# Patent

## Title
XML configuration technique and graphical user interface (GUI) for managing user data in a plurality of databases

## Abstract

A system and method for integrating data from a source application to a target application are provided. The system includes an interface module for extracting data from the source application and publishing the data in a first predetermined format; a business transformation logic engine for transforming the formatted data by a series of transformation handlers into a second predetermined format usable by the target application; and a configuration interface for defining the data to be transformed from the source application to the target application.

## Background
CROSS REFERENCE TO RELATED APPLICATIONS
This application claims priority to a provisional application entitled “XML CONFIGURATION TECHNIQUE AND GRAPHICAL USER INTERFACE (GUI) FOR MANAGING USER DATA IN A PLURALITY OF DATABASES” filed in the United States Patent and Trademark Office on Jul. 11, 2003 and assigned Ser. No. 60/486,508, the entire contents of which are hereby incorporated by reference. This application is also related to U.S. provisional application Ser. Nos. 60/486,517 and 60/486,512, each filed on Jul. 11, 2003, the entire contents of each of these applications also being incorporated by reference.


BACKGROUND
1. Field
The present invention relates generally to database management systems, and more particularly, to a system and method for managing user data in a plurality of databases. Additionally, the present invention relates to an XML configuration technique and graphical user interface (GUI) for managing the user data in the plurality of databases.
2. Description of the Related Art
Driven by new Internet technologies, business growth requires organizations to extend their systems, applications and directories to partners, suppliers, customers and employees. This explosion in user population makes the task of managing user accounts increasingly complex. It also creates a new need for identity management—the ability to control and monitor individual user access over time.
Compounding this situation are the business realities of mergers, acquisitions and divestitures—the numbers of users are increasing and the numbers of system types are expanding. IT directors are forced to manage multiple operating systems, mail systems, network operating systems and home-grown applications distributed across various, often worldwide locations.
Individually managing multiple directories is time-consuming, costly and error-prone—especially in organizations where changes frequently occur. Keeping up with the daily maintenance can be a significant task. Ensuring overall security and integrity across the board increases the challenge.
To meet these challenges, administrative security systems have been developed to provide user account management across multiple, geographically dispersed security systems and directories. An example of one such system is eTrustTMAdmin commercially available from Computer Associates International, Inc. of New York, the assignee of the present application. These systems enable the creation, modification and removal of users across multiple, heterogeneous environments. The single administrative security system allows administrators to centrally define and manage security policies across an enterprise by automating the provisioning of user accounts on a variety of IT systems and ERP (Enterprise Resource Planning) applications, for example, using a role-based approach. That is, role-based user provisioning enables the administrators to automatically provide users with a set of user ids based on their business functions and ensures consistent user access policies are applied across a wide range of system types and directories.
With the advances in centralizing the administration of user accounts, there remains a need for techniques for extracting data from directories and ERP applications to populate the administrative security systems without manually reentering the existing data.
SUMMARY
A system and method for managing user data in a plurality of databases is provided. The system and method extracts user data from a source application, repository or database, transforms the user data into global user data, and sends the global user data to a target application capable of managing the global user data across various environments.
According to an aspect of the present invention, a system for integrating data from a source application to a target application is provided comprising an interface module for extracting data from the source application and publishing the data in a first predetermined format; a business transformation logic engine for transforming the formatted data by a plurality of transformation handlers into a second predetermined format usable by the target application; and a configuration interface for defining the data to be transformed from the source application to the target application. The configuration interface formats the data in XML (Extensible Markup Language) format.
In a further aspect, the configuration interface defines decision tables based on business rules for combining values associated with data elements of the source application and outputting a value associated with at least one data element in the target application. Additionally, the configuration interface maps data elements from the source application to data elements of the target application. Furthermore, the configuration interface defines an order of execution of the plurality of transformation handlers.
In another aspect of the present invention, a method in a computer system for configuring a transformation of data from a source application to a target application comprises the steps of presenting at least one data element to a user from the source application; presenting at least one data element to the user from the target application; and presenting means for associating the at least one data element of the source application to the at least one data element of the target application. The method further comprises the steps of presenting a plurality of XSL (Extensible Stylesheet Language) files for transforming the source application data; and presenting a prompt to the user requesting submission of a sequential order for executing the plurality of XSL files.
In a further aspect, the method comprises the steps of presenting a prompt to the user for associating a comparison operator to the at least one data element of the source application; presenting a table for selecting a plurality of data elements of the source application to be compared; and presenting a prompt to the user for associating a result of the comparison to the at least one data element of the target application.



