LDAP Reconciliation

I've seen in a couple of posts that limiting the resource schema improves reconciliation performance. Now I'm assuming this is because the attributes that are brought back during a the list users process is limited to the attributes defined in the schema.
However I restricted my LDAP resource schema to four attributes that were needed for correlation, but a level 4 trace on the com.waveset.adapter.LDAPResourceAdapterBase class during the recon process shows that it's still retrieving all the attributes for all the users...In my trace i see multiple occurances of the getAttributes method returning all the attributes for a given user from LDAP. Has anyone else noticed this?

Similar Messages

Error during LDAP reconciliation (initial load)

Hi,
We are using IDM 7.1. We are trying to do initial load of accounts to Identity Manager using reconciliation with LDAP (Sun Directory Server 5.2). Reconciliation is consistently failing with the following error:
Error iterating accounts for resource CalNetDirectory:
javax.naming.OperationNotSupportedException: [LDAP: error code 12 - Sort Response Control]
Any inputs would be highly appreciated.
Thanks,
kIDMan.

Hello Rupam,
Abort the load of that object in txn:R3AM1.
Also, delete the queue entries like R3AI_<OBJECT_NAME> in txn:SMQ2.
This would let you to restrart the load again.
If again it goes to WAIT state , then it means that you do not have enough number of work processes to handle this load.
It happens if several other load are running.So you have to wait till other loads get finished or you need to increase the work process, if your hardware supports.
Hope this helps!
Best Regards,
Shanthala Kudva.

AD/LDAP reconciliation using paging

A couple of weeks ago my AD admins suddenly decided to change the maximum query size from 30 000 to 1 000 without telling me in advance I had to quickly upgrade my extraction scripts to support paging.
In case someone else has a need to do the same I thought I should publish the code:
http://iamreflections.blogspot.com/2010/10/adldap-reconciliation-using-paging.html
Hope this helps someone
/Martin

Hi,
Below is the configuration for UME-LDAP. In configtool you have to do this configuration.
ume.ldap.access.server_name : <servername>
ume.ldap.access.server_port         : <enter the port>
ume.ldap.access.user                    : <user>
ume.ldap.access.password           : <password>
ume.ldap.access.base_path.user :
Ume.ldap.access.base_path.grup :
Refer the link for more info on LDAP configuration.
http://help.sap.com/saphelp_nw70/helpdata/en/63/14f5b51a6eff429f2d8b2063400e82/frameset.htm
Thanks
R.Murali

Ldap reconciliation fail.

Hi gurus,
I need to do a full reconciliation on Ldap resource in order recreate some accounts that have been deleted on the resource.
IdM users are more than 10000 and the reconciliation process fails with the following error: "Error iterating accounts for resource RES-LDAP: com.waveset.util.WavesetException: There was a problem enumerating accounts javax.naming.SizeLimitExceededException: [LDAP: error code 4 - Sizelimit Exceeded]".
Looking into Ldap access log I see:
SRCH base="dc=univr,dc=it" scope=2 filter="(&(objectClass=inetorgperson))" attrs="uid" - RESULT err=4 tag=101 nentries=2000 etime=2 notes=U
It seems to me that IdM is asking for no more than 2000 entries and it wrongly interprets the Ldap return code (4).
How could I workaround this limit?
THIA

Have a look at this. It will help you
http://www.ldapadministrator.com/forum/viewtopic.php?t=14
Rgds,
Suren

