Configuring the Database User Management Connector for MySQL

4.1 Basic Configuration Parameters for MySQL

These are the connection-related parameters that Oracle Identity Governance requires to connect to MySQL.

Table 4-1 Basic Configuration Parameters for MySQL

Parameter	Mandatory?	Description
Connection Properties	No	Enter the connection properties for the target system database.
Connection URL	Yes	Enter the connection URL for your MySQL database. Default value: `jdbc:mysql://%h:%p/database`
Connector Server Name	No	If you created an IT resource of the type “Connector Server”, then enter its name.
Database Drivers	Yes	This parameter holds the name of the JDBC driver class. Default value: `com.mysql.jdbc.Driver`
Database Type	Yes	This parameter identifies the database type (such as Oracle or MySQL) and is used for loading respective scripts.
Password	Yes	Enter the password for the user name of the target system account to be used for connector operations.
User	Yes	Enter the user name of the target system account to be used for connector operations. Sample value: `root`

4.2 Advanced Settings Parameters for MySQL

These are the configuration-related entries that the connector uses during reconciliation and provisioning operations.

Note:

Unless specified, the parameters in the table are applicable to both target and authoritative applications.

Table 4-2 Advanced Setting Parameters for MySQL

Parameter	Mandatory?	Description
Connector Name	Yes	This parameter holds the name of the connector class. Value: `org.identityconnectors.dbum.DBUMConnector`
Connector Package Name	Yes	This parameter holds the name of the connector bundle package. Value: `org.identityconnectors.dbum`
Connector Package Version	Yes	This parameter holds the version of the connector bundle class. Value: 1.0.1116
disableValuesSet	No	Enter the possible values for the disabled status of a user. Default value: `"EXPIRED & LOCKED","LOCKED","EXPIRED"`
Reserve Keywords	No	Enter the list of words that are reserved and are not allowed to be used in the names of the connector artifacts Default value: `"DROP","INSERT","ALTER","CREATE", "DELETE","UPDATE","GRANT","TRUNCATE", "EXEC","TEMPORARY","TABLESPACE","DEFAULT", "QUOTA","PROFILE","IDENTIFIED","EXTERNALLY", "AS","GLOBALLY","REVOKE","ACCOUNT","UNLOCK", "LOCK","CASCADE"` Note: This parameter is available only when you are creating a target application.
Unsupported Character Set	No	Enter the characters that are not allowed to be used in the names of the connector artifacts Default value: "&","--","~","`","\"" Note: This parameter is available only when you are creating a target application.
Pool Max Idle	No	Maximum number of idle objects in a pool. Sample value: `10`
Pool Max Size	No	Maximum number of connections that the pool can create. Sample value: `10`
Pool Max Wait	No	Maximum time, in milliseconds, the pool must wait for a free object to make itself available to be consumed for an operation. Sample value: `150000`
Pool Min Evict Idle Time	No	Minimum time, in milliseconds, the connector must wait before evicting an idle object. Sample value: `120000`
Pool Min Idle	No	Minimum number of idle objects in a pool. Sample value: `1`

4.3 Attribute Mappings for MySQL

The attribute mappings on the Schema page vary depending on whether you are creating a target application or an authoritative application.

4.3.1 Attribute Mappings for a MySQL Target Application

The Schema page for a target application displays the default schema (provided by the connector) that maps Oracle Identity Governance attributes to target system columns. The connector uses these mappings during reconciliation and provisioning operations.

MySQL DB User Account Attributes

Table 4-3 lists the user-specific attribute mappings between the process form fields in Oracle Identity Governance and MySQL columns. The table also lists whether a specific attribute is used during provisioning or reconciliation and whether it is a matching key field for fetching records during reconciliation.

If required, you can edit the default attribute mappings by adding new attributes or deleting existing attributes as described in Creating a Target Application of Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 4-3 Default Attribute Mappings for MySQL DB User Account

Display Name	Target Attribute	Data Type	Mandatory Provisioning Property?	Provision Field?	Recon Field?	Key Field?	Case Insensitive?
Return Id	__UID__	String	No	Yes	Yes	Yes	Yes
Username	__NAME__	String	Yes	Yes	Yes	Yes	Yes
User Password	__PASSWORD__	String	No	Yes	No	No	No

Figure 4-1 shows the default User account attribute mappings.

Figure 4-1 Default Attribute Mappings for MySQL User Account

Description of "Figure 4-1 Default Attribute Mappings for MySQL User Account"

Privilege List Entitlement Attributes

Table 4-4 lists the roles-specific attribute mappings between the process form fields in Oracle Identity Governance and MySQL columns. The table lists whether a given attribute is mandatory during provisioning. It also lists whether a given attribute is used during reconciliation and whether it is a matching key field for fetching records during reconciliation.

If required, you can edit the default attribute mappings by adding new attributes or deleting existing attributes as described in Creating a Target Application of Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 4-4 Default Attribute Mappings for MySQL Privilege List Entitlement

Display Name	Target Attribute	Data Type	Mandatory Provisioning Property?	Recon Field	Key Field?	Case Insensitive?
Privilege	privileges~DBPrivilege~__NAME__	String	Yes	Yes	Yes	No

Figure 4-2 shows the default Privilege List entitlement mapping.

