Architecture Changes

For r12.5 and higher releases, CA Identity Manager includes a router DSA and a notification DSA:

The Provisioning Server goes through a router DSA to communicate with the Provisioning Directory. In previous releases of CA Identity Manager, connections to the Provisioning Directory came directly from the Provisioning Server and were authenticated with an LDAP bind username and password.
For CA Directory DSAs on one system to communicate with DSAs on another system, they must have knowledge of each other. So during Provisioning Directory installation, you identify each of the Provisioning Servers that may connect to it.

In a production environment, we recommend that you run the Provisioning Servers and the Provisioning Directories on separate systems to take advantage of failover and load balancing capabilities, and for performance reasons. Each Provisioning Server communicates with a local CA Directory router, which communicates with the Provisioning Directories.
A notification DSA named impd-notify is added during the upgrade. If you are upgrading from r12.0, the etaops-notify DSA is replaced with impd-notify during the upgrade. Also, the etrustadmin DSA is replaced with impd-main/co/inc and the etadmintemp DSA is removed.