OIM - Reconciliation jobs fail with Error: OPERATIONS_ERROR

Hi,
after integrating OIM with OAM for Fusion Apps provisioning (11.1.3), LDAP Reconciliation jobs fail with error OPERATIONS_ERROR.
Connection to LDAP looks OK, new users created in OIM are synchronized to LDAP, just Reconciliation jobs fail:
<May 1, 2012 10:00:50 AM CEST> <Error> <oracle.iam.platform.entitymgr.provider.ldap> <IAM-0042016> <An error occurred while getting the change log from LDAP - {0}
javax.naming.NamingException: Error: OPERATIONS_ERROR
Virtualization Session closed [Root exception is oracle.ods.virtualization.service.VirtualizationException: Virtualization Session closed]
at oracle.ods.virtualization.jndi.OVDUtil.mapErrorCode(OVDUtil.java:200)
at oracle.ods.virtualization.jndi.OVDContext.search(OVDContext.java:439)
at oracle.ods.virtualization.jndi.OVDContext.search(OVDContext.java:329)
at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:248)
at oracle.iam.platform.entitymgr.provider.ldap.LDAPUtil.search(LDAPUtil.java:1049)
at oracle.iam.platform.entitymgr.provider.ldap.LDAPDataProvider.getChangelogResults(LDAPDataProvider.java:1531)
at oracle.iam.platform.entitymgr.provider.ldap.LDAPDataProvider.deltaDetect(LDAPDataProvider.java:1488)
at oracle.iam.ldapsync.scheduletasks.user.LDAPUserChangesReconTask.execute(LDAPUserChangesReconTask.java:152)
at oracle.iam.scheduler.vo.TaskSupport.executeJob(TaskSupport.java:145)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at oracle.iam.scheduler.impl.quartz.QuartzJob.execute(QuartzJob.java:196)
at org.quartz.core.JobRunShell.run(JobRunShell.java:202)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
Caused By: oracle.ods.virtualization.service.VirtualizationException: Virtualization Session closed
at oracle.ods.virtualization.service.DefaultVirtualizationSession.checkActiveAndIncrementOp(DefaultVirtualizationSession.java:425)
at oracle.ods.virtualization.service.DefaultVirtualizationSession.search(DefaultVirtualizationSession.java:183)
at oracle.ods.virtualization.jndi.OVDContext.search(OVDContext.java:429)
at oracle.ods.virtualization.jndi.OVDContext.search(OVDContext.java:329)
at javax.naming.directory.InitialDirContext.search(InitialDirContext.java:248)
at oracle.iam.platform.entitymgr.provider.ldap.LDAPDataProvider.deltaDetect(LDAPDataProvider.java:1488)
at oracle.iam.ldapsync.scheduletasks.user.LDAPUserChangesReconTask.execute(LDAPUserChangesReconTask.java:152)
at oracle.iam.scheduler.vo.TaskSupport.executeJob(TaskSupport.java:146)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at oracle.iam.scheduler.impl.quartz.QuartzJob.execute(QuartzJob.java:198)
at org.quartz.core.JobRunShell.run(JobRunShell.java:203)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:529)
===
Reconciliation worked before integrating OIM with OAM.
Any ideas what could be wrong - or how to investigate this issue?
Thanks
Daniel

OVD changelog adapter was OK, but OVD URL was missing in the IT resource.
Reconciliation works now.
Thanks for pointing me to correct direction.
Daniel

LDAP Sync Question

I have configured OUD as LDAP Sync with OIM 11gR2. I am able to push users from OIM to OUD. But we have some users exists in OUD before LDAP Sync is configured. As LDAP Sync is bidirectional, we need to pull all those users from OUD to OIM.
But I don't see scheduler tasks which can pull data from OUD to OIM. I would like to know if there is any scheduler task available to pull users from OUD to OIM.
Can anyone throw some pointers?

See Step 6 here: http://docs.oracle.com/cd/E27559_01/integration.1112/e27123/oid_oim.htm#CHDGEGHJ
For reconciliation jobs, seed the LDAP Reconciliation jobs or Load LDAP Recon jobs into Quartz tables, which are part of Oracle Identity Manager schema. To do so:
Seed the LDAP Recon jobs by using the patch_weblogic.sh MDS utility available in OIM_HOME/bin/.
Note:
In a text editor, open the $OIM_ORACLE_HOME/server/bin/weblogic.profile file, and enter values for the properties before executing the patch_weblogic.sh script.
Set ANT_HOME and JAVA_HOME accordingly.
Create a backup of a $OIM_ORACLE_HOME/server/setup/deploy-files/setup.xml.
In a text editor, open the $OIM_ORACLE_HOME/server/setup/deploy-files/setup.xml file.
If the target for seeding Recon jobs is commented by default, then uncomment the following and have only that target in that file to seed the reconciliation jobs:
<target name="patch" description="This contains the list of targets to be invoked post-patching">
<antcall target="explode-archived-apps"/>
<antcall target="seed-ootb-jobs"/>
 == Uncomment this line.
<antcall target="update-oes-ootb-policies"/>
<antcall target="seed-ootb-templates"/>
<antcall target="unzip-db-deliverables-archive"/>

</target>
The required target to seed the Recon jobs is seed-ldap-recon-jobs.
Run the patch_weblogic.sh script.
-Kevin

[OIM 11g R1] OID 11.1.1.5.0 Connector with OpenLDAP: Errors in logs

I am using the Oracle Internet Directory 11.1.1.5.0 connector with OpenLDAP as my target system.
Every time I run the "LDAP Connector User search Reconciliation", I see the following error for each user.
<Feb 21, 2013 3:54:57 PM EST> <Error> <ORACLE.IAM.CONNECTORS.ICFCOMMON.RECON.SEARCHRECONTASK> <BEA-000000> <oracle.iam.connectors.icfcommon.recon.SearchReconTask : handle : Recon event skipped>
The reconciliation events do get generated in OIM and the reconciliation engine does link the account when a user match is found.
I am wondering what is causing that error to be thrown and whether if performance of the LDAP reconciliation is affected by this error.