Figure 4-2 Default Attribute Mappings for MySQL Privilege List Entitlement

Description of "Figure 4-2 Default Attribute Mappings for MySQL Privilege List Entitlement"

4.3.2 Attribute Mappings for a MySQL Authoritative Application

The Schema page for an authoritative application displays the default schema (provided by the connector) that maps Oracle Identity Governance attributes to target system columns. The connector uses these mappings during reconciliation operations.

Table 4-5 lists the user-specific attribute mappings between the reconciliation fields in Oracle Identity Governance and Oracle Database columns. The table also lists the data type for a given attribute and specified whether it is a mandatory attribute for reconciliation.

If required, you can edit these attributes mappings by adding new attributes or deleting existing attributes on the Schema page as described in Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

You may use the default schema that has been set for you or update and change it before continuing to the next step.

The Organization Name, Role, Xellerate Type, and Status identity attributes are mandatory fields on the OIG User form. They cannot be left blank during reconciliation. The target attribute mappings for these identity attributes are empty by default because there are no corresponding columns in the target system. Therefore, the connector provides default values (as listed in the “Default Value for Identity Display Name” column of Table 4-5) that it can use during reconciliation. For example, the default target attribute value for the Organization Name attribute is Xellerate Users. This implies that the connector reconciles all target system user accounts into the Xellerate Users organization in Oracle Identity Governance. Similarly, the default attribute value for Xellerate Type attribute is End-User, which implies that all reconciled user records are marked as end users.

Table 4-5 MySQL DB User Schema Attributes

Identity Display Name	Target Attribute	Data Type	Mandatory Reconciliation Property?	Recon Field?	Default Value for Identity Display Name
Organization Name	NA	String	No	Yes	Xellerate Users
Role	NA	String	No	Yes	Full-Time
User Login	__UID__	String	No	Yes	NA
Last Name	__NAME__	String	No	Yes	NA
Xellerate Type	NA	String	No	Yes	End-User
Status	NA	String	No	Yes	Active

Figure 3-4 shows the default User account attribute mappings.

Figure 4-3 Default Attribute Mappings for a MySQL User Account in an Authoritative Application

Description of "Figure 4-3 Default Attribute Mappings for a MySQL User Account in an Authoritative Application"

4.4 Correlation Rules for MySQL

Learn about the predefined rules, responses and situations for Target and Authoritative applications. The connector use these rules and responses for performing reconciliation.

4.4.1 Correlation Rules for a MySQL Target Application

The connector uses correlation rules to determine the identity to which Oracle Identity Governance must assign a resource.

Predefined Identity Correlation Rules

By default, the Database User Management connector provides a simple correlation rule when you create a Target application. The connector uses this correlation rule to compare the entries in Oracle Identity Governance repository and the target system repository, determine the difference between the two repositories, and apply the latest changes to Oracle Identity Governance.

Table 4-6 lists the default simple correlation rule for MySQL. If required, you can edit the default correlation rule or add new rules. You can create complex correlation rules also. For more information about adding or editing simple or complex correlation rules, see Creating a Target Application of Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 4-6 Predefined Identity Correlation Rule for MySQL

Target Attribute	Element Operator	Identity Attribute	Case Sensitive?
__NAME__	Equals	User Login	No

In this identity rule:

__NAME__ is a single-valued attribute on the target system that identifies the user account.
User Login is the field on the OIM User form.

Figure 3-5 shows the simple correlation rule for MySQL.

Figure 4-4 Simple Correlation Rule for MySQL

Description of "Figure 4-4 Simple Correlation Rule for MySQL"

Predefined Situations and Responses

The Database User Management connector provides a default set of situations and responses when you create a Target application. These situations and responses specify the action that Oracle Identity Governance must take based on the result of a reconciliation event.

Table 4-7 lists the default situations and responses for MySQL. If required, you can edit these default situations and responses or add new ones. For more information about adding or editing situations and responses, see Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance

Table 4-7 Predefined Situations and Responses for MySQL

Situation	Response
No Matches Found	Assign to Administrator With Least Load
One Entity Match Found	Establish Link
One Process Match Found	Establish Link

Figure 3-6 shows the situations and responses for MySQL that the connector provides by default.

Figure 4-5 Predefined Situations and Responses for MySQL

Description of "Figure 4-5 Predefined Situations and Responses for MySQL"

4.4.2 Correlation Rules for a MySQL Authoritative Application

When you create an Authoritative application, the connector uses correlation rules to determine the identity that must be reconciled into Oracle Identity Governance.

Predefined Identity Correlation Rules

By default, the Database User Management connector provides a simple correlation rule when you create an Authoritative application. The connector uses this correlation rule to compare the entries in Oracle Identity Governance repository and the target system repository, determine the difference between the two repositories, and apply the latest changes to Oracle Identity Governance.