BRIEF DESCRIPTION OF THE DRAWINGS
The above and other aspects, features, and advantages of the present invention will become more apparent in light of the following detailed description when taken in conjunction with the accompanying drawings in which:
FIG. 1 is a block diagram of an exemplary system for managing user data in a plurality of databases in accordance with an embodiment of the present invention;
FIG. 2 is a block diagram of an interface module in accordance with an embodiment of the present invention;
FIG. 3 is a block diagram of a business transformation logic (BTL) engine in accordance with an embodiment of the present invention;
FIGS. 4A-E illustrate exemplary screenshots of the configuration GUI in accordance with the present invention;
FIG. 5 is a flow diagram illustrating a method for managing user data in a plurality of databases in accordance with an embodiment of the present invention; and
FIG. 6 is an overall flow diagram illustrating a system and method for managing user data in a plurality of databases, where a source application or repository is a PeopleSoftTM application and a target application or repository is eTrustTM Admin.



DETAILED DESCRIPTION
Preferred embodiments of the present invention will be described hereinbelow with reference to the accompanying drawings. In the following description, well-known functions or constructions are not described in detail to avoid obscuring the invention in unnecessary detail.
A system and method for managing user data in a plurality of databases is provided. The system and method extracts user data from a source application, repository or database, transforms the user data into global user data, and sends the global user data to a target application capable of managing the global user data across various environments.
FIG. 1 is a block diagram of a system for managing user data in a plurality of databases. Generally, the system 100 includes an interface module 102 for extracting user data from a source application 104 and a business transformation logic (BTL) engine 106 for transforming the user data into a format usable by a target application 108. The interface module 102 includes a publisher 110 for extracting user data, e.g., employee data, from the source application 104. The publisher 110 publishes an XML message from the extracted user data and sends it to a subscriber 112. The subscriber 112 receives, decodes, and uncompresses the XML message. The subscriber 112 then sends the data to the BTL engine 106 that creates a MessageContext object with XML messages and sends it through a chain of BTL handlers, which will be described in detail below. From the BTL handlers, the object is sent to a workflow engine 114 where a request is created and sent to the target application 108. Depending on the request, the target application 108 creates, modifies, or deletes global users, their accounts, or changes the roles associated with a global user. Additionally, a configuration GUI (graphical user interface) 116 is provided for a user, e.g., an administrator, to define the information to be transformed from the source application 104 to the target application 108.
It is to be understood that the present invention may be implemented in various forms of hardware, software, firmware, special purpose processors, or a combination thereof. In one embodiment, the present invention may be implemented in software as an application program tangibly embodied on a program storage device. The application program may be uploaded to, and executed by, a machine comprising any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units (CPU), a random access memory (RAM), a read only memory (ROM) and input/output (I/O) interface(s) such as a keyboard, cursor control device (e.g., a mouse or joystick) and display device. The computer platform also includes an operating system and micro instruction code. The various processes and functions described herein may either be part of the micro instruction code or part of the application program (or a combination thereof) which is executed via the operating system. In addition, various other peripheral devices may be connected to the computer platform such as an additional data storage device and a printing device.
Additionally, it is to be appreciated that the system and method may be implemented on several machines coupled together over a network, e.g., a local area network (LAN), a Wide Area Network (WAN), the Internet, etc. For example, the interface module may be implemented on a first machine while the business transformation logic engine may be implemented on a second machine.
It is to be further understood that, because some of the constituent system components and method steps depicted in the accompanying figures may be implemented in software, the actual connections between the system components (or the process steps) may differ depending upon the manner in which the present invention is programmed. Given the teachings of the present invention provided herein, one of ordinary skill in the related art will be able to contemplate these and similar implementations or configurations of the present invention.
An embodiment of the present invention will be described below using a PeopleSoftTM application as the source application and Computer Associates' eTrustTM Admin as the target application with reference to FIGS. 2 and 3, where FIG. 2 is a graphical representation of a PeopleSoftTM eTrustTM Admin Interface (PETAI) module 202 and FIG. 3 is a block diagram of the BTL engine 306. It is to be understood that although the embodiment described below references PeopleSoft's HRMS (Human Resource Management System), the principles of the present invention will apply to other source applications and is not limited to that described below.
The main purpose of PETAI module 202 is to interface with PeopleSoftTM and to feed the PeopleSoftTM data onto the BTL Engine 306. The feed process will take place using two different mechanisms: Full Data Replication and Incremental Updates. The Full Data Replication process will be used to seed, or initially populate or repopulate, a copy of the entire sub-set of PeopleSoftTM records and fields exported onto eTrustTM Admin. The Incremental Updates mechanism will keep eTrustTM Admin current, with changes made on the master PeopleSoftTM data. Incremental updates will contain only the records where the data has been modified.
