Azure AD Connect 同步:了解体系结构Azure AD Connect sync: Understanding the architecture

本主题介绍 Azure AD Connect 同步的基本体系结构。在许多方面,它类似于其前身产品 MIIS 2003、ILM 2007 和 FIM 2010。This topic covers the basic architecture for Azure AD Connect sync. In many aspects, it is similar to its predecessors MIIS 2003, ILM 2007, and FIM 2010. Azure AD Connect 同步是这些技术的演进。Azure AD Connect sync is the evolution of these technologies. 如果熟悉上述任何早期技术,则也会熟悉本主题的内容。If you are familiar with any of these earlier technologies, the content of this topic will be familiar to you as well. 本主题很适合同步功能的新手。If you are new to synchronization, then this topic is for you. 但是,不一定要了解本主题的详细信息才能成功自定义 Azure AD Connect 同步(在本主题中称为“同步引擎”)。It is however not a requirement to know the details of this topic to be successful in making customizations to Azure AD Connect sync (called sync engine in this topic).

体系结构Architecture

同步引擎为多个连接的数据源中存储的对象创建集成视图,并管理这些数据源中的标识信息。The sync engine creates an integrated view of objects that are stored in multiple connected data sources and manages identity information in those data sources. 此集成视图的具体内容取决于从连接的数据源检索的标识信息,以及一组用于确定如何处理此信息的规则。This integrated view is determined by the identity information retrieved from connected data sources and a set of rules that determine how to process this information.

连接的数据源和连接器Connected Data Sources and Connectors

同步引擎处理来自不同数据存储库(例如 Active Directory 或 SQL Server 数据库)的标识信息。The sync engine processes identity information from different data repositories, such as Active Directory or a SQL Server database. 将数据组织成类似数据库格式并提供标准数据访问方法的每个数据存储库都是同步引擎的潜在数据源候选项。Every data repository that organizes its data in a database-like format and that provides standard data-access methods is a potential data source candidate for the sync engine. 由同步引擎同步的数据存储库称为连接的数据源或连接的目录 (CD)。 The data repositories that are synchronized by sync engine are called connected data sources or connected directories (CD).

同步引擎在名为 连接器的模块中对连接的数据源的交互进行封装。The sync engine encapsulates interaction with a connected data source within a module called a Connector. 每种类型的连接数据源都有特定的连接器。Each type of connected data source has a specific Connector. 连接器将所需的操作转换成连接的数据源识别的格式。The Connector translates a required operation into the format that the connected data source understands.

连接器执行 API 调用,以便与连接的数据源交换标识信息(读取和写入)。Connectors make API calls to exchange identity information (both read and write) with a connected data source. 此外,可以使用可扩展的连接框架来添加自定义连接器。It is also possible to add a custom Connector using the extensible connectivity framework. 下图演示了连接器如何将连接的数据源连接到同步引擎。The following illustration shows how a Connector connects a connected data source to the sync engine.

Arch1

数据可以朝任一方向流动,但无法同时朝两个方向流动。Data can flow in either direction, but it cannot flow in both directions simultaneously. 换而言之,可将连接器配置为允许数据从连接的数据源流到同步引擎,或从同步引擎流到连接的数据源,但是,每次对一个对象和属性只能执行其中一项操作。In other words, a Connector can be configured to allow data to flow from the connected data source to sync engine or from sync engine to the connected data source, but only one of those operations can occur at any one time for one object and attribute. 不同的对象和属性的方向可以不同。The direction can be different for different objects and for different attributes.

若要配置连接器,可以指定要同步的对象类型。To configure a Connector, you specify the object types that you want to synchronize. 指定对象类型可以定义要包含在同步过程中的对象的范围。Specifying the object types defines the scope of objects that are included in the synchronization process. 下一步是选择要同步的属性,即所谓的属性包含列表。The next step is to select the attributes to synchronize, which is known as an attribute inclusion list. 可以随时更改这些设置,以响应业务规则的更改。These settings can be changed any time in response to changes to your business rules. 使用 Azure AD Connect 安装向导时,向导将配置这些设置。When you use the Azure AD Connect installation wizard, these settings are configured for you.

要将对象导出到连接的数据源,属性包含列表必须至少包含在连接的数据源中创建特定对象类型所需的最少属性。To export objects to a connected data source, the attribute inclusion list must include at least the minimum attributes required to create a specific object type in a connected data source. 例如,必须将 sAMAccountName 属性包含在属性包含列表中才能将用户对象导出到 Active Directory,因为 Active Directory 中的所有用户对象都必须定义 sAMAccountName 属性。 For example, the sAMAccountName attribute must be included in the attribute inclusion list to export a user object to Active Directory because all user objects in Active Directory must have a sAMAccountName attribute defined. 同样,安装向导会自动完成此配置。Again, the installation wizard does this configuration for you.

