Disable User on updating an User attribute in OIM

Hi,
I have OIM 11g R2 with LDAP SYNC enabled with OID through OVD.
I want to trigger Disable user on modifying an UDF attribute of user.
Like if attribute1 of user is set to true then disabke user operation should be triggered for the user.
So first in my adapter i will check whether attribute is true and then trigger disable user.
In 11g R2 as mapping adapters attached to Users form in dataobject manager is not supported i am not able to map to the userdefinition and hence not able to check if attribute1 is true or false.
Please help and let me know if this can be achieved in any other way.
Edited by: 988070 on Mar 20, 2013 3:55 AM

You can write a post process event handler:
It will update the user status to disable when UDF attrtibute is set to true.
For this, you need to set the condition as:
Get the value of user defined attribute and store it in a variable "flag".
disable UserManagerResult disable(java.lang.String attributeName, java.lang.Object attributeValue) //attributeName will be user defined fieldm value will be "true"
throws ValidationFailedException,
oracle.iam.platform.authz.exception.AccessDeniedException,
UserDisableException,
NoSuchUserException,
SearchKeyNotUniqueException
Disables the user account matching the search criteria.
Parameters:
attributeName - - The attribute name for the search criteria.
attributeValue - - The attribute value for the search criteria.
Returns:
UserManagerResult containing the entity id of the disabled user.
Cheers,
Vamsi.

Similar Messages

How to delegate permission to user to update only his attribute

i create GPO logon that Update user descreption
and to do that h had to delegate Permission "property-specifc" to user to write in descreption attribute
and that work
but the problem is the user can update other user descreption if he use secripts
and i want user to update only his descreption

Hi,
This is Exchange server forum. I would like to verify if there is an Exchange server. Actually, we have a dedicated support team regarding the Microsoft Windows server, I recommend you ask your question on our Windows server forum which is staffed by more
experts specializing in this kind of problems. Thanks for your understanding.
For your convenience:
http://social.technet.microsoft.com/Forums/windowsserver/en-US/home?category=windowsserver
If you have any problem with Exchange server, welcome to our Exchange forum.
Hope it helps.
Best regards,
Amy Wang
TechNet Community Support

Disable profile option updation at user level

I want to disable the profile option HR: Security Profile or for that matter any other profile option at user level. The user should be able to see the value set by the system administrator (Field should be grayed out) and user should not be able to update it.
How to do it??

