930b5f872e89407f445d4000d4e4aaecaa6a0998vboxsync

930b5f872e89407f445d4000d4e4aaecaa6a0998vboxsyncSample 5b - "All-or-Nothing" Synchronization of Two Resources

930b5f872e89407f445d4000d4e4aaecaa6a0998vboxsync-------------------------------------------------------------

930b5f872e89407f445d4000d4e4aaecaa6a0998vboxsync

930b5f872e89407f445d4000d4e4aaecaa6a0998vboxsyncThis sample demonstrates flowing data between external resources just as

930b5f872e89407f445d4000d4e4aaecaa6a0998vboxsyncin the regular sample 5 on which it is based. It simulates two directory

930b5f872e89407f445d4000d4e4aaecaa6a0998vboxsyncresources using XML files. It extends sample 5 in that it configures a

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsynccompensation script that attempts to ensure either all the synchronization

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncor none of the synchronization is performed after making a changed to a

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncmanaged user.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncWhenever a change is made to managed/user resource, OpenIDM implicitly

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncattempts to synchronize external resources according to the object mapping

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncin sync.json where managed/user is the source. Typically, if the

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncsynchronization fails--owing to a policy validation for the target,

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncmissing required properties for the target, or simply that the target

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncis unavailable--the synchronization stops, leaving the managed/user

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncresource updated and any targets synchronized before the one that

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncfailed also updated. The target that failed, and any targets specified

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncin mappings subsequent to the one that failed have not been updated.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncNormally, you now have a set of systems that are out of sync, and the

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsynconly to re-synchronize them is a reconciliation. Reconciliations can

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncbe expensive with large data sets.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncOpenIDM 3.0 enhances the synchronization to multiple targets by providing

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncsynchronization details to an "onSync" script after successfully synchronizing

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncall targets or failing one target. This script hook can be used to "revert"

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncthe partial change to managed/user and the corresponding external resources

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncper the object mappings.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncSample 5b includes a script that demonstatrates compensating for a

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncsynchronization failure.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncFor documentation pertaining to this example see:

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsynchttp://openidm.forgerock.org/doc/install-guide/index.html#more-sample5b

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsyncTo try the sample, follow these steps.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync Steps 1 and 2 are optional, and only necessary if you'd like to receive emailed recon summaries.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync 8. Now make the LDAP xml file unavailable by changing it's permission so it is unreadable. You may need to have

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync root or sudo access to do this:

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync $ sudo chmod 000 /path/to/openidm/samples/sample5b/data/xml_LDAP_Data.xml

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync 9. Perform an update to the DDOE1 user. It will be updated in managed/user, the synchronization to AD will be successful,

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync but the synchronization to LDAP should fail. The compensate.js script will be invoked and will attempt to revert

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync the change by performing another update to DDOE1 in managed/user, which will, in turn, perform the sync to AD and LDAP.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync On the second time through, the sync will again fail to LDAP, which will trigger the compensate.js again. The script

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync this time will recognize we were originally called from compensation and will abort. The original sync error on the first

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync update will be thrown from the script and the UI should display an error.

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync Note that if you are making these updates from the UI, the UI screen does not referesh after the failure. It will still

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync show the "pending update" that has not taken effect. Go back to the Users tab and start over and you will see the old

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync managed/user data has been restored. View the xml_AD_Data.xml file and you will see that DDOE1 has also been reverted

3194da424708abdd288b28d96892b3a5f3f7df0bvboxsync to it's "pre-step-9" condition.