如果连接的数据源使用结构化组件(例如分区或容器)来组织对象,可以限制连接的数据源中用于给定解决方案的区域。If the connected data source uses structural components, such as partitions or containers to organize objects, you can limit the areas in the connected data source that are used for a given solution.

同步引擎命名空间的内部结构Internal structure of the sync engine namespace

整个同步引擎命名空间由用于存储标识信息的两个命名空间组成。The entire sync engine namespace consists of two namespaces that store the identity information. 这两个命名空间为:The two namespaces are:

  • 连接器空间 (CS)The connector space (CS)
  • Metaverse (MV)The metaverse (MV)

连接器空间 是一个暂存区域,其中包含连接的数据源中指定对象的表示形式,以及在属性包含列表中指定的属性。The connector space is a staging area that contains representations of the designated objects from a connected data source and the attributes specified in the attribute inclusion list. 同步引擎使用连接器空间来确定连接的数据源有何更改,以及暂存传入的更改。The sync engine uses the connector space to determine what has changed in the connected data source and to stage incoming changes. 同步引擎还使用连接器空间来暂存传出的更改,以便导出到连接的数据源。The sync engine also uses the connector space to stage outgoing changes for export to the connected data source. 同步引擎维护一个不同的连接器空间作为每个连接器的暂存区域。The sync engine maintains a distinct connector space as a staging area for each Connector.

使用暂存区域,同步引擎可与连接的数据源保持独立,而不受其可用性和可访问性的影响。By using a staging area, the sync engine remains independent of the connected data sources and is not affected by their availability and accessibility. 因此,随时可以使用暂存区域中的数据处理标识信息。As a result, you can process identity information at any time by using the data in the staging area. 同步引擎只能请求最后一个通信会话终止后在连接的数据源内所做的更改,或只推送连接的数据源尚未收到的标识信息更改,以减少同步引擎与连接的数据源之间的网络流量。The sync engine can request only the changes made inside the connected data source since the last communication session terminated or push out only the changes to identity information that the connected data source has not yet received, which reduces the network traffic between the sync engine and the connected data source.

此外,同步引擎存储它在连接器空间中暂存的所有对象的相关状态信息。In addition, sync engine stores status information about all objects that it stages in the connector space. 同步引擎在收到新的数据时,始终会评估此数据是否已同步。When new data is received, sync engine always evaluates whether the data has already been synchronized.

Metaverse 是一个存储区域,其中包含来自多个连接的数据源的聚合标识信息,并提供所有组合对象的单个全局集成视图。The metaverse is a storage area that contains the aggregated identity information from multiple connected data sources, providing a single global, integrated view of all combined objects. 根据从连接的数据源检索的标识信息以及一组用于自定义同步过程的规则来创建 Metaverse 对象。Metaverse objects are created based on the identity information that is retrieved from the connected data sources and a set of rules that allow you to customize the synchronization process.

下图显示了同步引擎内的连接器空间命名空间和 Metaverse 命名空间。The following illustration shows the connector space namespace and the metaverse namespace within the sync engine.

Arch2

同步引擎标识对象Sync engine identity objects

同步引擎中的对象是连接的数据源中任一个对象的表示形式,或同步引擎为这些对象提供的集成视图。The objects in the sync engine are representations of either objects in the connected data source or the integrated view that sync engine has of those objects. 每个同步引擎对象必须有一个全局唯一标识符 (GUID)。Every sync engine object must have a globally unique identifier (GUID). GUID 提供数据完整性以及对象之间的明确关系。GUIDs provide data integrity and express relationships between objects.

连接器空间对象Connector space objects

当同步引擎与连接的数据源通信时,将读取连接的数据源中的标识信息,并使用该信息在连接器空间中创建标识对象的表示形式。When sync engine communicates with a connected data source, it reads the identity information in the connected data source and uses that information to create a representation of the identity object in the connector space. 无法单独创建或删除这些对象。You cannot create or delete these objects individually. 但是,可以手动删除连接器空间中的所有对象。However, you can manually delete all objects in a connector space.

连接器空间中的所有对象有两个属性:All objects in the connector space have two attributes:

  • 全局唯一标识符 (GUID)A globally unique identifier (GUID)
  • 可分辨名称(也称为 DN)A distinguished name (also known as DN)

如果连接的数据源将唯一属性分配给对象,则连接器空间中的对象也可以有定位点属性。If the connected data source assigns a unique attribute to the object, then objects in the connector space can also have an anchor attribute. 定位点属性可唯一标识连接的数据源中的对象。The anchor attribute uniquely identifies an object in the connected data source. 同步引擎使用定位点在连接的数据源中查找此对象的对应表示形式。The sync engine uses the anchor to locate the corresponding representation of this object in the connected data source. 同步引擎假设对象的定位点永远不在对象的生存期内更改。Sync engine assumes that the anchor of an object never changes over the lifetime of the object.

