PingIDM

Configure a resource mapping

Objects in external resources are specified in a mapping as system/name/object-type, where name is the name used in the connector configuration, and object-type is the object defined in the connector configuration list of object types. Objects in the repository are specified in the mapping as managed/object-type, where object-type is defined in the managed object configuration.

External resources, and IDM managed objects, can be the source or the target in a mapping. By convention, the mapping name is a string of the form source_target, as shown in the following example:

Basic LDAP mapping 
{
    "mappings": [
        {
            "name": "systemLdapAccounts_managedUser",
            "source": "system/ldap/account",
            "target": "managed/user",
            "properties": [
                {
                    "source": "lastName",
                    "target": "sn"
                },
                {
                    "source": "telephoneNumber",
                    "target": "telephoneNumber"
                },
                {
                    "target": "phoneExtension",
                    "default": "0047"
                },
                {
                    "source": "email",
                    "target": "mail",
                    "comment": "Set mail if non-empty.",
                    "condition": {
                        "type": "text/javascript",
                        "source": "(object.email != null)"
                    }
                },
                {
                    "source": "",
                    "target": "displayName",
                    "transform": {
                        "type": "text/javascript",
                        "source": "source.lastName +', ' + source.firstName;"
                    }
                },
               {
                    "source" : "uid",
                    "target" : "userName",
                    "condition" : "/linkQualifier eq \"user\""
                    }
               },
            ]
        }
    ]
}

In this example, the name of the source is the external resource (ldap), and the target is IDM’s user repository; specifically, managed/user. The properties defined in the mapping correspond to attribute names that are defined in the IDM configuration. For example, the source attribute uid is defined in the ldap connector configuration file, rather than on the external resource itself.

Individual mapping files do not include a name property. The mapping name is taken from the file name. For example, the mapping shown in Basic LDAP Mapping would be in a file named mapping-systemLdapAccounts_managedUser.json, and start as follows:

{
   "source": "system/ldap/account",
   "target": "managed/user",
   ...
}

Configure mappings using the admin UI

In the Platform admin UI, you configure mappings in the Advanced Sync editor, which is scoped to a connector or a managed object type. In the legacy admin UI, you configure mappings from a top-level Mappings page.

Starting with IDM 8.1, the legacy admin UI is deprecated and is no longer bundled with IDM. New deployments should use the Platform admin UI, which is the replacement for the legacy admin UI.

Both UIs are available as separate downloads from the Backstage download site:

Using the Platform admin UI

To set up a synchronization mapping using the Platform admin UI, open the Advanced Sync editor from either the connector that provides the resource, or the managed object type:

  1. Open the Advanced Sync editor:

    • From a connector, click Provisioners in the sidebar, select the connector, select the object type, then click the Advanced Sync tab.

    • From a managed object type, click Identities > Configure in the sidebar, select the object type, then click the Advanced Sync tab.

  2. Click Sync Data.

  3. In the Sync Object Type modal, set the source under Sync From and the target under Sync To, and select the object types to synchronize.

    • To reverse the source and target, click the flip sync direction icon ().

    • To reuse the links from an existing mapping, select Link Mapping.

  4. Click Save.

    The new mapping opens in the Advanced Sync editor.

  5. On the Mapping tab, click Add a property to map a target property to its corresponding source property.

  6. To configure how source and target objects are matched, use the Correlation Query tab. Learn more.

  7. To define the actions taken for each synchronization situation, use the Situation Rules tab. Learn more.

  8. To reconcile the mapping, click the Reconcile tab, then click Reconcile Now.

    Reconcile Now runs a full reconciliation over the mapping. To preview or reconcile a single record, use the legacy admin UI.

The Advanced Sync editor also includes these tabs:

  • Schedules: Schedule reconciliation and liveSync jobs for the mapping. Learn more in Schedule liveSync using the admin UI.

  • Event Hooks: Configure scripts that run at specific stages of the synchronization process, such as object creation, update, deletion, or link changes. Learn more in Scripts in mappings.

  • Advanced: Restrict reconciliation to specific source or target records, set deletion thresholds, and configure other mapping options. Learn more in Restrict reconciliations using the admin UI.

Using the legacy admin UI

To set up a synchronization mapping using the legacy admin UI:

  1. From the navigation bar, click Configure > Mappings.

  2. Click New Mapping.

  3. On the New Mapping page, select a source and target resource from the configured resources at the bottom of the window, and click Create Mapping.

    You can filter these resources to display only connector configurations or managed objects.

  4. Select Add property on the Attributes grid to map a target property to its corresponding source property.

    The Property list shows all configured properties on the target resource. If the target resource is specified in a connector configuration, the Property list shows all properties configured for this connector. If the target resource is a managed object, the Property list shows the list of properties (defined in the managed object configuration for that object).

    • Select Add Missing Required Properties to add all the properties that are configured as required on the target resource. You can then map these required properties individually.

    • Select Quick Mapping to show all source and target properties simultaneously. Drag a source property onto its corresponding target property, or vice versa. When you’re done, click Save.

  5. To test your mapping configuration on a single source entry, click the Behaviors tab and scroll down to Single Record Reconciliation. Search for the entry to reconcile.

    The UI displays a preview of the target entry after a reconciliation. You can then click Reconcile Selected Record to perform the reconciliation on that one source entry.