ActiveSync IAPIUser

• Processes user-related changes on a particular resource.

• Performs actions directly on the full User view before launching the designated workflow process.

Merges attributes from the ActiveSync event into the User view. 

Typical attributes on the Input Form include: 

• accounts[*].*

• waveset.*

• accountInfo.*

• activeSync.<LHS Attr Name>

• activeSync.resourceName

• activeSync.resourceId

• activeSync.resource

• display.session (session for Proxy Admin)

• global.<LHS Attr Name> (if set globals flag is set on resource)

ActiveSync IAPIProcess

• Processes generic events on a resource by creating a Process view.

• Top-level fields in Process view are arbitrary inputs to the task.

• Collects attributes related to launching the task under the global attribute.

• Writes the workflow to retrieve inputs from under global rather than as top-level attributes.

Launches the specified task with ActiveSync poll attributes dumped into top-level workflow global attribute.

Workflow attributes assume the form:global.<LHS Attr Name>

Process Rule 

Either the name of a TaskDefinition, or a rule that returns the name of a TaskDefinition, to run for every record in the feed. The process rule gets the resource account attributes in the activeSync namespace, as well as the resource ID and name.

A process rule controls all functionality that occurs when the system detects any change on the resource. It is used when full control of the account processing is required. As a result, a process rule overrides all other rules. 

If a process rule is specified, the process will be run for every row regardless of any other settings on this adapter. 

At minimum, a process rule must perform the following functions: 

• Query for a matching User view.

• If the User exists, checkout the view. If not, create the User.

• Update or populate the view.

• Checkin the User view.

  It is possible to synchronize objects other than User, such as LDAP Roles.

Correlation Rule 

If no Identity Manager user’s resource info is determined to own the resource account, Identity Manager invokes the Correlation Rule to determine a list of potentially matching users/accountIDs or Attribute Conditions, used to match the user, based on the resource account attributes (in the account namespace). 

The rule returns one of the following pieces of information that can be used to correlate the entry with an existing Identity Manager account: 

• Identity Manager user name

• WSAttributes object (used for attribute-based search)

• List of items of type AttributeCondition or WSAttribute (AND-ed attribute-based search)

• List of items of type String (each item is the Identity Manager ID or the user name of an Identity Manager account)

  If more than one Identity Manager account can be identified by the correlation rule, you need a confirmation rule or resolve process rule to handle the matches.

  For the Database Table, Flat File, and PeopleSoft Component Active Sync adapters, the default correlation rule is inherited from the reconciliation policy on the resource.

  The same correlation rule can be used for reconciliation and Active Sync. See Correlation and Confirmation Rules for more information.

Confirmation Rule 

Rule that is evaluated for all users that are returned by a correlation rule. For each user, the full User view of the correlation Identity Manager identity and the resource account information (placed under the “account.” namespace) are passed to the confirmation rule. The confirmation rule is then expected to return a value that can be expressed like a Boolean value. For example, “true” or “1” or “yes” and “false” or “0” or null.

For the Database Table, Flat File, and PeopleSoft Component Active Sync adapters, the default confirmation rule is inherited from the reconciliation policy on the resource. 

The same confirmation rule can be used for reconciliation and Active Sync. See Correlation and Confirmation Rules for more information.

Delete Rule 

A rule that can expect a map of all values with keys of the form activeSync. or account. A LighthouseContext object (display.session) based on the proxy administrator’s session is made available to the context of the rule. The rule is then expected to return a value that can be expressed like a Boolean value. For example, “true” or “1” or “yes” and “false” or “0” or null.

If the rule returns true for an entry, the account deletion request will be processed through forms and workflow, depending on how the adapter is configured. 

Resolve Process Rule 

Either the name of the TaskDefinition or a rule that returns the name of a TaskDefinition to run in case of multiple matches to a record in the feed. The Resolve Process rule gets the resource account attributes as well as the resource ID and name.

This rule is also needed if there were no matches and Create Unmatched Accounts is not selected.

This workflow could be a process that prompts an administrator for manual action. 

Create Unmatched Accounts 

If set to true, creates an account on the resource when no matching Identity Manager user is found. If false, Identity Manager does not create the account unless the process rule is set and the workflow it identifies determines that a new account is warranted. The default is true. 

Populate Global 

If set to true, populates the global namespace in addition to the activeSync namespace. The default value is false. 

<Field name=’waveset.password’> 
   <Disable> 
      <neq> 
         <ref>feedOp</ref> 
         <s>create</s> 
      </neq> 
   </Disable> 
   <expression> 
      <cond> 
         <notnull> 
            <ref>activeSync.password</ref> 
         </notnull> 
         <ref>activeSync.password</ref> 
         <s>change12345</s> 
      </cond> 
   </expression> 
</Field>