Application Onboarding and Connector Configuration
The onboarding path
An application object is the anchor for every connector. The sequence is: pick the connector type (JDBC, LDAP, Active Directory, Delimited File, Web Services, SCIM, and so on), enter connection parameters, test the connection, then review the detected schema - account and group object types, their attributes, and the flags that matter: identity attribute, managed/entitlement attribute, multi-valued. Account aggregation builds links to identities, group aggregation populates entitlement data, and identity refresh correlates and provisions.
Configuration details candidates miss
- Correlation ties an account to an identity; it can be a simple attribute-to-attribute mapping or a rule. A bad correlation creates duplicate identities faster than any other mistake.
- Active Directory needs IQService reachable from the application server, plus a service account with the delegated rights the tasks require.
- Delimited File connectors depend on header handling, delimiter and quoting settings; a one-character mistake yields a schema full of
col1,col2. - Provisioning policy entries (Create, Update, Delete, Enable, Disable, Unlock) must exist or the connector has nothing to send.
Worked example
Onboarding a JDBC HR source: enter driver, URL and credentials; test connection; aggregate to let the connector read column metadata; mark employeeId as the identity attribute and department, managerId as identity attributes used by correlation; set correlation to employeeId equals identity employeeId; mark the source authoritative; run account aggregation, then a refresh. If accounts appear unattached afterwards, check correlation before re-running anything.
Rule of thumb
Aggregate accounts, then groups, then refresh - and never troubleshoot provisioning until the schema and correlation are verified.