The PETAI module 202 will be implemented using PeopleSoftTM Enterprise Integration technology, specifically using Application Messaging 211, and will be loaded into the PeopleSoftTM application. PeopleSoftTM Application Messaging is based on a “publish-and-subscribe” model that enables a third party external system to integrate with PeopleSoftTM applications via XML/HTTP(S) messages.
The PETAI module 202 includes a publisher 210 and a subscriber 212. The publisher mechanism 210 will be deployed onto PeopleSoftTM and will publish and deliver the XML messages to eTrustTM Admin subscriber 212. The PETAI module 202 will comprise two separate publisher mechanisms, one for implementing the Full Data Replication 210-1 and one for the Incremental Updates 210-2. The eTrustTM Admin subscriber mechanism 212 will be deployed onto the PeopleSoftTM Application Messaging Gateway 211 and will capture, transform and pass the XML messages onto the BTL engine 306.
The Incremental Updates Publisher mechanism 210-2 will subscribe to internal application messages that synchronize PeoplesoftTM database components when changes are being made to the PeopleSoftTM records and fields. Then, it will build the PeopleSoftTM XML message(s) and populate it (them) with the data, and finally publish it (them) onto the eTrustTM Admin subscriber 212. The Full Data Replication Publisher mechanism 210-1 will query all the defined PeopleSoftTM records and fields to get a full copy of data, then it will build the PeopleSoftTM XML message(s) and populate it (them) with the data, and finally publish it (them) onto the eTrustTM Admin subscriber 212.
Many PeopleSoftTM application tables are effective-dated, meaning that historical and future-date rows may be present on the table. eTrustTM Admin does not use effective dating so the PETAI module 202 will need to filter and provide only the current or active information before feeding it onto eTrustTM Admin. This filtering process will take place in the publisher 210 and needs to be implemented for both full data replication and incremental updates publisher mechanisms.
The PETAI module 202 will define a sub-set of PeopleSoftTM records and fields that will be published and delivered to the eTrustTM Admin subscriber 212. This definition will be taken from the PeopleSoftTM Message definitions(s) that will carry on the data to eTrustTM Admin. Separate PeopleSoftTM message definitions will be created for the full data replication and incremental updates publishers.
The subscriber 212, e.g., a Java subscriber, will be deployed and registered into the PeopleSoftTM Application Messaging Gateway Servlet. It will be in charge of capturing, decoding and uncompressing any XML messages delivered to eTrustTM Admin, and passing them onto the BTL engine 306. Transformations will change the format used in the XML message from a PeopleSoftTM format to an eTrustTM Admin format. The Java subscriber 212 will also integrate with the PeopleSoftTM Application Messaging Config Servlet. The Config servlet will allow the administrator to load/unload the PETAI Java subscriber 212 as well as configuring PeopleSoftTM Nodes to be subscribed from. Integration code will interface with the Config servlet APIs including a HTML graphical user interface for the Java subscriber configuration.
To handle large XML messages, a separate thread will process the full data replication messages while the Java subscriber thread will process incremental updates messages. This separate thread is implemented by an EDI (Electronic Data Interchange) engine.
Once the subscriber 212 transforms the user data from the source application, the data is passed to the BTL engine 306. The purpose of the BTL engine 306 is to provide a means to transform the input PeopleSoftTM data coming from the PETAI module 202 into Workflow request(s). This request(s) will lead towards the provisioning, modification or de-provisioning of an eTrustTM Admin Global user and all associated accounts. The transformation will be performed by a series of BTL handlers that will be invoked by the BTL engine 306, as shown in FIG. 3. The invocation process will follow a pre-determined order previously specified in the configuration GUI. Each BTL handler will receive, apply its transformation and pass onto the next handler a MessageContext Object. The MessageContext object is a structure, which will contain the PeopleSoftTM data in an XML format among other parts.
The BTL engine 306 will enable the administrator to determine and assign Roles to Global Users based on PeopleSoftTM data; to calculate and assign custom data fields to Global User attributes, for example, to generate a user id using two or more PeopleSoftTM data fields and some specific business rules; to map data elements within the XML buffer to Global User Attributes; to access custom code and/or third party code to set Global User attributes; etc.
The BTL engine 306 will comprise a chain of handlers including a sample template handler 330, XSL files handler 332, business rules handler 334, mapping handler 336, and generic component handler (Dirsync Handler) 338.
The template handler 330 will serve as a starting point for the end user to develop custom BTL handlers for transforming data.
The XSL handler 332 will allow the end user to transform the input XML message based on a chain of XSL (Extensible Stylesheet Language) files. The stylesheet must be provided a separate file containing the XSL Transformation code (no need to re-compile Java code). To get a hold of the XSL file, this handler will use a parameter in a configuration file containing an ID for the stylesheet 402, the name of the XSL file 404 and an order number to be applied 406, as illustrated in FIG. 4B. For example, a PSCAMA (PeopleSoftTM Common Application Message Attributes) handler may have an entry as follows:















