Administration Guide › Synchronization › Synchronization in Provisioning Manager › Account Template Synchronization › Which Attributes are Updated › Weak Synchronization

Weak Synchronization

To specify strong or weak synchronization, click the Account Template tab on the property sheet and select or clear the Strong Synchronization check box.

Weak synchronization ensures that global users have the minimum capability attributes that their accounts should possess. Weak synchronization is the default in most endpoint types. If you update a template that uses weak synchronization and accept the option to update associated accounts, CA Identity Manager updates capability attributes as follows:

• If a number field is updated in an account template and the new number is greater than the number in the account, CA Identity Manager changes the value in the account to match the new number.
• If a check box was not selected in an account template and you subsequently select it, CA Identity Manager updates the check box on any account where the check box is not selected.
• If a list is changed in an account template, CA Identity Manager updates all accounts to include any value from the new list that was not included in the account's list of values.

If an account belongs to other account templates (whether those templates use weak or strong synchronization), CA Identity Manager consults only the template that is changing. This is more efficient than checking every account template. Because weak synchronization only adds capabilities to accounts, it generally is not necessary to consult those other account templates.

Note: When propagating from a weak synchronization account template, changes that would remove or lower capabilities could leave some accounts unsynchronized. Remember that with weak synchronization, capabilities are never removed or lowered. Without consulting other templates for an account, the propagation does not consider if weak synchronization is sufficient.

A subsequent Synchronize Account with Account Templates might be needed to properly synchronize an account with its account templates. For this operation, you use Provisioning Manager.

Strong Synchronization

Strong synchronization ensures that accounts have the exact account attributes as those specified in the account template.

For example, suppose that you add a group to an existing UNIX account template. Originally, the account template made accounts members of the Staff group. Now, you want to make the accounts members of both the Staff and System groups. All accounts associated with the account template are considered synchronized when each account is a member of the Staff and System groups (and no other groups). Any account not in the Staff group is added to both groups.

Some other factors to consider include the following situations:

• If the account template uses strong synchronization, any account belonging to groups, other than Staff and System, are removed from those extra groups.
• If the account template uses weak synchronization, the accounts are added to the Staff and System groups. Any account that has additional groups defined to it remains a member of these groups.

Note: You should synchronize your accounts with their account templates regularly to ensure the accounts stay synchronized with their account templates.