Setting Up Active Directory Synchronization Failover

Step 1: Configure the Active Directory Synchronization Recovery Collector Task

• Configure the maximum number of hours to retain data. The default value is seven days. This value controls how far back the HighestCommittedUSN values are kept.

  You must configure one workflow per Active Sync resource that must be configured.

• Schedule this task from the Task page of the Identity Manager Administrator interface. The polling interval, which establishes how often to contact each host for their HighestCommittedUSN value, is set by the task schedule.

  When this task is executed, it calls out to the Active Directory adapter to retrieve the HighestCommittedUSN number from each domain controller’s rootDSE. It then stores this value in an Identity Manager configuration object. The task generates one configuration object per defined Active Sync resource to store alternate domain controller HighestCommittedUSN values.

Step 2: Define the Active Directory On-Error Process Active Sync Attribute

On each Active Directory Active Sync resource, Identity Manager defines an onError process that is called when a failure occurs during the synchronization of a resource. If an Active Directory resource defines an on-error process, this process is called if there errors occur when the poll method is called on the resource during active synchronization. This process checks the result from the IAPI objects, and if an error occurs, calls the defined process.

Configure this process to notify an administrator through email when an error occurs. Include the error text in the email body so that the administrator can determine if the error warrants that Identity Manager fails over to another domain controller.

Using the error text, the administrator is alerted to a potentially lengthy outage or an outrage due to a temporary, quickly resolved issue (such as a temporary routing issue that is resolved by the next poll attempt).

Step 3: Run Active Directory Synchronization Failover Task for the Failed Resource

If the domain controller returns an error that warrants failing over to another domain controller, run the Active Directory Synchronization Failover task from the Task page.

For manual fail-over mode, the fail-over task requests

• The name of the downed domain controller or resource

• The name of the DC hostname to fail over

• The timestamp of the collected HighestCommittedUSN value to use

You also must choose whether to restart Active Sync after the switch to a new domain controller is complete.

How the Task Works

When executed, the Active Directory Synchronization Failover task

Task Actions

1. Stops the Active Sync process on the failed resource

2. Reads in the fail over configuration object

3. Changes necessary resource attribute values

4. Optionally restarts the Active Sync process.

Example of Synchronization Failure Workflow

You can configure the following example workflow as the On Synchronization Failure Process resource attribute of an Active Directory resource. The workflow looks for the java.net.UnknownHostException error message. If it finds this message, the workflow launches a notification email to the administrator.

<TaskDefinition name=’Sample AD Sync On Error Workflow’
  executor=’com.waveset.workflow.WorkflowExecutor’
   syncControlAllowed=’true’ execMode=’sync’
   taskType=’Workflow’>
   <Extension>
      <WFProcess title=’Example AD Sync OnError Workflow’>
         <Variable name=’resultErrors’ input=’true’>
           <Comments>Errors returned from the resource.
           </Comments>
         </Variable>
        <Variable name=’resourceName’ input=’true’>
           <Comments>Name of the AD resource that returned the errors.
            </Comments>
         </Variable>
        <Variable name=’failureTimestamp’ input=’true’>
           <Comments>Failure timestamp, when it occurred.
           </Comments>
         </Variable>
        <Activity name=’start’>
           <Transition to=’checkErrors’/>
         </Activity>
         <Activity name=’checkErrors’>
           <Variable name=’criticalError’>
            <Comments>Local variable to hold if we need to notify
            </Comments>
           </Variable>
        <Action name=’iterateMessage’>
           <dolist name=’msg’>
             <ref>resultErrors</ref>
               <cond>
                 <match>
             <ref>msg</ref>
               <s>java.net.UnknownHostException</s>
                 </match>
                   <set name=’criticalError’>
                    <s>true</s>
                   </set>
               </cond>
           </dolist>
         </Action>
        <Transition to=’notify’>
           <notnull>
             <ref>criticalError</ref>
           </notnull>
         </Transition>
         <Transition to=’end’/>
         </Activity>
        <Activity name=’notify’>
           <Action application=’notify’>
             <Argument name=’template’    
                       value=’#ID#EmailTemplate:ADSyncFailoverSample’/>
             <Argument name=’resultErrors’ value=’$(resultErrors)’/>
           </Action>
         <Transition to=’end’/>
         </Activity>
        <Activity name=’end’/>
      </WFProcess>
    </Extension>
</TaskDefinition>