Best practices on enterprise and application roles in OIM and OAM 11g?

Hi, all,
I wonder if any of you can give me some advice on role design for OIM and OAM 11g. I'd like to have both enterprise roles, such as Accountant II, and application roles, such as App1_User, App1_Admin, etc. Ideally, the enterprise role would automatically give the user the appropriate application roles, but I can't figure out how to do that. We tried using OIM 11g's inheritance, but when the application role is inherited, OAM doesn't see it in OID/OVD and therefore doesn't think the user has the correct authorization to access the application. I thought about using role membership rules, but those seem to only allow you to use user attributes to control membership, which doesn't help at all in my situation.
How is this situation best handled? Any advice much appreciated!
Ariel Anderson
Senior Business Analyst
Zirous, Inc.

Hi,
I am assuming in clustered environment you are having two instances running.
It must be an issue with a single server,,because the problem is intermittent.
To see which server is causing problem....just perform the following steps:
1) Stop server1 and keep running server2..and fire new registration request...
2) stop server 2..and keep running server1.....and fire new registration request.
Using above, atleast you can see which server is causing the problem...
Regards,
J
Edited by: J_IDM on Mar 21, 2011 10:52 PM

Similar Messages

  • BC4J ApplicationModule - best practice in Stateful web application?

    When writing a stateful web application that uses BC4J framework as the model, what is considered best practice in using the Application Module. Is it okay to store an AM instance in a HttpSession, or should we opt for the features explained in the BC4J Pooling samples, which uses the SessionCookie interface?
    Tips/Tricks/Pitfalls information welcome
    Thx,

    When writing a stateful web application that uses BC4J framework as the model, what is considered best practice in
    using the Application Module. Is it okay to store an AM instance in a HttpSession, or should we opt for the features
    explained in the BC4J Pooling samples, which uses the SessionCookie interface? Best practice is to store the SessionCookie (an ApplicationModule handle) as demonstrated in the pooling sample.
    This will allow many advantages including scalable state management support, timeout support, and
    failover / clustering support.
    Caching the ApplicationModule directly can be dangerous because:
    1. The AM is not serializable which could result in serialization exceptions if the servlet container were distributable.
    2. The AM does not responsd to timeout which could result in memory leaks if the AM is not explicitly returned to the
    pool at the end of each request.
    3. For stateful applications the memory consumed by each AM could be significant. Even if the AM were correctly
    released to the pool upon session timeout it would still have consumed that memory up to that point. Using the
    SessionCookie along with state managed release allows for scalable state management.
    Tips/Tricks/Pitfalls information welcome
    Thx,

  • Business Package for SAP Best Practices for Enterprise Portal

    Hi,
    We are implementing EP for ECC 5.0 and we have to web enable some FI transactions like FB50/fb60 etc. We want to use standard business package for this. The only business package that caters this requirement is "Business Package for SAP Best Practices for Enterprise Portal 60.1". When i checked the data source for this business package, the specification is for "SAP R/3 4.6B and above". Does this work for ECC 5.0 as well? In general does the R/3 specific business packages work for ECC versions? Please let me know. Thanks for the help.  I promise rewards.
    Regards
    Hari

    Hari,
    When you download the BPO via Portal Content Portfolio,
    each bpo has additional information on the release.
    For example for the one you are inquiring about - Business Package for SAP Best Practices for Enterprise Portal, the additional release information is provided on the following links;
    https://www2.iviewstudio.com/sdn/info/index.cfm?action=faqs&part=#QSR03
    https://www2.iviewstudio.com/sdn/detail_view/index.cfm?action=package_information&CatalogSet=SAP%20Content&ItemID=17212&CFID=7544845&CFTOKEN=99283970
    Regards,
    James

  • Assigning App Builder and Application roles using Account Administration Tool

    If you have a DPS Enterprise or Professional Account and need to assign App Builder or Application role to an id to in case you need to create a new id with these roles, refer to the following documentation:
    Assigning App Builder and Application roles in your DPS Professional or Enterprise accounts

    gnm,
    Please refer to KnowledgeBase 2IDDCHB9: Using Remote Panels with a LabVIEW Applications (EXE) for the information you are looking for.
    Randy Hoskin
    Applications Engineer
    National Instruments
    http://www.ni.com/ask

  • I wonder to know what is the enterprise solution for windows and application event log management and analyzer

    Hi
    I wonder to know what is the enterprise solution for windows and application event log management and analyzer.
    I have recently research and find two application that seems to be profession ,1-manageengine eventlog analyzer, 2- Solarwinds LEM(Solarwind Log & Event Manager).
    I Want to know the point of view of Microsoft expert and give me their experience and solutions.
    thanks in advance.

