ROI iAM

Appearance

Daily Load (Delta) ​

The daily load iFlow performs incremental synchronization of user data from SAP IdM. It uses the lastrun timestamp variable — persisted by the previous run (either initial or daily) — to fetch only records modified since the last successful execution.

When to use ​

Use the daily load iFlow for:

  • Scheduled daily synchronization after the initial load has been completed
  • Incremental updates triggered by change events in the source system
  • Any scenario where only recently modified users need to be synchronized

Triggering the flow ​

The daily iFlow can be triggered via two channels:

  • HTTPS — Send a POST request to the customer-specific endpoint (e.g., /roiam/<customer>/sap_idm/loadusers_daily). The caller must have the ROIAM_RT_CUSTOMER role.
  • JMS — Send a message to the customer-specific JMS queue for daily loading. (used only for scheduling)

Both channels require the roiam_customer_system_name header to be set.

How the delta mechanism works ​

The flow executes the following sequence:

  1. Authorization — Resolves the source system destination and sets authentication headers.

  2. Read lastrun variable — A script reads the persisted lastrun timestamp for the given customer system. This value was written at the end of the most recent successful run (initial or daily).

  3. Read lastjobid variable — Reads the lastjobid to track execution lineage.

  4. Fetch modified users — Calls the source system API with the lastModified query parameter set to the lastrun value:

    text
    /idm-proxy-rest/api/usersFromIdM?startIndex=1&count=100&lastModified=2025-01-15T08:30:00Z

    The source system returns only records modified on or after this timestamp.

  5. Paged retrieval loop — If the result set exceeds a single page, the flow loops (up to 500 iterations). With a default page of 100, this means you can read with this flow up to 50000 records at once. If your system has more records than that, use the initial load flow first. Initial load (parallel)

  6. Transform to SCIM bulk — Accumulated records are transformed into SCIM bulk operations via the Dynamic Mapping Engine. The flow appends records page by page into the bulk structure

  7. SCIM write — If the bulk is non-empty, it is sent to ROI iAM via the bulk SCIM endpoint

  8. Persist variables — The lastrun timestamp (captured before data fetching) and a new lastjobid are written as SAP CI global variables if the job finishes without errors

WARNING

If the daily load is triggered before the initial load has completed at least once, the lastrun variable will be empty. In this case, the source system query will have no lastModified filter, effectively performing a full load through the sequential (non-parallel) flow. This may cause slow processing and will be limited to the number of iterations for the paged loop retrieval.

Relationship to the initial load ​

The initial parallel load establishes the lastrun variable that the daily flow depends on. The recommended sequence is:

  1. Run the parallel load iFlow for the first time — this loads all users and persists the lastrun timestamp.
  2. Schedule the daily load iFlow to run on a recurring basis (e.g., via a JMS external scheduler).
  3. Each daily run picks up only the delta since the previous run.

If the daily flow detects no changed records (empty SCIM bulk), it still updates the lastrun timestamp so that subsequent runs query from the correct point in time.

Example request ​

text
POST /roiam/<customer>/sap_idm/loadusers_daily
Headers:
  roiam_customer_system_name: MY_IDM_SYSTEM

No additional headers are required for delta loading — the flow reads its configuration from the persisted variables and the source system registration.

See also ​