<xsl-entry>



  <stylesheet-id>pscama</stylesheet-id>



  <stylesheet-filename>pscama.xsl</stylesheet-filename>



  <stylesheet-order>1</stylesheet-order>



</xsl-entry>



<xsl-entry>



  <stylesheet-id >sample</stylesheet-id>



  <stylesheet-filename>sample.xsl</stylesheet-filename>



  <stylesheet-order>2</stylesheet-order>



</xsl-entry>










The PSCAMA XSL program will provide the functionality to filter PSCAMA and data records in the XML message. The filtering code will use an audit action field (AUDIT_ACTN) at the PSCAMA record to filter the data records in the XML message. Logic will be as follows:
The data record will be included in the output if

    
    
        PSCAMA record not present for a specific data record
        PSCAMA record is present and AUDIT_ACTN is set to ‘A’ or ‘C’ or ‘N’ or ‘ ’
    
    


A sample XSL program will also be provided. It will serve as a starting point for the end user, e.g. administrator, to develop custom XSL programs.
The business rules (BR) handler 334 enables the user to create a set of decision tables that match their specific needs. A decision table is a set of business rules that determine the assignments of special Global User attributes required in the user provisioning process. Special Global User attributes can be roles, profiles, groups, or any other attribute requiring special treatment to determine its value. Decision tables present a sophisticated mechanism to set special attributes without having to write any code.
For each special Global User attribute an administrator may want to assign, the administrator will create one decision table. Each decision table needs to specify a set of input parameters to be used in the calculation of the attribute value. A decision table header enables the administer to provide this information. The header's first column is where the output field name is to be placed. Valid output field names are considered any field name on the ETRUST_ADMIN record. The rest of the header columns are where the input parameters are to be placed. Valid input parameters are considered any field on the XML message and must be defined using XPath standard syntax.
The decision table rows are where the business rules are defined as illustrated in FIG. 4D. Each row specifies the output value 410, the combination of comparison values 412, and operators for assigning the value 414. The first column on each row is where the output value is placed. The rest of the row columns are where the comparison values and the operators are placed. Valid comparison values are any real value in the PeopleSoftTM database and valid comparison operators are ‘=’ (equal) and ‘!=’ (not equal).
The following decision table example assigns the Global User Role attribute (Role-Name) and uses three input parameters to calculate the value (Country, Department ID, and Company). The sample defines two business rules for assigning two different role values.














PERSON/





PERSONAL—
PERSON/
PERSON/



DATA/
JOB/
JOB/


Role-Name
COUNTRY
DEPTID
COMPANY







Namerica_HR_GBI_Role
=USA
=HR
=GBI


International_Role
!=USA









The following is the above decision table in XML format:












<decision-table-entry>


 <decision-table-id>roles</decision-table-id>


 <header>


  <header-output>


   <header-field-name>Role-Name</header-field-name>


  </header-output>


  <header-input-entry>


   <header-position>0</header-position>


   <header-xpath>PERSON/PERSONAL_DATA/


   COUNTRY</header-xpath>


  </header-input-entry>


  <header-input-entry>


   <header-position>1</header-position>


   <header-xpath>PERSON/JOB/DEPTID</header-xpath>


  </header-input-entry>


  <header-input-entry>


   <header-position>2</header-position>


   <header-xpath>PERSON/JOB/COMPANY</header-xpath>


  </header-input-entry>


 </header>


 <rows>


  <row-entry index=“0” >


   <row-output>


    <row-field-value>NAmerica_HR_GBI_role</row-field-value>


   </row-output>


   <row-input-entry>


    <row-position>0</row-position>


    <row-comparison-value>USA</row-comparison-value>


    <row-comparison-operator>=</row-comparison-operator>


   </row-input-entry>


   <row-input-entry>


    <row-position>1</row-position>


    <row-comparison-value>10000</row-comparison-value>


    <row-comparison-operator>=</row-comparison-operator>


   </row-input-entry>


   <row-input-entry>


    <row-position>2</row-position>


    <row-comparison-value>GBI</row-comparison-value>


    <row-comparison-operator>=</row-comparison-operator>


   </row-input-entry>


  </row-entry>


  <row-entry index=“1” >


   <row-output>


    <row-field-value>International_role</row-field-value>


   </row-output>


   <row-input-entry>


    <row-position>0</row-position>


    <row-comparison-value>USA</row-comparison-value>


    <row-comparison-operator>!=</row-comparison-operator>


   </row-input-entry>


  </row-entry>


 </rows>


</decision-table-entry>


<decision-table-entry>


 <decision-table-id>groups</decision-table-id>


 <header>


  <header-output>


   <header-field-name>Group-Name</header-field-name>


  </header-output>


  <header-input-entry>


   <header-position>0</header-position>


   <header-xpath>PERSON/PERSONAL_DATA/


   COUNTRY</header-xpath>


  </header-input-entry>


 </header>


 <rows>


  <row-entry index=“0” >


   <row-output>


    <row-field-value>NAmerica_group</row-field-value>


   </row-output>


   <row-input-entry>


    <row-position>0</row-position>


    <row-comparison-value>USA</row-comparison-value>


    <row-comparison-operator>=</row-comparison-operator>


   </row-input-entry>


  </row-entry>


  <row-entry index=“1” >


   <row-output>


    <row-field-value>International_group</row-field-value>


   </row-output>


   <row-input-entry>


    <row-position>0</row-position>


    <row-comparison-value>USA</row-comparison-value>


    <row-comparison-operator>!=</row-comparison-operator>


   </row-input-entry>


  </row-entry>


 </rows>


</decision-table-entry>









The business rules handler 334 then sends the message to the mapping handler 336.
The BTL mapping handler 336 associates one PeopleSoftTM data field or a custom record field 420 to a Global User attribute 422 of the eTrustTM Admin application as shown in FIG. 4C. The mapping supports the association of any element and any non-element within the XML message to a Global User Attribute using XPath standard syntax.
The mapping of attributes will be defined by XML data stored in the configuration file. The end user can customize the XML data to fit their specific needs using the configuration GUI as illustrated in FIG. 4C. The configuration file will use XPath standard syntax to define the mappings having the root element as the context for all definitions.
The following XML data represents a sample PeopleSoftTM XML message:















<MsgData>



 <Transaction>



  <PERSONAL_DATA class=“R”>



   <EMPLID>C10001</EMPLID>



   <NAME>Stankowski,Richard</NAME>



   <LAST_NAME>Stankowski</LAST_NAME>



   <FIRST_NAME>Richard</FIRST_NAME>



   <MIDDLE_NAME></MIDDLE_NAME>



   <COUNTRY>USA</COUNTRY>



   <ADDRESS1>11308 Wildflower Lane</ADDRESS1>



   <ADDRESS2></ADDRESS2>



   <ADDRESS3></ADDRESS3>



   <ADDRESS4></ADDRESS4>



   <CITY>Grass Valley</CITY>



   <COUNTY></COUNTY>



   <STATE>CA</STATE>



   <POSTAL>97077</POSTAL>



  </PERSONAL_DATA>



  <JOB_ETA_VW class=“R”>



   <EMPLID>C10001</EMPLID>



   <DEPTID>13000</DEPTID>



   <DESCR>Finance</DESCR>



   <JOBCODE>KU067</JOBCODE>



   <JOBCODE_DESCR>Sr Accounts Payable



   Clerk</JOBCODE_DESCR>



   <LOCATION>KUDE00</LOCATION>



   <LOCATION_DESCR>Delaware



   Operations</LOCATION_DESCR>



   <EMPL_STATUS>T</EMPL_STATUS>



   <COMPANY>GBI</COMPANY>



   <BUSINESS_UNIT>GBIBU</BUSINESS_UNIT>



   <BUSINESS_TITLE></BUSINESS_TITLE>



   <SUPERVISOR_ID></SUPERVISOR_ID>



  </JOB_ETA_VW>



 </Transaction>



</MsgData>










For example, mapping definitions for “EMPLID” and “DEPTID” elements will be represented using XPath standard syntax as:















<eta21-attribute-mapping>



 <custom-element-xpath>PERSONAL_DATA/



 EMPLID</custom-element-xpath>



 <attribute-name>eTUserid</attribute-name>



 <attribute-mod-flag>overwrite</attribute-mod-flag>



</eta21-attribute-mapping>



<eta21-attribute-mapping>



 <custom-element-xpath>PERSONAL_DATA/



 EMPLID</custom-element-xpath>



 <attribute-name>eTGlobalUserName</attribute-name>



 <attribute-mod-flag>overwrite</attribute-mod-flag>



</eta21-attribute-mapping>



<eta21-attribute-mapping>



 <custom-element-xpath>JOB_ETA_VW/



 DEPTID</custom-element-xpath>



 <attribute-name>eTDepartment</attribute-name>



 <attribute-mod-flag>overwrite</attribute-mod-flag>



</eta21-attribute-mapping>










The generic component handler 338 will be the end point in the BTL engine chain and ultimately will transform the PeopleSoftTM data into Workflow requests.
Among other functions, the configuration GUI 116 will be employed to configure the various BTL handlers. The purpose of the configuration GUI 116 is to provide a means for a system administrator to easily define the information that is needed to transform a PeopleSoftTM User Entry into an eTrustTM Admin Global User Entry. This information will include the resulting eTrustTM Admin Global User attributes and the means that is used to produce them.
The BTL configuration GUI 116 will be comprised of the following interfaces as illustrated in the exemplary screenshots of FIGS. 4A-E:

    
    
        Node Selection (FIG. 4A): This interface will allow the end user to select a node of the source application to be configured.
    