Try a personalization combined with custom PLSQL, like this:
1) Acces System Profiles
2) Help->Diagnostics->Custom Code->Personalize
3) In the newly displayed Form Personalization form, create a line with a description like this: Prevent modification of USER_VISIBLE_VALUE
4) In the Conditions tab, set Trigger Event = WHEN-NEW-ITEM-INSTANCE
5) Set Trigger Object = PROFILE_VALUES.USER_VISIBLE_VALUE
6) In the Condition text area, enter:
apps.xxror_test_sysprofile(:PROFILE_VALUES.USER_PROFILE_OPTION_NAME,'USER')=1
7) Set Processing Mode to Both
8) Switch to the Actions tab and create two actions:
first:
type = property
description = Don't update
Language=all
enabled=yes
object type=Item
target object=PROFILE_VALUES.USER_VISIBLE_VALUE
property name=UPDATE_ALLOWED
value=false
second:
type=property
description=Don't enter
language=all
enabled=yes
object type=Item
target object=PROFILE_VALUES.USER_VISIBLE_VALUE
property name=ALTERABLE_PLUS
value=false
9) Repeat steps 3-8 if desired for other levels, such as:
Prevent modification of SITE_VISIBLE_VALUE
Prevent modification of APPL_VISIBLE_VALUE
Prevent modification of RESP_VISIBLE_VALUE
Prevent modification of SERVER_VISIBLE_VALUE
Prevent modification of ORG_VISIBLE_VALUE
paying attention to update the corresponding names for xxx_VISIBLE_VALUE.
10) Create the following PLSQL function:
CREATE OR REPLACE function xxror_test_sysprofile (
prof_opt_name in varchar2,
lvl in varchar2
return number
is
v_ret number;
s_prof varchar2(1024);
s_uname varchar2(100);
s_lvl varchar2(10);
begin
-- returns 0 if the user "uname" must be granted access the profile named "prof_opt_name" at the "lvl" level
-- returns 1 if the user "uname" must be forbidden to access such a profile at such a level.
-- important assumption: the "lvl" parameter may have only one of the following values:'SITE', 'APPL', 'RESP', 'USER', 'SERVER', 'ORG'
-- or else this function will return 1, thus forbidding the access
s_uname:=substr(upper(trim(nvl(fnd_profile.value('USERNAME'),''))),1,100);
if s_uname in ('MY_ADMIN_1','MY_ADMIN_2','SYSADMIN') then
v_ret:=0; -- no restrictions
else
     if s_uname in ('MY_POWERUSER_1','MY_POWERUSER_2') then
     -- restrict to only the below mentioned profiles
     s_prof:=substr(upper(trim(nvl(prof_opt_name,''))),1,1024);
          s_lvl:=substr(upper(trim(nvl(lvl,''))),1,10);
          if
          (s_prof like '%WHATEVER%')
          then
               if s_lvl in ('SITE', 'APPL', 'RESP', 'USER', 'SERVER', 'ORG') then
                    v_ret:=0; -- level acceptable for these users on these profiles
               else
                    v_ret:=1; -- unknown level, so reject
               end if;
          else
               -- these users may not access these profiles, so reject
               v_ret:=1;
          end if;
     else
          if s_lvl = 'SITE' then
          -- no way any other user than those above may modify site-level profiles
          v_ret:=1;
          else
               -- any other user than those above may modify lower-level profiles, but
               -- for now reject all
               v_ret:=1;
          end if;
     end if;
end if;
return v_ret;
end;
Pls be aware that testing first on a test instance is always advisable.

Changing Container of user in OID depending on Attribute in OIM

Hi All,
I am Using OIM 11g along with LDAP sync to OID.
I have configured LDAP Container Rules depending on the attribute Country. So when i give a country during user Creation then it is moving to the specified Container for OIM.
Now, the problem is i want that whenever the country of that user is updated.. it should move to its respective Container. but now the container is considered only at Creation time and So user is not moving from one Container to Other.
Can you please tell me how can i achive this.
Thanks!!
TJ

Hi Kevin,
It worked for updation of Country in Admin Console but it is not working when we are Changing through Reconciliation.
i.e. USR_LDAP_DN Attribute is updated in OIM but Change is not reflected in OID till any change is done to that user in OIM.
Can you Please Suggest What we can do so that Change gets reflected in OID.
Thanks!!
TJ

Restrict update on certail attributes in OIM 10 g

Hi,
We have a requirement to restrict updating certain fields in user profile in OIM 10g. for e.g, for logged in users with particular group i need to retsrict updating their firstname and last name. I have written an entity adapter for this. to restrict certain fields what we need to do. please reply
Thanks

Open <OIM_HOME>\xellerate\config\formmetadata.xml file. Find section : 
Here you can see list of attributes which an user can see/modify after he logs in. For e.g. you can see list like:
<Attribute name="Users.First Name" label="global.label.firstName" displayComponentType="TextField" dataLength="80" map="Users.First Name"/>
<Attribute name="Users.Middle Name" label="global.label.middleName" displayComponentType="TextField" dataLength="80" map="Users.Middle Name"/>
<Attribute name="Users.Last Name" label="global.label.lastName" displayComponentType="TextField" dataLength="80" map="Users.Last Name"/>
Now if you want to restrict user for editing certain attributes, set editable property to false. For example for middlename you can set:
<Attribute name="Users.Middle Name" label="global.label.middleName" displayComponentType="TextField" dataLength="80" map="Users.Middle Name" editable="False"/>
This will apply to all the users and is not group dependent. If this satisfies your requirement, you do not need to write any code/adapter.
regards,
GP

Updating Schdedule Task Attributes in OIM through our Code.

