Maximum duration setting on reconciliation schedule

The reconciliation timeout, or 'Maximum duration' setting that you configure when you set up a reconciliation schedule is not honored under certain conditions.

The following prerequisites are assumed:
  • The dispatcher or adapter is running for the entire duration of the reconciliation process.
  • The resource is running for the entire duration of the reconciliation process.
When the reconciliation process (either manual or scheduled) starts on IBM Verify Identity Governance, the following sequence of activities occurs on IBM Verify Identity Governance server and on the dispatcher or adapter.
  1. IBM Verify Identity Governance sends a request to the dispatcher/adapter to start the reconciliation operation and waits for the dispatcher to return the first batch of entries.
  2. Depending on the batch size property, that is specified on the dispatcher, the dispatcher or adapter prepares a batch of entries, and returns that batch to IBM Verify Identity Governance Server for processing.
  3. After the first batches of entries are processed on IBM Verify Identity Governance server, IBM Verify Identity Governance sends a request to the dispatcher to send the next batch of entries. This process continues until all the entries are reconciled and processed by IBM Verify Identity Governance or an exception that is causing the process to end.

If the reconciliation process runs for more than the configured time duration (“Maximum duration”), then IBM Verify Identity Governance server attempts to stop the reconciliation, after the maximum duration time elapses. Following are the two conditions where the behavior of IBM Verify Identity Governance differs when the maximum duration is reached.

Note: The behavior of IBM Verify Identity Governance that is described in the following section is for Security Directory Integrator-based adapters only. For ADK/DAML based adapters, IBM Verify Identity Governance always honors the “Maximum Duration” that is specified in the reconciliation schedule. After the reconciliation process runs for more than the “Maximum duration” time, IBM Verify Identity Governance closes the search request and stops the reconciliation request at its end.

Maximum duration time elapses when the following conditions occur:

Condition 1: IBM Verify Identity Governance waits to receive the first batch of entries from dispatcher or adapter

This condition might arise when the following events occur:
  • The request hangs on the dispatcher or adapter after it receives a search request from IBM Verify Identity Governance and before it might respond back to IBM Verify Identity Governance with the first batch of entries. IBM Verify Identity Governance keeps on waiting for the response.
  • A high value is specified for the batch size on the Security Directory Integrator-based dispatcher and the resource is slow. In this situation, the time that is taken by the dispatcher/adapter to accumulate the first batch of entries might exceed the maximum duration time that is specified on the IBM Verify Identity Governance server for the reconciliation process. IBM Verify Identity Governance server keeps on waiting for the initial response.

In these situations, IBM Verify Identity Governance does not stop the reconciliation request even if the reconciliation time exceeds the “Maximum Duration” value. IBM Verify Identity Governance waits for the dispatcher to return the first batch of entries and then checks the “Maximum duration” value that is specified in reconciliation schedule. If the “Maximum Duration” is elapsed, IBM Verify Identity Governance does not process the entries that are returned by dispatcher.

IBM Verify Identity Governance then sends a “Search Close” request to dispatcher/adapter to end the Search operation. If the dispatcher/adapter hangs, then the reconciliation operation in IBM Verify Identity Governance hangs forever and user must manually stop the operation from the IBM Verify Identity Governance console.

Condition 2: IBM Verify Identity Governance is waiting on or processing the entries from the dispatcher or adapter that are not the first batch

This condition might arise when the following events occur:
  • The request hangs on the dispatcher/adapter after one or more batches of entries are sent to IBM Verify Identity Governance in response to a search request. IBM Verify Identity Governance waits for the subsequent batch of entries. Meanwhile the maximum reconciliation duration is reached on the IBM Verify Identity Governance server.
  • A high value is specified for the batch size on the dispatcher and the resource is slow. In this situation, the time that is taken by the dispatcher to accumulate the next batch of entries might be substantially more. IBM Verify Identity Governance waits for the subsequent batch of entries. Meanwhile the maximum reconciliation duration is reached on the IBM Verify Identity Governance server.
  • The number of entries to be processed are substantially large on the resource and the “Maximum duration” is set to a considerably low value. The maximum reconciliation duration is reached when the reconciliation process is in progress.

In these situations, IBM Verify Identity Governance honors the “Maximum Duration” value that is set on the reconciliation schedule. After the reconciliation process runs for more than the “Maximum duration” time, IBM Verify Identity Governance sends a “Search Close” request to the dispatcher or adapter. After the dispatcher or adapter sends back the response that it closed the search request, IBM Verify Identity Governance stop the reconciliation request at its end.