许多连接器在导入每个对象时使用已知的唯一标识符自动为其生成定位点。Many of the Connectors use a known unique identifier to generate an anchor automatically for each object when it is imported. 例如,Active Directory 连接器使用定位点的 objectGUID 属性。For example, the Active Directory Connector uses the objectGUID attribute for an anchor. 如果连接的数据源未提供明确定义的唯一标识符,可以指定在连接器配置期间生成定位点。For connected data sources that do not provide a clearly defined unique identifier, you can specify anchor generation as part of the Connector configuration.

在这种情况下,将从对象类型的一个或多个唯一属性(均未更改)构建定位点,而该定位点可唯一标识连接器空间中的对象(例如,员工编号或用户 ID)。In that case, the anchor is built from one or more unique attributes of an object type, neither of which changes, and that uniquely identifies the object in the connector space (for example, an employee number or a user ID).

连接器空间对象可以是以下其中一项:A connector space object can be one of the following:

  • 暂存对象A staging object
  • 占位符A placeholder

暂存对象Staging Objects

暂存对象表示连接的数据源中指定的对象类型实例。A staging object represents an instance of the designated object types from the connected data source. 除了 GUID 和可分辨名称以外,暂存对象始终有一个用于指示对象类型的值。In addition to the GUID and the distinguished name, a staging object always has a value that indicates the object type.

已导入的暂存对象始终为定位点属性提供值。Staging objects that have been imported always have a value for the anchor attribute. 由同步引擎最近预配的和正在连接的数据源中创建的暂存对象不会为定位点属性提供值。Staging objects that have been newly provisioned by sync engine and are in the process of being created in the connected data source do not have a value for the anchor attribute.

暂存对象还带有业务属性的当前值,以及同步引擎执行同步过程所需的操作信息。Staging objects also carry current values of business attributes, and operational information needed by sync engine to perform the synchronization process. 操作信息包括用于指示暂存对象中暂存的更新类型的标志。Operational information includes flags that indicate the type of updates that are staged on the staging object. 如果某个暂存对象从连接的数据源收到尚未处理的新标识信息,则该对象将标记为等待导入If a staging object has received new identity information from the connected data source that has not yet been processed, the object is flagged as pending import. 如果某个暂存对象有新的标识信息尚未导出到连接的数据源,则该对象将标记为等待导出If a staging object has new identity information that has not yet been exported to the connected data source, it is flagged as pending export.

暂存对象可以是导入对象或导出对象。A staging object can be an import object or an export object. 同步引擎使用从连接的数据源接收的对象信息创建导入对象。The sync engine creates an import object by using object information received from the connected data source. 当同步引擎收到了与连接器中选择的对象类型之一匹配的新对象的存在状态信息时,会在连接器空间中创建导入对象作为该对象在连接的数据源中的表示形式。When sync engine receives information about the existence of a new object that matches one of the object types selected in the Connector, it creates an import object in the connector space as a representation of the object in the connected data source.

下图显示了一个导入对象,它表示连接的数据源中的对象。The following illustration shows an import object that represents an object in the connected data source.

Arch3

同步引擎使用 Metaverse 中的对象信息创建导出对象。The sync engine creates an export object by using object information in the metaverse. 在下一次通信会话期间,导出对象会导出到连接的数据源。Export objects are exported to the connected data source during the next communication session. 从同步引擎的立场来看,导出对象尚不在连接的数据源中存在。From the perspective of the sync engine, export objects do not exist in the connected data source yet. 因此,无法使用导出对象的定位点属性。Therefore, the anchor attribute for an export object is not available. 从同步引擎接收对象之后,连接的数据源为对象的定位点属性创建唯一值。After it receives the object from sync engine, the connected data source creates a unique value for the anchor attribute of the object.

下图显示了如何使用 Metaverse 中的标识信息创建导出对象。The following illustration shows how an export object is created by using identity information in the metaverse.

Arch4

同步引擎从连接的数据源重新导入对象,确认对象的导出。The sync engine confirms the export of the object by reimporting the object from the connected data source. 同步引擎在下一次导入期间从该连接的数据源接收对象后,导出对象会变为导入对象。Export objects become import objects when sync engine receives them during the next import from that connected data source.

占位符Placeholders

同步引擎使用平面命名空间来存储对象。The sync engine uses a flat namespace to store objects. 但是,有些连接的数据源(例如 Active Directory)使用分层命名空间。However, some connected data sources such as Active Directory use a hierarchical namespace. 为了将分层命名空间中的信息转换为平面命名空间,同步引擎会使用占位符来保留层次结构。To transform information from a hierarchical namespace into a flat namespace, sync engine uses placeholders to preserve the hierarchy.