Hi Guys,
My Requirement is that I should be able to update the schedule task attributes through my reconciliation code. I tried my level best to find some API but unable to locate the API's to update the schedule task attribute.
I used to following funciton to update the schedule task attribtue value:
public void updateScheduleTaskAttribute(long scheduledTaskKey,
long taskAttributeKey,
java.util.Map attributes)
This API found is in the tcSchedulerOperationsIntf interface. However, I am unable to find any API to retrieve the scheduledTaskKeyand taskAttributeKey parameters for the currently executing schedule task. Currently, we use the getAttribute(String) method to retrieve the schedule task attributes. I would be very grateful if you could guide me on how to obtain the scheduledTaskKey. If I am able to get that, I think it would be possible to obtain the taskAttributeKey, though do let me know if there is a better approach to get this also.
I would be highly obliged if someone could tell me some better way or a code snippet through which I can update the schedule task attribute values.
Thanks in advance,
Akki :-)

Thanks a lot kevin for your reply,
Actually there are some attributes which doesn't makes sense if they reside in IT Resources as IT Resource are meant for keeping connection parameters which will be used during provisioning. For ex: Last Reconciled Record, Last Reconciled Timestamp. These two attributes doesn't makes sense if they reside in IT Resources.
I hope you understood my requirements.
Hoping a ray of light :-)
Thanks in advance,
Akki

LastLogon attribute not updated in user ADFS federated logon

We have a situation where part of our users only use their AD domain account for ADFS federated logon.
Problem is that, the lastLogon attribute does not update, when the user makes an ADFS logon. That in turn will conflict with the automated unused AD account deactivation process which checks the lastLogontimeStamp attribute. Because of it, users may get
their AD account disabled though they are using it daily.
In a test AD, the ADFS logon updates the lastLogon attribute OK, so the problem is only in our production ADFS.
How to troubleshoot the problem and, what might be wrong with it?
Our AD is with two, WS 2008 R2 DC servers, DFL 2008 R2, and one ADFS server with WS 2008 R2.
Br, Kari

This is per design... if a user uses their AD DS account just for authenticating using an ADFS Proxy/WAP they never actually logon to the domain so the lastLogontimeStamp attribute will never but updated for the user account.
WORK

Disable JRE Auto update in Vista for all users?

I feel like a complete idiot that I can't figure this out, but it's either so obvious I'm overlooking it, or I just plain can't figure it out, so I'm hoping someone here can help.
We have not yet been able to figure out how to simply disabled the Auto Update option when installing JRE under Vista, so it will never check for updates, no matter what user is logged into a pc. I've just installed the newest version 1.6.0_05-b13, but get the same results.
Basically, we are creating a "base clone image" of a Vista workstation and we need the auto update feature of the JRE to be disabled so it doesn't check for updates. When a new user logs into the pc, we want them to 'inherit' this setting from the default user profile, or we simply want a 'global' setting on the pc that stops all JAVA update checks from occuring. But even though there are multiple registry keys that 'look' like they control the auto update function, no matter how we set them the update option still shows it is enabled when you open the JAVA control panel.
We have 2 basic problems:
- When a standard user runs the JAVA Control Panel applet and they select the 'Update' tab, the option to "uncheck" autoupdates is "grayed out". If we make the user a local administrator, then it is not grayed out anymore and they can set the option. Problem is, we have thousands of users and none of them are local administrators, hence the problem of getting it to already be defaulted to not check for updates. How do we get the update checkbox to NOT be grayed out for a NON-administrator?
- How do we set the 'global' (or default) option to disable the auto update checkbox for ALL users? No matter what we try, when a new user logs in, the auto update feature is still enabled after their initial profile is generated from the first time login.
I was able to figure out if I change the "EnableJavaUpdate" value in the below registry key, it will "remove" the Update tab from the JAVA Control Panel. But does the simply remove the tab? Or does it remove the tab AND disable auto updates for ALL users on the computer?
HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Update\Policy
I've sent multiple emails to Sun asking for help on what should be a simple thing to do, but have never received a reply from them.
Keith Hemmelman

