Approach Used for Reconciliation

Deployment Configurations 4-11 At the end of full reconciliation, the connector typically sets the last execution time parameter to the time when the reconciliation run ends. For the next reconciliation run, only the entity records that have been added, modified, or deleted after the first reconciliation run ended are fetched for reconciliation. This is called incremental reconciliation. You can manually switch from incremental reconciliation to full reconciliation by setting the value of the timestamp IT resource parameter to 0.

4.2.2 Reconciliation Architecture

Reconciliation is the process of pulling entity data from the target system into Oracle Identity Manager to keep the entity data in a consistent state between the two systems. The various components of Oracle Identity Manager involved in reconciliation and the interaction between these components are shown in the Figure 4–7 : Figure 4–7 Reconciliation Architecture The reconciliation architecture is described in the following steps: 1. Each connector has scheduled tasks associated with it. The scheduler triggers the connector scheduled task, which invokes reconciliation APIs to generate events. The event can be of type Regular, Changelog, or Delete. For more information about the scheduler, see Managing Scheduled Tasks for information about the Scheduler in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. For more information about scheduled tasks, see Connector for Reconciliation on page 4-21. 2. The reconciliation events are stored in the reconciliation event repository, which is Oracle Identity Manager database. Reconciliation Connector Scheduled Task Reconciliation APIs Other Oracle Identity Manager Components Reconciliation Process Reconciliation Event Repository Oracle Identity Manager Repository PLSQL Stored Procedure Kernel Reconciliation Event Manager Configuration APIs Action PLSQL Layer Action JAVA Layer Create Modify Delete in Bulk Create Modify Delete Action Rules Reconciliation Field Mappings Matching Rules 4-12 Oracle Fusion Middleware Users Guide for Oracle Identity Manager 3. When batch size is met, an asynchronous message is submitted which processes the batch of events in bulk. At the end of the schedule task another asynchronous message is submitted for processing the events of the last batch. 4. The processing involves data validation, matching of the entities and action create, update, delete and so on. This is followed by post processing via kernel orchestrations. For information about the action module, see Action Module on page 4-16. For information about the reconciliation profile, see New Metadata Model-Profile in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. 5. By default the reconciliation event processing happens in bulk, and therefore all the steps till post processing are performed by PLSQL stored procedures. Event can be processed one at a time in the following scenarios in this case all the steps till matching are done in PLSQL and the action is performed in java layer: ■ When events are processed from the Reconciliation Management console ■ When failed events are retried by the retry scheduled task that runs periodically For reconciliation single event processing, actions and post processing take place through the kernel. 6. Reconciliation events are made available to the Reconciliation Management console by another API call in the reconciliation management service. The functionality of various components of the reconciliation service are explained in the following sections: ■ Reconciliation Profile ■ Reconciliation Metadata ■ Reconciliation Target ■ Reconciliation Run ■ Reconciliation APIs ■ Reconciliation Schema ■ Reconciliation Engine ■ Reconciliation Best Practices ■ Connector for Reconciliation ■ Archival ■ Backward Compatibility Note: ■ In Figure 4–7 , the reconciliation engine encapsulates the Action JAVA Layer as well as parts of the Reconciliation Event Repository, and orchestrates all the arrows in that diagram. ■ In this release, trusted source reconciliation is supported for users only. It is not supported for roles, role membership, and role hierarchy reconciliation. ■ In this release, Oracle Identity Manager supports trusted source reconciliation and account reconciliation for organizations.