Method for reversely synchronizing user information
By using a data pipeline approach and TDI tools to achieve reverse synchronization of user information, the cumbersome process of importing user information into a unified management platform in an enterprise network is solved, thereby improving synchronization efficiency and reducing the workload of administrators.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-12-09
- Publication Date
- 2026-03-27
AI Technical Summary
In enterprise networks, the existing technology for importing user information from various application systems into a unified management platform is cumbersome and error-prone, resulting in a heavy workload and low efficiency for system administrators, and a lack of efficient automated synchronization methods.
Using a data pipeline approach, the Tivoli Directory Integrator (TDI) tool and XML configuration files are used to automate the synchronization process of user information, including reading, filtering, and transforming data sources and target systems, to achieve reverse synchronization of user information.
It reduces the risks associated with manual operations, lowers the management time and manpower costs for administrators, improves information synchronization efficiency, and features clear logic and simple operation.
Smart Images
Figure CN121745839A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of data synchronization technology, and in particular relates to a method for reverse synchronization of user information. Background Technology
[0002] In enterprise networks, a unified user management platform is both necessary and efficient. However, most enterprises initially build their information systems from individual, decentralized application systems, each maintaining its own user database. As the scale increases, the number of application systems becomes too large, and user management becomes overly cumbersome. They then begin building a unified management platform, which requires unifying user information from various application systems and importing it into the unified management platform, while also marking the user's access permissions for each application system.
[0003] The traditional method involves exporting users from each application system to create an Excel file containing information such as user ID, user security level, responsible department, and application system permission tags. Then, each Excel file is manually compared with the user information in the unified management platform to check if the user information appears in the Excel file. If it does, it means the user has access to that application system, and the unified management platform will mark the application system access permission as 1, indicating that the user has access rights.
[0004] In existing system management, the process of importing users from application systems to a unified management platform is cumbersome and prone to errors due to the large amount of data, significantly increasing the workload for system administrators. Furthermore, the lack of advanced technologies and tools results in extremely low information synchronization efficiency. Summary of the Invention
[0005] This invention proposes a method for reverse user information synchronization, enabling the reverse synchronization of user information from application systems to a unified management platform. This eliminates the risk of errors associated with traditional manual comparison, checking, updating, viewing, and verification. Administrators no longer need to manually export data or check user access permissions for specific application systems; the entire process is completed automatically by the system, reducing administrator time and manpower costs and improving system management efficiency. It is widely applicable to information synchronization from various application systems to an enterprise's unified user management platform.
[0006] The technical solution is as follows: A method for reverse synchronization of user information is provided. It adopts a data pipeline approach, configuring the user information of the application system as the source data file and the LDAP database information of the unified user management platform as the target file. It completes the reading, filtering and transformation of data from the data source and the target system, converting the context information of the data source into the context information of the target system; it polls and traverses the source data of the application system and compares it one by one with the LDAP user data in the unified management platform.
[0007] In one possible implementation, the method specifically includes: Step 1: Organize the existing user data tables of multiple application systems, create a user information list for each application system, and save it as a text file format application system user data source file; Step 2: Based on the reference user information list obtained from the outside, create all the latest user information in the LDAP user database of the unified management platform and initialize the application system permission settings: create roles corresponding to each application system under each user, and initialize all application system role attribute values to null, indicating that this user has no access to this application system; Step 3: Create a configuration file to map and modify the data in the application system user data source file in Step 1, and then write it to the LDAP user database of the unified management platform in Step 2, corresponding to the roles of each application system, and mark the access control attributes in the account information of each application system under the user to indicate the user's access permissions to each application system. After completing the three steps, the user information in the unified management platform's LDAP database will be updated. At this point, the user ID of each application system will be added to the user's application system role value, thus completing the reverse synchronization process of user information from the application system to the unified management platform.
[0008] In one possible implementation, the user information in the first step includes user ID, user name, and user status, where user status refers to the user's access status to the application system.
[0009] In one possible implementation, in the third step, an XML configuration file is created in the Tivoli Directory Integrator (TDI) tool so that the data in the application system user data source file in the first step can be written to the corresponding roles of each application system in the LDAP user database of the unified management platform in the second step after attribute mapping and attribute modification within the TDI tool.
