Tools / ForgeRock IAM interview questions
What is ForgeRock IDM reconciliation and how do you configure it?
Reconciliation in ForgeRock IDM is the process of comparing two populations — a source (typically managed users in IDM's repository) and a target (an external system accessed via a connector) — and taking configured actions to bring them into alignment. It is the batch, on-demand, or scheduled mechanism for ensuring that the two systems represent the same identity population.
During reconciliation, each source object is matched against target objects using a configured correlation query. Based on the comparison result, IDM classifies each record into a situation and takes a corresponding action:
| Situation | Meaning | Typical Action |
|---|---|---|
| CONFIRMED | Source and target both exist and are linked | UPDATE (sync attributes) |
| FOUND | Source exists; unlinked target match found | LINK (create link) |
| ABSENT | Source exists; no target object found | CREATE (provision to target) |
| UNQUALIFIED | Source does not meet filter criteria | UNLINK or IGNORE |
| AMBIGUOUS | Source matches multiple target objects | EXCEPTION (manual review) |
| MISSING | Target exists; source is gone | DELETE (deprovision) or REPORT |
| SOURCE_MISSING | Linked source object has been deleted | DELETE target or REPORT |
Reconciliation is configured in the sync.json file in IDM's configuration. You define the source and target object sets, the correlation query, a property mapping (which attributes flow from source to target), and the situation-action policy. Reconciliation can be triggered:
- Via the IDM admin UI (Run Reconciliation button)
- Via REST:
POST /openidm/recon?_action=recon&mapping=managedUser_systemLdapAccounts - On a schedule configured in
scheduler.json
More Related questions...
