Filter
Top Products
IBM Tivoli Identity Manager Performance Tuning Guide
Page 9
Setting the values
Edit the
enRole.properties file and update the value of enrole.reconciliation.threadcount to
num_recon_threads.
3.2.2 Limiting attributes returned from the adapter
Some adapters (such as the adapter for Microsoft Active Directory) can limit the attributes that are
returned to the IBM Tivoli Identity Manager server during reconciliations. This can reduce the amount of
work required by the adapter to retrieve or calculate the values of the attributes as well as amount of data
sent back to IBM Tivoli Identity Manager.
Consult the adapter documentation for information specific to that adapter. See also the
IBM Tivoli
Identity Manager adapters
section.
3.2.3 Limiting the attributes evaluated
During reconciliation, any attributes that were identified as having been changed are updated within the
IBM Tivoli Identity Manager directory server. Before this update takes place, the new value is evaluated
against the provisioning policy that governs the account to ensure that the change is allowed within the
policy, and if not, a policy enforcement is triggered. Any change to the account will trigger the policy
evaluation for that account regardless if the change would invalidate the policy.
To reduce the number of policy evaluations, limit the attributes that are evaluated during reconciliation.
Some endpoints (such as Microsoft Active Directory) contain attributes that change frequently but are
seldom used to enforce policy, such as last logon time. If these attributes are required, consider setting
up a second reconciliation to reconcile these attributes on a more infrequent schedule and remove them
from the more frequently running reconciliations. If possible, reconcile only those attributes that are
required for policy evaluation.
Determining the values
excluded_attributes – The list of attributes that are returned from the adapter to exclude from
processing within IBM Tivoli Identity Manager. Ideally these would be all attributes except those
that are required for policy evaluation.
Setting the values
1) Log into IBM Tivoli Identity Manager as a user with sufficient privileges to edit the service.
2) Select the Provisioning tab.
3) Navigate to the service in the organizational tree.
4) Select the service to modify.
5) Select Reconciliation.
6) Select the reconciliation schedule to modify.
7) Select the Query tab.
8) Move all excluded_attributes from to the Excluded Attributes list.
9) Click Submit.
3.2.4 Maximum duration
Large reconciliations can sometimes exceed the default maximum duration as specified in the
reconciliation schedule. When this limit is reached, the reconciliation is aborted. Increase the limit to allow
longer-running reconciliations to complete.