Configuring Novell Nsure® Identity Manager 2 for JDBC (formerly DirXML®)

Jason Elsberry

Software Engineer

Novell, Inc.

jelsberry@novell.com

Primer

Basic Identity Manager Nomenclature:

Schema: the set of classes and attributes defined on an Identity Manager server; the meaning of the term in the context of a directory is quite different than that of a database

Subscription: best understood with reference to the connected system; connected systems are said to subscribe to Identity Manager events; events flow from Identity Manager to the connected system

Publication: best understood with reference to the connected system; connected systems are said to publish events to Identity Manager; events flow from the connected system to Identity Manager

Identity Manager 2 Driver for JDBC

Novell eDirectory

Identity Manager Architecture

Identity Manager 2

IDM

Engine

IDM

Driver

Shim

Policies

Policies

Identity

Vault

Connected

System

Subscriber Channel

Publisher Channel

Remote Loader Service

Identity Manager Architecture
The Remote Loader

Application

Identity Manager 2

IDM

Engine

Remote Loader Shim

Policies

Policies

IDM

Driver

Shim

Subscriber Channel

Publisher Channel

Connected

System

Identity

Vault

Novell eDirectory

Basic Database Nomenclature:

JDBC: an acronym for Java DataBase Connectivity; it's an interface only; each database vendor or third party provides a unique implementation of the interface which are mostly compatible

Schema: synonymous with ownership; database objects (tables, views, triggers, stored procedures, functions) owned by a database identity; schema is useful for scoping (i.e., selecting a subset of database objects)

View: a logical table; it doesn't really exist in the database; when queried via a SELECT statement, the view is constituted by executing an SQL query; views are are a useful abstraction mechanism for representing multiple tables of arbitrary strucutre as a single table

Trigger: code that executes as a side-effect of an SQL statement (e.g., INSERT, UPDATE, DELETE) on a table; triggers are useful, among other things, for logging events

Instead-Of-Trigger: code that executes as a side-effect of an SQL statement (e.g., INSERT, UPDATE, DELETE) on a view; instead-of-triggers are useful for making views writeable

Identity Manager 2 Driver for JDBC

IDM JDBC Driver vs.

Third-Party JDBC Driver

IDM JDBC Driver

J

D

B

C

I

n

t

e

r

f

a

c

e

J

D

B

C

D

r

i

v

e

r

INSERT

SELECT

UPDATE

DELETE

Database

P

O

S

T

G

R

E

S

S

Y

B

A

S

E

M

Y

S

Q

L

D

B

2

M

S

S

Q

L

O

R

A

C

L

E

I

F

X

Two Synchronization Models:

Indirect

Direct

Identity Manager 2 Driver for JDBC

Indirect Synchronization
on the Subscriber Channel

Subscriber

Schema

Synchronization

Trigger(s)

Intermediate

Table(s)

Customer

Table(s)

Database

Direct Synchronization
on the Subscriber Channel

View(s)

Database

Customer

Table(s)

Schema

Subscriber

Database

Log Table

Publisher

Schema

Publication

Trigger(s)

Indirect Synchronization
on the Publisher Channel

Synchronization

Trigger(s)

Intermediate

Table(s)

Customer

Table(s)

Log Table

Publisher

Schema

View(s)

Publication

Trigger(s)

Database

Direct Synchronization
on the Publisher Channel

Customer

Table(s)

Direct and Indirect – What do they really mean?

Both terms are best understood with respect to the final destination of the data being synchronized.

Direct synchronization is usually associated with views because views provide the abstraction mechanism that best facilitates integration with existing customer tables.

Of course, you could use views to synchronize with intermediate tables, but why would you want to?

Indirect synchronization is usually associated with tables because customer tables likely don't match the structure required by the driver, so they can only serve as an intermediate staging area.

Of course, you might get lucky and they may match the required structure or the customer might allow you to modify their structure, but I wouldn't count on it.

So for all practicle purposes direct synchronization = view, indirect synchronization = table.

Identity Manager 2 Driver for JDBC

What's New?

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

Supported Databases:

IBM DB2 Universal Database (UDB) 7.2/8.2

Microsoft SQL Server 7/8 (2000)

Oracle 8i, 9i, 10g

Sybase Adaptive Server Enterprise 12.5 (ASE)

MySQL 3.23/4.1

Informix Dynamic Server (IDS) 9.4

PostgreSQL 7.4

* Supported = Tested
* A more specific list is available in the Implementation Guide.

Identity Manager 2 Driver for JDBC

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

What's New?
Publisher Features

New Publisher Features:

Triggerless Publication

Lossless Timestamp, Date and Time Format

Daily Publication

Future Event Processing

Batch Processing

Identity Manager 2 Driver for JDBC

Previous Minimum Database Requirements:

Support SQL grammar used by the driver

- SQL92 entry level

JDBC-accessible

- Third-party JDBC driver

- Third-party ODBC driver (not recommended)

Trigger support

Identity Manager 2 Driver for JDBC

Database

Publisher

Schema

Log Table

Publication

Trigger(s)

Indirect Publication
Triggerless

Synchronization

Trigger(s)

Intermediate

Table(s)

Customer

Table(s)

Publisher

Schema

View(s)

Log Table

Publication

Trigger(s)

Database

Direct Publication
Triggerless

Customer

Table(s)

New Publisher Features:

Triggerless Publication

Lossless Timestamp, Date and Time Format

Daily Publication

Future Event Processing

Batch Processing

Identity Manager 2 Driver for JDBC

Lossless Timestamp, Date and Time Format

In previous verions, all time types were published as 32-bit integers.