Any updates i am facing same problem.
thanks in advance

OIM OID RENCONCILIATION

i am able to provision users from oim to oid
but reconciliation is not working
command prompt is not showing any error when reconciliation tasks are running
following are the details
OID Lookup Reconciliation Task
LookupCodeName     Lookup.OID.Organization
ITResourceName     OID IT Resource
SearchContext     cn=Users,dc=ad,dc=infosys,dc=com
ObjectClass     OrganizationalUnit
CodeKeyLTrimStr     [NONE]
CodeKeyRTrimStr     ,dc=ad,dc=infosys,dc=com
ReconMode     UPDATE
AttrType     ou
OID User Recon Task
IsNativeQuery     no
ITResourceName     OID IT Resource
ResourceObjectName     OID User
XLDeleteUsersAllowed     false
UserContainer     cn=Users,dc=ad,dc=infosys,dc=com
Keystore     [NONE]
Organization     Xellerate Users
Xellerate Type     End-User Administrator
Role     Consultant
TrustedSource     true
PageSize     100
command prompt shows : (both the above task are set to run at recurring intervals of 5 minutes)
15:14:08,027 INFO [OID] tcTskOIDUserReconciliation LDAP RECONCILIATION CLASS In
stance Created
15:14:08,074 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:t
cUtilLDAPOperations(): Login Variables are:: are sServerName = 10.76.118.72, sPo
rtNo = 389, sPrincipalDN = cn=orcladmin,cn=Users,dc=ad,dc=infosys,dc=com, sProvi
derURL = ldap://10.76.118.72:389,
15:14:08,074 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:c
onnectToLDAP(s): are pContainerContext = ,
15:14:08,074 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:c
onnectToLDAP(s) provider URL before encoding: are sProviderURL = [ldap://10.76.1
18.72:389/],
15:14:08,074 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:c
onnectToLDAP(s) provider URL After encoding: are sProviderURL = [ldap://10.76.11
8.72:389],
15:14:08,090 INFO [OID] tcUtilLDAPOperationsParameter Variables passed are: pSe
archBase = [cn=Users,dc=ad,dc=infosys,dc=com], pFilterExpression = [(&(&(&(&(&(&
(objectclass=top)(objectclass=person))(objectclass=organizationalPerson))(object
class=inetOrgPerson))(objectclass=orclUser))(objectclass=orclUserV2))(modifyTime
stamp>=20100113094308Z))], pIsRelative = [true], pAttrNames = [[Ljava.lang.Strin
g;@fc0359]
15:14:08,105 INFO [OID] >>Next Page
Edited by: user12240044 on Jan 13, 2010 1:45 AM

u mean to say i need to run only the user recon task and not the lookup task in case i want to reconcile oid users to xellerate users org in oim
i provided the details stated by you:
refer below:
IsNativeQuery     no
ITResourceName     OID IT Resource
ResourceObjectName     OID User
XLDeleteUsersAllowed     false
UserContainer     cn=Users,dc=ad,dc=infosys,dc=com
Keystore     [NONE]
Organization     Xellerate Users
Xellerate Type     End-User Administrator
Role     Consultant
TrustedSource     true
PageSize     100
but still the users are not reconciled
the command prompt shows the following :
16:52:00,047 INFO [OID] tcTskOIDUserReconciliation LDAP RECONCILIATION CLASS In
stance Created
16:52:00,109 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:t
cUtilLDAPOperations(): Login Variables are:: are sServerName = 10.76.118.72, sPo
rtNo = 389, sPrincipalDN = cn=orcladmin,cn=Users,dc=ad,dc=infosys,dc=com, sProvi
derURL = ldap://10.76.118.72:389,
16:52:00,109 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:c
onnectToLDAP(s): are pContainerContext = ,
16:52:00,109 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:c
onnectToLDAP(s) provider URL before encoding: are sProviderURL = [ldap://10.76.1
18.72:389/],
16:52:00,109 INFO [OID] Parameter Variables passed into tcUtilLDAPOperations:c
onnectToLDAP(s) provider URL After encoding: are sProviderURL = [ldap://10.76.11
8.72:389],
16:52:00,140 INFO [OID] tcUtilLDAPOperationsParameter Variables passed are: pSe
archBase = [cn=Users,dc=ad,dc=infosys,dc=com], pFilterExpression = [(&(&(&(&(&(&
(objectclass=top)(objectclass=person))(objectclass=organizationalPerson))(object
class=inetOrgPerson))(objectclass=orclUser))(objectclass=orclUserV2))(modifyTime
stamp>=20100113111800Z))], pIsRelative = [true], pAttrNames = [[Ljava.lang.Strin
g;@9cba32]
16:52:00,140 INFO [OID] >>Next Page
what does pContainercontext implies?