[0010] In one feasible approach, the third step specifically involves: (1) In the Tivoli Directory Integrator (TDI) tool, create an XML configuration file and create two new data pipelines in the XML configuration file: an inbound data stream and an outbound data stream; the inbound data stream is loaded with the application system user data source file from the first step, and the outbound data stream is loaded with the LDAP user database of the unified management platform from the second step; (2) In the incoming data stream, traverse and query all user information in the application system user data source file, and mark its user ID and user name attributes as work attributes so that they can be used by the query variables in the outgoing data stream, and map and match them with the information in the LDAP user database in the unified management platform. (3) Find all relevant attribute information of all users in the unified management platform LDAP user database in the outgoing data stream, including user ID, user name, and application system role attribute. Create two expressions corresponding to the link conditions, namely the expression corresponding to condition one and the expression corresponding to condition two. The left side of the expression corresponding to condition one is the user ID attribute in the unified management platform LDAP user database, and the right side is the user ID value in the application system user data source file. The operator is equals. The left side of the expression corresponding to condition two is the user name attribute in the unified management platform LDAP user database, and the right side is the user name value in the application system user data source file. The operator is equals. (4) Determine whether the current user exists in the unified management platform and has access to this application system based on the expression corresponding to the two link conditions, or whether the current user once had access to this application system but is now an illegal user. (5) After polling and traversing all user information in the application system user data source file, based on the user application system role value in the unified management platform LDAP user database, all users with access permissions to this application system are filtered out, thus completing the access permission marking of this part of the users in the unified management platform LDAP user database.
[0011] Furthermore, the method also includes: marking users whose user status value is 0 in the application system data source file sent into the data stream, thus completing the sorting and marking of illegal user access permissions of the application system.
[0012] In one possible implementation, the expression corresponding to the two link conditions is used to determine whether the current user exists in the unified management platform and has access to this application system, or whether the current user previously had access to this application system but is now an unauthorized user. For each user in the application system user data source file sent into the data stream, compare it with all user information in the unified management platform LDAP user database. When the calculation results of the expressions corresponding to condition one and condition two are both 1, it means that the current user exists in the unified management platform and has access permissions for this application system. Then, write the user ID value in the application system user data source file into the application system role value corresponding to this user in the unified management platform LDAP user database.
[0013] In one possible implementation, the expression corresponding to the two link conditions is used to determine whether the current user exists in the unified management platform and has access to this application system, or whether the current user previously had access to this application system but is now an unauthorized user. If either the expression for condition one or the expression for condition two is 0, it means that the current user once had access to this application system but is no longer in the reference user information list. The user status value in the application system user data source file is then updated to 0, indicating that the user is illegitimate and their access to this application system needs to be cleared in time.
[0014] The beneficial effects of this invention are at least as follows: The information synchronization method provided by this invention solves the problem of reverse synchronization of user information from application systems to a unified management platform. By setting the reverse synchronization rules, the system automatically completes the comparison and synchronization, eliminating the risks caused by human error in traditional methods. At the same time, this method is logically clear, simple and easy to operate. Compared with the traditional method of manually importing user information, it reduces the workload of administrators and improves work efficiency. Attached Figure Description
[0015] Figure 1 This is a schematic diagram of the method flow of an embodiment of the present invention. Detailed Implementation
[0016] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0017] The features and illustrative embodiments of various aspects of the present invention will now be described in detail. Numerous specific details are set forth in the following detailed description to provide a thorough understanding of the invention. However, it will be apparent to those skilled in the art that the invention may be practiced without requiring some of these specific details. The following description of embodiments is merely intended to provide a better understanding of the invention by illustrating examples of the invention. The invention is by no means limited to any specific setups and methods set forth below, but covers any improvements, substitutions, and modifications to structures, methods, and devices without departing from the spirit of the invention. Well-known structures and techniques are not shown in the drawings and the following description to avoid unnecessarily obscuring the invention.
[0018] It should be noted that, unless otherwise specified, the embodiments of the present invention and the features thereof can be combined with each other, and the various embodiments can be referenced and cited from each other.
[0019] The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.
[0020] See Figure 1 The present invention provides a method for reverse synchronization of user information, specifically including: Step 1: Organize the user information of the application system, mark important attributes, perform preliminary cleaning and processing of the data, eliminate noisy data, and save it as a data source file in CSV format.
[0021] Step 2: Open the Tivoli Directory Integrator tool and create a new XML configuration file according to the data format requirements of the target system. The purpose of this file is to write data from the data source file to the target file after attribute mapping and modification within the TDI tool, such as field name conversion, field attribute update, and correspondence between old and new fields.
[0022] Step 3: Create a new data pipeline in the XML configuration file. The pipeline's input data stream is processed from the application system's user information data source file, and the pipeline's output data stream is processed from the unified management platform's LDAP database.
[0023] Step 4: Create a connector component for CSV files using an iterator within the incoming data stream, and configure the component's file path to the user data source file storage location. Connect to the data source within the incoming data stream, and mark the retrieved user ID as a working attribute so that its results can be used by other variables.