    Consider MS System Center 2012.
    Rgds

  • Best Practice for Use of ABAP in Customizing SRM and/or CRM

    I was wondering if there is a document that defines best practices for the use of ABAP with the installation and customization of SRM and/or CRM.   Such as amount of ABAP coding typically required, and best practices around the use of ABAP for customization and configuration.
    Thanks.

    Hi, Johnson
    Sorry, Please don't mind, you are not at right place to ask the Question like this
    Please read "The Forum Rules of Engagement" before posting!  HOT NEWS!!
    Thanks and Regards,
    Faisal

  • What are best practices for managing my iphone from both work and home computers?

    What are best practices for managing my iphone from both work and home computers?

    Sync iPod/iPad/iPhone with two computers
    Although it isn't possible to sync an Apple device with two different libraries it is possible to sync with the same logical library from multiple computers. Each library has an internal ID and when iTunes connects to your iPod/iPad/iPhone it compares the local ID with the one the device normally syncs with. If they are the same you can go ahead and sync...
    I have my library cloned to a small 1Tb USB drive which I can take between home & work. At either location I use SyncToy 2.1 to update the local copy with the external drive. Mac users should be able to find similar tools. I can open either of the local libraries or the one on the external drive and update the media content of my iPhone. The slight exception is Photos which normally connects to a specific folder on a specific machine, although that can easily be remapped to the current library if you create a "Photos" folder inside the iTunes Media folder so that syncing the iTunes folders keeps this up to date as well. I periodically sweep my library for new files & orphans withiTunes Folder Watch just in case I make changes at one location but then overwrite the library with a newer copy from the other. Again Mac users should be able to find similar tools.
    As long as your media is organised within an iTunes Music or Tunes Media folder, in turn held inside the main iTunes folder that has your library files (whether or not you let iTunes keep the media folder organised) each library can access items at the same relative path from the library folder so the library can be at different drives/paths on different machines. This solution ensures I always have adequate backups of my library and I can update my devices whenever I can connect to the same build of iTunes.
    When working with an iPhone earlier builds of iTunes would remove any file not physically present in the local library, even if there was an entry for it, making manual management practically redundant on the iPhone. This behaviour has been changed but it will still only permit manual management with a library that has the correct internal ID. If you don't want to sync your library between machines on a regular basis just copy the iTunes Library.itl file from the current "home" machine to any other you want to use, then clean out the library entires and import the local content you have on that box.
    tt2

  • Best Practice to Setup an application to work with both oracle and db2 db

    Hi,
    We have an application that currently supports both oracle and db2 databases . It is currently using JPA with eclipselink as backend mechanism and we want to move to ADFBc as our backend . So what is best practice to do this?
    I came across an old post in https://groups.google.com/forum/#!topic/adf-methodology/UlJZSTu14Io that states to create two different model projects to support oracle and db2 .
    Is this still the standard ? Is there a way that we could work around rather than creating multiple projects?
    How do i get the view controller to work with multiple model projects if this is the case?
    Thank you.