OIM's Trusted Source

I have OIM11g and OID11g, and setup OID as the ldap during configuring OIM. OIM pulls the new or changes of the identities via the LDAP Reconciliation jobs from OID.
There is also the LDAP provision to OID from OIM running auto out of the box.
Can we say the OID is the OIM's trusted source?

Rajiv Dewan wrote:
There is also the LDAP provision to OID from OIM running auto out of the boxGo to Adminitration Console > Search User > Select User > Click that user > Go to Resources Tab
What do you see here ?
If you see LDAP/OID resource there then it means that resource is configured as Target Resource.
Also, which task do you run to bring changes fromOID/LDAP to OIM. Is it trusted reconciliation o target reconciliation task ?
Guide also tells about configuring OID/LDAP as trusted resurce. Do you see those configuration in your system ?selected a user's Resources Tab, it shows the provisioned the resource of the target Application.
And as I stated in the beginning "OIM pulls the new or changes of the identities via the LDAP Reconciliation jobs from OID.".
The Reconciliation Jobs are out of the box jobs.
So can we say the OID is OIM's trusted source?

Transformation during LDAP Sync reconciliation in OIM 11g

Does anyone know if the use of transformations is supported in LDAP Sync reconciliation in OIM 11g?
The reconciliation of LDAP User records is defined in /db/LDAPUser in the OIM metadata. The default version of this file has entries to specify OneToOne transformations, e.g.
<Transformation name="OneToOne">
<Parameter name="givenname" fieldname="givenname"/>
</Transformation>
For one of my attributes I wish to perform a custom transformation, and have implemented a transformation method as a GC provider (i.e. developed a Java class implementing the TransformationProvider interface and defined this Transformation in an xml file in the metadata path /db/GTC/ProviderDefinitions. I have uploaded a new version of LDAPUser that references my custom transformation provider for one of the LDAP attributes.
When I try and perform an LDAP Sync user reconciliation, my custom class does not seem to be getting called when I generate a reconciliation event for the affected attribute. I also do not see any logs indicating a failure to load my provider. I have also turned up all the relevant log levels I can identify, and can see no record of OIM doing anything related to transformationat all (e.g. even calling the standard OneToOne transformation provider).
I am suspicious that although LDAPUser has transformation entries, this may be misleading and transformation is not being performed at all for LDAP Sync.
Does anyone else have experience of using transformation providers during LDAP Sync reconciliation?

Thanks for your reply Nishith
I need some suggestion from you.I have installed OID 11.1.1.6.0 and OIAM 11G R2(not configured ).
while performing the OIM configuration can I use Enable Ldap sync or I need to finish the OIM configuration first and then do the ldap sync.
Regards
sri

How to force reconciliation of an LDAP resource to a fixed IdM org

I have 3 IdM organizations: Top Top:Mailboxes and Top:Engineers.
When the LDAP resource was created it is available to Top and Top:Engineers.
Top:Mailboxes is a list of all the mailboxes in use at the company, Top:Engineers is just the IT dept.
When I run a full reconciliation of the LDAP resource as Configurator, I get a huge number of disputes.. It seems that IdM is matching and linking all resource accounts against ALL Idm users, even those in IdM organizations that are not supposed to have access to the resource.
Ok, if that is how recon works, thats it.. but is there a way I can force the reconciliation of a resource with specific IdM organizations?

