Configuration checklist
Before any deployment, determine the configuration parameters necessary for the synchronization topology.
For a better configuration experience, gather the following information before you start your configuration.
External servers
- External server type
-
Determine the type of external servers included in the synchronization topology. Supported servers include:
-
PingDirectory server
-
PingDirectoryProxy server
-
Sun Directory Server Enterprise Edition
-
Sun Directory Server
-
Oracle Unified Directory
-
OpenDJ
-
Microsoft Active Directory (AD)
-
Generic LDAP directories
-
- LDAP connection settings
-
Determine the following for each external server instance included in the synchronization topology:
-
Host
-
Port
-
Bind distinguished name (DN)
-
Bind password
-
- Security and authentication settings
-
Determine the following:
-
The secure connection types for each external server, such as SSL or StartTLS
-
The authentication methods for external servers, such as simple authentication or external SASL mechanisms
-
If you are synchronizing encoded passwords or clear-text passwords in particular, the connection should be secure. To synchronize to or from a Microsoft AD system, establish an SSL or StartTLS connection to PingDataSync. You should also enable password encryption for synchronization from AD or when synchronizing clear-text passwords. For more information, see Configuring password encryption. |
Sync Pipes
A Sync Pipe
defines a single synchronization path between the source and destination targets. One Sync Pipe
is needed for each point-to-point synchronization path defined for a topology.
Sync Source
-
Determine which external server is the
Sync Source
for the synchronization topology. You can define a prioritized list of external servers for failover purposes. Sync Destination
-
Determine which external server is the
Sync Destination
for the synchronization topology. You can define a prioritized list of external servers for failover purposes.
Sync Classes
A Sync Class
defines how attributes and DNs are mapped and how source and destination entries are correlated. For each Sync Pipe
defined, define one or more Sync Classes
with the following information:
- Evaluation order
-
If you are defining more than one
Sync Class
, the evaluation order of eachSync Class
must be determined with theevaluation-order-index
property. If there is an overlap between criteria used to identify aSync Class
, theSync Class
with the most specific criteria is used first. - Base DNs
-
Determine which base DNs contain entries needed in the
Sync Class
. - Include filters
-
Determine the filters to be used to search for entries in the
Sync Source
. - Synchronized entry operations
-
Determine which operations to synchronize:
-
create
-
modify
-
delete
-
- DNs
-
Determine the differences between the DNs from the
Sync Source
topology to theSync Destination
topology. For example, if there are structural differences in each directory information tree (DIT). - Destination correlation attributes
-
Determine the correlation attributes used to associate a source entry to a destination entry during synchronization. During the configuration setup, one or more comma-separated lists of destination correlation attributes are defined and used to search for corresponding source entries. PingDataSync maps all attributes in a detected change from source to destination attributes using the attribute maps defined in the
Sync Class
.The correlation attributes are flexible enough that several destination searches with different combinations of attributes can be performed until an entry matches. For LDAP server endpoints, use the DN to correlate entries.
For example, to correlate entries in LDAP deployments, specify the attribute lists
dn,uid
,uid,employeeNumber
andcn,employeeNumber
. PingDataSync searches for a corresponding entry that has the samedn
anduid
values. If the search fails, it then searches foruid
andemployeeNumber
. If that search fails, it searches forcn
andemployeeNumber
. If none of these searches are successful, the synchronization change is aborted and a message is logged.To prevent incorrect matches, the most restrictive attribute lists (those that will never match the wrong entry) should be first in the list, followed by less restrictive attribute lists, which are used when the earlier lists fail. For LDAP-to-LDAP deployments, use the DN with a combination of other unique identifiers in the entry to guarantee correlation. For non-LDAP deployments, determine the attributes that can be synchronized across the network.
- Attributes
-
Determine the differences between the attributes from the
Sync Source
to theSync Destination
.Attribute consideration Description Attribute mappings
Determine how attributes are mapped from the
Sync Source
to theSync Destination
.For example, if they’re mapped directly, mapped based on attribute values, or mapped based on attributes that store DN values.
Automatically mapped source attributes
Determine if there are attributes that can be automatically synchronized with the same name at the
Sync Source
toSync Destination
.For example, if you can set direct mappings for
cn
,uid
,telephoneNumber
, or for all attributes.Non-auto mapped source attributes
Determine if there are attributes that shouldn’t be automatically mapped.
For example, the
Sync Source
might have an attribute,employee
, while theSync Destination
has a corresponding attribute,employeeNumber
. If an attribute isn’t automatically mapped, you must provide a map to synchronize it.Conditional value mapping
Determine if some mappings should only be applied some of the time as a function of the source attributes.
You can use conditional value mappings with the
conditional-value-pattern
property, which conditionalizes the attribute mapping based on the subtype of the entry, or on the value of the attribute.For example, this might apply if the
adminName
attribute on the destination should be a copy of thename
attribute on the source, but only if theisAdmin
attribute on the source is set totrue
. Conditional mappings are multivalued. Each value is evaluated until one is matched (the condition istrue
). If none of the conditional mappings are matched, the ordinary mappings is used. If there isn’t an ordinary mapping, the attribute is not created on the destination.