Thank you for the reply. I apologize for not getting back here sooner.
We actually already use a deployment.properties file located under the Default User profile on our Vista setup. It's located under the "C:\Users\Default\AppData\LocalLow\Sun\Java\Deployment" folder. This file does get copied over to a new user profile when a new person logs in. This is what we want since we have set things like the maximum cache size and temporary file location.
The problem though is there is no setting that disables the automatic update check within this file. The best I can figure out is that for some reason under the Vista environment, the auto update setting is controlled in the registry at: HKEY_CURRENT_USER\Software\JavaSoft\Java Update\Policy
There is a REG_BINARY key there that appears to control this option. It is named "EnableAutoUpdateCheck". The problem is that the value of this key is "several" characters long and it is "different" from one user to the next. I tried disabling auto update under the Java Control Panel and then copied the value of this key into the same aread of the Default User hive but when a new user logs in, it ignores that setting and auto update is still enabled. I also tried using a simple "0" to disable the autoupdate or a "1" to enable it for this key, but it doesn't work either. (This is very frustrating why there isn't a simple 1 or 0 setting to turn the auto update setting on/off.)
We had no problem getting this to work under XP. Basically we didn't have to do anything special in XP. We simply created a temporary user account and made all the settings we wanted and then copied that profile over to our Default User profile and the Java autoupdate setting under the Java Control Panel was disabled for all new users. We did the same thing under Vista, but the auto update setting was ignored and re-enabled for all new users.
I read through the settings for the deployment.properties file located at the below link, but there is nothing there to control the auto update setting.
http://java.sun.com/j2se/1.5.0/docs/guide/deployment/deployment-guide/properties.html
Thus, we can't get the auto update setting to be disabled in the default user profile so it will in turn be disabled for all new users that log into the computer. This is extremely frustrating.
The other equally frustrating problem we have run into under the Vista environment is that when you run the Java Control Panel, the option to disable the auto update check is "grayed out" and the user can't uncheck this option to disable auto update. We have found you must be an administrator before this option is no longer grayed out. Since none of our thousands of users are admins, this is also a problem for us. (This option works fine for a standard user if you are on a XP machine though. It's just Vista where things have changed.)
I've sent repeated emails to Sun in the past asking for help, but they never replied.
Keith

Updating AD Attributes via OIM user forms

Hi,
I have configured an AD connector. Firstly, I did a trusted recon to create the OIM. Next, I did a user recon to link the AD user to the OIM user. After that I have configured to pre-populate to show the AD attributes onto the OIM user form.
Now, what I want to do is to update the AD attributes (eg. Mobile) in the OIM web interface, and has it reflect back to AD.
Appreciate a detail description as I am very new to OIM.
Cheers, SK

You may want to try this:
a. Add an entry in Lookup.USR_PROCESS_TRIGGERS
b. Add a Process Form field and a Process task in each Process where you want to push the value.
The task should have a name "<UDF label> Updated"
c. Create another one called "Change <UDF label>"
d. Make the tasks conditional, "allow multiple instances"
e. Wire the "Change <UDF label>" to copy values from the user profile to the process form
f. Wire the "<UDF Label> Updated" to the connector adapter.
--Deepak

Prevent multiple users from updating coherence cache data at the same time

Hi,
I have a web application which have a huge amount of data instead of storing the data in Http Session are storing it in coherence. Now multiple groups of users can use or update the same data in coherence. There are 100's of groups with several thousand users in each group. How do I prevent multiple users from updating the cache data. Here is the scenario. User logs-in checks in coherence if the data there and gets it from coherence and displays it on the ui if not get it from backend i.e. mainframe systems and store it in coherence before displaying it on the screen. Now some other user at the same time can also perform the same function and if don't find the data in coherence can get it from backend and start saving it in coherence while the other user is also in the process of saving or updating. How do I prevent this in coherence. As have to use the same key when storing in coherence because the same data is shared across users and don't want to keep multiple copies of the same data. Is there something coherence provides out-of-the-box or what is best approach to handle this scenario.
Thanks

