You can use an optional include/exclude file on the connected system to control which identities are or are not synchronized from the Identity Vault to the connected system.
To control which objects are synchronized from the connected system to the Identity Vault, use policies. For details about customizing policies, see the Policy Builder and Driver Customization Guide on the Identity Manager 3 Documentation Web site.
The connected system include/exclude file must be a sequential file or a member of a partitioned data set. The INCEXC DD statement in the driver shim started task JCL identifies the include/exclude file. An example include/exclude file that excludes many common z/OS users and groups, such as JES, OMVS, and INIT, is provided in the driver samples library member INCEXC.
The file is read when the driver shim starts. If you make changes to it, you must restart the driver shim.
The include/exclude file can contain include rules and exclude rules. To ensure optimal performance, each include/exclude file should contain no more than 50 entries total.
You can use the include/exclude file to phase in your deployment of the driver, excluding most users and groups at first, and then adding more as you gain confidence and experience.
Identity Vault events for identities that match an exclude rule are discarded by the Subscriber shim.
Included identities are treated normally by the Subscriber shim.
Identities that do not match an include rule or an exclude rule in the file are included.
Identities are matched in the following priority:
Exclude rules
Include rules
Within each level of this matching priority, identities are matched against rules in the order that the rules appear in the file. The first rule that matches determines whether the identity is included or excluded.
Except for class names, attribute names, and the values to match, the contents of the include/exclude file are case insensitive.
The Subscriber Creation policy converts object names to uppercase. Use uppercase names in the include/exclude file to match identities.
The include/exclude file can contain any number of include sections, exclude sections, and single-line rules.
Include sections and exclude sections can contain class matching rules, and class matching rules can contain attribute matching rules. Include sections and exclude sections can also contain association matching rules.
Class and attribute names used in the include/exclude file must correspond to the names specified in the schema file. For details about the schema file, see Section 6.2, The Connected System Schema File.
Lines that begin with an octothorpe (#) are comments.
# This is a comment.
Include and exclude sections provide rules to specify which objects are to be included or excluded from synchronization.
An include section begins with an include line and ends with an endinclude line.
INCLUDE . . . ENDINCLUDE
An exclude section begins with an exclude line and ends with an endexclude line.
EXCLUDE . . . ENDEXCLUDE
You can use class matching rules and association matching rules within an include section and an exclude section.
Use a class matching rule within an include section or an exclude section to specify the name of a class of objects to include or exclude.
A class matching rule is defined by a class line that specifies the name of the class and ends with an endclass line.
CLASS className
.
.
.
ENDCLASS
You can use attribute matching rules within a class matching rule.
You can use attribute matching rules within a class matching rule to limit the objects that are included or excluded. If no attribute matching rules are specified for a class, all objects of the specified class are included or excluded.
An attribute matching rule comprises an attribute name, an equals sign (=), and an expression. The expression can be an exact value, or it can use limited regular expressions. For details about limited regular expressions, see Limited Regular Expressions.
attributeName=expression
Multiple attribute matching rules can be specified for a given class.
Attribute matching rules within a class matching rule are logically ANDed together. To logically OR attribute matching rules for a class, specify multiple class matching rules. For example, the following include/exclude file excludes both user01 and user02:
# Exclude the User object if its ACID is USER01 or USER02.
EXCLUDE
CLASS USER
ACID=USER01
ENDCLASS
CLASS USER
ACID=USER02
ENDCLASS
ENDEXCLUDE
You can specify association matching rules in an include or exclude section. Association matching rule expressions can specify an exact association or a limited regular expression. For details about limited regular expressions, see Limited Regular Expressions.
By default, an association is the ACID. Association formation can be customized in the Subscriber REXX execs.
For example, to exclude the root user, specify
EXCLUDE ROOT ENDEXCLUDE
INCLUDE|EXCLUDE [className] objectSelection
Where objectSelection can be
{associationMatch | attributeName=expression}
You must specify whether the rule is to include or exclude the objects it matches.
You can specify a class name to limit matches to only objects of that class.
You must specify either an association or an attribute matching expression. The syntax of the association and attribute matching expression is the same as that of association matching rules and attribute matching rules previously described. For details, see Association Matching Rules and Attribute Matching Rules.
For example, to ignore events from the Admin user in the Identity Vault:
# Do not subscribe to events for the Admin user. EXCLUDE ADMIN
A limited regular expression is a pattern used to match a string of characters.
Character matching is case sensitive.
Any literal character matches that character.
A period (.) matches any single character.
A bracket expression is a set of characters enclosed by left ([) and right (]) brackets that matches any listed character. Within a bracket expression, a range expression is a pair of characters separated by a hyphen, and is equivalent to listing all of the characters that sort between the given characters. For example, [0-9] matches any single digit.
An asterisk (*) indicates that the preceding item is matched zero or more times.
A plus sign (+) indicates that the preceding item is matched one or more times.
A question mark (?) indicates that the preceding item is matched zero or one times.
You can use parentheses to group multiple expressions into a single item. For example, (abc)+ matches abc, abcabc, abcabcabc, etc. Nesting of parentheses is not supported.
Example 6-1 Example 1
# Exclude users whose names start with TEMP
EXCLUDE
CLASS USER
ACID=TEMP.*
ENDCLASS
ENDEXCLUDE
Example 6-2 Example 2
# Exclude USERA and USERB
# Because attribute rules are ANDed, these must be in separate
# CLASS sections.
EXCLUDE
CLASS USER
ACID=USERA
ENDCLASS
CLASS USER
ACID=USERB
ENDCLASS
ENDEXCLUDE