Overview of primary keys and attributes
The primary keys of a connector are:
Stableid: the least immutable identifier that is ideally able to remain consistent across rename and move context operations.
Longid: the primary identifier used as the main actors on all operations: reset, unlock, enable, and so on.
Shortid: user friendly identifier used to logon and often used to associate to the user profile.
The stableid, longid and shortid all must uniquely identify an object. In other words, there cannot be duplicates across multiple objects per target.
Simplistic connectors
In many connectors the stableid, longid, and shortid can represent the same identifier. For example, when targeting UNIX, an account identifier, such as the UNIX "root" account, is the same for the stableid, longid and shortid. This does make these target types difficult to track context on rename operations, but this is generally not a limitation. Where this becomes important is when we are talking about cross targeting, as is the case with multitargeting Active Directory and Active Directory forested infrastructures.
Complex connectors
In the more complicated connectors, such as Active Directory (and sometimes ldap when using a more fully functional schema), the stableid represents a unique identifier (called an Object GUID) which never changes, even if an object is moved or renamed. In other words, the identifier is immutable. When an object is created a new unique Object GUID is issued and remains unchanged for the lifetime of the object. Active Directory also has the ability to delete an object which can then be revived/undeleted from a tombstone in which case, their Object GUID still remains unchanged.
The longid is used to act on objects during an operation. In the Active Directory scenario, the longid represents the Distinguished Name. This identifier can change, either by:
Arename operation by changing the object’s common name or,
By the move context operation where the object is moved to a different relative DN.
It is for this reason, the rename and move-context operations return the longid and shortid, to indicate to Bravura Security Fabric that the values for these keys have changed. This in turn updates the values within the product database. In all other operations, the longid remains unchanged.
Finally, the shortid represents a friendly name that the user can type quickly and is easy to remember. This identifier is also used during association with the profile user id. In Active Directory this object is represented by the SAM Account Name (otherwise simply known as the logon name.)