    Thanks for the response .
    The problem is i would have the same schema on both the databases (both in oracle and db2) .
    I don't see a scenario where i want both the application model projects at the same time . What i meant is , Application will either be deployed with Oracle DB or DB2 but not with both on a production environment .
    So is there a way where i just change the connection parameters alone rather having two different models ?
    If i have to use two model projects ,  would it be possible say i built the view controller for Oracle , and use it for DB2 if i make sure the BC objects names are similar between model projects and switch just the model jar based on the deployment environment ?
    -Sam

  • Best Practice for Enterprise Application Integration

    I would like to integrate a few corporate systems together by using Oracle Fusion Middleware. I suppose the integrated process is running in synchronous mode such that it also supports two phase commit.
    In BPEL Process manager, there is a tool called "WSIF" which seems to be relevant to my requirement. I would like to know which tools should be best for my integration project and any suggestion on implementation.
    Thanks in advance,
    Samuel Wai

    This has been answered repeatedly. WL allows you to cache JNDI context
              objects, ejb homes and remotes without any problems. (EJB remote interfaces
              must only be used by one thread at a time, but that requirement is provided
              by the EJB spec itself.)
              Peace,
              Cameron Purdy
              Tangosol, Inc.
              http://www.tangosol.com
              +1.617.623.5782
              WebLogic Consulting Available
              "Geordie" <[email protected]> wrote in message
              news:3af9579f$[email protected]..
              >
              > I'm wondering what the best practice is for Servlet EJB integration in
              terms of
              > caching the home and remote objects. My understanding is that the Home
              object
              > is threadsafe and could therefore be cached as an attribute of the
              Servlet. This
              > would remove the need for a JNDI lookup for each request. Similarly
              caching the
              > ProxyObject would yield further savings. However, I have noticed that
              most examples
              > don't use either of these practices. Why not?
              >
              > Thanks in advance,
              > Geordie
              

  • Best practices for an oracle application upgrade

    Hello,
    We have an enterprise application deployed on Oracle Weblogic and connecting to an Oracle database (11g).
    The archive is versioned and we are using Weblogic's feature to upgrade to new versions and retire old versions.
    In a case of emergency when we need to rollback an upgrade, the job is really easy on Weblogic but not the same on Oracle DB.
    For most of our releases, the release package is an ear plus some database scripts.
    Releases are deployed with minimum downtime, so while we are releasing our clients are still writing to the DB.
    In case of a rollback is needed, we need to make sure the changes we made to the DB structure (Views, SP, Tables...) are reverted but data inserted by clients stayed intact.
    Correct me if I am wrong, but Flashback and RMAN TSPITR are not the good options here.
    What other people usually do in similar cases? What are best practices and deployment plans for our case?
    Guides and direction are welcomed.
    Thanks!

    Hi Magnus
    I guess you have to install again to ensure no problems. BP installation also involves ensuring correct SP levels (cannot be higher) for all software components.
    Best regards
    Ramki

  • Scripting Enterprise Groups-Application Roles mapping

    Hi All,
    For my WebCenter Portal, I have local Application Roles that need to be mapped to Enterprise Groups. I know this can be done from the Portal Administration console using "Add Groups". This doesn't seem to persist across re-deployments.
    I tried doing this via the Security Editor in JDeveloper. For this I had to first create the same Enterprise Roles in jazn-data and then map them to the Application Roles. However, on deployment, this causes the existing users on weblogic to lose their respective Enterprise Groups assignments.
    Is there a way to script the group-role mapping using WLST or other so that I can run the script as a deployment step?
    Best Regards,
    Bijesh

    Hi,
    The following links explains different ways to achieve your desired goals.
    1)http://weblogic-wonders.com/weblogic/2010/11/10/wlst-script-to-add-users-groups-and-modify-roles/
    2)http://www.orastudy.com/oradoc/selfstu/fusion/core.1111/e10043/apadvadmin.htm
    3)http://middlewaremagic.com/weblogic/?p=4981
    Hope it helps you.
    Regards,
    Hoque

  • Best Practice in V7.0 : Issues with Sales Planning and Reporting

    I am trying to install the SAP Best Practices for BPC 5.1 on SAP PBC 7.0 SP 04 I have done this as I cannot find any Best Practice documents for version 7 as yet.
    I have managed to get through the Administration setup and most of the BPC -Administration Configuration Guide, however I am having a problem with 7.4 Running a Data ManagementPackage - Import on page 32 of 36. This step involves you uploading a data file Demo_Revenue_Data.txt into BPC.
    The file says that it has failed due to Ínvalid dimension ACCOUNT in lookup.
    I believe that this error may be driven by a previous step 6.4 Creating Script Logic where the logic for BP_Sales Application was required.
    My question is twofold in that I need to determine:
    1. Has anyone else tried the BestPractices for BPC 5.0 in BPC 7.0?
    2. Does anyone know how to overcome the error when uploading the Demo Revenue into BPC?
    Edited by: Kevin West on Jul 8, 2009 2:03 PM

    Hi,
    BPC best practices document from 5 is working fine also for 7.0 because 7.0 is just an update for 5.x.
    Running Import involve logic just if you are running the package with option enabled (Run Default Logic).
    Your issue seems to be related to maping which means you have to check Transformation and Conversion file.
    Any way the best practices document will not provide you information about how to build Transformation and Conversion files.
    You have to follow an SAP BPC training and that it will help you to build your applicatioon easier and faster.
    Regards
    Sorin Radulescu

  • Best practice for mouseless ADF applications

    I am developing an ADF application where the users do not want to use the mouse.
    So I would like to know if there are a best practice for this?
    I am already using the accessKey functionality and subforms defaultCommand
    But I have had problems setting focus to objects on a page like tables. I would like a button to return the focus to the table after it has made the command like delete.
    I have implemented a solution where I have found inspiration several threads and other webpages (see below).
    Is this solution okay?
    Are there any problems with it?
    I would also like to know if there are better pathways to go like
    out of the box solutions,
    http://www.oracle.com/technetwork/developer-tools/adf/learnmore/79-global-template-button-strategy-360139.pdf (are there an example implementation?), or
    http://one-size-doesnt-fit-all.blogspot.dk/2010/11/adf-ui-shell-supporting-global-hotkeys.html
    in advance thanks
    Inspiration webpages
    https://blogs.oracle.com/jdevotnharvest/entry/how_to_programmatically_set_focus
    http://technology.amis.nl/2008/01/04/adf-11g-rich-faces-focus-on-field-after-button-press-or-ppr-including-javascript-in-ppr-response-and-clientlisteners-client-side-programming-in-adf-faces-rich-client-components-part-2/
    how to Commit table by writting Java code in Managed Bean?
    Table does not refresh and getting error as UIComponent is Null
    A short description of the solution:
    (jdeveloper version 11.1.1.2.0)
    --- Example where I use onSetFocus in jsff page
    <af:commandButton text="#{hrsusuiBundle.FOCUS}" id="cb10"
    partialSubmit="true" accessKey="f"
    shortDesc="Alt+Shift+F"
    actionListener="#{managedBean_clientUtils.onSetFocus}">
    <af:clientAttribute name="focusField" value="t1"/>
    </af:commandButton>
    --- Examples where I use doTableActionAndSetFocus in jsff page
    --- There have to be a binding in the jsff page to delete, commit and rollback
    <af:commandButton text="#{hrsusuiBundle.DELETE}" id="cb4"
    accessKey="x"
    shortDesc="Alt+Shift+X"
    partialSubmit="true"
    actionListener="#{managedBean_clientUtils.doTableActionAndSetFocus}">
    <af:clientAttribute name="focusField" value="t1"/>
    <af:clientAttribute name="actionField" value="Delete"/>
    </af:commandButton>
    <af:commandButton text="#{hrsusuiBundle.COMMIT}" id="cb5"
    accessKey="s" shortDesc="Alt+Shift+S"
    partialSubmit="true"
    actionListener="#{managedBean_clientUtils.doTableActionAndSetFocus}">
    <af:clientAttribute name="focusField" value="t1"/>
    <af:clientAttribute name="actionField" value="Commit"/>
    </af:commandButton>
    <af:commandButton text="#{hrsusuiBundle.ROLLBACK}" id="cb6"
    accessKey="z" shortDesc="Alt+Shift+Z"
    partialSubmit="true"
    actionListener="#{managedBean_clientUtils.doTableActionAndSetFocus}"
    immediate="true">
    <af:resetActionListener/>
    <af:clientAttribute name="focusField" value="t1"/>
    <af:clientAttribute name="actionField" value="Rollback"/>
    </af:commandButton>
    --- This is the java class I use
    --- It is published in adfc-config.xml as a request scope managedbean
    public class ClientUtils {
    public ClientUtils() {
    public void doTableActionAndSetFocus(ActionEvent event) {
    RichCommandButton rcb = (RichCommandButton)event.getSource();
    String focusOn = (String)rcb.getAttributes().get("focusField");
    String actionToDo = (String)rcb.getAttributes().get("actionField");
    UIComponent component = null;
    String clientId = null;
    component = JSFUtils.findComponentInRoot(focusOn);
    clientId = component.getClientId(JSFUtils.getFacesContext());
    if ( "Delete".equals(actionToDo) || "Commit".equals(actionToDo) || "Rollback".equals(actionToDo) ){
    BindingContainer bindings = BindingContext.getCurrent().getCurrentBindingsEntry();
    OperationBinding operationBinding = bindings.getOperationBinding(actionToDo);
    Object result = operationBinding.execute();
    AdfFacesContext.getCurrentInstance().addPartialTarget(component);
    if (clientId != null) {           
    makeSetFocusJavaScript(clientId);
    public static String onSetFocus(ActionEvent event) {
    RichCommandButton rcb = (RichCommandButton)event.getSource();
    String focusOn = (String)rcb.getAttributes().get("focusField");
    String clientId = null;
    if (focusOn.contains(":")) {
    clientId = focusOn;
    } else {
    clientId = findComponentsClientIdInRoot(focusOn);
    if (clientId != null) {           
    makeSetFocusJavaScript(clientId);
    return null;
    private static void writeJavaScriptToClient(String script) {
    FacesContext fctx = FacesContext.getCurrentInstance();
    ExtendedRenderKitService erks = null;
    erks = Service.getRenderKitService(fctx, ExtendedRenderKitService.class);
    erks.addScript(fctx, script);
    public static void makeSetFocusJavaScript(String clientId) {
    if (clientId != null) {
    StringBuilder script = new StringBuilder();
    //use client id to ensure component is found if located in
    //naming container
    script.append("var textInput = ");
    script.append("AdfPage.PAGE.findComponentByAbsoluteId");
    script.append ("('"+clientId+"');");
    script.append("if(textInput != null){");
    script.append("textInput.focus();");
    script.append("}");
    writeJavaScriptToClient(script.toString());
    public static String findComponentsClientIdInRoot(String id) {
    UIComponent component = null;
    String clientId = null;
    component = JSFUtils.findComponentInRoot(id);
    clientId = component.getClientId(JSFUtils.getFacesContext());
    return clientId;
    }

    Hi,
    I am developing an ADF application where the users do not want to use the mouse. So I would like to know if there are a best practice for this?
    Well HTML (and this is the user interface you see) follows a tab index navigation that you follow with "tab" and "shift+tab". Anything else is a short cut for which you use mnemonics (as you already do) or shortcuts (explained in http://one-size-doesnt-fit-all.blogspot.dk/2010/11/adf-ui-shell-supporting-global-hotkeys.html). There is a distinction to make between non-web environments (which I think you and your users have abackground in) and client desktop environments. Browsers block some keyboard functionality for their own purpose. So you may have to find a list of keys first that work across browsers. Unlike desktop clients, which allow you to "press a button" without the button to take focus, this cannot be done on the web. So you need to be clever here, avoiding buttons at all.
    The following paper is about JavaScript in ADF and explains the basics for what Chris Muir explains in : http://one-size-doesnt-fit-all.blogspot.dk/2010/11/adf-ui-shell-supporting-global-hotkeys.html
    http://www.oracle.com/technetwork/developer-tools/jdev/1-2011-javascript-302460.pdf
    It has the outline for how to register short cut keys that perform a specific action (e.g. register ctrl+d to delete the current row you are on, or press F11 to execute a query (similar to Oracle Forms frmres files)). However, be aware that this includes some code you have to write (actually quite some code to be honest).
    http://www.oracle.com/technetwork/developer-tools/adf/learnmore/79-global-template-button-strategy-360139.pdf (are there an example implementation?), or
    http://one-size-doesnt-fit-all.blogspot.dk/2010/11/adf-ui-shell-supporting-global-hotkeys.html
    Actually these are implementations as they come with example code for you to use and customize, do they? So what is this question asking for more ? Also note that global buttons don't quite have anything in common with the question you asked. I assume you want to see it as an implementation of the Forms toolbar that operates on the form or table the focus is in. This however does not work for the web as there is nothing that keeps track of which component has a focus and to what iterator (data block) it belongs. This would involve even more coding (though possibly doable)
    Frank

