Access data objects by remote proxy
You can proxy REST requests to a remote IDM instance using the /external/idm/factoryPid endpoint. This lets you treat any other IDM instance as a resource within the one you are managing. You can then use it in a sync mapping, call actions on it, use it within scripts, or use it in any other way that you might use a resource in IDM. You can call any endpoint in the remote IDM system using this proxy.
A few situations where this feature may be useful include:
-
Situations where some, but not all, data needs to be migrated from an older version to a newer release.
-
Situations where a development or testing environment has data that needs to be synced into the production environment.
-
Situations where data is deployed in geographically diverse data centers and changes need to be kept in sync with one another.
-
Situations where a new instance needs to sync data between existing on-premises and cloud instances.
This feature does not support liveSync/implicit sync from the remote IDM resources. This means that you will be limited to using recon when it comes to pulling data from a remote system.
If requests sent to the source server include an X-Requested-With header, the value of the header will be set to RemoteIDMProxy.
|
Prerequisites
To connect to a remote instance over SSL, you must import the remote instance’s server certificate into your local instance’s truststore. For example:
keytool \ -import \ -alias fr-platform \ -keystore security/truststore \ -file ~/fr-platform.pem
Mapping
To use the remote IDM proxy in a synchronization mapping, add the following to your sync.json file or individual mapping file (updating the values as necessary):
{
"name" : "onprem_user_to_fidc_alpha_user",
"source" : "external/idm/65/managed/user",
"target" : "external/idm/fidc/managed/alpha_user"
}Authentication
Authentication against the remote IDM instance is supported via basic authentication, or bearer token authentication when IDM is configured to use rsFilter. The authentication strategy determines some of the parameters required for the request.
| Property | Required? | Definition |
|---|---|---|
enabled |
No |
The enable state of the service. Default is |
scope |
No |
The requested OAuth2 scope(s). |
scopeDelimiter |
No |
The scope delimiter to use. Defaults to space. |
authtype |
Yes |
The authentication strategy to use. Either |
instanceUrl |
Yes |
The URL of the remote instance to relay the request to. |
userName |
With |
The basic authentication user name. |
password |
With |
The basic authentication password. |
clientId |
With |
The clientId used to request an access token from the token endpoint. |
clientSecret |
With |
The client secret used to request an access token from the token endpoint. |
tokenEndpoint |
With |
The OAuth2 token endpoint. |
Examples
Basic authentication
{
"enabled" : true,
"authType" : "basic",
"instanceUrl" : "https://localhost:8443/openidm/",
"userName" : "openidm-admin",
"password" : "openidm-admin"
}Bearer/Oauth2 authentication
{
"enabled" : true,
"authType" : "bearer",
"instanceUrl" : "https://fr-platform.iam.example.com/openidm/",
"clientId" : "idm-provisioning",
"clientSecret" : "password",
"scope" : [ ],
"tokenEndpoint" : "https://fr-platform.iam.example.com/am/oauth2/realms/root/access_token",
"scopeDelimiter" : " "
}Sample request
curl \
--header "X-OpenIDM-Username: openidm-admin" \
--header "X-OpenIDM-Password: openidm-admin" \
--insecure
--header "Accept-API-Version: resource=1.0" \
--request GET \
'https://localhost:8443/openidm/external/idm/platform/managed/user?_queryFilter=true'
{
"result": [{
"_id": "95b2b43c-621e-4bca-8a97-efc768f17751",
"_rev": "00000000f20217df",
"userName": "testUser",
"accountStatus": "active",
"givenName": "Test",
"sn": "User",
"mail": "testUser@test.com"
}],
"resultCount": 1,
"pagedResultsCookie": null,
"totalPagedResultsPolicy": "NONE",
"totalPagedResults": -1,
"remainingPagedResults": -1
}