Help Required With Access Policy Trigger On Enable User In Oim 11gR2

My scenario is:
We have a created a access policy for the user.
Scenario1:
As soon as the role is added to user, the account is provisioned. -Working
Scenario 2:
As the user is disabled, the account gets revoked-Working
Scenario 3:
As the user is enabled, the new instance of the account should get provisioned.(It was earlier working in 11G r1)
"Evaluate User Policies " is running every ten minutes.Manually also triggered it. but the account doesn't get provisioned after the user is enabled.
Any inputs?
Please help

Your Scenario 2:
As the user is disabled, the account gets revoked-Working ----> ITS WRONG if you are using OOTB feature of OIM
-> When the user gets disabled, the accounts should get disabled. The result which u are getting above is not OOTB. Have you made any customization to any logic?
Just for your info, there is one system property which is used to enable disabled resources when the user is enabled:
http://docs.oracle.com/cd/E27559_01/admin.1112/e27149/system_props.htm#OMADM884
Enable disabled resource instances when a user is enabled
If the value is TRUE, then the disabled resource instances are enabled when a user is enabled.
XL.EnableDisabledResources
TRUE

Similar Messages

Help required with Access Sequence for 'Delivery output' of Scheduling note

Dear Gurus
I need help with creation of an Access Sequence.
I have created an access sequence for sales org and customer, where the communication is emailed or faxed to the CR party- Forwarding agent.
BUT - some customers have more than 1 forwarding agent in their masterdata, and not all forwarding agents are wanting to receive fax/email, so if a condition record exists it will always try to send via the method set up against the customer.
I need to create an access sequence which looks at the customer/ Forwarding agent combination, - I have created new condition tables and Access sequences to include Vendor, - but when i create delivery notes, - this is not working, - it is not recognising the access sequence at all, the vendor party/haulier is not being recognised at all- I keep getting access not made, Initialised field'
Please advise how i can get the customer/Forwarding agent scenario to work
Many thanks
Tony

Hi Tony,
The field SPDNR can not be entered directly in the feild catalog list.
First it has to be included in the list through inculde or user exit......
SPRO->Sales and Distribution>System Modifications->Create New Fields (Using Condition Technique)-->New Fields For Output Control---> Use INCLUDE for new fields in Dictionary (messages) or Use user exit for new fields (messages)
You ask your ABAP consultant to do this then it will be available in the field catalog list then u can select in the condition table then into access sequence and so on...
Kindly Reward points if usefull.
Regards
vK

Help required with Access Sequence for output of Delivery

Hi
I have created new conditon table for shipping point and storage location
Created new access sequence , with this new condition table as the 1st sequence - the others being Sales org/ Customer and then Shipping point.
Applied this Access sequence to Output type
I created condition record against 1st access sequence, Shipping point and storage location
Yet when I created Stock Transport Order and subsequent delivery for this STO.
The first access sequence against Shipping point and Storage location was not found
The fields used against shipping point and storage location in my access sequence are as follows:-
VSTEL KOMKBV2 VSTEL
LGORT KOMPBV2 LGORT
I also tried with a condition for shipping point and material , but this was not found either
Any ideas ?
Please advise
Many thanks
Tony

HI
checked the config and the delivery type is assigned to output determination procedure for shipping output.
we have two outputs for deliveries, one for delivery schedule note and the other for despatch note, once PGI has been done.
Delivery schedule note is first in the determination procedure so delivery type NL replenishment delivery is assigned to the first output in this procedure
is something amiss here ??
Thanks
Tony

Help required with Photoshop Elements 4.0 this has been installed on my new Toshiba laptop with windows 8.1 for some 18 months and operating well. Now it will not open, message pops up saying "attempt to access invalid address" then "application not respo

Help required with Photoshop Elements 4.0 this has been installed on my new Toshiba laptop with windows 8.1 for some 18 months and operating well. Now it will not open, message pops up saying “attempt to access invalid address” then “application not responding” Suggestions how to access would be much appreciated. Tks. Stuart

What is the size of your hard disk? PSE 4 is a very old program and I suspect it is not able to access the entire hard disk on your machine. Just a thought here.

