1.1 Understanding Driver Concepts
The driver is a bidirectional synchronization product between SAP R/3 HR systems and the Identity Vault. This framework uses XML to provide data and event transformation capabilities that convert Identity Vault data and events into SAP HR data and vice-versa.
The Identity Vault acts as a hub, with other applications and directories publishing their changes to it. The Identity Vault then sends changes to the applications and directories that have subscribed for them. This results in two main flows of data: the Publisher channel and the Subscriber channel.
1.1.1 Publisher Channel
Figure 1-1 Publisher Channel Process
The SAP R/3 HR database publishes information in the form of HRMD_A IDocs using Application Link Enabling (ALE) technology. The driver is only interested in HRMD_A Message IDocs. Any object type in these IDocs can be mapped to an eDirectory object type and subsequently synchronized. The driver consumes the IDoc files and converts the data into XML format.
The Publisher channel polls the SAP HR database for changes, and then submits XML-formatted changes to the Metadirectory engine for publication into the Identity Vault. The engine processes the document by sequentially applying all configured policies based on standard driver process flow.
The driver can then manipulate the information using various policies and filters defined by the system administrator. The driver then submits the data to the Identity Vault. Using eDirectory and other Identity Manager drivers, the data can be shared with other business applications and directories. Based on business rules, these other applications can add additional data that can in turn be inserted back into the SAP HR database using Business Application Programming Interface (BAPI) technology.
1.1.2 Subscriber Channel
Figure 1-2 Subscriber Channel Process
The Subscriber channel receives XML-formatted eDirectory events from the Metadirectory engine. The driver then converts these documents to an appropriate data format, and updates SAP via the BAPI interface.
The Identity Vault sends changes only to the applications that have subscribed to receive them.