AD Access Policy Update or Revoke Not Happening

Hi
Problem:
I am automating the AD user Provisioning through OIM Access Policy. I am able to provision user in AD, But the provisioned user is not visible in Resources tab. If anything is modified OIM attributes and that are not transferring from OIM to AD User Process Form. If I removed User from the Role, The user was not revoked from the AD.
Configuration:
I have created the following task to automate the user provisioning. They are
1) Rule
Name: ALL AD Users
Rule Criteria : User Login != NULL
2) Role
Name : AD Role
Member Ship Rule : ALL AD Users
3) Access Policy:
Access Policy Information Provided
Access Policy Name:      AD Access Policy
Access Policy Description:      AD Access Policy
With Approval:      No
Retrofit Access Policy:      Yes
Priority:1
Resources to be provisioned by this access policy
Resource Name: AD User
Revoke resource and entitlement(s) if no longer applies: Checked
Process Forms: AD User Details
AD User form details are populating through pre-populate adapter in create and Change <FieldName> populating in update Operation.
Role
Name : AD Role
I couldn't see any error in the AD Connector log file.
Do I need to do anything apart from AD Access Policy to view the resource in Resource TAB, and also Updating the user attributes ( Change Process Tasks are configured), and Revoke.
Help is greatly appreciated.

What do you mean by this statement :
But the provisioned user is not visible in Resources tabDo you mean that when you go to Resource Profile of a user then you can't see AD User is provisioned to that user ?
Check "Auto Save" check box on "AD User" Process Defintion
Add one user into that Role explicitly into that Role/Group
Resources to be provisioned by this access policyI hope you are giving values for AD Server and Organization Name on the process form in this section.
Enable the logs as well whether AD User tasks are getting called or not
And
For sending Modified Attributes to AD, have you create corresponding tasks like Change First Name, Change Last Name etc in AD User Process Defintion and made its entry in Trigger Lookup ?
If yes then it will work only when you'll see AD User in Provisioned/Enables status in User's Resource Profile
Let me know the results

Similar Messages

Every time I attempt to download Firefox's latest update, this does not happen as it takes too long to connect to the update server?

Firefox is telling me that there is an important update to download.
Each time I attempt to download this update.......I am unable to do so as it is not connecting to the update download site??

Can you look and see if you have an actual kernel panic? See -> http://support.apple.com/kb/HT2546.
Kernel panics are much simpler to decipher than a crash log.
Call back,
Clinton

Vmware tools intallation -- linux 4 update 5 was not happening

Hi ,
I want to install Vmware tools for my machine. I installed VMware and Linux 4 update 5 but was unable to install vmware tools once i installed linux. I couldnt find vmware tools rpm. I just find vmwaretools-8.1.4-227600.tar.gz file. I was not able to move my cursor freely. everytime i need to use keystrokes like alt+control to come out. Can anyone help me how to install vmware tools.

Please, avoid duplicated thread :
Linux 4 Update 5 vmware tools
Nicolas.

Windows Server Gateway - Receive all policy updates API Not Implemented

Hi All,
I have been testing the setup of a HNV environment using a 2012 R2 Gateway and 2012 R2 Hosts.
VM to VM communications on the Tenant-Blue network is working.
External connectivity for the VM network (using NAT) is not working.
The GW is configured as follows:
MGT: 192.168.100.251/24
Front End: 10.1.37.241/24
GW: 10.1.37.254
Back End: APIPA (Connected to PA Network)
The connection string specifies the VMhost and the GatewayVM (but nothing else).
The only thing I can see that may be wrong is the Validation tests show that "Recieve all policy updates API" is not implemented:
Any clues or guidance?
I have followed Kristians 2012 R2 NVGRE guide to the letter (with the exception that I am using a private IP for my front end, rather than a public IP, this shouldnt matter and I should still be able to pass through the GW with my VM traffic).
Regards,
Daniel
MCSE: Private Cloud, Virtualization enthusiast.

"When you say the "default gateway for NVGRE enabled networks is not using the virtualization gateway at all" what do
you mean? how are your VMs able to access the internet if they are not using the default gateway on the VMs? or is this all done behind the scenes?"
Dan, sorry for not being clear.
When you create a VM Network in VMM, the default gateway is
always x.x.x.1.
You can choose to type this in manually during the creation, or just leave it blank. It will always use x.x.x.1.
The default gateway does not require a virtualization gateway for the tenants to communicate with
eachother within the same VM network, but
only when the tenants requires access to the outside/internet.
Kristian (Virtualization and some coffee: http://kristiannese.blogspot.com )

Not able to get the AD organizations list while creating access policy

Hi All,
Had created IT Resource for AD server, and was able to successfully connect to it. And Now when I try to create a access policy, where I am not able to view any organization from AD.
Can someone please let me know how to resolve this.
Thanks in advance.....
Regards
Arun

Please check the error log which I am getting when I ran the schedule job
======= Start Stack Trace =======================>
<Aug 3, 2012 2:30:55 PM GMT+05:30> <Error> <OIMCP.ADCS> <BEA-000000> <com.thortech.xl.schedule.tasks.ADLookupReconTask : performReconciliation>
<Aug 3, 2012 2:30:55 PM GMT+05:30> <Error> <OIMCP.ADCS> <BEA-000000> <[LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 52e, vece ]>
<Aug 3, 2012 2:30:55 PM GMT+05:30> <Error> <OIMCP.ADCS> <BEA-000000> <Description : [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecu
rityContext error, data 52e, vece ]>
<Aug 3, 2012 2:30:55 PM GMT+05:30> <Error> <OIMCP.ADCS> <BEA-000000> <com.thortech.xl.exception.ConnectionException: [LDAP: error code 49 - 80090308: LdapErr: D
SID-0C090334, comment: AcceptSecurityContext error, data 52e, vece ]
at com.thortech.xl.integration.ActiveDirectory.tcADUtilLDAPController.searchResultPageEnum(Unknown Source)
at com.thortech.xl.schedule.tasks.ADLookupReconTask.performReconciliation(Unknown Source)
at com.thortech.xl.schedule.tasks.ADLookupReconTask.execute(Unknown Source)
at com.thortech.xl.scheduler.tasks.SchedulerBaseTask.execute(SchedulerBaseTask.java:384)
at oracle.iam.scheduler.vo.TaskSupport.executeJob(TaskSupport.java:145)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at oracle.iam.scheduler.impl.quartz.QuartzJob.execute(QuartzJob.java:196)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
>
<Aug 3, 2012 2:30:55 PM GMT+05:30> <Error> <OIMCP.ADCS> <BEA-000000> <================= End Stack Trace =======================>
Based on which I had checked the credentials I provided, and they are correct. I am able to connect to AD with same credentials when I create new IT Resource.
Not sure what went wrong
Regards
Arun

HT4314 After updating my OS, I couldn't get onto my gamecenter account. I created a new nickname to see what would happen. Now I can only access my new nickname, but not my old one that has all my scores. My friends can still see my old nickname.

After updating my OS, I couldn't get onto my gamecenter account. I created a new nickname to see what would happen. Now I can only access my new nickname, but not my old one. However, my old account has all my scores! I want to delete the new nickname and re-access my old (i.e., original) nickname. Interestingly, my friends can still see my old nickname.
Any suggestions would be VERY appreciated! Thanks.

This was EXACTLY what I needed about the purchases I made from my device. However, is there a way to re-download other ones you've made from a computer? Because I realized some of them were not just purchased from my device.
This is a picture of what it looks like now:
http://tinypic.com/r/107quxu/7
As you can see, the stuff circled in red doesn't give me an option to download from Cloud Beta because it already says "downloaded".
any way to get around that?

[OIM 9.1.0.2] RESOURCE NOT REVOKED BY ACCESS POLICY WHEN USER DISABLED

Hi Experts,
OIM Build Number: 1866.62 ( BP15 )
IHAC that faced an unexpected behavior on User disabling.
Some users were associated to groups that had access policies applied.
When those users were disabled, they didnt lose their associated groups and also the resource and permission associated thru access policy applied to those groups.
I saw that there was a bug reported to that issue. So I performed the action plan and set up the XL.EvaluateMembershipForInactiveUser System Property as TRUE. Now after disabling the users are properly removed from groups.
Customer problem: For those users, almost 1000, I did a recon just to estimule the identity, so the membership rule was applied and the groups were removed, but OIM didn't evaluate the access policies and didn't revoke the resources.
I ran the Evaluate User Policies task, and it seems to be stuck. Should the Evaluate User Policies schedule task work for that scenario? Should the resource after running that task be revoked?
Any help would be very appreciated.

Hi Nishith,
I ran the task, but it seems really stuck. It displays the RUNNING status, but any effect is observed. I have to change task status to INACTIVE in the Design Console.
This task has 2 attributes: Batch Size= 500 and Number of Threads=20.
But I have noticed this task in another environment (w/ BP 18 applied), it has 3 attributes: Batch Size= 500 ; Number of Threads=20 and Time Limit in mins=1.
Is it any enhancement for this task in order to improve its performance, or something like that?
What else I can check?
Thanks in advance.

OIM iPlanet Resource revoked using access policy

Hi,
I had created a group and access policy based upon which i tried to provisioned a iplanet resource to a user.
For this I had created a UDF(say type with value C) and created a rule based on which user is assigned to group say business and also iPlanet resource is provisioned to user
As I Edit the profile and clear UDF. User is removed from group and also iPlanet resource is revoked.(In Access Policy revoked if no longer applied)
I am able to do this task Successfully But If iPlanet resource is already allocated to user and I update the UDF(value C) user is assigned to group and iplanet is already assigned to user(muliple resource UNTICK). and now if i again Updated the UDF(mean clear it) user is removed from the group but iPlanet resource is not revoked from the user......
Can somebody tell me why it is happening??? wheather its a bug in OIM or I am missing something...
Thanks
Anil

If I understand your requirement correctly, when you change the value in process form edit from C to other, iPlanet resource is getting revoked.
But when you change the the same value from user profile edit, the iplanet is not getting revoked right?
As per my knowledge I can say, when you update the value for UDF in user profile, you can use triggers USR.TRIGGERS which will update the process form. In this case your process form will gets updated by default.
This in turn triggers access policy and revokes the resource.
Hope this helps you

HT201412 After ios7, My iphone4 has gone dead twice in a time frame of around two months...even though its not happening very often but a two month Old phone going dead just after a New update is not acceptable.probably ios7 still has sum bugs dat need to

After ios7, My iphone4 has gone dead twice in a time frame of around two months...even though its not happening very often but a two month Old phone going dead just after a New update is not acceptable.probably ios7 still has sum bugs dat need to be fixed...Can this bug expected to be fixed in the next update...

