Functional Architecture of Generic Technology Connectors

18-6 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager ■ Full and Incremental Reconciliation ■ Batched Reconciliation ■ Reconciliation of Multivalued Attribute Data Child Data Deletion ■ Failure Threshold for Stopping Reconciliation

18.3.1.1 Trusted Source Reconciliation

A generic technology connector can be used for trusted source reconciliation. During reconciliation in trusted mode: ■ If the reconciliation engine detects new target system accounts, it creates corresponding Oracle Identity Manager users. ■ If the reconciliation engine detects changes to existing target system accounts, the same changes are made in the corresponding Oracle Identity Manager users. A generic technology connector that is used for trusted source reconciliation cannot be used for provisioning. This design feature was incorporated to ensure that you do not create or modify through Oracle Identity Manager user account information on a target system that is designated as a trusted source. Connector objects, such as IT resources and resource objects, are created automatically at the end of the generic technology connector creation process. By default, the resource object of a generic technology connector is a trusted resource object. In other words, a generic technology connector is already compatible with the Multiple Trusted Source reconciliation feature. This feature is discussed in Chapter 12, Developing Provisioning Processes .

18.3.1.2 Account Status Reconciliation

User account status information is used to track whether or not the owner of a target system account is to be allowed to access and use the account. If the target system does not store account status information in the format in which it is stored in Oracle Identity Manager, you can use the predefined translation transformation provider to implement account status reconciliation. Note: While creating a generic technology connector, if you do not select the Trusted Source reconciliation option, target resource reconciliation is enabled. In target resource reconciliation, only modifications to target system accounts are reconciled. New target system accounts detected during reconciliation are not created automatically in Oracle Identity Manager. Note: In trusted source reconciliation, the reconciliation of multivalued child data is not supported. Understanding Generic Technology Connectors 18-7

18.3.1.3 Full and Incremental Reconciliation

While creating a generic technology connector, you can specify that you want to use the connector for full or incremental reconciliation. You select incremental reconciliation if the target system supports a method for the reconciliation engine to identify records that have changed since the last reconciliation run. For example, if the target system time stamps the creation of or changes made to user records, the reconciliation engine can identify records that have been added or modified since the last reconciliation run. In incremental reconciliation, only target system records that have changed after the last reconciliation run are reconciled stored into Oracle Identity Manager. You select full reconciliation if any one of the following conditions is true: ■ The target system does not support any method for the reconciliation engine to identify records that have changed since the last reconciliation run. ■ You want to perform first-time reconciliation of all user account records in the target system. In full reconciliation, all the reconciliation records are extracted from the target system. However, the optimized reconciliation feature identifies and ignores records that have already been reconciled in Oracle Identity Manager. This helps reduce the space occupied by reconciliation data. If this feature were not present, the amount of data stored in the Oracle Identity Manager database would increase rapidly with each reconciliation run.

18.3.1.4 Batched Reconciliation

You can specify a batch size for reconciliation. By doing this, you can break into batches the total number of records that the reconciliation engine fetches from the target system during each reconciliation run. This feature provides more control over the reconciliation process.

18.3.1.5 Reconciliation of Multivalued Attribute Data Child Data Deletion

You can specify whether or not you want to reconcile into Oracle Identity Manager the deletion of multivalued attribute data on the target system. Note: User account status reconciliation can be implemented independently of whether you select trusted source or target resource reconciliation. The Design Console offers features for implementing account status reconciliation, without using the translation transformation provider. For more information, see Section 12.3.2.2, Reconciliation Field Mappings Tab . Note: The outcome of both full and incremental reconciliation is the same: ■ All the target system records are reconciled during the first reconciliation run. ■ From the second reconciliation run onward, target system records that are created or updated after the last reconciliation run are reconciled into Oracle Identity Manager. 18-8 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager

18.3.1.6 Failure Threshold for Stopping Reconciliation

During reconciliation, validation providers can be used to run checks on target system data before it is stored in Oracle Identity Manager. You can set a failure threshold to automatically stop a reconciliation run if the percentage of records that fail the validation checks to the total number of records processed exceeds the specified threshold percentage.

18.3.2 Other Features

The following features are not specific to the reconciliation or provisioning module: ■ Custom Data Fields and Field Mappings ■ Custom Providers ■ Multilanguage Support ■ Custom Date Formats ■ Propagation of Changes in Oracle Identity Manager User Attributes to Target Systems

18.3.2.1 Custom Data Fields and Field Mappings

While creating a generic technology connector, you can specify the identity fields and field mappings data flow paths that must be used during reconciliation and provisioning.

18.3.2.2 Custom Providers

You can create custom providers if the predefined providers shipped with Oracle Identity Manager do not address the transport, format change, validation, or transformation requirements of your operating environment.

18.3.2.3 Multilanguage Support

Generic technology connectors can handle both ASCII and non-ASCII data multibyte characters, which represent a user, an account, or some other type of provisioned resource object.

18.3.2.4 Custom Date Formats

While creating a generic technology connector, you can specify: ■ The format of date values in target system records that are extracted during reconciliation ■ The format in which date values must be sent to the target system during provisioning Note: Generic technology connectors do not support the reconciliation of parent data deletion. For example, if the account of user John Doe is deleted from the target system, you cannot use a generic technology connector to reconcile this user account deletion into Oracle Identity Manager. Understanding Generic Technology Connectors 18-9

18.3.2.5 Propagation of Changes in Oracle Identity Manager User Attributes to Target Systems

While creating a generic technology connector, you can enable the automatic propagation of changes in Oracle Identity Manager User attributes to the target system.

18.4 Connector Objects Created by the Generic Technology Connector Framework

The list of connector objects created by the generic technology connector framework depends on the combination of the reconciliation and provisioning options that you select on the Step 1: Basic Information page: ■ Both Reconciliation and Provisioning Are Selected ■ Only Reconciliation Is Selected ■ Only Provisioning Is Selected

18.4.1 Both Reconciliation and Provisioning Are Selected

The following objects are created when you select both the provisioning and reconciliation options on the Step 1: Basic Information page: ■ IT resource type The parameters of the IT resource type are the run-time parameters of the format and transport providers for both reconciliation and provisioning that you select on the first page. ■ IT resource The IT resource is an instance of the IT resource type. It contains the run-time parameter values of the providers. ■ Resource object The resource object holds the values of the fields that constitute the reconciliation staging parent data set. For each reconciliation staging child data set, multilevel reconciliation fields with corresponding child fields as their attributes are created automatically. ■ Parent and child forms Note: Except for the form names, the names of the generic technology connector objects are in the GTC_NAME_GTC format, where GTC_NAME is the name that you assign to the connector. For example, if you specify DBTables_conn as the name of a generic technology connector that you create, all the connector objects except the forms are named DBTables_conn_GTC. Note: When you select the trusted source reconciliation option, a trusted resource object is one of the objects created automatically at the end of the connector creation process.