Disable AD account with access policy

Hi all,
how can I disable AD account with access policy (or create AD account in disabled state)
Regards,
Vladimir

Dewan.Rajiv wrote:
Access Polcies are just for triggering provisioning. You can custom AD connector or write your own to create user in disabled state using JNDI.Hi Dewan,
I have to create a simple demo system, and I need a solution which is not too weird (that means use as little of disparate technologies as possible).
I have two connected systems:
1. HR system, which is a trusted source for user and organizational data.
2. AD system, which is my provision destination.
I want to comply to the following requirements:
1. When a user is created in HR system, a new OIM account shall be created, and a new AD account shall or shall not (depending on HR data) be created in AD in disabled state
2. When a user is marked as dismissed in HR system, the AD account if exists, shall be disabled and moved to some special place in AD tree.
3. Same rules shall apply if the OIM account is created or marked as "Dismissed" manually by OIM administrator.
I use OIM reconciliation to get source data and it is no problem for me to create any reconciliation event I need.
I was considering creating Group->Access Policy->Resource chains, but Access Policy allows only to manage AD attributes, not account enable status.
Or should I add some unmapped pseudo-attribute to AD connector and a task which will enable/disable AD account based on the value of this attribute?
What other options do I have?
Regards,
Vladimir

Help require with installing Adobe Acrobat onto my Macbook Pro Retina.

Help require with installing Adobe Acrobat onto my Macbook Pro Retina.
I have successfully installed all of my creative cloud apps with the exception being acrobat.
I cannot print from Indesign to PDF.
I have unistalled, reinstalled and still no Adobe Acrobat.
I now have to go back to Windows 8 and create the PDF's there.
Any one know how to get around this issue?
Thanks in advance
Kelvin

OSX has effectively killed the ability to print to pdf, (print to pdf eliminates most of the "Rich features" of current pdf).
Export from InDesign, always, excpet for the 1% of the time where you know why print to pdf would produce a better result.

Help required with (soundcard) connection / settings, thanks in advan

Help required with connection / settings between a Creative Sound Blaster Audigy Platinum EX (soundcard) and a Creative DTT3500 Digital (5. speakers).
The problem
No sound from any of the speakers. (Exception can plug in headphones at front)
Background
My computer has been recently upgraded at my local computer shop and all programs re-installed (including driver update from Creative's website). However after reconnecting speakers and restoring the original settings I?m getting no sound from any of the speakers. I?ve followed all the available advice/instructions I can find on this website and manuals to no avail.
Set-up
Physical
(Digital DIN) Speakers/decoder amplifier (DTT3500) connected to the (digital out) soundcard (Audigy Platinum EX) using minijack to DIN cable. (As per instruction manual)
Software
Creative Audio Consul ? setting as per instructions, however have tried variations in vain. (Note: above tabs there is a select device box with SB Audigy [A0000] in it ? only option. Just wondering what [A0000] means?)
Your advice please. A simple step by step guide would be appreciated, many thanks in advance, Jon

"My computer has been recently upgraded at my local computer shop and all programs re-installed (including driver update from Creative's website). "
Do you have the original installation disk?
If so, try installing THOSE drivers, ESPECIALLY if it worked before. Be sure to uninstall what is there now, first.
Its natural for most people to want the 'latest' drivers for their hardware. However:
After experiencing some difficulties with some CL 'updates' for certain products, I now avoid them UNLESS I am having a PROBLEM with the existing drivers.

