Object Schema Mapping Definition

objectType

String

NO *

The target Object Type (as a simple String) such as "employee", "partner", etc.

If not specified then the default type will apply as configured in ObjectType Resolution Definition.

(*) Among the list of Object Synchronization Definitions, only one is allowed to have a null object Type field. All object Types may be non null, but there cannot be more than one null object Type.

-

objectClassId

Enum

YES

The class of objects to search on the external application.

It must be coherent with objectKind.

inetOrgPerson for LDAP,

__ACCOUNT__ for CSV, etc.

shadowKind

Enum

YES

The kind of Shadow corresponding to the technical objectClassId

Must be coherent with objectClassId.

ACCOUNT, ORGANIZATION, ENTITLEMENT

enabled

Boolean

NO

Whether this object schema mapping is enabled or not

true, false

inboundAttributesMappingDefinitions

-

NO

The list of of inbound attributes mappings (see AttributesMappingDefinition).

-

outboundAttributesMappingDefinitions

-

NO

The list of of outbound attributes mappings (see AttributesMappingDefinition).

-

applicationObjectLookupDefinition

-

NO

Makes sense for the outbound case only. Configure how to search remote Application objects that may match a given object. See ApplicationObjectLookupDefinition below.

-

applicationObjectActivationDefinition

-

NO

Makes sense for the outbound case only. Configure how to react in provisioning terms to events such as an object is deleted.

-

simpleLookupStrategyDefinition

YES

The lookup configuration specific to the "attributes mapping" lookup strategy.

attributeLookupDefinitions

-

NO

If the list contains several attribute mappings they are ANDed together such as givenName = 'John' AND sn = 'Doe'

This list must contain at least one element.

attributeLookupDefinition

-

NO

The configuration of one attributeLookupDefinition.

inputAttributeId

String

YES

The input object's attribute name (e.g. "login") whose value must match a target Application Object attribute.
Available attributes also include "built-in attributes", defined in Builtin Attribute Id.

targetAttributeId

String

YES

The target Application Object attribute name (e.g. "uid" for a LDAP account) whose value must match input data.

normalizeRule

Rule

NO

A Normalize Rule used to transform the input value(s) before comparing it with an Application Object attribute

attributeMappingDefinitions

-

YES

The list of attribute mappings.

validationRule

Rule

NO

A Validation Rule applied to the whole target IDM object, after all its attributes have been individually validated using AttributeMappingDefinition's validation Rule, see Attribute Mapping Definition

objectIgnoredCondition

-

NO

If the condition matches, then for the inbound case the input Shadow will be simply ignored, and for the outbound case the target Shadow will be ignored

attributeMappingDefinition

-

NO

The configuration of one attributeMappingDefinition.

The mapping computes the target attribute value(s). The computation is performed using a strategy.

One and only one mapping strategy must be configured, among the 2 possible strategies.

targetAttributeId

String

YES

The id of the attribute targeted by the mapping.

-

targetAttributeType

Enum

NO

Give a hint about the target attribute type, useful to determine if attributes are equal or not when computing a patch to apply on an IDM object, see Attribute Types and Comparing Attribute Values.

STRING

attributeValuePrecision

NO

Precision used to determine whether to attribute values are equal or not, see Comparing Attribute Values. The use of a precision is optional; if no precision is specified then strict equality is assumed.

-

mandatory

Boolean

NO

Whether the computed target attribute value is mandatory or not.
If it is mandatory but a null mapping value is computed, then an error occurs.
For the SimpleAttributeMappingStrategy, this boolean is also used to validate that the input attribute value is not null or missing.

true,false

secret

Boolean

NO

Whether the target attribute value is considered secret.
If secret, the value will be obfuscated in audit logs and reporting.

true,false

validationRule

Rule

NO

A Validation Rule applied on the target attribute value(s) computed by this mapping. It comes in addition to mandatory.

-

simpleAttributeMappingStrategyDefinition

-

NO

The simple attribute mapping strategy: source attribute to target attribute.

-

customAttributeMappingStrategyDefinition

-

NO

The target attribute value is computed by a Groovy script.

-

mappingStrength

Enum

NO

Optional: the strength with which the mapping is applied, see Mapping Strength.

STRONG

multiValued

Boolean

NO

Boolean: whether the target attribute is multi-valued or not. Mono-valued assumed by default. If "true", then the ADDITIVE mappingStrength may be applied to this mapping.

true,false

idmIdentifierResolutionDefinition

NO

Meaningful when this mapping holds a reference to an IDM object (or several references if the attribute is multi-valued). Mutually exclusive with other mapping strategies: "simple" and "custom". See Idm Identifier Resolution Definition

-

syncChannel

NO

Limit application of this mapping only to a specific channel. If no channel is specified then the mapping will be applied for all channels.

-

STRONG (default)

Authoritative mapping (the default): replace existing attribute value(s) with the mapped one(s), erasing old value(s).

WEAK

Apply the mapping only if the target attribute does not have any value. This mapping strength is use to set initial (default) values for attributes.

ADDITIVE

Pertains to multi-valued attributes only. Only add new value(s) if needed, never removing values. If the attribute is mono-valued, then this strength is equivalent to WEAK.

CASE_INSENSITIVE

STRING

Case-insensitive String comparison, e.g. "John" and "JOhN".

UNACCENTED

STRING

Accent-insensitive String comparison, e.g. "Adèle" and "Adele".

TRIMMED

STRING

Leading and trailing chars-insensitive String comparison, e.g. "John" and " John ".

CASE_INSENSITIVE_UNACCENTED

STRING

Combine "case-insensitive" and "unaccented".