Table 4-8 lists the default simple correlation rule for a MySQL authoritative application. If required, you can edit the default correlation rule or add new rules. You can create complex correlation rules also. For more information about adding or editing simple or complex correlation rules, see Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

Table 4-8 Predefined Identity Correlation Rule for a MySQL Authoritative Application

Target Attribute	Element Operator	Identity Attribute	Case Sensitive?
__UID__	Equals	User Login	No

In this identity rule:

__UID__ is an attribute on the target system that uniquely identifies the user account.
User Login is the field on the OIM User form.

Figure 3-7 shows the simple correlation rule for MySQL.

Figure 4-6 Simple Correlation Rule for a MySQL Authoritative Application

Description of "Figure 4-6 Simple Correlation Rule for a MySQL Authoritative Application"

Predefined Situations and Responses

The Database User Management connector provides a default set of situations and responses when you create an Authoritative application. These situations and responses specify the action that Oracle Identity Governance must take based on the result of a reconciliation event.

Table 4-9 lists the default situations and responses for MySQL. If required, you can edit these default situations and responses or add new ones. For more information about adding or editing situations and responses, see Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance

Table 4-9 Predefined Situations and Responses for a MySQL Authoritative Application

Situation	Response
No Matches Found	Create User
One Entity Match Found	Establish Link

Figure 3-8 shows the situations and responses for Oracle Database that the connector provides by default.

Figure 4-7 Predefined Situations and Responses for a MySQL Authoritative Application

Description of "Figure 4-7 Predefined Situations and Responses for a MySQL Authoritative Application"

4.5 Reconciliation Jobs for MySQL

These are the reconciliation jobs that are automatically created in Oracle Identity Governance after you create the application for your target system.

You can either use these predefined jobs or edit them to meet your requirements. Alternatively, you can create custom reconciliation jobs. For information about editing these predefined jobs or creating new ones, see Updating Reconciliation Jobs in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.

User Reconciliation Jobs

The following reconciliation jobs are available for reconciling user data:

DBUM MySQL User Target Reconciliation: Use this reconciliation job to reconcile user data from a Target application.
DBUM MySQL User Trusted Reconciliation: Use this reconciliation job to reconcile user data from an Authoritative application.

The parameters for both these jobs are the same.

Table 4-10 Parameters of the User Reconciliation Jobs for MySQL

Parameter	Description
Application Name	Name of the application you created for your target system. This value is the same as the value that you provided for the Application Name field while creating your target application. Do not modify this value.
Batch Size	Enter the number of records that must be included in each batch fetched from the target system during reconciliation.
Filter	Enter the expression for filtering records that the scheduled job must reconcile. Sample value: `equalTo('__UID__','SEPT12USER1')` For information about the filters expressions that you can create and use, see ICF Filter Syntax in Developing and Customizing Applications for Oracle Identity Governance.
Object Type	Type of object you want to reconcile. Default value: `User`
Scheduled Task Name	Name of the scheduled job. Note: For the scheduled job included with this connector, you must not change the value of this attribute. However, if you create a new job or create a copy of the job, then enter the unique name for that scheduled job as the value of this attribute.

Delete User Reconciliation Jobs

The following reconciliation jobs are available for reconciling data about deleted user accounts:

DBUM MySQL Delete User Target Reconciliation: Use this reconciliation job to reconcile data about deleted user accounts from a Target application.
DBUM MySQL Delete User Trusted Reconciliation: Use this reconciliation job to reconcile data about deleted user accounts from an Authoritative application.

The parameters for both these jobs are the same.

Table 4-11 Parameters of the Delete User Reconciliation Jobs for MySQL

Parameter Description

Application Name

Name of the application you created for your target system. This value is the same as the value that you provided for the Application Name field while creating your target application.

Do not modify this value.

Object Type

Type of object you want to reconcile.

Default value: User

Reconciliation Jobs for Entitlements

Use the DBUM MySQL Privilege Type Lookup Reconciliation job to reconcile the list of privileges from your target system. This job is available only for a Target application.

Table 4-12 Parameters of the DBUM MySQL Privilege TypeLookup Reconciliation Job

Parameter	Description
Application Name	Name of the application you created for your target system. This value is the same as the value that you provided for the Application Name field while creating your target application. Do not modify this value.
Lookup Name	This parameter holds the name of the lookup definition that maps each lookup definition with the data source from which values must be fetched. Default value: `Lookup.DBUM.MySQL.SchemaPrivileges`
Object Type	Enter the type of object whose values must be synchronized. Default value: `__PRIVILEGES__` Note: Do not change the value of this attribute.
Code Key Attribute	Enter the name of the connector or target system attribute that is used to populate the Code Key column of the lookup definition (specified as the value of the Lookup Name attribute). Default value: `__NAME__` Note: Do not change the value of this attribute.
Decode Attribute	Enter the name of the connector or target system attribute that is used to populate the Decode column of the lookup definition (specified as the value of the Lookup Name attribute). Default value: `__NAME__`