[0024] Step 5: Create an LDAP type connector component in the output data stream using a lookup method. The purpose is to connect to the LDAP database of the unified management platform, read relevant user data, and specify the correspondence between the user ID attribute in the source data and the user ID attribute in the target LDAP database in the link conditions. Filter out users in the LDAP database that meet the link conditions, and mark their user ID attribute and application system role attribute as working attributes so that subsequent scripts can modify them.
[0025] Step 6: After retrieving the relevant user data, create an LDAP type connector component in the output data stream using an update method. Configure the target unified management platform's LDAP database, find users who meet the linking criteria, and then modify the application system role attribute values of these users. First, retrieve the user's existing role attribute values, then use a script to add the newly added application system role to the user's role attribute values, and return the final value. At this point, the user's new application system account has been successfully attached to the user information in the unified management platform.
[0026] In one embodiment: Suppose a digital environment contains multiple application systems, such as an asset management system, an email management system, and a PDM management system. User management in these systems is independent, and data is not shared between them, failing to establish a comprehensive lifecycle management system for employee information from onboarding to offboarding. Therefore, the company needs to build a unified management platform to achieve unified management of user information throughout its lifecycle. This requires reverse-synchronizing user information from the previously built information systems to the unified management platform. The implementation process of this method will be illustrated using this scenario as an example.
[0027] Step 1: Organize all valid user information in the asset management system, email management system, and PDM management system, including user ID, login name, user status, user permissions, department, etc., and perform data cleaning and noise reduction on invalid users, test users, and system users to form corresponding CSV files C1, C2, and C3.
[0028] Step 2: Open the Tivoli Directory Integrator tool, and according to the data format requirements of the unified management platform, create XML configuration files X1, X2, and X3 corresponding to the three application systems. Map and modify the user ID and login name fields in C1, C2, and C3 by converting field names, updating field attributes, and matching old and new fields, and write them into the target files M1, M2, and M3.
[0029] Step 3: Create the corresponding data pipeline in each XML configuration file of X1, X2 and X3 respectively. Taking X1 as an example, the input data stream of the pipeline is connected to the M1 file of the asset system, and the output data stream of the pipeline processes the LDAP database of the unified management platform.
[0030] Step 4: Create a connector component of CSV file type in the input data stream using an iterator, and configure the component's file path to the local storage path of M1, M2, and M3. Connect to data sources M1, M2, and M3 in the input data stream, and mark the read user ID as a working attribute so that its result can be used by other variables such as login name, user status, etc.
[0031] Step 5: Create an LDAP type connector component in the output data stream using a lookup method. The purpose is to connect to the LDAP database of the unified management platform, read the relevant user data (user) from the unified platform, and specify the mapping between the user ID attributes in the source data M1, M2, and M3 and the user ID attributes in the target LDAP database in the link conditions. Users in the LDAP database that meet the link conditions are then filtered out. These filtered users will then have access permissions to the corresponding asset management system, email management system, and PDM management system. Their user ID attributes and the role attributes of the application systems (such as asset management system, email management system, and PDM management system) are marked as work attributes so that their scripts can be modified later on the unified management platform.
[0032] Step 6: After retrieving the relevant user data, create an LDAP type connector component in the output data stream using an update method. Configure the target unified management platform's LDAP database, find users who meet the linking criteria, and then modify the application system role attribute values of these users. First, retrieve the user's existing role attribute values, then use a script to add the newly added application system role to the user's role attribute values, and return the final value. At this point, the user's new application system account has been successfully attached to the user information in the unified management platform, thus completing the reverse synchronization of user information from the application system to the unified management platform.
[0033] Key technologies of this invention: 1) By adopting a data pipeline approach, user information of the application system is configured as the source data file, and LDAP database information of the unified user management platform is configured as the target file. This completes the reading, filtering, and transformation of data from the data source and the target system, and converts the context information of the data source into the context information of the target system.
[0034] 2) By polling and traversing the source data of the application system and comparing it one by one with the LDAP user data in the unified management platform, the access permissions and role values of users in the unified management platform to the application system are marked, as well as the illegal users in the source data of the application system, which facilitates subsequent processing.
[0035] 3) Update the role values of the LDAP user application system and the user status values in the application system user data source file of the unified management platform respectively, so as to realize the reverse synchronization of user information from the application system to the unified management platform, laying a good technical environment and management foundation for unified management and construction of users.
