Connector for Reconciliation Reconciliation Architecture

4-22 Oracle Fusion Middleware Users Guide for Oracle Identity Manager The connector for reconciliation is deployed by using the Deployment Manager. When the connector is deployed, the corresponding reconciliation profile for that connector is created in the metadata store MDS, and horizontal tables that store the event data are also created. For information about configuring connectors, see Oracle Identity Manager Connector documentation.

4.2.2.10 Archival

The Reconciliation Archival utility allows you to move processed events from the active reconciliation tables to archive tables. The events to move can be selected based on a time range. Only linked and closed events, which means successfully processed or closed by an administrator, can be archived.

4.2.2.11 Backward Compatibility

You do not need to change the existing reconciliation configurations or scheduled tasks to leverage the new reconciliation service. The existing configurations for reconciliation setup in earlier Oracle Identity Manager releases continues to function after upgrading to 11g Release 1 11.1.1. As part of the upgrade, corresponding reconciliation event tables are created for each of the existing object types being reconciled.

4.2.2.12 Reconciliation Manager

The Reconciliation Manager is a Web-based UI, which is a part of Oracle Identity Manager Administrative and User Console. The Reconciliation Manager lets you view and manage reconciliation events generated by Oracle Identity Manager reconciliation engine. These events are generated through scheduled reconciliation runs. The Reconciliation Manager provides search capabilities on reconciliation runs as well as events. Users can use the Reconciliation Manager to perform reconciliation manually on generated events. Note: Do not manually update reconciliation profile or update any reconciliation configurations from the Deployment Manager or Oracle Identity Manager Design Console when a reconciliation run is still in progress. This is because, if a reconciliation field is deleted or updated when a reconciliation run is in progress, then the event data might not be valid any more. See Also: ■ Reconciliation Metadata on page 4-13 for information about MDS ■ Horizontal Tables for information about the horizontal tables in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. See Also: Using the Reconciliation Archival Utility for information about how to use the Reconciliation Archival utility in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. Deployment Configurations 4-23

4.3 Integration Between LDAP Identity Store and Oracle Identity Manager

Oracle Identity Manager users and roles are stored in Oracle Identity Manager database. However, when a user, role, or role membership change takes place in Oracle Identity Manager, this information is propagated to LDAP identity store. If user, role, or role membership change takes place in LDAP directly, then these changes are synchronized into Oracle Identity Manager. The synchronization involves: ■ User creation, modification, deletion, change in enable or disable states, and password change are made in LDAP in addition to the internal Oracle Identity Manager tables. ■ Role creation, modification, and deletion actions update the LDAP groups, including membership changes. ■ Initial load of users, roles, and role memberships are synchronized. ■ Direct changes to user profile in LDAP are reconciled to Oracle Identity Manager. ■ Direct changes to roles and role memberships in LDAP are reconciled to Oracle Identity Manager. When changes are made in the user and role data, the actual operation is performed with the help of the kernel handlers. These handlers go through an orchestration lifecycle of various stages, such as validation, preprocessing, action, and postprocessing. For more information about the various stages of kernel orchestration, see Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. Oracle Identity Manager kernel orchestration connects to the Entity Manager, which in turn connects to the LDAP provider. The LDAP provider connects to Oracle Virtual Directory OVD. The OVD is an interface to various directory systems, such as Oracle Internet Directory, iPlanet, and Active Directory. The LDAP provider reaches the LDAP data by using OVD. Figure 4–8 shows the communication between Oracle Identity Manager and LDAP: Figure 4–8 Oracle Identity Manager and LDAP The integration configuration and synchronization of data between Oracle Identity Manager and the LDAP identity store are described in the following sections: ■ Configuring the Integration with LDAP ■ Provisioning Data From Oracle Identity Manager to LDAP Identity Store See Also: Managing Reconciliation Events for more information about the Reconciliation Manager in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. Oracle Identity Manager Kernel Orchestration Entity Manager LDAP Provider OVD LDAP