Hi 1283ar.
Unfortunately, iOS 7 is too hard to push for the iPhone 4 and therefore has a lot of effects turned off to try to get it to run as smoothly as possible.
However, it becomes better and better with each update coming but it's hard to do anything about the hardware on an already released phones.
If you still have trouble or think they are too hard. My tip is, if so, to restore your iPhone 4 and make a clean setup with no iCloud backup. But all your photos in a photostream so you can access it later.

Access Policy is not getting trigggered after creation of user through GTC

Hi,
I have an access policy for ALL USER role and that provision users to an RO after getting created in oim. I have a trusted source flat file reconciliation GTC for user creation. I am facing issue when user is getting created through GTC, access policy is not getting triggered. But while creating an user through web console the same access policy is working fine and user is getting provisioned with RO.
If anybody have any idea how to resolve this, please help me in this regards.
Regards,
Avijit

Hi ,
its good to know that its working. As per my experience it works for once (through reconciliation) but then stops working. Now to confirm try to revoke the user by changing the group member-ship through reconciliation and see if the resource is revoked or not (repeat it for 2 -3 times). Note that don't do it form within IDM web admin console, do it through reconciliation.
do post your results.......
Regards.

Could not access Creative Cloud today without updating it. After update it will not open. It spins for five seconds then closes. Mac Pro tower 3 yrs old 12 gb ram os 10.7.2

Could not access Creative Cloud today without updating it. After update it will not open. It spins for five seconds then closes. Mac Pro tower 3 yrs old 12 gb ram os 10.7.2

I was unable to access the laptop last night to create a new user; however my client would perfer not to try a second account since that would make it unusable for him while we test the second profile.
Also John Sophos was installed after this started to verify that it was not a virus/malware (I know pointless step but it has happened to me before) so I don't think that is the problem

OIM Access Policy OU Updates

All,
I am wondering if any you have encountered an issue in OIM where a user’s OU in AD does not change when a new access policy applies to the user with a new OU (the old access policy is no longer valid). I have noticed that child form attributes (groups) are updated with the values from the new access policy, but parent form values such as OU, are not updated.
The access policies currently do have retrofit selected.
I also have tried running the “Evaluate User Policies” task with no luck.
If you have any insight as to how we might resolve or workaround this issue, it would be appreciated.
Thanks,
-Derek

What version of OIM are you using? And have you made any changes to the web client? (particularly xlWebAdmin.properties, struts-config.xml or the class files?)
Deborah

I have updated to maverick from mountain lion.initially my mac book pro was snow leopard.the multitrack touch pad swapping the page is not happening in finder,it is only working in safari.please help me how to get that swiping gesture in finder

i have updated to maverick from mountain lion.initially my mac book pro was snow leopard.the multitrack touch pad swapping the page to get back to previous page is not happening in finder,it is only working in safari.please help me how to get that swiping gesture in finder

Hi..
I repled to you here > https://discussions.apple.com/message/25598596#25598596
Please do not start duplicate topics. It makes it that much harder to assist you.

How do I stop calendar from coming on automatically and overiding gmail so that I cannot access it. I can use windows explorer and this does not happen.

When I use firefox to access my gmail account, the calendar comes on by itself and I then cannot get to my emails. If I get the gmail account by windows explorer this does not happen. What can I do within firefox to stop this from happening. It just started this today.
== This happened ==
Every time Firefox opened
== Today

I had the Integrated Gmail 2.5.5 addon enabled.
After disabling the addon the problem is gone.
Hope it works to you guys.

Issue in Workflow- Field Update is not happening

Hi Friends,
I am facing an issue to update a check box field Released.
I have created a task having Advance with Dialog opiton,Background processing to update the Checkbox field.
The BOR Object type used is BUS1006 and method is CHANGE. Everything looks fine when tested the task as well as the workflow in test mode and it is working fine in both the cases. But some how, this field update is not happening over the CRM 2007 Web UI. We are assuming it is due to user authorizations or some other settings ( like assignment of backend user to the workflow)
for doing this task. Can some one give us some pointers on this. This will be of great help.
Thanks,
Udaya

Hi Imtiaz,
I am new to this. Can you please give me some pointers on how to check whether WF-BATCH has the needed authorisations and the process can be executed in background.
Reply me at your convenient time.
Thanks a lot for your response.
Regards,
Udaya

AD Access Policy Update or Revoke Not Happening

Similar Messages

Maybe you are looking for