每个占位符代表尚未导入同步引擎、但需要构造分层名称的对象的分层名称的组成部分(例如,组织单位)。Each placeholder represents a component (for example, an organizational unit) of an object's hierarchical name that has not been imported into sync engine but is required to construct the hierarchical name. 占位符填补在连接的数据源中引用不是连接器空间中暂存对象的对象所产生的间距。They fill gaps created by references in the connected data source to objects that are not staging objects in the connector space.

同步引擎还使用占位符来存储尚未导入的引用对象。The sync engine also uses placeholders to store referenced objects that have not yet been imported. 例如,如果已将同步配置为包含 Abbie Spencer 对象的管理器属性,并且接收的值是尚未导入的对象(例如 CN=Lee Sperry,CN=Users,DC=fabrikam,DC=com ),则管理器信息将存储为连接器空间中的占位符。For example, if sync is configured to include the manager attribute for the Abbie Spencer object and the received value is an object that has not been imported yet, such as CN=Lee Sperry,CN=Users,DC=fabrikam,DC=com, the manager information is stored as placeholders in the connector space. 如果稍后导入管理器对象,则表示此管理器的暂存对象会覆盖占位符对象。If the manager object is later imported, the placeholder object is overwritten by the staging object that represents the manager.

Metaverse 对象Metaverse objects

Metaverse 对象包含同步引擎具有的连接器空间中暂存对象的聚合视图。A metaverse object contains the aggregated view that sync engine has of the staging objects in the connector space. 同步引擎使用导入对象中的信息创建 Metaverse 对象。Sync engine creates metaverse objects by using the information in import objects. 可将多个连接器空间对象链接到单个 Metaverse 对象,但无法将连接器空间对象链接到多个 Metaverse 对象。Several connector space objects can be linked to a single metaverse object, but a connector space object cannot be linked to more than one metaverse object.

无法手动创建或删除 Metaverse 对象。Metaverse objects cannot be manually created or deleted. 同步引擎自动删除连接器空间中没有任何连接器空间对象链接的 Metaverse 对象。The sync engine automatically deletes metaverse objects that do not have a link to any connector space object in the connector space.

为了将连接的数据源中的对象映射到 Metaverse 中对应的对象类型,同步引擎提供了可扩展的架构,其中包含一组预定义的对象类型和关联的属性。To map objects within a connected data source to a corresponding object type within the metaverse, sync engine provides an extensible schema with a predefined set of object types and associated attributes. 可以为 Metaverse 对象创建新的对象类型和属性。You can create new object types and attributes for metaverse objects. 属性可以是单值或多值属性,属性类型可以是字符串、引用、数字和布尔值。Attributes can be single-valued or multivalued, and the attribute types can be strings, references, numbers, and Boolean values.

暂存对象与 Metaverse 对象之间的关系Relationships between staging objects and metaverse objects

在同步引擎命名空间中,数据流由暂存对象与 Metaverse 对象之间的链接关系来启用。Within the sync engine namespace, the data flow is enabled by the link relationship between staging objects and metaverse objects. 链接到 Metaverse 对象的暂存对象称为联接的对象 (或连接器对象 )。A staging object that is linked to a metaverse object is called a joined object (or connector object). 未链接到 Metaverse 对象的暂存对象称为脱离的对象 (或断开连接器对象 )。A staging object that is not linked to a metaverse object is called a disjoined object (or disconnector object). 之所以偏向于使用术语“联接”和“脱离”,是为了不与负责从连接的目录导入和导出数据的连接器相混淆。The terms joined and disjoined are preferred to not confuse with the Connectors responsible for importing and exporting data from a connected directory.

占位符永远不会链接到 Metaverse 对象Placeholders are never linked to a metaverse object

联接的对象由暂存对象及其与单个 Metaverse 对象的链接关系构成。A joined object comprises a staging object and its linked relationship to a single metaverse object. 联接的对象用于同步连接器空间对象与 Metaverse 对象之间的属性值。Joined objects are used to synchronize attribute values between a connector space object and a metaverse object.

当暂存对象在同步期间变为联接的对象时,属性可以在暂存对象与 Metaverse 对象之间流动。When a staging object becomes a joined object during synchronization, attributes can flow between the staging object and the metaverse object. 属性流动是双向的,并可以使用导入属性规则和导出属性规则进行配置。Attribute flow is bidirectional and is configured by using import attribute rules and export attribute rules.

一个连接器空间对象只能链接到一个 Metaverse 对象。A single connector space object can be linked to only one metaverse object. 但是,每个 Metaverse 对象可以链接到相同或不同连接器空间中的多个连接器空间对象,如下图所示。However, each metaverse object can be linked to multiple connector space objects in the same or in different connector spaces, as shown in the following illustration.

