Scenario: Sub-Tree Synchronization

Figure:  Synchronization scenario–Sub-tree synchronization with all options enabled illustrates synchronization where only a sub-tree of the domain is synchronized.

All synchronization options are selected. New users are created, deleted users are removed, and users who have been moved in LDAP are also moved in OneSpan Authentication Server.

In the context of user move, however, note that users Bob Baker and Chris Clark from the OrgDoc organizational unit in LDAP are synchronized differently:

• Before the synchronization, Chris Clark was moved from OrgDev to OrgDoc in LDAP. After synchronization, Chris Clark is in the new organziational unit OrgDoc on OneSpan Authentication Server.

  Chris Clark is moved for the following reasons:

  • The user was moved to a different organizational unit, which is considered a change by LDAP Synchronization Tool that is covered by the Update Users "All" option.

• Before the synchronization, Bob Baker is in OrgDoc in LDAP. After synchronization, Bob Baker remains in the Europe organizational unit.

  Bob Baker is not moved for the following reasons:

  • Unlike Chris Clark, he was not moved to OrgDoc in LDAP, so his location has not changed.

  • The pre-synchronization state in OneSpan Authentication Server was achieved by a previous synchronization without Mirror organizational unit structure selected. As a consequence, the structure on the server before the synchronization is flat. In this state, Bob Baker is in the Europe organizational unit. He remains in this organizational unit after the synchronization.