This guide shows you how to install and get started with ForgeRock Identity Management software. As you read this guide, you will learn how ForgeRock Identity Management software reconciles customer identity data to ensure accurate information across disparate resources within an organization.

ForgeRock Identity Platform™ serves as the basis for our simple and comprehensive Identity and Access Management solution. We help our customers deepen their relationships with their customers, and improve the productivity and connectivity of their employees and partners. For more information about ForgeRock and about the platform, refer to https://www.forgerock.com.

The ForgeRock Common REST API works across the platform to provide common ways to access web resources and collections of resources.

Whenever you need access to important information, administrators need to know who you are. They need to know your identity, which may be distributed in multiple accounts.

As a user, you might have several accounts even within your own company, for functions such as:

Each of these accounts may be stored in different resources, such as DS, Active Directory, OpenLDAP, and more. Keeping track of user identities in each of these resources (also known as data stores) can get complex. IDM simplifies the process, as it reconciles differences between resources.

With situational policies, IDM can handle discrepancies such as a missing or updated address for a specific user. The server includes default but configurable policies to handle such conditions. In this way, consistency and predictability is ensured, in an otherwise chaotic resource environment.

IDM can make it easier to track user identities across these resources. IDM has a highly scalable, modular, readily deployable architecture that can help you manage workflows and user information.

In this guide, you will learn how IDM reconciles user data between two data stores. We will look at a department that is adding a third engineer, Jane Sanchez.

Your Human Resources department has updated their data store with Jane Sanchez’s information. You want to use IDM to update the internal Engineering data store, but first, you have to start IDM.

While the reconciliation demonstrated in this guide uses two simplified data files, you can set up the same operations at an enterprise level on a variety of resources.

Return to the situation described earlier, where you have Jane Sanchez joining the engineering department. The following illustration depicts what must be done to reconcile the differences.

In a production deployment, you can have any number of external data stores, such as Active Directory and ForgeRock Directory Services (DS). For illustration purposes, this guide uses two simple static files as external data stores:

You can find these files in the binary package that you downloaded earlier, in the following subdirectory: openidm/samples/getting-started/data.

A central feature of IDM is reconciliation — comparing the contents of two data stores and deciding what to do, depending on the differences.

This scenario is based on two data files:

Reconciliation modifies the Engineering data store by adding the newly hired Jane Sanchez. As suggested by the following illustration, it will also address detailed differences between Jane’s Human Resources account and the Engineering data store.

This sample includes configuration files that map detailed information from the Human Resources data store to the Engineering data store. For example, the configuration maps the firstName entry in Human Resources to the firstname entry in Engineering.

In the admin UI, you can review how the different categories are reconciled for user Jane Sanchez. Log in to the admin UI at https://localhost:8443/admin. The default username is openidm-admin and default password is openidm-admin.

Click Configure > Mappings > HumanResources_Engineering > Edit.

In the Sample source preview text box, enter Sanchez. A selectable drop-down entry for Jane Sanchez should display. When you select Jane Sanchez’s entry, two tables of attributes should display. One table displays how the data is modeled in the source data store. The other table displays how the data is modeled in the target data store. Refer to the following screenshot for an example:

Scroll back up the same page. Click Reconcile.

When you reconcile the two data stores, IDM makes the change to the Engineering data store.

The mapping for this example is configured in the sync.json file, in the /path/to/openidm/samples/getting-started/conf directory.

Now that you have used IDM to reconcile two data stores, try something else. Assume the Engineering organization wants to overwrite all user telephone numbers in its employee data store with one central telephone number.

For this purpose, you can set up a default telephone number for the next reconciliation:

When you click Update, and Save, IDM changes the mapping in the sync.json file. The next time you run a reconciliation from Human Resources to Engineering, the default telephone number will be included for all employees in the Engineering group.

Follow these steps to stop and remove IDM.

We hope that you want to continue exploring IDM.

To do so, review the rest of the IDM documentation.

IDM can do much more than reconcile data between two different sources. Read about the key product features in these sections: