Delete Role Request Template

Hi,
I want to be able to use the Delete role request template in code to create a request that deletes a role.
So I supposed that you will have to give the role name or role key with the request.
But when I check the DeleteRoleDataSet, it doesn't contain any attributes.
Just :
<?xml version = '1.0' encoding = 'UTF-8'?>
<xl-ddm-data version="2.0.1.0" user="XELSYSADM" database="jdbc:oracle:thin:@oristb1l.solaris.nbb:1551/ISTB1L.NBB" exported-date="1315573110831" description="bla"><RequestDataset repo-type="MDS" name="DeleteRoleDataSet" mds-path="/metadata/iam-features-requestactions/model-data" mds-file="DeleteRoleDataSet.xml"><completeXml><request-data-set xmlns="http://www.oracle.com/schema/oim/request" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.oracle.com/schema/oim/request" name="DeleteRoleDataSet" entity="Role" operation="DELETE">
<DataSetValidator name="DeleteRoleDataValidator" classname="oracle.iam.requestactions.plugins.datavalidator.DeleteRoleDataValidator"/>
<Attribute name="RequestorID" available-in-bulk="false" type="Clob" length="1024" widget="text" required="false"/>
<Attribute name="FAOpData" available-in-bulk="false" type="Clob" length="4096" widget="text" required="false"/>
</request-data-set></completeXml></RequestDataset></xl-ddm-data>
How can I use this then ?
How does it now which Role to delete ?
Thx for your help

WHat do you mean by "Delete Role Request Template" ?
I can't see any Request Type with name "Delete Role" under Request Template.

Similar Messages

[OIM11g R1] How to Delete Request Template Management

Dear all,
As for the intro, if we create new request template with at least 1 role in it, OIM will automatically create authorization policy (request template management) with the same name. And for my current issue, I think it is caused by fault in export/import xml. I have one request template that is not synced with the one in authorization policy. The one in request template doesn't have any role assigned onto it. But the one in authorization policy has it. As a result, when I try to add some role on the request template, there comes pop-up error. So my conclusion is, this issue should able to be fixed if I delete the request template management in authorization policy. But the situation is, we cannot delete request template management. We can only delete user/role management. Any idea how to solve this? Do you know how to force delete it via LDAP or Oracle DB?
Thank you

Thanks Kevin,
But we have something like this here. Is it because the version, or maybe we need to patch it?
https://drive.google.com/file/d/0B1xvmF8kRL9_eHhrbFFKdGdPa3M/edit?usp=sharing

Exception while trying to add new roles into Request template - OIM 11g R1

When I try to edit 'Allowed Roles' tab in the Request template, I am facing an exception saying *'oracle.iam.platform.utils.MaxLimitException'*. What is the maximum number of roles that can be added to a request template? Also, which OIM table contains data related to the roles attached to request template?

Hi Rajiv,
Thanks for the information. It did resolve the issue.
However, I have another query. Was their any reason for setting the max limit of roles in request template to 300? Will their be any issues(like system unstability, system performance drop) if the limit is increased?

How to delete role through Transport Request

Hi,
when I am deleting Role it is Not asking me for transport request ..this is what i needed.can anybody solve my problem
regards
Gaurav

Hi,
Please check if your role is already locked under some Transport request. If so it wont pop up any TR.
If it is locked under some TR, make sure you detach it from the TR and try again it will pop up a TR screen
Please revert in case of issues
Regards,
Pramod

How to add dynamically a role in a Request Template

Hi all,
We have created a job that reads roles from a custom table and creates them in IDM. We have also a request template of type Assign Roles that has all the allowed roles that can be assigned to a user. We have a requirement to add a role from the custom table in the IDM and also add it in allowed roles of the Request Template so that it will be available. Our problem is that we cannot find an API that we can call in order to add the roles in the request template. Does anyone know how we can do this?
Thanks in advance,
Kostas

Did you look at RequestTemplateService? I believe you can use this to modify your template pragmatically. Thus the step would be to read the custom table, create role in IDM and the modify the template pragmatically to add the newly created role in the available role which can be requested.
http://download.oracle.com/docs/cd/E14571_01/apirefs.1111/e17334/oracle/iam/request/api/RequestTemplateService.html
HTH,
BB

Deleting roles from CUP

Gurus,
We accidently synced CUP with our EP which points to an ABAP stack (therefore tens of thousands of roles!). There are over 6,000 pages of roles in CUP that need to be deleted. Do we have to do this page by page or is there another way?
Thanks,
Grace Rae

Hi Grace,
Role deletion in CUP can be either rolewise or pagewise. However there is an easier method where you can disable the Roles in one go. The Disabled Roles do not get displayed to Users at the time of Request creation.
The Role Upload Template which is used for importing these Roles in CUP would be needed here. There is a 5th field for Systems in the template, which had to be modified.
If the System for these Roles is EP then just replace it with EP(D) in the Role Upload Template. After this modification import the Template again and check the Overwrite Existing Roles option.
Hope this will minimize your efforts in deleting Roles.
Regards,
Nikita.

CUP - Unable to assign and delete role at the same time

Hello everybody,
I have an issue with CUP.
Regarding a change account request, if I assign roles, it works. In the other hand, if I delete roles (also with a change account request) it works too. But if I mix both of them in the same request (assigning and deleting roles) it doesn't works. Only the deletion works. Some times we have no error message and some times we have:
Error provisioning your request. Request no: 94. Error occurred in the system(s) : n/a, error details :
DR1CLNT200-ZTEST01-USER CREATE-Function template /VIRSA/BAPI_USER_CHANGE could not be retrieved from DR1CLNT200
Do you have please an idea to solve this issue?
For information the CUP used is a 5.3 SP 5.0 version.
Thanks in advance for any help.
BMW

Hi Ben,
There may be a possibility of such a behaviour in SP05 as many of the changes in code has been done
till now which may result into such issue and we can't confirm your findings by re-creating it. However, you can check few things functionally which may resolve this issue:-
1) This error usually comes when the role selected is already assigned to the user or user doesn't exist in the system for which change request is created.
2) when this error encounters the system, please take the system logs for that time from 'Monitoring' tab under configuration in 'English' and there the error cause can be found out or please paste the logs so that we can analyse.
3) Also, you can refer to SAP Note:- 1168508 where many of the role related issues have been resolved after SP05, therefore, for smooth functioning of GRC-CUP 5.3, it's better to upgrade to the latest SP i.e. SP18.11(available at SMP).
Best Regards,
Akhil Chopra

Create a custom Request Template

Hello,
i need to create a custom request template.
Custom Template = Create user + disable user.
The request should be creating a user and disabling them automatically.
1. What is the correct way to realize this scenario?
2. Do i need bpel processes for that?
3. Where are the default request templates stored in oim? Is it possible to modify the 'create user' template and add the 'disable user' functionality?
Many thanks in advance!

1) Use these templates. Create and Disable User.
3)__Default Request Template in OIM:__
1-Assign Roles:Default template for assigning roles to users
2-Create User:Default template for creating users
3-De-Provision Resource:Default template for deprovisioning resources
4-Delete User:Default template for deleting users
5-Disable Provisioned Resource:Default template for disabling provisioned resources
6-Disable User:Default template for disabling users
7-Enable Provisioned Resource:Default template for enabling provisioned resources
8-Enable User:Default template for enabling users
9-Modify Provisioned Resource:Default template for modifying provisioned resources
10-Modify Self Profile:Default template for modifying self profile
11-Modify User Profile:Default template for modifying user profiles
12-Provision Resource:Default template for provisioning resources
13-Remove from Roles:Default template for removing users from roles
14-Self-Register User:Default template for self registering users
15-Self-Request Resource: Default template for requesting resources for self
Default template are:
Go to Advanced Administration-->left pane of the Request Templates -->Advanced Search
To modify:
Select a template name in the search results table.--> Actions menu, select Open.
Template Details section-->the details of the template are displayed in the fields
I hope this helps,
Thiago Leoncio

Request Key for Role Requests in OIM 11.1.1.5.0

Hi,
We are currently working on an enhancement in which after the role request is approved in the work flow process (SOA), need to be assigned to a group. A notification has to be sent to this group with the request details and the task needs to be assigned to them.This functionality is implemented using the process task and providing the group name in the assignment tab of the task.
The problem we are facing here is, we are not able to get the request key (of the role request) dynamically, which can be used in the adapter to get the request details/ role details.
We have implemented the same process while requesting for RO. i.e. after the RO request is approved in the SOA work flow it gets assigned to a group.
In that case we could get the request key by using the below sql query:
"select usr.USR_LOGIN,req.request_key,usr.usr_first_name,usr.usr_last_name from usr usr,request req,oiu oiu where req.request_key=oiu.request_key and req.requester_key=usr.usr_key and oiu.orc_key=" + processInstanceKey;
How ever for the role requests, we are not able to figure out the query / any other process using which we can get the request key dynamically that can be used in the process task adapter.
Please suggest the db query or any other method to get the request key for the role request.
Thanks in advance.
Shakti.