Arch5

暂存对象与 Metaverse 对象之间的链接关系持续存在,只能按照指定的规则删除。The linked relationship between the staging object and a metaverse object is persistent and can be removed only by rules that you specify.

脱离的对象是未链接到任何 Metaverse 对象的暂存对象。A disjoined object is a staging object that is not linked to any metaverse object. 在 Metaverse 中,脱离对象的属性值不做进一步的处理。The attribute values of a disjoined object are not processed any further within the metaverse. 同步引擎不会更新连接的数据源中相应对象的属性值。The attribute values of the corresponding object in the connected data source are not updated by sync engine.

使用脱离的对象可以先将标识信息存储在同步引擎中,以后再做处理。By using disjoined objects, you can store identity information in sync engine and process it later. 将暂存对象保持为连接器空间中的脱离对象有许多好处。Keeping a staging object as a disjoined object in the connector space has many advantages. 由于系统已暂存此对象的所需信息,因此不需要在下一次从连接的数据源导入期间创建此对象的表示形式。Because the system has already staged the required information about this object, it is not necessary to create a representation of this object again during the next import from the connected data source. 这样,即使当前没有与连接的数据源建立连接,同步引擎也始终有连接的数据源的完整快照。This way, sync engine always has a complete snapshot of the connected data source, even if there is no current connection to the connected data source. 根据指定的规则,可将脱离的对象转换为联接的对象,反之亦然。Disjoined objects can be converted into joined objects, and vice versa, depending on the rules that you specify.

导入对象创建为脱离的对象。An import object is created as a disjoined object. 导出对象必须是联接的对象。An export object must be a joined object. 系统逻辑强制实施此规则,并删除每个不是联接对象的导出对象。The system logic enforces this rule and deletes every export object that is not a joined object.

同步引擎标识管理过程Sync engine identity management process

标识管理过程控制在不同的连接数据源之间更新标识信息的方式。The identity management process controls how identity information is updated between different connected data sources. 标识管理分为三个过程:Identity management occurs in three processes:

  • 导入Import
  • 同步Synchronization
  • 导出Export

在导入过程中,同步引擎评估从连接的数据源传入的标识信息。During the import process, sync engine evaluates the incoming identity information from a connected data source. 检测到更改时,它会在连接器空间中创建新的暂存对象或更新现有暂存对象以进行同步。When changes are detected, it either creates new staging objects or updates existing staging objects in the connector space for synchronization.

在同步过程中,同步引擎更新 Metaverse 以反映连接器空间中发生的更改,并更新连接器空间以反映 Metaverse 中发生的更改。During the synchronization process, sync engine updates the metaverse to reflect changes that have occurred in the connector space and updates the connector space to reflect changes that have occurred in the metaverse.

在导出过程中,同步引擎推送暂存对象中暂存的更改以及标记为等待导出的更改。During the export process, sync engine pushes out changes that are staged on staging objects and that are flagged as pending export.

下图显示了当标识信息在两个连接的数据源之间流动时,发生每个过程的位置。The following illustration shows where each of the processes occurs as identity information flows from one connected data source to another.

Arch6

导入过程Import process

在导入过程中,同步引擎评估标识信息的更新。During the import process, sync engine evaluates updates to identity information. 同步引擎比较从连接的数据源收到的标识信息与暂存对象的标识信息,以确定暂存对象是否需要更新。Sync engine compares the identity information received from the connected data source with the identity information about a staging object and determines whether the staging object requires updates. 如果需要使用新数据更新暂存对象,则暂存对象将标记为等待导入。If it is necessary to update the staging object with new data, the staging object is flagged as pending import.

同步引擎在同步之前准备连接器空间中的对象,只能处理已更改的标识信息。By staging objects in the connector space before synchronization, sync engine can process only the identity information that has changed. 此过程具有以下优点:This process provides the following benefits:

  • 高效的同步Efficient synchronization. 将同步期间处理的数据量减到最少。The amount of data processed during synchronization is minimized.
  • 高效的重新同步Efficient resynchronization. 可以更改同步引擎处理标识信息的方式,而不需要将同步引擎重新连接到数据源。You can change how sync engine processes identity information without reconnecting the sync engine to the data source.
  • 有机会预览同步Opportunity to preview synchronization. 可以预览同步,以验证对于标识管理过程所做的假设是否正确。You can preview synchronization to verify that your assumptions about the identity management process are correct.

对于连接器中指定的每个对象,同步引擎先尝试在连接器的连接器空间中查找该对象的表示形式。For each object specified in the Connector, the sync engine first tries to locate a representation of the object in the connector space of the Connector. 同步引擎检查连接器空间中所有的暂存对象,尝试查找具有匹配定位点属性的对应暂存对象。Sync engine examines all staging objects in the connector space and tries to find a corresponding staging object that has a matching anchor attribute. 如果现有暂存对象没有匹配的定位点属性,则同步引擎尝试查找具有相同可分辨名称的对应暂存对象。If no existing staging object has a matching anchor attribute, sync engine tries to find a corresponding staging object with the same distinguished name.

当同步引擎找到可分辨名称匹配但定位点不匹配的暂存对象时,会发生以下特殊行为:When sync engine finds a staging object that matches by distinguished name but not by anchor, the following special behavior occurs:

  • 如果连接器空间中找到的对象没有定位点,则同步引擎会从连接器空间中删除此对象,并将其链接到的 Metaverse 对象标记为在下一次运行同步时重试预配If the object located in the connector space has no anchor, then sync engine removes this object from the connector space and marks the metaverse object it is linked to as retry provisioning on next synchronization run. 然后创建新的导入对象。Then it creates the new import object.
  • 如果连接器空间中找到的对象具有定位点,则同步引擎会假设此对象已在连接的目录中重命名或已删除。If the object located in the connector space has an anchor, then sync engine assumes that this object has either been renamed or deleted in the connected directory. 它为连接器空间对象分配新的临时可分辨名称,以便暂存传入的对象。It assigns a temporary, new distinguished name for the connector space object so that it can stage the incoming object. 旧对象会变成暂时性对象,等待连接器导入重命名或删除内容以解决这种情况。The old object then becomes transient, waiting for the Connector to import the rename or deletion to resolve the situation.

如果同步引擎找到的暂存对象对应于连接器中指定的对象,它可确定要应用哪一种更改。If sync engine locates a staging object that corresponds to the object specified in the Connector, it determines what kind of changes to apply. 例如,同步引擎可能会在连接的数据源中重命名或删除该对象,或者只更新该对象的属性值。For example, sync engine might rename or delete the object in the connected data source, or it might only update the object’s attribute values.

具有更新数据的暂存对象会标记为等待导入。Staging objects with updated data are marked as pending import. 可以使用不同类型的等待导入。Different types of pending imports are available. 根据导入过程的结果,连接器空间中的暂存对象具有以下等待导入类型之一:Depending on the result of the import process, a staging object in the connector space has one of the following pending import types:

  • None. 暂存对象的所有属性都没有更改。No changes to any of the attributes of the staging object are available. 同步引擎不将此类型标记为等待导入。Sync engine does not flag this type as pending import.
  • 添加Add. 暂存对象是连接器空间中新的导入对象。The staging object is a new import object in the connector space. 同步引擎将此类型标记为等待导入,以便在 Metaverse 中进行其他处理。Sync engine flags this type as pending import for additional processing in the metaverse.
  • 更新Update. 同步引擎在连接器空间中查找相应的暂存对象并将此类型标记为等待导入,以便在 Metaverse 中处理属性更新。Sync engine finds a corresponding staging object in the connector space and flags this type as pending import so that updates to the attributes can be processed in the metaverse. 更新包括对象重命名。Updates include object renaming.
  • 删除Delete. 同步引擎在连接器空间中查找相应的暂存对象并将此类型标记为等待导入,以便删除联接的对象。Sync engine finds a corresponding staging object in the connector space and flags this type as pending import so that the joined object can be deleted.
  • 删除/添加Delete/Add. 同步引擎在连接器空间中找到了对应的暂存对象,但对象类型不匹配。Sync engine finds a corresponding staging object in the connector space, but the object types do not match. 在此情况下,将暂存删除-添加修改。In this case, a delete-add modification is staged. 删除-添加修改向同步引擎表示必须对此对象进行完全重新同步,因为对象类型更改时,会将不同的规则集应用到此对象。A delete-add modification indicates to the sync engine that a complete resynchronization of this object must occur because different sets of rules apply to this object when the object type changes.

设置暂存对象的等待导入状态可以大幅减少同步期间处理的数据量,因为这样可让系统只处理已更新了数据的对象。By setting the pending import status of a staging object, it is possible to reduce significantly the amount of data processed during synchronization because doing so allows the system to process only those objects that have updated data.

同步过程Synchronization process

同步由两个相关的过程组成:Synchronization consists of two related processes:

  • 入站同步:在使用连接器空间中的数据更新 Metaverse 的内容时发生。Inbound synchronization, when the content of the metaverse is updated by using the data in the connector space.
  • 出站同步:在使用 Metaverse 中的数据更新连接器空间的内容时发生。Outbound synchronization, when the content of the connector space is updated by using data in the metaverse.

入站同步过程使用连接器空间中暂存的信息在 Metaverse 中为存储在连接的数据源中的数据创建集成视图。By using the information staged in the connector space, the inbound synchronization process creates in the metaverse the integrated view of the data that is stored in the connected data sources. 根据规则的配置方式,聚合所有暂存对象或只是具有等待导入信息的对象。Either all staging objects or only those with a pending import information are aggregated, depending on how the rules are configured.

出站同步过程在 Metaverse 对象更改时更新导出对象。The outbound synchronization process updates export objects when metaverse objects change.

入站同步在 Metaverse 中为从连接的数据源接收的标识信息创建集成视图。Inbound synchronization creates the integrated view in the metaverse of the identity information that is received from the connected data sources. 同步引擎随时可以使用连接的数据源中最新的标识信息处理标识信息。Sync engine can process identity information at any time by using the latest identity information that it has from the connected data source.

入站同步Inbound synchronization

入站同步包括以下过程:Inbound synchronization includes the following processes:

  • 预配 (也称为投影 ,如果一定要将此过程与出站同步预配进行区分的话)。Provision (also called Projection if it is important to distinguish this process from outbound synchronization provisioning). 同步引擎根据暂存对象创建新的 Metaverse 对象并链接它们。The Sync engine creates a new metaverse object based on a staging object and links them. 预配是对象级的操作。Provision is an object-level operation.
  • 联接Join. 同步引擎将暂存对象链接到现有的 Metaverse 对象。The Sync engine links a staging object to an existing metaverse object. 联接是对象级的操作。A join is an object-level operation.
  • 导入属性流Import attribute flow. 同步引擎更新 Metaverse 中对象的属性值(称为属性流)。Sync engine updates the attribute values, called attribute flow, of the object in the metaverse. 导入属性流是需要暂存对象与 Metaverse 对象之间的链接的属性级操作。Import attribute flow is an attribute-level operation that requires a link between a staging object and a metaverse object.

预配是唯一可在 Metaverse 中创建对象的过程。Provision is the only process that creates objects in the metaverse. 预配只影响属于脱离对象的导入对象。Provision affects only import objects that are disjoined objects. 在预配期间,同步引擎会创建 Metaverse 对象(其对应于导入对象的对象类型),并创建这两个对象间的链接,从而创建联接的对象。During provision, sync engine creates a metaverse object that corresponds to the object type of the import object and establishes a link between both objects, thus creating a joined object.

联接过程还会创建导入对象与 Metaverse 对象之间的链接。The join process also establishes a link between import objects and a metaverse object. 联接与预配的差异在于联接过程要求导入对象链接到现有的 Metaverse 对象,而预配过程会创建新的 Metaverse 对象。The difference between join and provision is that the join process requires that the import object are linked to an existing metaverse object, where the provision process creates a new metaverse object.

同步引擎使用同步规则配置中指定的条件尝试将导入对象联接到 Metaverse 对象。Sync engine tries to join an import object to a metaverse object by using criteria that is specified in the Synchronization Rule configuration.

在预配或联接过程中,同步引擎将分离对象链接到 Metaverse 对象,使它们联接在一起。During the provision and join processes, sync engine links a disjoined object to a metaverse object, making them joined. 在完成这些对象级操作之后,同步引擎可以更新关联 Metaverse 对象的属性值。After these object-level operations are completed, sync engine can update the attribute values of the associated metaverse object. 此过程称为导入属性流。This process is called import attribute flow.

导入属性流发生于携带新数据并链接到 Metaverse 对象的所有导入对象上。Import attribute flow occurs on all import objects that carry new data and are linked to a metaverse object.

出站同步Outbound synchronization

出站同步在 Metaverse 对象已更改但未删除时更新导出对象。Outbound synchronization updates export objects when a metaverse object change but is not deleted. 出站同步的目标是评估更改 Metaverse 对象是否需要更新连接器空间中的暂存对象。The objective of outbound synchronization is to evaluate whether changes to metaverse objects require updates to staging objects in the connector spaces. 在某些情况下,更改可能要求更新所有连接器空间中的暂存对象。In some cases, the changes can require that staging objects in all connector spaces be updated. 更改的暂存对象标记为等待导出,并使其成为导出对象。Staging objects that are changed are flagged as pending export, making them export objects. 然后,这些对象会在导出过程中推送到连接的数据源。These export objects are later pushed out to the connected data source during the export process.

出站同步有三个过程:Outbound synchronization has three processes:

  • 设置Provisioning
  • 取消预配Deprovisioning
  • 导出属性流。Export attribute flow

预配和取消预配都是对象级的操作。Provisioning and deprovisioning are both object-level operations. 取消预配依赖于预配,因为只有预配可以启始它。Deprovisioning depends on provisioning because only provisioning can initiate it. 当预配删除了 Metaverse 对象与导出对象之间的链接时,会触发取消预配。Deprovisioning is triggered when provisioning removes the link between a metaverse object and an export object.