Hi,
actually I believe, that if we are speaking about multiple users each with its own HttpSession, in case of two users accessing the same session attribute in their own session, the actually used cache keys will not be the same.
On the other hand, this is probably not what you would really like, you would possibly like to share that data among sessions.
You should probably consider using either read-through caching with the CacheLoader implementor doing the expensive data retrieval (if the data to be cached can be obtained outside of an HTTP container), or side caching with using Coherence locks or entry-processors for concurrency control on the data retrieval operations for the same key (take care of retries in this case).
Best regards,
Robert

BPM 11g: how to update a user screen

Hello all.
This is my problem:
I have some user screens that show some process objects in them. After their creation, i had to add (because the client now wants them) some more attributes to those process objects, how can i update the user screen to show me those new attributes in the objects it is showing?
I tried adding the code in the source view but i get the "cant find attribute" warning.
So far i have been doing the user screen again (from scratch) to add those new version of the objects, but it is getting really troublesome to do as the project gets biggers.
Thanks for any help.

Do any1 know?

Update Request User Details with updateRegistrationUserDetails

Hi,
I have the following scenario: The Self-Registration form is defined with the fields First Name, Middle Name, Last Name, Manager Login. When the request is created, based on the Manager Login, the other user's attributes are set according to the Manager's Attributes. So when the manager goes to approve the request, most of the user information are already set. To update the User Details in the request, I can call the updateRegistrationUserDetails of Request API.
Problem: I can not update the fields other than those defined in the FormMetadata.Xml. So I have to add the fields and set them as optional but I don't want to show non required fields to the end-user. I wish to have those attributes as not visible in the self-request form. Then I can update the information using the API.
Question: How to add fields to the User Details of the request and not show them in the self-request form?
Thanks,

As I've said, I could not update the request fields that were not declared in the FormMetadata.xml. You can try set them as not visible but I am not sure the visibile attribute works for the SelfRegistration form. If it is not a problem, you can show the fields and set them as optional true. In my exaple, the SelfReg form has a manager employee code field.
Create an entity adapter and assign it to the Request object, pre-insert.
1) create two variables: requestKey, requestObjecAction, managerEmpCode (in my example)
2) test if the request object action is Create Entity.
3) call the method to update the request. below is my example:
     // Updates the request with the information of manager: Manager Login,
     // Location, Department and Organization
     public String updateRequestWithManagerInfo(long requestKey, String managerEmpCode) {
          String result = JavaTaskBase.EXECUTION_ERROR;
          logger.debug("******** Starting updateRequestWithManagerInfo *************");
          logger.debug("requestKey: " + requestKey);
          logger.debug("managerEmpCode: " + managerEmpCode);
          try {
               HashMap<String, String> filter = new HashMap<String, String>();
               filter.put(JavaTaskBase.USR_UDF_EMPLOYEE_ID, managerEmpCode);
               String[] columns = new String[] { JavaTaskBase.USER_KEY_FIELD,
                         JavaTaskBase.USER_LOGIN_FIELD, JavaTaskBase.USR_UDF_LOCATION,
                         JavaTaskBase.USR_UDF_HR_DEPARTMENT,
                         JavaTaskBase.ORGANIZATION_ATTRIBUTE_NAME };
               logger.debug("Querying User by EmpCode...");
               // Update Request Attributes: requestKey, ManagerId
               tcResultSet resultSet = this.getUserOperations().findUsersFiltered(filter, columns);
               logger.debug("tcResultSet.getTotaRowCount(): "+ resultSet.getTotalRowCount());
               resultSet.goToRow(0);
               String organizationName = resultSet.getStringValue(JavaTaskBase.ORGANIZATION_ATTRIBUTE_NAME);
               String managerLogin = resultSet.getStringValue(JavaTaskBase.USER_LOGIN_FIELD);
               String managerLocation = resultSet.getStringValue(JavaTaskBase.USR_UDF_LOCATION);
               String managerDepto = resultSet.getStringValue(JavaTaskBase.USR_UDF_HR_DEPARTMENT);
               String managerKey = resultSet.getStringValue(JavaTaskBase.USER_KEY_FIELD);
               logger.debug("Manager Organization: " + organizationName);
               logger.debug("Manager Login: " + managerLogin);
               logger.debug("Manager Location: " + managerLocation);
               logger.debug("Manager Department: " + managerDepto);
               logger.debug("Manager Key: " + managerKey);
               // Prepares the information to update the request
               HashMap<String, String> values = new HashMap<String, String>();
               values.put(JavaTaskBase.ORGANIZATION_ATTRIBUTE_NAME, organizationName);
               values.put(JavaTaskBase.USR_UDF_LOCATION, managerLocation);
               values.put(JavaTaskBase.USR_UDF_HR_DEPARTMENT, managerDepto);
               values.put(JavaTaskBase.USER_MANAGER_LOGIN, managerLogin);
               logger.debug("Updating Request Info...");
               // Updates the request
               this.getRequestOperations().updateRegistrationUserDetails(
                         requestKey, values);
               logger.debug("Request Updated Successfulfy.");
               result = managerKey;
          } catch (Exception ex) {
               logger.error("Error in updateRequestWithManagerInfo method", ex);
               ex.printStackTrace();
               result = JavaTaskBase.EXECUTION_ERROR;
          return result;
thanks,
Renato.