  • Best Practice for Deploying ADF application

    I am tasked with developing a best or prefered practice of feploying a large ADF application. Background: we are in the process of redeveloping a UI for a large system. We have broken the system down into susbsytems. Each of these susbsystems UI will be a ADF aaplicaion(?). This is a move from a MS .Net front end. The backend (Batch processes etc) is being dveloped in Java. So my question is if I have several ADF projects for each subsystem and common components that they all will use - what is the best practice to compile package and deploy? The deployment will be to weblogic server or servers(Cluster).
    We have a team of at least 40 -50 developers worldwide so we are looking for an automated build and deploy and would like to follow Oracle best practice. So far I have read Deploying ADF Applications (http://download.oracle.com/docs/cd/E15523_01/web.1111/e15470/deploy.htm#BGBJHGFH) and have followed the links. I have also look at the ADF evangalist blogs - lots of chatter about ojdeploy. My concern about ojdeploy is that dependent files are also being compiled at the same time. I expected that we want shared dependent files compiled only once (Is that a valid concern)?
    So then when we build the source out of subversion (ojdeploy ? Ant? ) then what is best practice to deploy to a weblogic server (wslt admin console) - again we want it to be automated.
    Thank you in advance for replies.
    RK

    Rule 1: Never use the "Automatically Expose UI Componentes in a New Managed Bean" option, create your bindings manually;
    Rule 2: Rule 1 is always right;
    Rule 3: In doubts, refer to rule 2.
    You may also want to check out :
    http://groups.google.com/group/adf-methodology
    And :
    http://www.oracle.com/technology/products/jdev/collateral/4gl/papers/Introduction_Best_Practices.pdf

  • Supported/Best Practice to restore Planning application between servers

    I have two servers with Hyperion Planning 9.3.1 (prod and dev) I want to copy the application called 'BFS' from Production to 'NewBFS' - Dev server.
    As per our consultants they indicated to do the following:
    1. Backup the repository database containing application BFS from production
    2. Do a restore of the .bak file to 'NewBFS' database on dev server
    3. Resync orphan logins (from sql server logins and database logins)
    4. Log into Planning via the default admin user ID
    5. Go to application settings and change the URL
    6. Register the Shared Services URL
    7. Manage Database
    8. Check all boxes and click refresh
    9. Go to Shared Services and resync native directory users
    However when try to log into planning with something other than 'admin' we receive an error that 'user xx is not provisioned ...'
    From my db experience the user tables are either still referencing production and/or have not resynced properly.
    So long story short...can I restore one Planning app to another server and if so what is the supported/best practice?
    thanks
    JTS

    HemanthK ,
    This is what we do to restore one planning app from prod to test. And now it looks like it works: We are MS SQL Server so these instructions are based on SQL DB
    1. Backup the Planning Application SQL DB on Production
    2. Stop the Shared Services and Planning Services on Development
    3. Restore the Production Planning App SQL DB
    4. Reset orphan logins (SQL script is available at other sites, just google Reset orphan users SQL)
    5. Restart the Shared Service first then Planning Service on Development
    6. Log in development as default admin to Planning, go to the new app, choose Manage Application Settings
    7. Run the script John had indicated c:\Hyperion\Planning\bin>Updateusers.cm servername adminname adminpassword applicationname (no dashes before each parameter)
    8. Go to planning as admin again, choose a form and choose assign access, choose add access, choose migrate identities. Here is a good self-check to see that the users are only the users from development box
    9. finally go to manage databases in planning, choose refresh database and security
    10. choose manage security filters it should now reflect only development users
    11. login as a development user into planning to ensure correct security/user rights...
    You should now be able to access the application on the development box.

Maybe you are looking for