It is also a good idea to specify a grace period for pending operations so the executed pending operations will get cleaned up when they are not needed. This is illustrated in the resource configuration example above. Too many pending operations stored in the shadows may affect system performance. The data structure that represents pending operations is quite complex and it is not easily indexed. Therefore the propagation task needs to examine all the shadows that have at least one pending operation. This is more than acceptable approach in case that the pending operations are regularly purged and do not accumulate in the shadows forever. And that is one of the reasons for specifying the grace period.
Current implementation of provisioning propagation was designed specifically to work with simple manual resources. Therefore there are some limitations:
- Provisioning scripts are currently not supported. The propagation task will ignore all provisioning scripts.
- Support for entitlement associations is limited. Subject-to-object associations are very likely to work properly, although this was not explicitly tested. Object-to-subject associations are currently not supported.
- Consistency mechanism support for propagated resources is currently limited. We do not guarantee that consistency mechanisms will work for all the circumstances.
- Application of this mechanism to anything other than manual and semi-manual resources is questionable. It might or might not work. All the testing of this feature was done with manual resources only.
This is a limited midPoint feature. This feature currently supports only some specific use-cases. We are perfectly capable to finish the feature, just the funding for the work is needed. Please consider the possibility for sponsoring development of this feature by using midPoint platform subscription. If you are midPoint platform subscriber and this feature is withing the goals of your deployment you may be able to use your subscription to endorse implementation of this feature.