    


BTL Handlers Registration (FIG. 4B): This interface will allow the end user to register BTL handlers on the BTL engine and define their invocation order. It will also allow the end user to add, remove or modify the loading order of XSL files.

    
    
        Attribute Mapping Interface (FIG. 4C): This interface will allow the end user to define the mapping parameters used by the BTL Mapping Handler.
        Decision Tables Interface (FIG. 4D): This interface will allow the end user to create and add decision tables to be executed by the BTL Business Rules Handler.
        General Configuration (FIG. 4E): This interface will allow the end user to set all remaining configuration parameters.
    
    


The configuration GUI 116 will additionally enable the administrator to set any necessary configuration parameters. These configuration parameters will be held in the XML configuration file mentioned above. The subscriber, BTL Engine and BTL handlers access and load settings from the configuration file in order to operate. For example, the subscriber reads supported message definitions, message node name, full data replication output folder, etc.; the BTL Engine reads the registered BTL handlers and loading order, etc.; the BTL Business Rules handler reads decision tables, etc.
Below is an exemplary list of parameters included in the configuration file:











Parameter Name
Parameter Description







erpfeed-config
This is the root element for the XML configuration



file (replaces ‘dirsync-config’).


supported-message-
This element holds a Peoplesoft Message name that


name
will be processed by the BTL Engine. By default,



there will be an entry with the following names:



ETA_PERSON_SYNC_EFF



ETA_PERSON_FULLSYNC_EFF


etahandler-
This element holds a PeopleSoft external node name


nodename
that we want to subscribe. By default, there will be



an entry with the following names:



ETRUST


etahandler-html-
This element holds the folder name where this


root-dir
option is installed. Set by default to: /eaopeo21


output-user-tag-
This element holds the output user tag name that the


name
Mapping Handler will use to represent a Global



User Entry at the output message. Set by default to:



UserEntry


peoplesoft-msgdata-
This element holds the MsgData tag name of the


tag-name
PeopleSoft input XML message. This tag name



contains all transaction elements within a message.



Set by default to:



MsgData


peoplesoft-
This element holds the FieldTypes tag name of the


fieldtypes-tag-name
PeopleSoft input XML message. This tag name



contains the PeopleSoft field type information



section of the message. Set by default to:



FieldTypes


peoplesoft-trans-
This element holds a Transaction tag name of the


tag-name
PeopleSoft input XML message. This tag name



contains the record data elements for a transaction.



Set by default to:



Transaction


full-data-replication-
This element holds the threshold of transactions to


threshold
determine if a PeopleSoft input XML message will



be processed as an incremental updates message or



as a full data replication message. Set by default to:



1


full-data-replication-
This element holds the folder name where full data


output-dir
replication messages will be copied.



Set by default to:



fulldatareplication_output/


log-level-num
This element holds the log level. Valid values are



from 1 to 5. Set by default to: 3


xsl-entries-dir
This element holds the folder name where XSL files



must be placed. The XSLT handler or extended



classes will expect stylesheets to be located at this



folder. Set by default to:



XSL/


xsl-entry
This is the main element for a XSL entry. This



contains the ‘stylesheet-id’ and ‘stylesheet-filename’



elements.


stylesheet-id
A unique ID identifying an ‘xsl-entry’.


stylesheet-filename
The XSL file name containing the transformation



code to be used by an ‘xsl-entry’.


Stylesheet-order
This element holds the order number of a XSL



entry.


eta21-attribute-
This is the main mapping element containing each


mapping
map entry (Replaces ‘eta-attribute-mapping’). This



contains the ‘custom-element-xpath’,



‘attribute-name’ and ‘attribute-mod-flag’ elements.


custom-element-
This element holds the custom XPath sentence


xpath
addressing the part of the input XML message to be



mapped to the Global User attribute.



Note: the same custom element can be



mapped to one or more attribute names but the same



attribute name can not be set by two or more custom



elements.


btl-handler-entry
This is the main element for a BTL Handler entry.