The problem with this is that a 32-bit integer representing the number of seconds that have elpased since January 1st, 1970 cannot express the full range of values of database time types (approximately 120 years at best) and is less granular (databases time types are often granular to nanoseconds).

The publisher can now publish database time types in a canonical string format capable of expressing the full range of database time values with equal granularity via the <time-syntax> configuration parameter.

Identity Manager 2 Driver for JDBC

New Publisher Features:

Triggerless Publication

Lossless Timestamp, Date and Time Format

Daily Publication

Future Event Processing

Batch Processing

Identity Manager 2 Driver for JDBC

Daily Publication

In previous verions, publication occurred at fixed-length intervals.

The publisher can now publish at a specific time-of-day via the <time-of-day> configuration parameter.

Identity Manager 2 Driver for JDBC

New Publisher Features:

Triggerless Publication

Lossless Timestamp, Date and Time Format

Daily Publication

Future Event Processing

Batch Processing

Identity Manager 2 Driver for JDBC

Future Event Processing

In previous verions, events were published in the order they were logged.

The publisher can now publish events at a specified time instead of the order of insertion.

This allows one to postpone event processing until some time in the future. For example, if you don't want a hire to be effective until a week from today, you could log and event one week in the future. Depending upon the polling method used (interval or daily), the event will not be processed before the specified time although it may be processed after the specified time.

Future event processing can be enabled via the <handle-future-events> publisher configuration parameter.

Identity Manager 2 Driver for JDBC

New Publisher Features:

Triggerless Publication

Lossless Timestamp, Date and Time Format

Daily Publication

Future Event Processing

Batch Processing

Identity Manager 2 Driver for JDBC

Batch Processing

In previous verions, events were published one at a time and operations against the log table were sent across the network separately.

If supported by the third-party JDBC implementation and when configured to do so, the driver can submit multiple events per document and update the log table in a single batch. This can reduce the amount of network traffic from the driver to identity manager and to the database server.

Batch processing can be enabled via the <batch-size> publisher configuration parameter where the batch size value is > 1.

Identity Manager 2 Driver for JDBC

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

Smart Configuration:

The driver now sets the majority of its own parameters at runtime!

Doesn't override explicitly set parameters.

Allows for transparent functionality across database platforms.

Allows the driver to correctly distinguish between authentication, connectivity, retry, and fatal error conditions for different third-party JDBC implementations and databases.

It's extensible! You can make it aware of third-party JDBC implementations and unsupported databases.

Identity Manager 2 Driver for JDBC

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

Schema Filtering:

A schema is the set of objects owned by a database identity.

The driver uses database schemas as one mechanism for reducing the scope of the database it inspects on start-up, thereby limiting the amount of metadata it caches and reducing start-up time.

Even so, a single schema can be very large.

The driver now allows you to specify regular expression filters to include or exclude certain tables/views in a single schema, reducing the amount of cached data and start-up time even further.

Schema filters can be set via the <include-table-filter> and <exclude-table-filter> driver configuration parameters.

Identity Manager 2 Driver for JDBC

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

Extended View Support:

Traditionally, views are used to read data from a database and therefore well-suited for publication.

With the introduction of Instead-of-Triggers by most major enterprise database vendors, views are now writeable and can, consequently, be subscribed to.

The driver used to require that a view return only one row of data per object, making it difficult to work with views that join multiple tables. This limitation has been overcome.

Furthermore, the driver now supports referential relationships between views. That is, it is now possible to express containment between views. For example, a view for groups can contain users and vice versa.

Identity Manager 2 Driver for JDBC

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

Enhanced Security:

Some third-party JDBC implementations support encryption methods such as SSL and you can turn it on via the JDBC URL passed to the driver. Others (Sybase JConnect, for instance) require the use of a Properties object.

Previously, with such third-party implementations, your only option was to remote load the driver and use the remote loader's SSL encryption to encrypt data on the wire. This is no longer necessary.

The driver now allows connection properties to be set via a Properties object, removing the need to utilize the remote loader to ensure an encrypted communications channel.

Identity Manager 2 Driver for JDBC

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

Password Modify/Check Support:

Previously, with subscriber supported only password set operations (that is, a subordinate <password> element supplied with an <add> event).

The subscriber now supports password modify <modify-password> and password check <check-object-password> operations.

Identity Manager 2 Driver for JDBC

New Features Overview:

Expanded Database Support

Numerous Publisher Enhancements

Smart Configuration

Schema Filtering

Extended View Support

Enhanced Security

Password Modify/Check Support

New and Improved Preconfigurations

Identity Manager 2 Driver for JDBC

New and Improved Preconfigurations:

There is one preconfiguration (JDBC.xml) for all databases.

Preconfiguration uses GCV-style parameters.

Preconfiguration demonstrates both Group and User class synchronization as well as User account management.

SQL install scripts have been collapsed into a single file whenever possible.

SQL scripts have been normalized across all databases. They all have a similar structure, ordering, formatting, documentation, etc.

Triggered/triggerless publication, future event processing, direct/indirect synchronization are all demonstrated and coexist in the same preconfiguration/SQL scripts.

Identity Manager 2 Driver for JDBC

Live Demo

2003-12-08T12:43:39