将更改应用到 Metaverse 中的对象时,始终会触发预配。Provisioning is always triggered when changes are applied to objects in the metaverse. 对 Metaverse 对象进行更改时,同步引擎可以在预配过程中执行以下任一任务:When changes are made to metaverse objects, sync engine can perform any of the following tasks as part of the provisioning process:

  • 创建联接的对象,其中 Metaverse 对象已链接到新建的导出对象。Create joined objects, where a metaverse object is linked to a newly created export object.
  • 重命名联接的对象。Rename a joined object.
  • 断开 Metaverse 对象与暂存对象之间的链接,从而创建脱离的对象。Disjoin links between a metaverse object and staging objects, creating a disjoined object.

如果预配要求同步引擎创建新的连接器对象,则 Metaverse 对象链接到的暂存对象始终为导出对象,因为该对象尚不在连接的数据源中存在。If provisioning requires sync engine to create a new connector object, the staging object to which the metaverse object is linked is always an export object, because the object does not yet exist in the connected data source.

如果预配要求同步引擎分离已联接的对象以便创建脱离的对象,则会触发取消预配。If provisioning requires sync engine to disjoin a joined object, creating a disjoined object, deprovisioning is triggered. 取消预配过程会删除该对象。The deprovisioning process deletes the object.

在取消预配期间,删除导出对象并不实际删除该对象。During deprovisioning, deleting an export object does not physically delete the object. 该对象会标记为已删除,表示已在该对象上暂存删除操作。The object is flagged as deleted, which means that the delete operation is staged on the object.

类似于导入属性流发生在入站同步过程中,导出属性流发生在出站同步过程中。Export attribute flow also occurs during the outbound synchronization process, similar to the way that import attribute flow occurs during inbound synchronization. 导出属性流只发生在联接的 Metaverse 与导出对象之间。Export attribute flow occurs only between metaverse and export objects that are joined.

导出过程Export process

在导出过程中,同步引擎将检查连接器空间中所有标记为等待导出的导出对象,并将更新发送到连接的数据源。During the export process, sync engine examines all export objects that are flagged as pending export in the connector space, and then sends updates to the connected data source.

同步引擎可以确定导出是否成功,但无法充分确定标识管理过程是否已完成。The sync engine can determine the success of an export but it cannot sufficiently determine that the identity management process is complete. 其他过程始终可以更改连接的数据源中的对象。Objects in the connected data source can always be changed by other processes. 由于同步引擎对于连接的数据源没有持续连接,因此无法只根据成功导出通知对连接的数据源中的对象属性进行假设。Because sync engine does not have a persistent connection to the connected data source, it is not sufficient to make assumptions about the properties of an object in the connected data source based only on a successful export notification.

例如,连接的数据源中的过程可以将对象的属性变回其原始值(也就是说,连接的数据源可以在同步引擎推送数据并成功应用于连接的数据源之后立即覆盖这些值)。For example, a process in the connected data source could change the object’s attributes back to their original values (that is, the connected data source could overwrite the values immediately after the data is pushed out by sync engine and successfully applied in the connected data source).

同步引擎存储有关每个暂存对象的导出和导入状态的信息。The sync engine stores export and import status information about each staging object. 自从上次导出以后,如果在属性包含列表中指定的属性值已更改,则存储导入和导出状态可以相应地让同步引擎做出反应。If values of the attributes that are specified in the attribute inclusion list have changed since the last export, the storage of import and export status enables sync engine to react appropriately. 同步引擎使用导入过程来确认已导出到连接的数据源的属性值。Sync engine uses the import process to confirm attribute values that have been exported to the connected data source. 会在导入和导出的信息之间进行比较(如下图所示),使同步引擎能够确定导出是否成功或者是否需要重复导出。A comparison between the imported and exported information, as shown in the following illustration, enables sync engine to determine whether the export was successful or if it needs to be repeated.

Arch7

例如,如果同步引擎将值为 5 的属性 C 导出到连接的数据源,则在导出状态内存中存储 C=5。For example, if sync engine exports attribute C, which has a value of 5, to a connected data source, it stores C=5 in its export status memory. 此对象的每次额外导出都会导致尝试再度将 C=5 导出到连接的数据源,因为同步引擎假设此值尚未持续应用到对象(也就是说,除非最近从连接的数据源导入了不同的值)。Each additional export on this object results in an attempt to export C=5 to the connected data source again because sync engine assumes that this value has not been persistently applied to the object (that is, unless a different value was imported recently from the connected data source). 在对象导入操作期间收到 C=5 时,会清除导出内存。The export memory is cleared when C=5 is received during an import operation on the object.

后续步骤Next steps

了解有关 Azure AD Connect 同步配置的详细信息。Learn more about the Azure AD Connect sync configuration.

了解有关将本地标识与 Azure Active Directory 集成的详细信息。Learn more about Integrating your on-premises identities with Azure Active Directory.