This contains the ‘btl-handler-classname’ and



‘btl-handler-order’ elements.


btl-handler-
This element holds the full Java class name of a


classname
BTL handler entry.


btl-handler-order
This element holds the order number of a BTL



handler entry.


start-edi-engine
This element holds a Boolean value that allows to



load or not the EDIEngine for processing full data



replication messages. By default set to:



true









Additionally, below is an exemplary list of decision table parameters used in configuring the business rules handlers:
















Multi-
Value




Parameter Name
value
Type
Attributes
Description







decision-table-
Yes
—
—
Groups a decision


entry



table.


decision-table-id
No
Text
—
The decision table






id.


header
No
—
—
Groups the decision






table header.


header-output
No
—
—
Groups a header






output.


header-field-name
No
Text
—
The output field






name for this






decision table.


header-input-
Yes
—
—
Groups a header


entry



input entry.


header-position
No
Numeric
—
Header input entry






position.


header-xpath
No
XPath
—
Header input field






(must use standard






XPath).


rows
No
—
—
Groups all decision






table rows.


row-entry
Yes
—
index
Groups a row entry.


row-output
No
—
—
Groups the row






output.


row-field-value
No
Text
—
Output field value






for a row.


row-input-entry
Yes
—
—
Groups a row input






entry.


row-position
No
Numeric
—
The row position.


row-comparison-
No
Text
—
The row comparison


value



value (must be the






same type as header






entry for this






position).


row-comparison-
No
Text
—
The row comparison


operator



operator. Valid






values are:






=






!=









It is worth noting that to define the mappings and the BR decision tables meta-data will be required. This meta-data will be needed for both eTrustTM Admin and PeopleSoftTM. In the case of PeopleSoftTM, it will consist of the attributes that can be used as parameters to the Decision Table Definitions. In the case of eTrustTM Admin, this data will consist of a list of all supported Global User attributes. There will be two ways that the PeopleSoftTM data can be obtained from the BTL Configuration GUI. The first is by using a PeopleSoftTM Extract. From an existing extract, the BTL configuration GUI will be able to obtain the required meta-data. At any time, the system administrator will be able to add to and modify this meta-data. In the case of eTrustTM Admin meta-data, a listing of the attributes that exist will be readily available from the configuration GUI. In the BTL Configuration GUI, the eTrustTM Admin meta-data may be modified as well.
With reference to FIGS. 5 and 6, a method for managing user data in a plurality of databases will be described illustrating the data flow where the source application is a PeopleSoftTM application and the target application is eTrustTM Admin.
The PETAI module 602 will interface with PeopleSoftTM system 604 (step 502) and will feed PeopleSoftTM data onto the BTL engine 606 through its Java Subscriber 612 (step 504). The BTL engine 606 will generate a MessageContext object containing the PeopleSoftTM data and it will pass it on to the first BTL handler defined in the configuration file that in this case is the sample template handler 630 (step 506). The template handler 630 will process and transform the MessageContext object and it will pass it on to next handler in the chain. The XSL files handler 632 receives the MessageContext and applies a chain of XSL Transformations, e.g., PSCAMA.XSL and sample.XSL (step 508).
The business rules handler 634 receives the MessageContext object and transforms it executing any decision tables defined in the configuration file (step 510), via the configuration GUI 616. Then, it will pass it on to the mapping handler 636. The mapping handler 636 receives the MessageContext object and transforms it assigning PeopleSoftTM data fields and custom fields to Global User attributes based on the mapping information in the configuration file (step 512). Then, it will pass it on to the generic component handler 638. The generic component handler or end point handler (Dirsync Handler) will ultimately generate eTrustTM Admin Workflow requests (step 514), via the workflow engine 614. This request(s) will lead towards the provisioning, modification or de-provisioning of Global user and all associated accounts in the eTrustTM Admin application 608.
The system and method according to embodiments of the present invention provides organizations the ability to capture changes to a source application, e.g., a PeopleSoftTM application, in real time. The system and method transforms the data into “intelligible” user provisioning requests based on business rules associated with specific values in the source application data. The system and method then submits these requests via a workflow engine to a user provisioning engine, e.g., a target application, which ultimately sends (create, delete, or modify) requests to managed security systems. In summary, embodiments of the present invention automate the user provisioning process from a source application to the heterogeneous security systems making up the organizations IT infrastructure.
While the invention has been shown and described with reference to certain preferred embodiments thereof, it will be understood by those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