Role getting revoked with Access Policy

Hi,
I have a Access Policy which will provision to a Resource Object with only one special role. Whenever a user belongs to the group according to a rule called USR_UDF_GLOBALSTATUS == Active, automatically user is getting provisioned to the Resource object with that Role as per the access policy.In this access policy, "Revoke if no longer applies" option is disabled for that Resource Object.
Whenever for that user, USR_UDF_GLOBALSTATUS == Active is changed as USR_UDF_GLOBALSTATUS == InActive from reconciliation, the user is removed from that Group. Till here everything is fine. But the Special Role assigned to that user is also getting revoked. I haven't enabled "Revoke if no longer applies" option. But how come the role is getting revoked?
According to my requirement, that special role should still stay even if the user is removed from the group. Please help...
- Pavan

Enable all logging. Check and see if the user was a member of more groups than just the one. There might be more than one access policy for the user, one that gives the resource with a base set of values for the parent form, and then another access policy that has a lower priority that provides the role. Also look at the Xellerate User object and check for any tasks that might be triggered on this change in value as well as other values. Your best bet is to look at the user and all their groups and resources. Then perform your change, and look on their resource profiles both in targets, and on the xellerate user object, and see what all tasks were inserted.
-Kevin

Help required with inittab mechanism on Solaris 11

Hi
we have an application running on Solaris 11 which uses /etc/inittab entries to spawn and maintain a number of daemon processes. I know that use of /etc/inittab is deprecated in Solaris 11 but at the moment we would prefer not to have to modify our software to use SMF. However saying that we have hit an issue which may force our hand....
We have inittab entries which look like this:
app1:34:respawn: su - appuser -c "exec /APP/myDaemon.sh >> /APP/myDaemon.log 2>&1" > /dev/null 2>&1 0<&1
When init state 3 is entered we see two processes associated with myDaemon:
# uname -a
SunOS host40054 5.11 11.0 sun4v sparc sun4v
# ps -Af |grep myDa
appuser 21383 21380 0 19:26:58 ? 0:00 -ksh -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
root 21380 1 0 19:26:58 ? 0:00 su - appuser -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
If I drop the OS to init state 2 only the parent process is terminated:
# /usr/sbin/init 2
# ps -Af |grep myDa
appuser 21383 21380 0 19:26:58 ? 0:00 -ksh -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
leaving the daemon process still running. Returning to init state 3 we now see:
# /usr/sbin/init 3
# ps -Af |grep myDa
appuser 26997 1 0 19:30:54 ? 0:00 -ksh -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
root 26994 1 0 19:30:54 ? 0:00 su - appuser -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
appuser 21383 1 0 19:26:58 ? 0:00 -ksh -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
So now we've ended up with two daemon processes running (not what we want).
If I compare with Solaris 10 and earlier, the inittab works very well for us. We only ever see the single daemon process running and this is dropped and respawned as required.
# uname -a
SunOS host40041 5.10 Generic_147440-04 sun4u sparc SUNW,Sun-Fire-V210
# ps -Af | grep myD
appuser 2390 27941 0 19:38:21 ? 0:00 -ksh -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
# /usr/sbin/init 2
# ps -Af | grep myD
root 2665 1187 0 19:39:19 pts/1 0:00 grep myD
# /usr/sbin/init 3
# ps -Af | grep myD
appuser 2795 27941 0 19:39:30 ? 0:00 -ksh -c exec /APP/myDaemon.sh >> /APP/myDaemon.log
With Solaris 11 it's as if the su shell process has been made explicit and now the mechnanism, as far as we are concerned, is broken.
Can anyone suggest a way to get back to the Solaris 10 way of working, or some kind of workaround for this issue, before we have to dust off our XML skills and wrestle with SMF.
Many thanks
Dave.

If you use Access Policy for triggering Provision/Revoke then it will Cancel all the tasks and you won't be able to use the same instance. On each Enable you'll see new instance of Seibel RO which would be wrong.
Workaround:
Create two Tasks Enable and Disable and configured it properly like Disable Effect and Enable Effect.
Attach Adapter which is attached with Delete User Task in Disable Task and Map with Disabled
Attach Adapter which is attached with Create User Task in Enable Task and Map with Provisioned

Help required in accessing a file on shared path

Hi,
I am trying to access a file present in a shared location using a custom component. When i run my Java code the file is accessible. But when i deploy the same code on livecycle as a custom component, the code is not able to access the file.
The location of the file is as follows: \\Shiva\Test\tempExcel.xlsx
The path string i use in Java code is: ////Shiva//Test//tempExcel.xlsx
Can someone help me with this issue. Do i have to change the pattern of the file path when i am trying to access the file from adobe livecycle custom component?
In case i need to provide permissions to livecycle for accessing the Excel sheet please suggest on how i should implement the same.

readResource content operation will fetch documents from Adobe Repository. Unless you checkin the required file into repository, the above error will remain.
From a shared folder, you should able to read the files using readDocument (using FileUtils) without any issues. Perhaps, the access rights prevent the execution.
If you are running JBoss as a windows service (turnkey will create a windows service for the JBoss instance), try the following:
Run -> services.msc -> Right click on JBoss service for Adobe LiveCycle -> Properties
Check the value given under logon tab. The User Account mentioned there should have appropriate access to the shared folder you are attempting read.
Nith

Problem with Access policy Provisioning on AD

Hi,
I have created an access policy, which will trigger the provisioning the user to AD when the user is added to group 'abc'.
Its without approval.
We have object form and process form. Process form is autosave.
But, the problem is, as soon as the user is added to the group 'abc'.
It triggers the provisioning flow. But the provisioning will be in ready state only.
When we go and save the resource form only the provisioning flow triggers.
If we make the object as auto save, it will work. But in our case we cannot make the object autosave as it has a resource form to be filled by user in other flow.
Is there any approach to solve the issue?
Regards,
SK

Hi Rajiv,
So, there is no way we can implement this?
My requirement is same as this,
OIM: Question about "Auto Save" option on Resource Object
I have a Resource Object that needs to be provisioned at least two ways:
1) thru an access policy by group membership
2) thru user self-request, who is not already in that group membership
The problem is if I don't check the "Auto Save" check box the automatic assignment thru access policy is not completing and If I do check the check box then user request is not letting the user to enter values into the resource form. Instead it is directly going to submit request. Looks like these are mutually exclusive.
Is there a way to make both work on the same Resource Object?
Thanks
SK

Some help required with logic for a dynamic sql query

i have below code but not sure how to resolve this problem - what i need is to be able to dynamically
the problem:
i have a rabbge of paratmeters coming in from a form and need to be able to create a dynamic query string to go into a prepared statement object.
the problem i have is there are 2 fields year range and year.
if year range is none i need to create the query string as such :
where the value of year can be serached on exactly
str.append("VOLUME_YEAR = ? ");the probelm is if the year range is 5 or year range is 10 i dont know how to maipulate the query string to be able to set the string such that i can then place the year value in the place holder in preparedStatement.setInt(1, year)
how can i create the intial query string ie.- what are the possible things that i can do. - i'm thinking of things like putting some type of between or such type query statement - but not at all sure how the syntax would go - ie. how would i use the year value and how would i create this dynamic part of the query string so that the JDBC regonises it?
thanks for any help.
public String setVolumeYearQuerySt(String year, String yearRange, StringBuffer str){
          String volumeYearQueryString = null;
          Sring doAction= null;
          if (yearRange.equals("None")){str.append("VOLUME_YEAR = ? ");}
          else if(yearRange.equals("5 Years")){doAction = "Nothing";}
          else if (yearRange.equals("10 Years")){doAction = "Nothing";}
          return volumeYearQueryString;
          }

