Table of Contents

Systems

Connection and administration of systems serves two purposes:

Systems can be divided into two groups:

A single connected system can be utilized for both acquiring and propagation of data at the same time. For example, an HR system from which data about employees is drawn, but email and login generated in CzechIdM are written back.

System connection configuration is initiated in the menu tab Systems. Above the list of current systems there is a button Add.

 System list

Basic information

Click on it to connect new system. On the new system page one must provide some basic information:

 Connecting a new system

Configuration

Subsequently, a connector, which will connect the selected system, needs to be chosen in the tab Configuration. The configuration setting of the system connection always differs according to the selected connector.  Connector configuration

When the connector is configured, the green button Test Connector can be used to test to connection to real system.

Some connectors do not support "test" operation

The system of connectors provides connection to a system without the need to edit the administered system itself since their standardly provided interfaces are utilized.

The basic provided connectors are:

Other connectors can be added arbitrarily from publicly accessible sources (AD and Exchange connector), via own implementation or by inquiring of CzechIdM developers. Connectors use widely extended framework ConnId, formerly OpenICF, connector framework.

Attributes Scheme

A scheme represents a list of attributes of some object (e.g. Account) in the connected system. By defining a scheme, CzechIdM is enabled to control management of object's attributes. The system scheme can be found in the tab Systems → System detail → Scheme .

The easiest and preferred way of how to create attributes scheme is to click the Generate scheme. Thus the attribute scheme is generated by the system's connector - all available attributes of the object are returned from the connector and can be modified by clicking on the object name in the table e.g. __ACCOUNT__.

 Generate attributes scheme

Not all connectors support automatic scheme generation. From the selection of standard connectors, this functionality is supported by Database Table connector and LDAP connector, for instance.

The other option of defining scheme is clicking on the green Add button, define the object e.g. __ACCOUNT__ and then add attributes into the scheme manually one by one.

 New schema created manually

If editing (magnifying glass by the attribute name), or creating (green Add button) attributes in scheme, their names on the system and their data types need to be filled in.

 Attributes list in scheme

Usual data types are

 Attribute detail

Every connector has some significant attributes, they are usually introduced by "__" characters like __NAME__. Meaning of the attribute depends on the connector.

Then, some of the following settings can be enabled for each attribute:

Attributes mapping

When the attributes scheme for the object are ready, connected system attributes available in the scheme can be mapped onto CzechIdM entity attributes e.g. attributes of identity.

 Attributes mapping list

Attributes mapping is available at Systems → Mapping. If there is none use green Add button to create a new one.

 New attributes mapping

When the attribute mapping is created and it is clear what object in the connected system is mapped to what entity in CzechIdM, the procedure gets to the object/entity attributes configuration.

Click on the Add button to create a new attribute in current mapping.

 Detail of attribute in the attributes mapping

These options can be filled:

The attributes mapping must always contain one attribute marked as an Identifier. Otherwise the provisioning won't be possible.
Some of the options behaviour may vary depending on the connector used as well as connected system itself. e.g. some connectors returns NULL if the attribute does not exists, some connectors return empty string "" instead.

Other options of the mapped attribute are:

 Detail of attribute in the attributes mapping - transformations

It is now clear what attribute is managed on the connected system and how the changes are propagated from/to the attribute. Obviously it is necessary to define what attribute in CzechIdM we want to connect the end system attribute to.

Now almost everything is set to synchronize or provision the attribute. If the range of standard options for attributes mapping is not wide enough, administrators can use transformation scripts to do advanced magic.

Virtual Systems

This is a way of how to manage systems via user tasks, not directly via direct (e.g. network) communication. This feature is mainly implemented as CzechIdM module.