Hi Kevin,
The complete steps that we are following are as below:
1. The requester raises a request for assigning role xyz to user abc by using request template. Once the SOA workflow is completed the user gets the role.
2. After the evaluate user policy scheduler is run and the record is inserted in to the child table, a task "ADD Role To User" is triggered,
3. Have created an adapter to set Response= "SUCCESS" and associated it with the task "ADD Role To User".
4. On Response= "SUCCESS" we are triggering two tasks. i. Assigning task to a team
ii. Sending notification to the team about the role request.
5. While writing the task for sending notification ,we have created an adapter. We need to get the request key(of step no 1) and role details to be displayed in this mail.
As you have mentioned, "There should be no process instance key for a Role Request because there is no object.", i am not able to figure out a way to get the request key
which i can use in the adapter to send notification.
Please suggest how can i get it and let me know if you need any other details.
Thanks in advance.
Shakti.

Service Account Management through Request Templates

Hi,
I am trying to implement Service Account lifecycle use cases (Create, Modify, Delete) on 2 resources(AD User, iPlanet User) through Request templates. In this case OOTB tasks - Service Account Alert, Service Account Changed, Service Account Moved with resource specific Process definitions are not get triggered as I am initiating process through Request Templates.
I want to trigger post process EventHandler upon triggering any of these events. so, I created metadata xml file as the following and imported it into MDS.
-----------------EventHandler Metadata file------------------------
<?xml version='1.0' encoding='utf-8'?>
<eventhandlers>
<action-handler class="com.wipro.sdf.iam.oim.plugin.ServiceAccountCreationEventHandler" entity-type="Resource" operation="PROVISION" name="ServiceAccountCreateEventHandler" stage="postprocess" order="1021" sync="TRUE"/>
</eventhandlers>
----------------------------XXX----------------------------------------------
When I trigger create event of SA on any of the resources, the EventHandler is being invoked and from execute() method, Orchestration is giving the following data
{UD_IPNT_USR_LAST_NAME=TestTwo, BENEFICIARYKEY=798, UD_IPNT_USR_COMMON_NAME=SA Test Two, *ResourceKey*=12, serviceaccount=true, UD_IPNT_USR_SA_ADMIN=USER16TE, UD_IPNT_USR_USERID=SATEST2, UD_IPNT_USR_FIRST_NAME=SAccount}
My EventHandler has to do some actions on target resource(AD / iPlanet),so I would like to get resource connection details like IP, port , admin login details etc.
To fetch those details, I am using ResourceKey that is coming from Orchestration.
When I use the following code to find Resource details based on Key, its throwing resource not found exception.
-----------------------Code from execute() of EventHandler----------------------
String resKey = getParamaterValue(parameters, "ResourceKey");
tcITResourceInstanceOperationsIntf resInsObj = Platform.getService(tcITResourceInstanceOperationsIntf.class);
//Get Resource Details based on Resource Key
HashMap searchMap= new HashMap();
searchMap.put(Constants.IT_RESOURCE_KEY, resKey);
logger.debug(methodName+" - IT Resouece Search Map is : "+searchMap);
tcResultSet resultSet = resInsObj.findITResourceInstances(searchMap);
-------------------------------End of code ------------------------------------------------
I tried finding for the table which stores all IT Resource connection details. But no luck.
Now my questions are:
1. Which table stores all IT Resource Information that can be seen from Design Console -> Resource Management -> IT Resource Type Definition - > Resource?
2. Which table stores Resource Key and Name details?
3. When we do query for records from any form in Design Console, where exactly would logs get recorded? (as it queries DB to fetch information there should some file like DB Tracer Log etc)
Could somebody please answer these questions and give some hint to implement SA management through Req Templates?
Thank you in advance,
Mounika

Hi kevin,
thanks for reply.
i am thinking that, Even though OIM11G is developed in ADF,some parts of the code is in struts only,like xlWebApp.war .
i have seen source code of xlWebApp.war folder that is there in OIM11g.
it seems to be developed in struts only.
is there any ADF interaction in that?
i have written helloworld program in struts,that is working fine.
i have done that,for ADUser resource popup i added button "serviceaccount for this resource".when i click that one jsp page will come.
so i am thinking that,some other reason is there for not working.
can u please tell me the reason?

