SAP NetWeaver Identity Management Identity Center Tutorial - Basic synchronization Version 7.0 Rev 2
SAP Library document classification: PUBLIC No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, Windows, Outlook, Excel, and PowerPoint are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iseries, pseries, xseries, zseries, System i, System i5, System p, System p5, System x, System z, System z9, z/os, AFP, Intelligent Miner, WebSphere, Netfinity, Tivoli, Informix, i5/os, POWER, POWER5, POWER5+, OpenPower and PowerPC are trademarks or registered trademarks of IBM Corporation. Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or other countries. Oracle is a registered trademark of Oracle Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc. HTML, XML, XHTML, and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. Java is a registered trademark of Sun Microsystems, Inc. JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. MaxDB is a trademark of MySQL AB, Sweden. SAP, R/3, mysap, mysap.com, xapps, xapp, SAP NetWeaver, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves information purposes only. National product specifications may vary. These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.
i Preface The product SAP NetWeaver Identity Management Identity Center is a high-end identity management solution, capable of handling a large amount of repositories containing an unlimited amount of information. The Identity Center offers a robust, flexible and scalable high-availability solution for workflow, provisioning, data synchronization and joining for a large number of data repositories. The reader This manual provides the necessary information to users who need an introduction to basic synchronization operations in the Identity Center. Prerequisites To get the most benefit from this manual, you should have the following knowledge: General knowledge about the Identity Center as described in SAP NetWeaver Identity Management Identity Center Getting Started. Basic knowledge of databases and SQL. Basic knowledge of Microsoft Access. The following software is required: SAP NetWeaver Identity Management Identity Center version 7.0 or newer must be correctly installed and licensed. Microsoft Access 2000 or newer. An Identity Center where at least one dispatcher has been configured and is running. (See SAP NetWeaver Identity Management Identity Center Getting Started.) The source files necessary to follow the case in this manual are included in the installation of the Identity Center and will be located in the \Tutorial\Data source sub-directory. The manual The manual contains a tutorial consisting of four sections describing the basic synchronization functions of the Identity Center. In the first section you create the job. The second section describes how you create repository definitions for the data sources and target repositories. The third section describes how to read the data sources, while in the fourth section you see how you can create two data repositories from these data sources. The introduction describes the scenario, some basic concepts of the Identity Center and data sources used in the tutorial. Person names used in this tutorial are fictional.
ii Related documents You can find useful information in the following document: SAP NetWeaver Identity Management Identity Center Getting Started
iii Table of contents Introduction... 1 The scenario...1 The basic concepts...1 The data sources...2 Section overview...3 Section 1: Creating the job... 4 Creating the job...4 Running the job...5 Section 2: Creating the repository definitions... 6 Creating an ODBC System DSN...6 Creating the People repository definition...8 Creating the Email repository definition...12 Creating the Persons repository definition...14 The constants...15 Section 3: Reading the source repositories... 16 Reading the person objects...16 Reading the e-mail addresses...19 Running the job...20 Section 4: Writing to the target repositories... 21 Producing the CSV file...21 Running the job...24 Creating a database table...25 Running the job...27
iv
Introduction 1 Introduction This manual gives a step-by-step introduction to the basic synchronization functions of the Identity Center. You will learn how you can read data from two different data sources and how to produce information by combining data from these data sources. The scenario We will read data from a Microsoft Access database and a text file, the latter containing e-mail addresses to be added to the user data held in the database. We will use a simple query to join these data sources and produce two data repositories, each containing data foreign to the source files. The output formats will, for simplicity s sake, be a database table and a text file once again but bear in mind that any data repository can be used. The basic concepts This section describes some fundamental concepts of the Identity Center. Pass A pass will perform one single operation. The operations are typically to retrieve information from one place and send it to the other. A pass can be as advanced as you want it to be, and information from the data sources can be manipulated and presented in different ways by, for example, using SQL queries. Job A job is a collection of passes, executed in sequence, top to bottom. Repository definition The Identity Center needs to access a number of external repositories, either as data sources or target repositories. The concept repository definition in the Identity Center is used as a reference to those external repositories and it contains the parameters needed to establish the connection. The idea is that these parameters are only specified once for each external repository and in one place, no matter how many times or how many different passes connect to a given repository and use this information.
