Page History

...

1. Login as a CO Administrator and select your CO.
2. Go to Configuration > Provisioning Targets.
3. Click (+) Add Provisioning Target.
4. Configure the new Provisioning Target.
   1. If the Plugin you select has additional configuration options (most do), they will appear after you click Add.
   2. Select the desired mode:Plugins configured for
      1. Automatic Mode
       will
      1. : The Plugin will be invoked automatically whenever COmanage Registry notices data suitable for provisioning has changed.
      Plugins configured for
      2. Manual Mode
       will
      1. : The Plugin will only be invoked when a CO Admin explicitly does so (as described below).
      As
      2. Enrollment Mode: The Plugin will only be invoked once, at the conclusion of an Enrollment Flow. Available as of Registry v3.2.0
      , Plugins can be configured in Enrollment Mode. Plugins in Enrollment Mode will only be invoked once, at the conclusion of an Enrollment Flow
      1. .
      2. Queue Mode: The Plugin will not be immediately invoked, but instead a Job will be queued for asynchronous processing. See Queue Based Provisioning, below.
      3. Queue on Error Mode: The Plugin will be immediately invoked, but on error a Job will be queued for asynchronous reprocessing. See Queue Based Provisioning, below.
      1. As of Registry v1.0.3, Provisioning Targets can be ordered, so that a given provisioner can be guaranteed to run before another provisioner (for the same record). This applies only during Automatic Provisioning.

      2. As of Registry v2.0.0, a Provisioning Group can be specified. If provided, only CO People who are members of the CO Group (and only the CO Group itself, if the Provisioning Target also supports provisioning groups) will be provisioned using this provisioner. If a CO Person is subsequently removed from the group, their record will be deleted from the target (that is, the provisioning operation will automatically be converted to a delete action).

         Note

         Keep in mind that when a CO Person is not in Active or Grace Period status, they are effectively removed from all Groups (with the exception of All Members Groups) for purposes of provisioning. So, for example, if a CO Person is expired, and the Provisioning Target is configured for the I Like Ice Cream Group (of which the person is a member), they will be completely removed from the Provisioning Target. Only All Members groups (at either the CO or COU level) can be used to maintain an expired record in the Provisioning Target (assuming the Target supports such behavior in the first place).

         
         

      3. As of Registry v3.2.0, an Organizational Identity Source can be associated with a Provisioning Target, via the Skip If Associated With Org Identity Source configuration option. If set, then a CO Person who has an Organizational Identity created from the specified Organizational identity Source will not be provisioned.

         Note
         If used with a Provisioning Group, this setting takes precedence, and will prevent the CO Person from being provisioned.

         
         

   3. Configure any Plugin specific options.

   ...

   Info
   title Note for Developers
   Provisioning can be disabled on a per model/save basis by passing the option "provision" => false (v1.0.1 and later).

   Queue Based Provisioning

   As of Registry v4.0.0, queue based provisioning is supported in two ways: for all provisioning attempts, and on error only. A provisioning action is queued by scheduling a Registry Job using the Provisioner Job Plugin. For the queue to be processed, the Job Shell must be configured to run.

   Only one Job for the combination of (Provisioning Target + Provisioning Subject + Provisioning Action) will be queued at any time. If a second Job is queued (for example, two actions causing provisioning happen quickly back to back), the second Job will be recorded as Failed, however the first Job will run and bring the target fully up to date. In the event of different actions (for example, an update followed by a delete), the actions will be executed sequentially.

   Queue Based Provisioning, unlike Automatic Provisioning, is not necessarily immediate. For Queue Mode, the provisioning action will be queued for immediate execution. However, it will not be processed until the next run of Job Shell, which will depend on how often it is scheduled to run from cron and whether there are other jobs in the queue to be processed first. For Queue On Error Mode, the provisioning action will run immediately, but on failure will be subject to the Retry Interval.

   The Retry Interval specifies how long to wait before trying to provision again after a failure (ie: the first time the action is queued in Queue On Error Mode, or the second time the action is queue in Queue Mode). The default is 900 seconds (15 minutes). Setting the interval to 0 will prevent the provisioning action from being tried again on a failure. A provisioning action stuck in a failure loop can be manually terminated by cancelling the currently queued job for the subject.

   Monitoring Push Provisioning

   When provisioning is triggered automatically by an update, there is not currently a way to pass to the end user the results of the provisioning operation (other than manually clicking on the Provisioned Services link for the CO Person) (CO-582). If a provisioning plugin fails in such a situation, an error message will be syslog()d (at LOG_ERR). It is recommended that syslog be suitably configured and monitored to catch any errors with automatic provisioning. Alternately, as of Registry v4.0.0 use one of the Queue based operational modes.

   Additionally, a Notification will be generated and sent to the CO Administrators.

   ...