CASE_INSENSITIVE_TRIMMED

STRING

Combine "case-insensitive" and "trimmed".

UNACCENTED_TRIMMED

STRING

Combine "unaccented" and "trimmed".

CASE_INSENSITIVE_UNACCENTED_TRIMMED

STRING

Combine "case-insensitive", "unaccented" and "trimmed".

DAY

DATE

Dates are considered equal if their difference is less than one day.

HOUR

DATE

Dates are considered equal if their difference is less than one hour.

MINUTE

DATE

Dates are considered equal if their difference is less than one minute.

SECOND

DATE

Dates are considered equal if their difference is less than one second.

F0_1

FLOAT

Floats are considered equal if their difference is less than one tenth.

F0_01

FLOAT

Floats are considered equal if their difference is less than one hundredth.

F0_001

FLOAT

Floats are considered equal if their difference is less than one thousandth.

F0_0001

FLOAT

Floats are considered equal if their difference is less than one ten thousandth.

inputAttributeId

YES

The input attribute id (e.g. "uid" for an inbound LDAP mapping) whose value is mapped to the target attribute (see targetAttributeId in the above Attribute Mapping Definition).

For inbound mappings, available attributes also include "built-in attributes", that must be configured using their armored format, e.g. "__objectId__".

The list of inbound built-in attributes is provided in a later section, see Shadow Attributes.

inputValidationRule

NO

A Validation Rule applied on the input attribute value(s), e.g. the value of the "uid" attribute in the above example.

normalizeRule

NO

Optional: a Normalize Rule used to transform the input value before mapping it to the target attribute. The Normalize Rule will be typically executed with a Groovy script.

computeRule

Rule

YES

The Compute Rule  returning a java.lang.Object. If the output is an instance of java.util.Collection then the target attribute is multi-valued.

computeRuleAttributeDependencies

-

NO

The list of attributes the ComputeRule depends on, i.e. the list of an object's attributes mentioned in the Groovy script.

Ideally this list should be automatically constructed when parsing the Groovy script, but, contrarily to Memority IDM Service, this feature has not been implemented in Synchronization service yet. So, for the moment, this list of attributes must be explicitly and manually configured:

• in the inbound CSV import case, this is the list of CSV fields used in the Groovy script. This list helps display in the USR portal's "Import" feature UI the expected format of the CSV file

• in the outbound provisioning case, this is the list of IDM attributes used in the Groovy script. This list helps determine whether a provisioning target Application is concerned by an IDM attribute change or not

referencingAttributeId

String

Can be mandatory

The id of the attribute holding the reference, e.g. "manager".

This property is mandatory if the resolution strategy involves the local Synchronization service repository, i.e. INTERNAL_REPOSITORY or INTERNAL_OR_CORRELATION.

-

referencedObjectKind

Enum

NO

The referenced IDM object kind, which may be different from the referencing kind (e.g. an Identity referencing an Organization).

If not provided, then the referencing Shadow's underlying Object Kind is assumed.

referencedObjectClassId

NO

Meaningful only if the identifier strategy retrieval involves the local Synchronization service repository (which is most common case):
The referenced object class within the Application (e.g. "inetOrgPerson").

If not provided, then the referencing Shadow's underlying class is assumed.

referencedObjectApplicationId

String

NO

Needed when:

• the identifier strategy retrieval involves the local Synchronization service repository

• the referenced object's kind is not the same than the referencing object's kind

If not provided, then the referencing Shadow's underlying application is assumed.

identifierResolutionStrategy

Enum

YES

The identifier resolution strategy.

INTERNAL_REPOSITORY: Lookup only in the local Synchronization service repository (most common case, fastest strategy, this is the default)

IDM_CORRELATION : Lookup only in the remote IDM repository (rare case)
INTERNAL_OR_CORRELATION : Attempt first to lookup in the local Synchronization service repository, and if not found, fallback to IDM correlation

correlationDefinition

-

Can be mandatory

Mandatory if the identifier resolution strategy involves IDM correlation i.e. IDM_CORRELATION or INTERNAL_OR_CORRELATION

onIdmObjectDeleteEvent

SyncAction

NO

The provisioning operation performed in reaction to an IDM object deleted event (hard or soft delete).

By default do nothing (NO_OP), which means the provisioning process is interrupted

onIdmObjectDisableEvent

SyncAction

NO

The provisioning operation performed in reaction to an IDM object disabled event.

By default it is null, meaning the provisioning process won't be interrupted when an IDM object is disabled, i.e. attribute mappings will be evaluated and the "regular" provisioning operation will go on.

onApplicationUnassignedEvent

SyncAction

NO

The provisioning operation performed when a provisioned Application is no longer associated to an IDM object.

By default do nothing (NO_OP), which means the provisioning process is interrupted.

customAction

Rule

YES if a CUSTOM action is configured above

Optional: a compute Rule executed when the CUSTOM Sync Action has been configured above.

This Rule computes an ObjectPatch applied on remote application object. It may return null if no action is to be executed.

The attributes contained in the patch are those of the application object, e.g. "givenName" for an LDAP account.

The Rule's context contains:

• IDM_OBJECT: the IDM object at the origin of the activation event

• SHADOW: the provisioning target

• PROV: the provisioning context, which namely contains the activationSituation property, which may be among:

  • IDM_OBJECT_DELETED: encompasses both "hard" and "soft" deletion (no distinction)

  • IDM_OBJECT_DISABLED

  • APPLICATION_UNASSIGNED: an IDM object is no longer supposed to have an account on a remote application

A example of custom Action script :

return MANAGE.newPatch()
.set("givenName").value("new_given_name")
.get()

objectMatchingConditions

-

YES

If any condition matches in the list then the account is ignored