2 Introduction The data sources The necessary data sources are included with the installation. These files are located in the \Tutorial\Data source directory. In this tutorial the default installation folder is used, which is C:\Program Files\SAP\IdM\Identity Center. File Name Description people.mdb Person database A Microsoft Access database containing information about the people in the organization. email.txt E-mail addresses A text file containing the e-mail address Persons The basic information about the person objects is stored in a Microsoft Access database (people.mdb). This database has the following fields: EmployeeID Surname Given name Department Location
Introduction 3 E-mail addresses The e-mail addresses are stored in the text file, email.txt, in the following format: <EmployeeID>=<Email> Section overview The tutorial consists of the following sections: Section 1: Creating the job Section 2: Creating the repository definitions Section 3: Reading the source repositories Section 4: Writing to the target repositories Here you will create the job. In this section you will create repository definitions for the two data sources, a database file people.mdb and a text file email.txt. In addition you will create a repository definition for the target file persons.txt. In this section you will create two passes; a pass to read the persons from the database file people.mdb and a pass to read the e-mail addresses from the text file email.txt. This section describes how you create the target text file persons.txt and a database table trondheim which holds an e-mail list for Trondheim employees, by manipulating the data from the two data sources.
4 Section 1: Creating the job Section 1: Creating the job This section describes how to create the job. Creating the job To create the job: 1. Start the Identity Center. 2. Navigate to the Identity Center s "Job folder" and create a new job by selecting "Job folder" and choosing New/Empty job from the context menu. The new job, which by default is a Java job, is created. Fill in the following values in the "Options" tab: Change the name of the job in the console tree. Select "Enabled". Select the dispatcher in the list "Run by dispatchers". 3. Choose "Apply".
Section 1: Creating the job 5 Running the job We are now able to run the job just to verify that everything works as it should. When using the schedule rule "On demand", the job must be run manually. Choose "Run now" to schedule the job to be run by the dispatcher. As we still have not added any passes to the job, it will not perform any actions. This can be verified by looking at the job log: You may have to choose the "Refresh" button to update the list.
6 Section 2: Creating the repository definitions Section 2: Creating the repository definitions Creating the repository definitions for your repositories is not mandatory, but it is a best practice and highly recommended. Here we will create repository definitions People and Email for the two data sources, a database file people.mdb and a text file email.txt, and a repository definition Persons for the target file persons.txt. Creating an ODBC System DSN To be able to reference the data source people.mdb, you need to create ODBC System DSN for it. This is necessary when using the JDBC-ODBC driver to access a repository. Use the "Data Sources (ODBC)" in the "Administrative Tools" group in the Control Panel. 1. Select the "System DSN" tab. 2. Choose "Add ". Select the "Microsoft Access Driver (*.mdb)" driver from the list.
Section 2: Creating the repository definitions 7 3. Choose "Finish". Name the data source people. 4. Choose the "Select" button in the "Database" group box. Navigate to and select the database. 5. Choose "OK" to close the dialog boxes.
8 Section 2: Creating the repository definitions Creating the People repository definition To create the repository definition: 1. Start the repository wizard by selecting the Identity Center s "Repositories" node in the console root, and choosing New/Repository from the context menu. 2. Choose "Next >". Select "Database" as the repository template. 3. Choose "Next >". Name the database repository definition People (for people.mdb).
Section 2: Creating the repository definitions 9 4. Choose "Next >". Fill in the JDBC driver. To create the JDBC URL, click inside the "JDBC URL" field and the " " button will appear. 5. Choose the " " button. Select "Define JDBC URL" that opens a JDBC connection wizard.
10 Section 2: Creating the repository definitions 6. Choose "Next >" in the JDBC connection wizard. Select the correct JDBC driver. 7. Choose "Next >". Fill in the name of the data source database, people.
Section 2: Creating the repository definitions 11 8. Choose "Next >", and then "Finish" to confirm the resulting JDBC URL and to return to the repository wizard. 9. Choose "Next >" and then "Finish" to insert the new repository definition.
12 Section 2: Creating the repository definitions Creating the Email repository definition To create the repository definition: 1. Start the repository wizard by selecting the Identity Center s "Repositories" node in the console tree, and choosing New/Repository from the context menu. 2. Choose "Next >". Select "File" as the repository template. 3. Choose "Next >". Fill in the repository definition name, Email.
Section 2: Creating the repository definitions 13 4. Choose "Next >". 5. Click inside the "File name" field. The " " button will appear. 6. Choose the " " button. Navigate to the email.txt file and choose "Open". 7. Choose "Next >" and then "Finish" to insert the new repository definition.