Saish - thanks a lot for the code example.
Although, i think its far too advanced for me to understand and try to manipulate it and fit my problem. I'm pretty new to programming as you can probably see from my simple if else type statements. But i'm going to give it a try and see how it goes.
could you please be kind enough to demonstrate how i could use the above syntax to do the following. --
i have a year being entered in form . in the database there is a column year volume which contains year in single year value format and also in a year range value format - thus as in below - how could i do this -
eg.
user can enter a value in the year field a single value or a range value - then he can select +/-5 or 10 yrs range on that value - the DB holds the values as single values and ranges as below -
one suggested apporach is as follows if a single user is alloweed to enter only a single value in the filed and select a query range +/- 5 etc..
volume year of �1926-1928� and the user enters �1927�, the query has to find all records where
look for records that are �less than or equal to� 1927. It then has to check to see if it contains a range. For those that it finds containing a range, it has to work out what the �upper� year is and check to see if that is �greater than or equal� to 1927. If it is, then that is a possible matchanother approach that is suggested is to have a drop down with all years from databse and user is only llowed to select value from drop down and following logic is suggested :
Because volumes can be received as ranges (e.g. 1964-1966), some extra coding is required where the user asks for a Year Range (such as + or � 5).
Using the Year selected from the dropdown list, split it into 2 values, a low year and a high year. For example, if �1965-1968� is selected from the year dropdown, split it into �1965� and �1968� for the low year and high year respectively. If �1964� is selected from the year dropdown, split it into �1964� and �1964�. Now take the Year Range that the user has entered into account. For example, if the user has entered 5, subtract 5 from the low year and add 5 to the high year. Using these values, include the following search criteria in the query to the database:-
(<low year>     BETWEEN
             left (VOLUME_YEAR, charindex ('-',VOLUME_YEAR + '-') - 1)
     AND     right (VOLUME_YEAR, charindex ('-',VOLUME_YEAR + '-') - 1))
OR     (<high year>     BETWEEN
             left (VOLUME_YEAR, charindex ('-',VOLUME_YEAR + '-') - 1)
     AND     right (VOLUME_YEAR, charindex ('-',VOLUME_YEAR + '-') - 1))regards - i think if i could solve the first approach that would be something good as its most user freindly
thanks

Problem with Access Policy

Hi All!
OIM 11g:
1. I have installed DBUM 9.1.0.4
2. I have configured IT Resurce, and RO for granting user MS SQL User and database role (for example in HRData db)
3. I have created Role named: "HRData DB User" and Access Policy named: "HR Data DB User" wchich grants correct RO.
4. When role is granted by xelsysadm for specific oim user everything is OK.
Problem:
when user request for role: "HRData DB User" from Self-Service portal, and request is approved by xelsysadm, role is granted but RO is not granted. I have following error:
+<Nov 19, 2010 1:12:46 PM CET> <Error> <XELLERATE.SERVER> <BEA-000000> <Class/Method+
+: tcDataObj/eventPreInsert Error :Insert permission is denied>+
+<Nov 19, 2010 1:12:46 PM CET> <Error> <oracle.iam.accesspolicy.impl.handlers.provis+
ioning> <IAM-4030308> <An error occurred in oracle.iam.accesspolicy.impl.handlers.p
rovisioning.ProvisionAccountActionHandler while provisioning resource 161 to user 4
+3 and the cause of error is DOBJ.INSERT_PERMISSION_DENIED: H: You do not have permi+
ssion to insert this object..>
+<Nov 19, 2010 1:12:46 PM CET> <Warning> <oracle.iam.callbacks.common> <IAM-2030081>+
+<[CALLBACKMSG] Inside completion plugin for request 68.>+
+<Nov 19, 2010 1:12:46 PM CET> <Warning> <oracle.iam.callbacks.common> <IAM-2030082>+
+<[CALLBACKMSG] Inside completion plugin for request 68, target tye is Role and ope+
ration is SELFASSIGNROLES.>
+<Nov 19, 2010 1:12:46 PM CET> <Warning> <oracle.iam.callbacks.common> <IAM-2030082>+
+<[CALLBACKMSG] Inside completion plugin for request 68, target tye is RoleUser and+
operation is CREATE.>
Any suggestions?
best
mp