[0036] The above description merely illustrates embodiments of the present invention and is quite specific and detailed; however, it should not be construed as limiting the scope of the patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the scope of protection of the present invention. Furthermore, any parts of the present invention not described in detail are conventional techniques.
Claims
1. A method for reverse synchronization of user information, characterized in that, Using a data pipeline approach, the user information of the application system is configured as the source data file, and the LDAP database information of the unified user management platform is configured as the target file. This completes the reading, filtering, and transformation of data from the data source and the target system, and converts the context information of the data source into the context information of the target system. The application system source data is polled and traversed, and then compared one by one with the LDAP user data in the unified management platform.
2. The method according to claim 1, characterized in that, The method is specifically as follows: Step 1: Organize the existing user data tables of multiple application systems, create a user information list for each application system, and save it as a text file format application system user data source file; Step 2: Based on the reference user information list obtained from the outside, create all the latest user information in the LDAP user database of the unified management platform and initialize the application system permission settings: create roles corresponding to each application system under each user, and initialize all application system role attribute values to null, indicating that this user has no access to this application system; Step 3: Create a configuration file to map and modify the data in the application system user data source file in Step 1, and then write it to the LDAP user database of the unified management platform in Step 2, corresponding to the roles of each application system, and mark the access control attributes in the account information of each application system under the user to indicate the user's access permissions to each application system. After completing the three steps, the user information in the unified management platform's LDAP database will be updated. At this point, the user ID of each application system will be added to the user's application system role value, thus completing the reverse synchronization process of user information from the application system to the unified management platform.
3. The method according to claim 2, characterized in that, The user information in the first step includes user ID, user name, and user status, where user status refers to the user's access status to the application system.
4. The method according to claim 2, characterized in that, In the third step, an XML configuration file is created in the TDI tool so that the data in the application system user data source file in the first step can be written to the corresponding roles of each application system in the LDAP user database of the unified management platform in the second step after attribute mapping and attribute modification within the TDI tool.
5. The method according to claim 4, characterized in that, The third step is as follows: (1) In the TDI tool, create an XML configuration file and create two new data pipelines in the XML configuration file: an inbound data stream and an outbound data stream; the inbound data stream is loaded with the application system user data source file from the first step, and the outbound data stream is loaded with the LDAP user database of the unified management platform from the second step. (2) In the incoming data stream, traverse and query all user information in the application system user data source file, and mark its user ID and user name attributes as work attributes so that they can be used by the query variables in the outgoing data stream, and map and match them with the information in the LDAP user database in the unified management platform. (3) Find all relevant attribute information of all users in the unified management platform LDAP user database in the outgoing data stream, including user ID, user name, and application system role attribute. Create two expressions corresponding to the link conditions, namely the expression corresponding to condition one and the expression corresponding to condition two. The left side of the expression corresponding to condition one is the user ID attribute in the unified management platform LDAP user database, and the right side is the user ID value in the application system user data source file. The operator is equals. The left side of the expression corresponding to condition two is the user name attribute in the unified management platform LDAP user database, and the right side is the user name value in the application system user data source file. The operator is equals. (4) Determine whether the current user exists in the unified management platform and has access to this application system based on the expression corresponding to the two link conditions, or whether the current user once had access to this application system but is now an illegal user. (5) After polling and traversing all user information in the application system user data source file, based on the user application system role value in the unified management platform LDAP user database, all users with access permissions to this application system are filtered out, thus completing the access permission marking of this part of the users in the unified management platform LDAP user database.
6. The method according to claim 5, characterized in that, The method also includes: marking users whose user status value is 0 in the application system data source file sent into the data stream, which completes the sorting and marking of illegal user access permissions of the application system.
7. The method according to claim 5, characterized in that, Based on the expressions corresponding to the two link conditions, determine whether the current user exists in the unified management platform and has access to this application system, or whether the current user previously had access to this application system but is now an unauthorized user. For each user in the application system user data source file sent into the data stream, compare it with all user information in the unified management platform LDAP user database. When the calculation results of the expressions corresponding to condition one and condition two are both 1, it means that the current user exists in the unified management platform and has access permissions for this application system. Then, write the user ID value in the application system user data source file into the application system role value corresponding to this user in the unified management platform LDAP user database.
8. The method according to claim 5, characterized in that, Based on the expressions corresponding to the two link conditions, determine whether the current user exists in the unified management platform and has access to this application system, or whether the current user previously had access to this application system but is now an unauthorized user. If either the expression for condition one or the expression for condition two is 0, it means that the current user once had access to this application system but is no longer in the reference user information list. The user status value in the application system user data source file is then updated to 0, indicating that the user is illegitimate and their access to this application system needs to be cleared in time.