure the Directory Server Plug-in on each Directory Server being synchronized.

This Plug-in:

• Enhances the Directory Server Connector’s change-detection features by storing encrypted passwords in the Retro Changelog

• Provides bidirectional support for user attribute and password synchronization between Active Directory and Directory Server (see Using On-Demand Password Synchronization to Obtain Clear-Text Passwords

The Directory Server Plug-in is functional in a N-way, multimaster replication (MMR) environments. (Previously, Identity Synchronization for Windows supported two-way MMR only.)

Windows NT Connector Subcomponents

If your installation requires synchronization with Windows NT SAM Registries, the Identity Synchronization for Windows installation program installs the following in the Primary Domain Controller (PDC) along with the Windows NT Connector:

• Change Detector: Detects user entry and password change events by monitoring the Security Log, and then passes the changes to the Connector

• Password Filter: Captures password changes made on the NT Domain Controller and passes these securely to the NT Connector

Message Queue

Identity Synchronization for Windows uses Message Queue (a persistent message queue mechanism with a publish/subscribe model) to propagate attribute and password changes between directory sources and to distribute administrative and configuration information to the connectors managing synchronization for those directory sources.

Message Queue is an enterprise messaging system that implements the Java Message Service (JMS) open standard. The JMS specification describes a set of programming interfaces that provide a common way for Java applications to create, send, receive, and read messages in a distributed environment.

Message Queue consists of message publishers and subscribers that exchange messages using a common message service. This message service is composed of one or more dedicated message brokers, which are responsible for controlling access to the message queue, maintaining information about active publishers and subscribers, and ensuring that messages are delivered.

Message Queue is the best approach because it:

• Establishes a system of trust between connectors

• Simplifies security access controls for all components

• Facilitates end-to-end encryption of passwords

• Ensures that all password update messages are delivered

• Reduces connector-to-connector communication complexity and security risks

• Enables a central authority to distribute configuration information

• Allows for the aggregation of all connector logs in a central location