|
| |
| Sun Java System Identity Synchronization for Windows 1 2004Q3 Installation and Configuration Guide | |
Chapter 6
Synchronizing Existing UsersThe Identity Synchronization for Windows command line utility provides the idsync resync subcommand to bootstrap deployments with existing users. This command uses administrator-specified matching rules to link existing entries, to populate an empty directory with the contents of a remote directory, or to bulk-synchronize attribute values (including passwords) between two existing user populations.
This chapter explains how to use the idsync resync subcommand to link and synchronize existing users for new Identity Synchronization for Windows installations. In addition, this chapter provides instructions for starting and stopping synchronization and services. The information is organized as follows:
Note
You must finish installing Core and the Connectors before trying to link and synchronize existing users.
For more information about the idsync resync subcommand, see Appendix A, "Using the Identity Synchronization for Windows Command Line Utilities."
Table 6-1 summarizes the post-installation steps to follow based on existing user populations:
Using idsync resyncThis section explains linking and synchronizing processes, describes the proper syntax for using the idsync resync subcommand, and explains how to verify that the processes completed successfully. The information is organized as follows:
Resynchronizing Users
Note
Before starting synchronization for your deployment, verify that all existing users are synchronized between servers.
You can use the idsync resync command to link existing entries, create users, and synchronize user attributes in two directory sources. Specifically, you can use the idsync resync command to
- Populate an empty Directory Server with existing Active Directory or Windows NT SAM domain users
- Link all users and then synchronize all user entry attribute values (other than passwords) in two existing directory sources
- Synchronize user entries when two directory sources become out of sync
- “Prime” the Active Directory and Windows NT SAM Connectors object cache database, which maintains a shadow copy of the Active Directory or Windows NT SAM user entries.
You cannot use the idsync resync command to synchronize passwords (except to invalidate Directory Server passwords to force on-demand password synchronization in an Active Directory environment).
Linking Users
After populating Active Directory and Directory Server with users and installing the Active Directory and Directory Server Connectors (before starting synchronization), you must use the idsync resync command to ensure that all existing users are linked in the two directory sources.
What is linking? Identity Synchronization for Windows correlates the same user on Directory Server and on Windows by storing the following unique, immutable identifiers:
Storing this immutable identifier allows Identity Synchronization for Windows to synchronize other key identifiers, such as uid and cn. The dspswuserlink attribute is populated when:
- Identity Synchronization for Windows creates a new user in Directory Server (after a new user is synchronized from Windows or by running
idsync resync -c)- Identity Synchronization for Windows creates a new user on Windows
(after synchronizing a new user from Directory Server or by running
idsync resync -c -o Sun)- You run idsync resync -c -f to link entries that already exist on Directory Server and Windows as described in this chapter.
To link existing users, you must provide rules for matching users between the two directories. For example, to link a user entry in two directories, both the first names and last names must match in both directory entries.
Linking user entries and resolving data conflicts could be described as more art than science. There are many reasons why the idsync resync subcommand might fail to link two users in opposing directory sources and depends to a large extent on the consistency of the data in the linked directories.
One strategy for using idsync resync is to use the -n argument, which runs the operation in “safe mode” so you can preview the effects of an operation with no actual changes. Running in safe mode allows you to refine the linking criteria gradually until you find an optimum set of user matching criteria.
However, you should be aware that there is a balance to be achieved through linkage accuracy and linkage coverage.
For example, if both directory sources contain an employee ID or social security number, you might begin with linking criteria that includes this number only. You might think that to improve linkage accuracy, you should include a last name attribute in the criteria as well. However, you could lose linkages because entries that would have matched on ID alone did not match because there were inconsistent last name values in the data. You will have to go through a data cleansing process for entries that fail to link.
idsync resync Arguments
The idsync resync command accepts the following arguments:
Table 6-2 idsync resync Usage
Argument
Meaning
-f <filename>
Creates links between unlinked user entries using one of the specified XML configuration files provided by Identity Synchronization for Windows
(see Appendix B, "LinkUsers XML Document Sample")-k
Creates links between unlinked users only (does not create users or modify existing users). You must use this argument in combination with the -f argument.