Hi Rajiv,
So, there is no way we can implement this?
My requirement is same as this,
OIM: Question about "Auto Save" option on Resource Object
I have a Resource Object that needs to be provisioned at least two ways:
1) thru an access policy by group membership
2) thru user self-request, who is not already in that group membership
The problem is if I don't check the "Auto Save" check box the automatic assignment thru access policy is not completing and If I do check the check box then user request is not letting the user to enter values into the resource form. Instead it is directly going to submit request. Looks like these are mutually exclusive.
Is there a way to make both work on the same Resource Object?
Thanks
SK

Help me with accessing system and non-J2ME applications

As I've read in a book:
"Record stores are a private mechanism that allows MIDlets to retain data on a device. A consequence of the design of record stores is that it is not possible for a MIDlet to access data belonging to other MIDlet suites or, perhaps more significantly, data belonging to other non-Java applications on the same device. This latter restriction is quite significant, because it means that you cannot access things like a user's address book or appointment diary from a MIDlet. Similarly, non-Java applications cannot access data stored by MIDlets. Whether these restrictions will be addressed in a future version of the MIDP specification remains to be seen."
I think MIDP 2.0 has removed some of those restrictions.
I am still very novice to the J2ME world.
Here's my question: how can I handle any system or non-java application (text, image, or sound) to process them in my MIDlet. I need to read text or image. Is this possible?
Also is there some technique for browsing in mobile phones to search for some file that I need to access? (similar to that of Windows operating system)
I've been told that JSR 75 may provide me with those features, or FileConnection API. Is this true? If so, please help me with detailed information about the two of them, like how to use them, how to download them..etc. You can recommend me any links for reading.
Thank you.

As I've read in a book:
"Record stores are a private mechanism that allows MIDlets to retain data on a device. A consequence of the design of record stores is that it is not possible for a MIDlet to access data belonging to other MIDlet suites or, perhaps more significantly, data belonging to other non-Java applications on the same device. This latter restriction is quite significant, because it means that you cannot access things like a user's address book or appointment diary from a MIDlet. Similarly, non-Java applications cannot access data stored by MIDlets. Whether these restrictions will be addressed in a future version of the MIDP specification remains to be seen."
I think MIDP 2.0 has removed some of those restrictions.
I am still very novice to the J2ME world.
Here's my question: how can I handle any system or non-java application (text, image, or sound) to process them in my MIDlet. I need to read text or image. Is this possible?
Also is there some technique for browsing in mobile phones to search for some file that I need to access? (similar to that of Windows operating system)
I've been told that JSR 75 may provide me with those features, or FileConnection API. Is this true? If so, please help me with detailed information about the two of them, like how to use them, how to download them..etc. You can recommend me any links for reading.
Thank you.

Provisioing with Access Policy

Hi All
I have made one Access policy for Full-Time employees.
I want that if admin creates a user who is Full-Time employee, it shouls automatically get provisioined with AD.
I have made that Access Policy. But If Admin craetes one user who is Full-Time Employee then provisioing status goes into *"READY"* State.
It stucks in Resource form.
And in my resource form only one lookup field is there. And i have put Value already in that lookup.
Could any one please tell me the solution for this.
Thanks a lot!

Hi
I made access policy Without Approval.
That extra field i.e. AD SERVER, I have already filled with ADITResource.
Actually i have made one resource form, i'm giving value of AD Server from there & it is prepopulation in process form.
But When user gp for provisioning then it stuck in Resource Form not in Process form. It shows status Ready.
Is it possible to remove that Resource form from access policy, I think it may remove my problem ?
But i don know how to remove resource form from Access Policy region.
Please suggest.
Thanks for these replies.

Help Required With Access Policy Trigger On Enable User In Oim 11gR2

Similar Messages

Maybe you are looking for