14 Section 2: Creating the repository definitions Creating the Persons repository definition The procedure for creating the Persons repository definition (for the target file persons.txt) is the same as for the Email repository definition. Instead of selecting an existing file, you create the file as shown below: Now you have created the repository definitions you need for this tutorial.
Section 2: Creating the repository definitions 15 The constants Expand any of the created repository definitions, the People repository definition for example, in the console tree and select "Constants". Here you see all the constants that were created by the wizard. These constants contain the values that are used in the passes. If you need to change them, you do so here. Which constants are defined will depend on the type of repository. DBCONNECTION: holds the JDBC URL used to connect to the repository when using the Java Runtime engine. JDBCDRIVER: holds the JDBC driver used by the Java Runtime engine when connecting to the repository. OLEDBCONNECTION: holds the OLEDB connection string used to connect to the repository when using the Windows Runtime engine. Windows Runtime engine is not used in this tutorial and hence this constant is not in use. We recommend using Java Runtime engine.
16 Section 3: Reading the source repositories Section 3: Reading the source repositories Pass name Read person objects Read e-mail addresses In this section, you will add the following passes to the job: Reading the person objects Description Reads information about the person objects from the people.mdb database, and stores it as a table in the Identity Center database. Reads the e-mail addresses from the email.txt file. This pass will read information from the data source people.mdb in to the tutorial_persons table of the Identity Center database specified in the field "Database". The columns in this file (which are used by later passes) are indicated in the "Definitions" section. Create the pass: 1. Select the job in the console tree and choose New/From database from the context menu. The pass is included in the console tree and the pass properties are displayed in the details pane. 2. Select the "Repository" tab: Modify the pass name in the console tree and fill in the "Repository" field by selecting the People repository definition.
Section 3: Reading the source repositories 17 3. Select the "Source" tab and fill in the fields: From database Choose "%$rep.dbconnection%" from the "Constants" in the context menu. The prefix "rep" indicates that this constant is referring to a constant defined in a repository definition (see page 15), in this case the People repository definition and a database file people.mdb. SQL statement This SELECT statement retrieves all entries from the database. 4. Select the "Destination" tab.
18 Section 3: Reading the source repositories Fill in the fields: Database Choose "%$ddm.identitycenter%" from the "System parameters" in the context menu to specify that you want to use the Identity Center database as the destination for this pass. Table name Enter tutorial_persons as the table name in the Identity Center database. This table will be created automatically. Definitions Now we will use the data discovery feature. This serves two purposes: One, it verifies that the connection to your data source is valid, and two, it creates the pass definitions. Choose "Insert template" above the grid and select "Data source template". The SQL statement defined in the "Source" tab is executed to retrieve the first 50 rows, and the data is analyzed to insert the necessary definitions to create the table in the Identity Center database. For instance, in the second line: Surname is the column in the Identity Center database VARCHAR specifies the data type 255 is the maximum length of the field surname is the column in the data source 5. Choose "Apply".
Section 3: Reading the source repositories 19 Reading the e-mail addresses This pass will retrieve all the e-mail addresses from the file email.txt. 1. Select the pass you just created and choose New/From ASCII file from the context menu. 2. Select the "Repository" tab: Modify the pass name in the console tree and fill in the "Repository" field by selecting the Email repository definition. 3. Select the "Source" tab and fill in the fields:
20 Section 3: Reading the source repositories File name Choose "%$rep.filename%" from the "Constants" in the context menu. The prefix "rep" indicates that this constant is referring to a constant defined in a repository definition (see page 15), in this case the Email repository definition and a text file email.txt. Field separator Enter = as this is the character used in the data source. 4. Select the "Destination" tab. Fill in the fields as shown above: Database Choose "%$ddm.identitycenter%" from the "System parameters" in the context menu to specify that you want to use the Identity Center database as the destination for this pass. Table name Enter tutorial_email as the name of the database table. Definitions Choose "Insert template" and select "Data source template" to create a template based on the source file. It is not necessary to modify the template. 5. Choose "Apply". Running the job Run the job to make sure there are no errors. If there are errors, double-click the log entry to get more details.