-a <ldap-filter>
Specifies an LDAP filter to limit the entries to be synchronized
The filter will be applied to the source of the resynchronization operation.
For example, if you specify idsync resync -o Sun -a “usid=*” all Directory Server users that have a uid attribute will be synchronized to Active Directory.-l <sul-to-sync>
Specifies individual Synchronization User Lists (SULs) to resynchronize
Note: You can specify multiple SUL IDs to resynchronize multiple SULs or, if you do not specify any SUL IDs, the program will resynchronize all of your SULs.
-o (Sun | Windows)
Specifies the source of the resynchronization operation
(Default is Windows.)
-c
Creates a user entry automatically if the corresponding user is not found at destination
Note: Identity Synchronization for Windows will attempt to create users even if you have not configured creations in that direction. For example, if you have not configured Identity Synchronization for Windows to synchronize from Windows to Sun (or vice versa), but you specify the -c argument, Identity Synchronization for Windows will try to create users that are not found.
-i (ALL_USERS | NEW_USERS | NEW_LINKED_USERS)
Resets passwords for user entries synchronized in a Sun directory source, forcing password synchronization within the current domain for those users the next time the user password is required.
See Table 6-3 for more information about how these options affect password validation.
-u
Updates the object cache.
This argument updates the local cache of user entries for a Windows directory source only, which prevents pre-existing Windows users from being created in Directory Server. If you use this argument, Windows user entries are not synchronized with Directory Server user entries. This argument is valid only when the resync source is Windows.
-x
Deletes all destination user entries that do not match a source entry.
-n
Runs in safe mode so you can preview the effects of an operation with no actual changes.
Table 6-4 provides examples to illustrate the results of combining different arguments (The –h, -p, -D, -w, -, and -s arguments are defaulted and have been omitted for brevity).
Checking Results in the Central LogThe results of all idsync resync operations are reported in a special central log named resync.log. This log lists all of the users that were properly linked and synchronized, those that failed to link, and those that were previously linked.
Note
Some pre-existing special Active Directory users (such as Administrator and Guest) might appear in this log as failures.
Starting and Stopping SynchronizationStarting and stopping synchronization does not start or stop individual java processes, daemons, or services. Once you begin synchronization, stopping synchronization only pauses the operation. When you restart synchronization, the program resumes synchronization from where it stopped and no changes will be lost.
To start or stop synchronization:
- In the Sun Java System Server Console navigation pane, select the Identity Synchronization for Windows instance.
- When the Identity Synchronization for Windows pane is displayed, click the Open button in the upper right corner.
- When you are prompted, enter the configuration password.
- Select the Tasks tab (Figure 6-1):
Figure 6-1 Starting and Stopping Synchronization
- To start synchronization, click Start Synchronization.
- To stop synchronization, click Stop Synchronization.
Note
You can also start and stop synchronization using the idsync startsync and idsync stopsync command line utilities. For detailed instructions, see Using startsync and Using stopsync.
Starting and Stopping ServicesIdentity Synchronization for Windows and Message Queue are installed as daemons on Solaris and as services on Windows. These processes start automatically when the system boots, but you can also start and stop them manually, as follows:
- On Solaris: From the command line,
- On Windows:
- From the Windows Start menu:
- Select Start > Settings > Control Panel > Administrative Services.
- When the Administrative Services dialog box is displayed, double-click the Services icon to open the Services dialog box.
- Select Identity Synchronization for Windows and then select
Action > Start (or Stop) from the menu bar. Repeat for iMQ Broker.- From the command line, enter the net command to control the services.
Note
Pause 30 seconds after stopping the Identity Synchronization for Windows daemon/service before starting it again. Connectors can take several seconds to cleanly shut themselves down.
