Ok.
FF Active sync cannot be reconciled. What to do with this scenario then?
1. FF active sync record processed, IDM object created from the FF as record and an LDAP resource entry created and linked to that IdM object.
2. User changes an attribute in the LDAP resource independently from IdM
3. Why doesnt the FF Active sync correct the attribute by replacing the value from source file on the next cycle?
Answer: it has no means to do so... no reconciliation... it will never be corrected unless or until the source record is changed.
I guess there has to be a method of forcing IdM to process ALL records every cycle to force correctness, However, an occasional recon against the FF and Idm objects would keep things up-to-date and correct.
We have a similar situation as the one greenfan88 sketches.
We have an authorative resource that we get data from via flat file active sync. Data from the resource is pussed to an LDAP.
User is allowed to change that attribute on the LDAP via idm.
But still we want to know the value the authoriative FFAS resource provided initially.
Therefor we store the value coming from the FFAS resource in 2 attributes on the ldap. One may be modified by the user, one not.
So no need for the ffas resource to overwrite the value again. A copy of the actual value is still available... (so no (impossible) reconciliation required for the ffas resource)
(By the way: most attributes are simply not available for the user for editing, :-)
How did you go about using FFAsync to load data in IDM and then push that out to an LDAP resource?
I am trying to do this for the first time and would appreciate a jump start.
I want to load accounts from csv, and bring them in Sun IDM. Then at the same time, I want to push them out to LDAP and also log things such as password, etc, for mailing out to users.