Can you show detail in xml of 'RuleLibrary:GetUserOrganization'
like this...
<invoke name='getOrganizationsDisplayNames' class='com.waveset.ui.FormUtil'>
<ref>:display.session</ref>
</invoke>
Its still error...
Failed to create a new user based on resource account uid=jsmith,ou=People,ou=Engineering,dc=abb,dc=com@LDAP: java.lang.ClassCastException at com.waveset.view.UserViewConverter.refreshAssignmentView(UserViewConverter.java:1035) at com.waveset.view.UserViewConverter.refresh(UserViewConverter.java:2873) at com.waveset.view.UserViewer.cycleView(UserViewer.java:2497) at com.waveset.recon.Response.processUserForm(Response.java:1050) at com.waveset.recon.Response.createNewUserFromAccount(Response.java:895) at com.waveset.recon.Response.performResponse(Response.java:128) at com.waveset.recon.ReconTask$WorkerThread.performResponse(ReconTask.java:2027) at com.waveset.recon.ReconTask$WorkerThread.respondOrRequeue(ReconTask.java:2180) at com.waveset.recon.ReconTask$WorkerThread.applyOrDeferResponse(ReconTask.java:1670) at com.waveset.recon.ReconTask$WorkerThread.reconcileAccount(ReconTask.java:1900) at com.waveset.recon.ReconTask$WorkerThread.run(ReconTask.java:2948) .

Custom code for Flat file reconciliation on LDAP

Hello,
I have to write a custom code for flat file reconciliation on LDAP as the GTC connector wasn't working entirely.
Could someone help me out with this.. How do i do this ??
Thanks

flat file reconciliation on LDAPWhat do you mean by Flat File on LDAP ?
If you want to create Flat File connector then search google for reading a flat file using Java.
Define RO Fields and do mapping in Process Defintion. You can use Xellerate User RO for Trusted Recon.
Make a map of CSV that and Recon Field
Call the Reconciliation API

Trying to use Dual Mode reconciliation against an Irregular LDAP directory

I am currently developing an OIM deployment. Our main goal at the moment is to get dualmode reconciliation working against LDAP and to sync passwords between the two. The interesting thing here is that we have divided up our LDAP directory by region. so our DN is "dc=company,dc=com", but our user containers are in "ou=people,l=America,dc=company,dc=com" for US and "ou=people,l=Asia,dc=company,dc=com" for Asia (for example)
does anyone have experience doing anything like this? It seems that the scheduled task has to have the full path of the container to get the users, but do I need a different IT resource for each one? Does it have to be treated like a separate instance of the LDAP directory for each location? So far I have had consistant results when doing the trusted recon, but the target recon seems to recon some users, but not others? Just looking for a little jolt in the right direction. or a big jolt. :)
Rob

We are using the LDAP connector version 9.0.4.2.
The problem is, the users are in a people container sitting under a location container. If I use the root dn in the IT resource, the task doesn't pick up any users. If I use the l=location,dc=company,dc=com, it seems to work for the one people container only, but I wonder if I need to treat each branch as a seperate instance of LDAP to get this to work correctly?

LDAPSYNC Reconn Job: LDAP User Create and Update Reconciliation

OIM 11.1.1.5.4 (BP4) libOVD, trusted data source oid 11.1.1.5.0
I have the reconn job working " LDAP User Create and Update FULL Reconciliation"
But the incremental job not working "LDAP User Create and Update Reconciliation"
No errors found in the oim server logs
the msg found with the indication of the execution of the job.
Has anyone been successful with the job "LDAP User Create and Update Reconciliation"
[2012-10-21T08:09:03.922-04:00] [oim_server1] [NOTIFICATION] [IAM-1020005] [oracle.iam.scheduler.impl.quartz] [tid: OIMQuartzScheduler_Worker-2] [userId: oiminternal] [ecid: 0000Je3Cacy3n3WjLxuHOA1GWyFa000002,0] [APP: oim#11.1.1.3.0] Job Listener, Job was executed QuartzJobListener.jobWasExecuted Description null FullName DEFAULT.LDAP User Create and Update Reconciliation Name LDAP User Create and Update Reconciliation
TIA
gadba

has any one had that worked, for the incremental job of ldapsync recon ?

OVD/OID group reconciliation in OIM 11g with LDAP sync

Hi All!
Is it possible to reconcile OID groups to OIM using LDAP sync? How to achieve such configuration?
I have OIM with LDAP sync and user and roles provisining to OVD is working.
best
mp

Hi,
I want to Integrate OIM and OID. Can you guide me in doing so?. The platform I will use is Windows 2003 Server, OIM version is 9.1. Also please tell me which version of OID i should use.
Note: I am new to OID and OIM.
Thanks in advance.
Regards,
Kazmi

LDAP Reconciliation

Similar Messages

Maybe you are looking for