Previous Topic: Explore Backlog LimitationNext Topic: Correlation Domain


Correlation Attribute

Value Syntax: GUAttrName[=Namespace:AccountAttrName[:Offset,Length]]

Default Values:

GlobalUserName

FullName

Description: Controls the correlation matching algorithm used by the correlate phase of explore/correlate.

The correlation algorithm uses this parameter when determining how accounts are associated with global users.

Each value defines a global user attribute that will be compared against an account attribute. The list is ordered, and only values applicable for an endpoint type are used when correlating accounts from an endpoint of that endpoint type. If there are two defined mappings for the same global user attribute that are applicable to the endpoint type where correlate is being run, then the first parameter value is used.

You can provide this mapping in one of the following ways:

GUAttrName

In this form, you name only the global user attribute and not the corresponding account attribute. This value assumes for the omitted account attribute name the account attribute that is predefined by the endpoint type to correspond to this global user attribute. For information about the predefined mappings, see the endpoint type's Connector Guide.

A parameter value in this form applies to all endpoint types for which an account mapping is defined. All endpoint types define mappings for GlobalUserName (typically the account name). Most endpoint types define mappings for Full Name.

GUAttrName=Namespace:AccountAttrName

In this form, you name the global user attribute and a specific account attribute of a specific endpoint type. A parameter value in this form applies only to the indicated endpoint type. Use this form rather than the first form to match global users on an attribute such as Full Name in one endpoint type but not in all endpoint types.

GUAttrName=Namespace:AccountAttrName:Offset,Length

In this form, you name the global user attribute and a specified substring of an account attribute of a specific endpoint type. Offset indicates the start of the substring, the value 1 indicating the start of the attribute value. Length indicates the number of characters in the substring value. If the full account value is shorter than (Length + Offset - 1) characters, the substring value that is used will be shorter than Length characters.

A parameter value in this form applies only to the indicated endpoint type. Use this form if you know that an account attribute value (for example, description) has a form where the first eight characters are known to contain a unique employee identifier that can be matched to a global user attribute value.

For example, assume that the configured parameter values are the following:
GlobalUserName
FullName=LDAP Namespace:globalFullName
FullName=ActiveDirectory:DisplayName
 CustomField01=ActiveDirectory:Telephone

The following occurs for each previously uncorrelated account that is found while correlating accounts in an Active Directory container:

  1. The Provisioning Server starts with the first parameter value (GlobalUserName) and determines that the Active Directory endpoint type's defined account attribute that maps to GlobalUserName is NT_AccountID (LDAP attribute name eTADSsAMAccountName). It attempts to find the unique global user whose name is equal to the account's NT_AccountID attribute value. If a unique match is found, the Provisioning Server associates the account with the global user. If more than one match is found, the Provisioning Server performs Step 5. If no match is found, the Provisioning Server performs the next step.
  2. The Provisioning Server considers the second parameter value (FullName=LDAP Namespace:globalFullName). Since this value is specific to another endpoint type, it is skipped and the Provisioning Server performs the next step.
  3. The Provisioning Server considers the third parameter value (FullName=ActiveDirectory:DisplayName). Since this value is specific to Active Directory, it is used. It attempts to find the unique global user whose FullName is equal to the account's DisplayName attribute value. If a unique match is found, the Provisioning Server associates the account with the global user. If more than one match is found, the Provisioning Server performs Step 5. If no match is found, the Provisioning Server performs step 4.
  4. The Provisioning Server considers the final parameter value (CustomField01=ActiveDirectory:Telephone). Because this value is specific to Active Directory, it is used. It attempts to find the unique global user whose Custom Field #01 attribute is equal to the account's Telephone attribute value. Note that the name you gave to the custom global user attribute using global properties of the System Task is not displayed here. If a unique match is found, the Provisioning Server associates the account with the global user. If more than one match is found, the Provisioning Server performs Step 5. If no match is found, the Provisioning Server performs the next step.
  5. The Provisioning Server associates the account with the [default user] object in the domain specified by the configuration parameter Explore and Correlate/Create Users Domain. If the [default user] object does not already exist, it is created.