What Federation Does

When federation is enabled, ESM Modules attempt to share information and responsibilities, so that multiple ESMs behave as if they all had the same information about users, groups, and resources. For example, suppose you have multiple LDAP repositories with security information: a user might be defined in one LDAP repository, and a resource access control rule in another. If you want the resource control rules from one LDAP repository to apply to users defined in another LDAP repository, you would enable federation.

Disabling federation, instructs ESM Modules to attempt to act independently of each other. With federation disabled, the access control rules defined in one ESM should only apply to users who are also defined in that ESM.

If federation is not configured, and two or more security managers which use the MLDAP ESM Module are used, the system will operate in "compatibility mode" for federation. This implements the historical behavior of old product versions prior to the introduction of full federation support. In this mode, ESM Modules do not fully federate but have some interaction, which can lead to unexpected results in some cases. Compatibility mode is currently deprecated. Micro Focus strongly recommends that you explicitly configure federation as either enabled or disabled, depending on your requirements. [1]

If you are not sure what setting to use, try the following guidelines:

• If your configuration only has one ESM, you do not need to configure federation.
• If your configuration has multiple ESMs, but you are not using the MLDAP ESM Module, or you only have one instance of the MLDAP ESM Module, you do not need to configure federation. You might want to configure federation in case it becomes relevant in a later release.
• Do you define users in one ESM, and the groups they belong to in another? If so, you should enable federation (you expect your security information to be combined).
• Do you define users and/or groups in one ESM, and resource access rules that apply to them in another? If so, you should enable federation.
• Are the resource access rules defined in each ESM meant only to apply to users and groups known to that ESM? If so, you should disable federation (you expect your ESMs to act independently).

If none of the above apply, you can probably disable federation.