Order of User Profile update

Hi
I'm in the middle of configuring UPS and would appreciate some advise on the order of how the end user interacts with their profile and how updating of user profile and AD should work.
1. users start life from AD, only a handful of fields get added.
1a. UPS updates SharePoint profile datatabase.
2. every user needs an image, users are allowed to edit certain aspects of their profile (manager). Should this be user profile in SharePoint?
2a. SharePoint exports to AD new information ? (i.e.image)
3. Ideally, I would want outlook to pick up the images from somewhere.
Is the above order correct, Im not keen on updating AD as in step 2a. Is this needed?
Thanks

Updating AD is needed if you want to push attributes from SharePoint to Active Directory (like a photo). What version of Exchange do you have?
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

How do I disable iTunes for a single user?

I recently purchased an iPhone and installed iTunes on my Windows Vista computer. It looks like iTunes was installed for all users. I typically have 2 windows user accounts active during the day. When I plug in my iPhone (with the included usb cable) iTunes tries to start for both users. One will succeed and I will constantly get error messages from the other until I unplug my iPhone. I always want my primary user account to start iTunes and connect to my iPhone when I plug it in and never want my secondary user to start iTunes or connect to my iPhone. Is there a way that I can just disable iTunes for my secondary user?

Chris,
Thanks for your reply. Where is this option available? I have checked all the tabs that show up when I select iPhone. I have checked all the menu items (including edit-preferences) and I have also right clicked on iPhone. I don't see an item anywhere that will let me control this.
I am using iPhone 2.2.1 and iTunes 8.1, there are no updates available.
thanks again,
Jason

Using Update Resource User

Hi,
I have a requirement where I need to update a user who is not in IDM but in the resource, I need to update few attributes of this user in LDAP.
Here is what I am doing to meet this,
I am calling the subprocess Resource Object Retries where
op =updateResourceObject,
objectType=user
user = user object I builtWhich is most similiar to Out-Of-Box workflow Update Resource User
My workflow works fine for when the user in windows NT (not in IDM) is updated, but when I am doing this for a user in LDAP, I am getting Objet class violation (error code =65) . I tried passing object class as
<list> and <LIST> //xml Object and XPRESS .Still it is the same.
I need some rescue here.
I was wondering where is the Out-of-box Update Resource User
method called.
If any one has worked , using updateResourceObject service ,
help me.
thanks,
pandu

Hi pandu345,
Hint to reduce side effect error - one thing about objectclass violations:
Consult the directory server error log to see which attribute caused the error!
In case you modified the schema to be nonconformant to already existing entries you will always get objectclass violations not matter what you try to modify. (I have suffered that already in a non-IdM-but-ldap environment)
/h

Disable User on updating an User attribute in OIM

Similar Messages

Maybe you are looking for