Configuration checklist
Before any deployment, determine the configuration parameters necessary for the synchronization topology.
For a better configuration experience, gather the following information before you start your configuration.
External servers
As a best practice, external server definitions should not point at load balancers. Instead, direct connections should be made to the required systems. |
- External server type
-
Determine the type of external servers included in the synchronization topology. Supported servers include:
-
PingDirectory server
-
PingDirectoryProxy server
-
Sun Directory Server Enterprise Edition
-
Sun Directory Server
-
Oracle Unified Directory
-
OpenDJ
-
Microsoft Active Directory (AD)
-
Generic LDAP directories
-
- LDAP connection settings
-
Determine the following for each external server instance included in the synchronization topology:
-
Host
-
Port
-
Bind distinguished name (DN)
-
Bind password
-
- Security and authentication settings
-
Determine the following:
-
The secure connection types for each external server, such as SSL or StartTLS
-
The authentication methods for external servers, such as simple authentication or external SASL mechanisms
-
If you are synchronizing encoded passwords or clear-text passwords in particular, the connection should be secure. To synchronize to or from a Microsoft AD system, establish an SSL or StartTLS connection to PingDataSync. You should also enable password encryption for synchronization from AD or when synchronizing clear-text passwords. For more information, see Configuring password encryption. |
Sync Pipes
A Sync Pipe
defines a single synchronization path between the source and destination targets. One Sync Pipe
is needed for each point-to-point synchronization path defined for a topology.
Sync Source
-
Determine which external server is the
Sync Source
for the synchronization topology. You can define a prioritized list of external servers for failover purposes. Sync Destination
-
Determine which external server is the
Sync Destination
for the synchronization topology. You can define a prioritized list of external servers for failover purposes.
Sync Classes
A Sync Class
defines how attributes and DNs are mapped and how source and destination entries are correlated. For each Sync Pipe
defined, define one or more Sync Classes
with the following information:
- Evaluation order
-
If you are defining more than one
Sync Class
, the evaluation order of eachSync Class
must be determined with theevaluation-order-index
property. If there is an overlap between criteria used to identify aSync Class
, theSync Class
with the most specific criteria is used first. - Base DNs
-
Determine which base DNs contain entries needed in the
Sync Class
. - Include filters
-
Determine the filters to be used to search for entries in the
Sync Source
. - Synchronized entry operations
-
Determine which operations to synchronize:
-
create
-
modify
-
delete
-
- DNs
-
Determine the differences between the DNs from the
Sync Source
topology to theSync Destination
topology. For example, if there are structural differences in each directory information tree (DIT). - Destination correlation attributes
-
Determine the correlation attributes used to associate a source entry to a destination entry during synchronization. During the configuration setup, one or more comma-separated lists of destination correlation attributes are defined and used to search for corresponding source entries. PingDataSync maps all attributes in a detected change from source to destination attributes using the attribute maps defined in the
Sync Class
.
The correlation attributes are flexible enough that several destination searches with different combinations of attributes can be performed until an entry matches. For LDAP server endpoints, use the DN to correlate entries.
For example, to correlate entries in LDAP deployments, specify the attribute lists dn,uid
, uid,employeeNumber
and cn,employeeNumber
. PingDataSync searches for a corresponding entry that has the same dn
and uid
values. If the search fails, it then searches for uid
and employeeNumber
. If that search fails, it searches for cn
and employeeNumber
. If none of these searches are successful, the synchronization change is aborted and a message is logged.
To prevent incorrect matches, the most restrictive attribute lists (those that will never match the wrong entry) should be first in the list, followed by less restrictive attribute lists, which are used when the earlier lists fail. For LDAP-to-LDAP deployments, use the DN with a combination of other unique identifiers in the entry to guarantee correlation. For non-LDAP deployments, determine the attributes that can be synchronized across the network. |
- Attributes
-
Determine the differences between the attributes from the
Sync Source
to theSync Destination
.
Attribute consideration | Description | ||
---|---|---|---|
Attribute mappings |
Determine how attributes are mapped from the For example, if they’re mapped directly, mapped based on attribute values, or mapped based on attributes that store DN values. |
||
Automatically mapped source attributes |
Determine if there are attributes that can be automatically synchronized with the same name at the For example, if you can set direct mappings for |
||
Non-auto mapped source attributes |
Determine if there are attributes that shouldn’t be automatically mapped. For example, the |
||
Conditional value mapping |
Determine if some mappings should only be applied some of the time as a function of the source attributes.
For example, this might apply if the |