Section 4: Writing to the target repositories 21 Section 4: Writing to the target repositories In Section 3 you read the data sources and created a table for each data source in the Identity Center database. In this section we will produce two different data repositories from this database. We will create a CSV file and a database table. You will add the following passes: Pass name Create person file Create database table trondheim Producing the CSV file Description Creates a CSV file with the person objects. Creates a database table holding the e-mail addresses of Trondheim employees. We will create a pass that generates a CSV file with the persons: 1. Select the "Read e-mail addresses" pass in the console tree and choose New/To ASCII file... from the context menu. 2. Select the "Repository" tab. Modify the pass name in the console tree and fill in the "Repository" field by selecting the Persons repository definition.
22 Section 4: Writing to the target repositories 3. Select the "Source" tab. Fill in the fields as shown above: Database Choose "%$ddm.identitycenter%" from the "System parameters" in the context menu to specify that you want to use the Identity Center database as the data source for this pass. SQL statement This SQL statement selects the fields from the tables in the database needed to create the necessary join to list the correct e-mail address for each person. To see how this query can be created using SQL Server Management Studio, see page 24. SELECT tutorial_persons.*, tutorial_email.email FROM tutorial_email RIGHT JOIN tutorial_persons ON tutorial_email.employeeid = tutorial_persons.employeeid;
Section 4: Writing to the target repositories 23 4. Select the "Destination" tab. Enter the following information: File name Choose "%$rep.filename%" from the "Constants" in the context menu. The prefix "rep" indicates that this constant is referring to a constant defined in a repository definition (see page 15), in this case the Persons repository definition and a target text file persons.txt. Generate CSV file Select the check box and select "Include CSV header". Enter ; as the CSV delimiter. Definitions Choose "Insert template" and select "Data source template". Modify the definitions as displayed above. We create a new attribute "Name" by combining the source attributes Surname and Givenname. 5. Choose "Apply".
24 Section 4: Writing to the target repositories Building the SQL statement You can use the query builder tools provided for your database to build the SQL statement. Here we give an example using SQL Server Management Studio to build the SQL statement with the Query designer: 1. Choose "New Query" from the toolbar and open the Query Designer (choose "Design Query in Editor" from the tool bar). 2. Add the two tables, tutorial_email and tutorial_persons, to the query. 3. Add the join link (right outer join) between the EmployeeID fields (attributes), and include all fields from the tutorial_persons table and the email address from the tutorial_email table. To add the join link, drag the EmployeeID attribute from one table to the other, then right-click the established link to set the properties. 4. Choose "OK" to close the "Query Designer" dialog box and build the query. Query can now be executed in the SQL Server Management Studio as a test, to verify that it is correct. You can then copy the query and paste it into the "SQL statement" field in the "Source" tab of the "Create person file" pass. Running the job Run the job to make sure there are no errors. You can view the resulting CSV file by doubleclicking the file name on the "Destination" tab.
Section 4: Writing to the target repositories 25 Creating a database table Finally we will create a database table trondheim from the same data sources. For simplicity's sake, we'll write the table back to the People repository definition and a database file people.mdb. If you want to write to another database, follow the steps in Section 2 (see page 6) to define a repository definition for your database. 1. Select the pass "Create person file" in the console tree and choose New/To database from the context menu. The pass is included in the console tree and the pass properties are displayed in the details pane. 2. Select the "Repository" tab: Modify the pass name in the console tree and fill in the "Repository" field by selecting the People repository definition.
26 Section 4: Writing to the target repositories 3. Select the "Source" tab. Fill in the fields as shown above: Database Choose "%$ddm.identitycenter%" from the "System parameters" in the context menu to specify that you want to use the Identity Center database as the data source for this pass. SQL statement This SQL statement selects all person objects located in Trondheim and their e-mail addresses. SELECT tutorial_persons.*, tutorial_email.email FROM tutorial_email RIGHT JOIN tutorial_persons ON tutorial_email.employeeid = tutorial_persons.employeeid WHERE tutorial_persons.location = 'Trondheim';
Section 4: Writing to the target repositories 27 4. Select the "Destination" tab. Fill in the fields with the following information: Database Choose "%$rep.dbconnection%" from the "Constants" in the context menu. The prefix "rep" indicates that this constant is referring to a constant defined in a repository definition (see page 15), in this case the People repository definition and a database file people.mdb. Database table name Enter trondheim as the table name. This table will be created automatically. Definitions Choose "Insert template" and select "Data source template" to fill in the definitions. 5. Choose "Apply". Running the job Run the job and verify that the table trondheim containing all the persons from Trondheim, including the e-mail addresses, indeed is created.
28 Section 4: Writing to the target repositories