Reconciliation Metadata Reconciliation Architecture

4-14 Oracle Fusion Middleware Users Guide for Oracle Identity Manager

4.2.2.3 Reconciliation Target

Reconciliation target refers to an instance of an application that acts as a source of changes for Oracle Identity Manager. An example of reconciliation target is an HR system, which acts as a source of identities for Oracle Identity Manager. A reconciliation target can be a source of users or accounts.

4.2.2.4 Reconciliation Run

Reconciliation run refers to the combination of a reconciliation connector and associated configurations which when run by the scheduled task, performs the reconciliation based on the rules defined in the associated configurations. The scheduler runs reconciliation periodically at fixed intervals. Reconciliation runs are scheduled within Oracle Identity Manager scheduler to run at a specified frequency. All events created during a reconciliation run are grouped together by a unique reconciliation run ID.

4.2.2.5 Reconciliation APIs

These are a set of published APIs to provide reconciliation data to Oracle Identity Manager in the form of reconciliation events. Connectors can use the APIs to push data to the reconciliation event repository. Scheduled tasks can be setup to run the APIs when reconciliation is to be run on a scheduled basis. The existing connectors do not need to be changed because the existing APIs are supported.

4.2.2.6 Reconciliation Schema

The data that comes from the target system for reconciliation is stored in the reconciliation schema. The data contains the changes to be reconciled with Oracle Identity Manager. Reconciliation schema refers to the set of schema tables to store the reconciliation data. The reconciliation schema is redesigned for performance reasons and future extensibility. See Improved Database Schema in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for more information about the reconciliation schema.

4.2.2.7 Reconciliation Engine

The reconciliation engine uses all configurable components and includes the data processor and rule evaluator that use these components to convert input data into a list of action items. It also includes the components that determine whether or not the actions can be automated based on the rule context. When an action is performed, either automatically or manually, the engine performs the appropriate updates and provisioning actions. The main task of the reconciliation engine is to perform the comparison, determine the action to be taken, and apply the action in Oracle Identity Manager. It contains two modules, which are described in the following sections: ■ Matching Module ■ Action Module

4.2.2.7.1 Matching Module The matching rule specified in the profile is used to identify

whether the record being searched, exists in Oracle Identity Manager or not. Matching rules are rules to identify whether the data is for an identity that Oracle Identity Manager already has a record of, or to identify the owner of the account in Oracle Identity Manager. When no record is found for the data of an account, an owner match is then performed to identify the owner of the account by using the matching rules. Deployment Configurations 4-15 For user and role entities owner matching is performed. For account entities, when no record is found, an owner match is then performed to identify the owner of the account. For role membership events, matching is performed to identify role and user. For role hierarchy events, matching is performed to identity the parent and child role. At the end of the evaluation, the match table contains all the possible matches found within Oracle Identity Manager that meet the criteria for the event, and the state of the event is updated to one of the statuses listed in Table 4–3 : Note: While performing role hierarchy and role membership reconciliation, the matching criteria must contain both Namespace and Role Name in the matching criteria. The following is an example of a matching rule: UGP.ugp_rolename=x and UGP.ugp_namespace=y Here, x is the name of the horizontal table name column that is mapped to Role Name, and y is the name of the horizontal column that is mapped to Namespace. Table 4–3 Reconciliation Status Events Status Events Description Data Received Event data has been created in the database and is ready for further processing. Event Received A reconciliation event has been created and is ready for further processing. The finishReconciliationEvent API has not yet been called. Data Validation Failed The reconciliation event record is invalid. For example, a role event with an invalid role category will fail to validate. This situation could indicate a race condition. The RE_NOTE field should contain the details of the failure, which is also displayed in the user interface. Data Validation Succeeded The event data was successfully validated and the event can now safely be processed by the Engine. Multiple Accounts Match Found Given the current matching rules, multiple matching account records were found for the data. No Account Match Found Given the current matching rules, no matching account records were found for the data. Single Account Match Found Given the current matching rules, one matching account record was found for the data. Multiple Org Matches Found Given the current matching rules, multiple matching organization records were found for the data. No Org Match Found Given the current matching rules, no matching organization records were found for the data. Single Org Match Found Given the current matching rules, one matching organization record was found for the data. Multiple Role Grants Match Found Multiple matching records for user membership within a role were found. No Role Grant Match Found No matching records for user membership within a role were found.