## Claims

1. A system for integrating data from a source application to a target application, the system comprising:
an interface module, implemented in hardware, configured to extract data from the source application and to transform the extracted data into at least one Extensible Markup Language (XML) message; a first predetermined format;
a business transformation logic (BTL) engine, implemented in hardware, and configured to transform the at least one XML message using a plurality of Extensible Stylesheet Language (XSL) files into a second predetermined format, wherein the extracted data has a first predetermined format, the target application is configured to use the transformed XML message in the second predetermined format, the second predetermined format is different from the first predetermined format, and the source application is different than the target application; and
a configuration graphical user interface configured to receive input that defines the integration of the extracted data from the source application to the target application, the configuration graphical user interface comprising:
a node selection interface configured to enable selection of one or more nodes of the source application to be configured and to enable selection of one or more nodes of the target application to be configured;
a BTL handler interface configured to enable registration of one or more BTL handlers on the BTL engine and configured to define the invocation order of the registered one or more BTL handlers based at least in part on input received from the configuration graphical user interface;
an attribute mapping interface configured to directly map each of the one or more nodes of the source application directly to at least one of the one or more nodes of the target application based at least in part on the input received from the configuration graphical user interface; and
a decision table interface configured to enable creation of one or more decision tables defining business rules for execution by the BTL handler interface based at least in part on the input received from the configuration graphical user interface.

2. A method in a computer system for configuring a transformation of data from a source application to a target application, the method comprising the steps of:
presenting at least one data element to a user from the source application, the source application configured to use data in a first predetermined format;
presenting at least one data element to the user from the target application, the target application configured to use data in a second predetermined format different from the first predetermined format, the second application being different from the first application;
presenting means for directly associating the at least one data element of the source application to the at least one data element of the target application, wherein the direct association of the at least one data element of the source application to the at least one data element of the target application is substantially free of an intermediate association;
presenting a plurality of Extensible Stylesheet Language (XSL) files for transforming the at least one data element of the source application to the at least one data element of the target application;
presenting a prompt to the user requesting submission of a sequential order for executing the plurality of XSL files;
creating one or more decision tables defining business rules for execution based at least in part on a response to the prompt to the user requesting submission of a sequential order for executing the plurality of XSL files;
extracting data from the source application;
transforming the extracted data into at least one Extensible Markup Language (XML) message; and
transforming the at least one XML message into one or more objects having the second predetermined format, the transforming of the at least one XML message using at least the means for directly associating and the sequential order for executing the plurality of XSL files.

3. The method as in claim 2, further comprising the steps of:
presenting a prompt to the user for associating a comparison operator to the at least one data element of the source application; and
presenting a prompt to the user for associating a result of the comparison to the at least one data element of the target application.

4. The method as in claim 3, further comprising the step of presenting a table for selecting a plurality of data elements of the source application to be compared.

5. The method as in claim 2, further comprising the step of presenting a prompt to the user for selecting a node of the source application to be configured.

6. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform method steps for configuring a transformation of data from a source application to a target application, the method steps comprising:
presenting at least one data element to a user from the source application, the source application configured to use data in a first predetermined format;
presenting at least one data element to the user from the target application, the target application configured to use data in a second predetermined format different from the first predetermined format, the second application being different from the first application;
presenting means for directly associating the at least one data element of the source application to the at least one data element of the target application, wherein the direct association of the at least one data element of the source application to the at least one data element of the target application is substantially free of an intermediate association;
presenting a plurality of Extensible Stylesheet Language (XSL) files for transforming the at least one data element of the source application to the at least one data element of the target application; and
presenting a prompt to the user requesting submission of a sequential order for executing the plurality of XSL files;
creating one or more decision tables defining business rules for execution based at least in part on a response to the prompt to the user requesting submission of a sequential order for executing the plurality of XSL files;
modifying data of the source application, the modified data having the first predetermined format;
in response to the modifying, extracting the modified data from the source application;
transforming the extracted data into the second predetermined format, the transforming using the means for directly associating and using the sequential order for executing the plurality of XSL files; and
automatically generating and executing one or more requests using the transformed data and the source application.

7. The program storage device as in claim 6, further comprising the steps of:
presenting a prompt to the user for associating a comparison operator to the at least one data element of the source application; and
presenting a prompt to the user for associating a result of the comparison to the at least one data element of the target application.

8. The program storage device as in claim 7, further comprising the step of presenting a table for selecting a plurality of data elements of the source application to be compared.

9. The program storage device as in claim 6, further comprising the step of presenting a prompt to the user for selecting a node of the source application to be configured.

10. The system as in claim 1, wherein the at least one Extensible Markup Language (XML) message is in a format different from the first predetermined format.

11. The method as in claim 2, the method comprising the step of decoding and uncompressing the XML message.

12. The method as in claim 2, the method comprising automatically generating and executing one or more requests using the one or more objects.

13. The method as in claim 12, wherein the executing of the one or more requests comprises modifying data of one or more user accounts.