About this document

This document aims that providing insight into configuration of the Efecte Self-Service Efecte Identity connector, how the Efecte Self-Service uses the data it gets from Efecte Identity Management and in which ways end-users can drive updates of their data toward Efecte Identity Management.

This article describes the behavior of Efecte Identity Management Connector in ESS version 2022.3 or newer.

Efecte Identity Management connector

This connector handles integration with Efecte Identity Management system (hereon in referred to as EIM or Efecte Identity). Configuration for connector is stored in /etc/integration-hub/tenant-configs/<tenant_name >/connector-idm.xml file. Changes to configuration requires reload of tenant by issuing "integration-hub-tenant reload <tenant_name>" command.

Common part of configuration (used by various notions of this connector) are EIM connection properties in bean with id ="idmRemoteConfiguration".

In order to use SSL encrypted connection (besides switching 'sslEnabled' flag on) certificate configuration is also necessary. EIM admin should provide you with appropriate one that is also supported on EIM side. To import certificate into local keystore on Integration hub machine issue:

yes yes | keytool -importcert -file "idm-remoting.crt" -alias "idm-remoting.crt" -keystore /etc/pki/java/cacerts -storepass changeit

Please use your own certificate file name and keystore password.

Organization connector

When configured properly, Identity connector can be used as source for Organization Data hereby replacing the LDAP connector.

Organization information data is handled by bean id="idmOrganizationInfoHandler" that contains following parameters:

Sample configuration:

<bean id="idmOrganizationInfoHandler" class="com.efecte.integration.connector.idm.handler.IdmOrganizationInformationHandler">
<property name="efecteIdentityFacade" ref="efecteIdentityFacade"/>
<property name="searchLimit" value="500"/>
<property name="userFilter">
 <set>
  <value>cn=Users,dc=host,dc=domain,dc=com</value>
 </set>
</property>
</bean>

Communication between Efecte Identity Management and the connector is handled by bean id="efecteIdentityFacade" with following parameters:

For properties accountTypeMethodNames, roleTypeNames and/or serviceAgreementNames add additional value tags in efecteIdentityFacade.

efecteIdentityFacade

<bean id="efecteIdentityFacade" class="com.efecte.integration.connector.idm.EfecteIdentityFacade">
  <constructor-arg ref="idmRemoteConfiguration"/>
  <property name="accountTypeMethodNames">
    <set>
      <value>AD Password</value>
      <value>Some Other Password</value>
    </set>
  </property>
  <property name="serviceAgreementNames">
    <set>
      <value>Customer - AD users</value>
    </set>
  </property>
  <property name="roleTypeNames">
     <set>
        <value>AD group</value>
     </set>
  </property>
</bean>

Fetching performance

Performance statistics can be enabled to give more detailed view of execution flow. In order to do it configure metrics service in connector configuration xml:

<!-- Performance Metrics -->
<bean class="com.efecte.integration.util.Metrics" id="metrics" init-method="init" destroy-method="destroy">
 <property name="metricsEnabled" value="true"/>
 <property name="metricsLogName" value="Metrics"/>
 <property name="metricsLogMarker" value="METRICS"/>
 <property name="reportTimeUnit" value="MINUTES"/>
 <property name="reportPeriod" value="1"/>
</bean>
<bean id="idmOrganizationInfoHandler" class="com.efecte.integration.connector.idm.handler.IdmOrganizationInformationHandler">
 ... existing configuration ...
 <property name="metrics" ref="metrics"/>
</bean>

and configure appropriate logger in log4j.xml file:

<appender name="agent-stats" class="org.apache.log4j.RollingFileAppender">
 <!-- The active file to log to -->
 <param name="file" value="/var/log/integration-agent/agent-stats.log"/>
 <param name="append" value="true"/>
 <param name="encoding" value="UTF-8"/>
 <param name="MaxFileSize" value="100MB"/>
 <param name="MaxBackupIndex" value="10"/>
 <layout class="org.apache.log4j.PatternLayout">
  <param name="ConversionPattern" value="%c{1}|%p|%d|%t|%X{hostName}|%m%n"/>
 </layout>
</appender>
<!-- Application performance metrics -->
<logger name="Metrics">
 <level value="info"/>
 <appender-ref ref="agent-stats"/>
</logger>

Data from Efecte Identity Management

The following are the key data fields of a user (an agent) in EIM the ESS is using when fetching and writing data. 

Efecte Self Service configuration

In order to select Efecte Identity connector as Organization connector configure it on Integration Suite side and then open admin page of Efecte Self Service, select Integrations -> Organization -> Organization Connector.

Before changing connector change administrator groups according to new organization data. This could be executed in two ways:

• on admin UI, "Settings" tab: "Administrators' AD group" and “Service owners' AD group”
• in webshop.properties file parameter ldap.administrator.group (note that settings from DB comes first)

Then from "Organization Connector" dropdown choose Efecte Identity connector (if not set as default). Keep in mind that after this organization cache will be cleared and, if user is not logged in as global admin, he could be logged out. Log in once again if needed and click "Show test data" button to check organization information data.

Efecte Identity as organization data connector for global admin

In order to use Efecte Identity Management system as the organization data provider for global admin, in /etc/webshop/webshop.properties file (ESS machine) configure:

• globaladmin.organization.connector.type = com.efecte.integration.connector.idm.IdMConnector
• globaladmin.organization.connector.instanceName = defaultEfecteIdentity

and restart ESS. For users to have access to globaladmin, they need to additionally belong to the AD group defined in webshop.properties as the global administrator group.

My Services

Identity connector can act as source of data for My Services fields
My Services is a common name for a set of integration mechanisms enabling external systems to dynamically modify content of catalog that is visible to users.

Defining MyServices Fields

1. Go to ESS admin page -> Integrations -> External data fields -> External data fields
2. Press Add MyServices field button
3. Enter configuration
   • Field name – enter a name to be used as alias for this MyServices field
   • Data from – select Efecte Identity connector
   • Service from Efecte Identity mapped to MyServices field (Login to Efecte Identity -> Administration -> Services -> Service Name)
     • Data list id - this value should be the same as the name of the service
4. Press Update button - if there are no errors, in MyServices field elements table you will see the names of the 'Roles' as defined in Efecte Identity for the service (check 'Roles' on selected Service)

The Efecte Identity connector is not only responsibly for synchronization of elements, but also for tracking associations between elements and users.

My Services & offering catalog

Using MyService entry as the source for Service Item IDs

1. On admin page Services tab, open a Service and select Service Item
2. In Item properties, open 'External data link' drop-down and select the name of the MyServices field you want to use
3. From 'Item ID' drop-down select element that will be used as ItemId when placing order

ID of selected element will be used as the ItemID when users are placing orders for the given item.

Associations between Users and DataCards

Connector is not only responsibly for the retrieval of Identity Service information, but also for:

• tracking associations between Identity Services and users (Identity Agents)
• altering said associations

In order to use this functionality:

1. On admin page, open Service and select Service Item
2. In Service Item properties, open 'MyServices Link' drop-down and select name of the MyServices field
3. From Sub-items drop-down select:
   • User using – in this case user will be presented list of Services they are associated with
   • User not using – in this case user will be presented list of Services they are not associated with

Submitting order for Service Item will result in

• Removing
• Adding

association between the user (Agent) placing the order and the Efecte Identity Service.