Issue to add t-codes & functions in ERM role request GRC 10.0 - SP 5

Hi
We are on SAP GRC 10.0 - SP5. We are facing a strange issue while creating a Role request.
After Defining the role, we are unable to add actions and there is no option of add/delete.
Similarly while adding Functions, we are getting an error of Function module doesnot exist.
On SP5 we could able to add t-codes successfully. Is this an issue with SP5.
Thanks and Best Regards,
Srihari.K

Hi Diego,
We applied the SAP Note. Now we could able to add the function from RAR rule set to a role. But this is brining all the t-codes in the function.
We could not able to add the Actions directly into the role while defining. There is no add button appearing in Action edit screen where we can add t-codes to the role manually.
We are on GRC 10.0 - SP5. Does anybody has this issue and got it resolved?
Thanks and Best Regards,
Srihari.K

Unable to Create Service Request Template in CRM

Hello,
I need to create a service request template in crm web ui,
Following are the steps followed.
I have identified the transaction type as SRQT screen shot attached below
However when I click on on the work center link groups of the service pro role, I am not able to find the same for the service request template
As per the post below it says that you need to go navigation bar profile and add the SM-SUPPORT work center and the work center link group as SM-SRQT-CR
How to customize service request templates
The error appears when I try to add the logical link id,
Because of the above error I am not able to create service request template in sap crm, please advice which logical link ID, I need to use so that the service request template can be created in the system.
Kind Regards
Atul

Hi Atul,
1. Screen shot 1 is correct
2. Screen shot 2 - You are at end of all work centers in your custom role which you might have copied from standard or Z role. If you look in standard role SERVICEPRO, navigation bar profile SRV-PRO, work center - SRV-ORD, you will find service request template
In Cases work Center in standard SERVICEPRO role you can create service request template.
Try copying this to your custom role in your required work center. It should work.
Regards,
Niraj

OIM 11g - Modify Assign Roles request

Hi everyone,
I would like to know if it's possible to modify Assign Roles request in order to restrict the available assignees. I mean for example, if a manager wants to create a new Assign Roles request, he will be able to select only users whose he is the manager of.
If someone knows how to do that he will be really helpfull !
Thanks in advance,
Thibault

Thanks for both of you !!
Indeed it's OOTB and it didn't work for me because there was another authorization policy configured for REQUEST_ADMINISTRATOR which allowed them to search for all users. And because all of my requesters had this role, they could search for all users. So I configured a new request template which allow a role, that I had already created before, to create request and now it works fine.
Thanks !!
Thibault

Deleting roles from GRC AC CUP

Hi
We had GRC 5.3 installed with SP05. We have archived all our existing requests and are trying to delete some of the roles from CUP. However when trying to delete the role it is giving a message "Cannot delete because this is referenced by request". Is there something else which i need to take care of? Will application of latest support packs help in this situation?
Appreciate your help regarding the same.
Thank you.
Anjan Pandey

Hi Anajan,
I feel some requests are still exist in GRC CUP for that particler role. Please follow the below steps and try to delete the Role again.
Go to CUP configuration tab > click on Request option under the workflow> choose deleting requests > next> then its asks to delete all requests and then choose Submit option.
once you click on submit button, you will get the message all existing requests are deleted with Job id.
finally go to the Roles and delete the required roles form the GRC CUP.
Regards,
Arjuna.

Request Template link display

Hi,
I have logged in as xelsysadm and created "Contractor Create User" request template.
Settings are:
1. I didn't select "Template Level Approval Process" (Is it mandatory?)
2. For User Type, in Attribute Restrictions have selected "Contractor" as LookUp Values and "XellerateUsers" as Organization
3. Assigned "Request Administrators", "System Administrators" as roles.
Where can i see this "Contractor Create User" link?
Do i need configure anywhere?
Thanks,
Madhavi

are you using xelsysadm user to raise request?
one more thing. If you are not using Template level approval you must associate approval policy( for Request level and operational level). I suggest, you change it to Template level .
To verify this follow below link
http://docs.oracle.com/cd/E14571_01/doc.1111/e14309/request.htm#OMDEV2873
create request template
http://docs.oracle.com/cd/E14571_01/doc.1111/e14316/req.htm
Edited by: Nishith Nayan on Feb 8, 2012 7:37 AM

Delete Role Request Template

Similar Messages

Maybe you are looking for