Mapping users from resources to user in IDM

Hi
I have a user say tom123 in Windows NT and the same user also exists in LDAP with accountid tom1. How do i load them into IDM as a single user with different resources?
Any ideas are appreciated

VIXik,
Lets say the primary source of data is a FlatFile from an HR system. Data from this would enter IdM via the FF active Sync mechanism.
The other resources such as AD and LDAP and Mail exist but are untrustworthy they contain many out-of-date entries for example which we want to identify and remove!
The situation is that we want to name the IDM account by the HR systems key and then reconcile the correct LDAP/AD resource accounts to these. We dont want the initial IDM account creation to make resource accounts.
Is is best to load the IDM entries from File (same file as used in FF activesync) with a Form that doesnt create/link resources and then reconcile accounts and then start the FF active sync process...
OR...
remove the resources from the FFactive sync form for initial FF active sync cycle.. create IDM accounts... reconcile resource accounts... edit FFactivesync form to readd resource account creation.. and restart FF active sync.
Which is better? Any pros and cons for either.

Similar Messages

Could not parse mapping document from resource

HI All,
I'm using hibernate3.2.2 I wrote the following code to contact the database but the system tells the error on it. My code is
Dealer.java:
package com.mapping;
public class Dealer {
     private int id;
     private String name;
     private int did;
     public int getDid() {
          return did;
     public void setDid(int did) {
          this.did = did;
     public int getId() {
          return id;
     public void setId(int id) {
          this.id = id;
     public String getName() {
          return name;
     public void setName(String name) {
          this.name = name;
Product.java
------------------package com.mapping;
public class Product {
     private int id;
     private int did;
     private String name;
     private double price;
     public int getDid() {
          return did;
     public void setDid(int did) {
          this.did = did;
     public int getId() {
          return id;
     public void setId(int id) {
          this.id = id;
     public String getName() {
          return name;
     public void setName(String name) {
          this.name = name;
     public double getPrice() {
          return price;
     public void setPrice(double price) {
          this.price = price;
JoinExample.java
package com.mapping;
import java.util.Iterator;
import org.hibernate.Query;
import org.hibernate.Session;
import org.hibernate.SessionFactory;
import org.hibernate.cfg.Configuration;
import com.HibernateSessionFactory;
public class JoinExample {
     public static void main(String args[]){
          Session session=null;
          try{
               session = HibernateSessionFactory.getInstance().getCurrentSession();
               session.beginTransaction();
               String sql_query = "from Product p inner join p.dealer as d";
                    Query query = session.createQuery(sql_query);
                    Iterator ite = query.list().iterator();
                    System.out.println("Dealer Name\t"+"Product Name\t"+"Price");
                    while ( ite.hasNext() ) {
                    Object[] pair = (Object[]) ite.next();
                    Product pro = (Product) pair[0];
                    Dealer dea = (Dealer) pair[1];
                    System.out.print(pro.getName());
                    System.out.print("\t"+dea.getName());
                    System.out.print("\t\t"+pro.getPrice());
                    System.out.println();
                    session.close();
          }catch(Exception e){
               e.printStackTrace();
Dealer.xml
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE hibernate-mapping PUBLIC "-//Hibernate/Hibernate Mapping DTD//EN"
"http://hibernate.sourceforge.net/
hibernate-mapping-3.0.dtd">
<hibernate-mapping>
<class name="com.mapping.Dealer" table="dealer">
<id name="id" type="java.lang.Integer" column="id">
<generator class="increment"/>
</id>
<property name="name" type="java.lang.String" column="name"/>
<property name="did" type="java.lang.Integer" column="did"/>
<bag name="product" inverse="true" cascade="all,delete-orphan">
          <key column="did"/>
<one-to-many class="com.mapping.Product"/>
</bag>
</class>
</hibernate-mapping>
Product.xml
<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE hibernate-mapping
PUBLIC "-//Hibernate/Hibernate Mapping DTD//EN"
"http://hibernate.sourceforge.net/
hibernate-mapping-3.0.dtd">
<hibernate-mapping>
<class name="com.mapping.Product" table="product">
<id name="id" type="java.lang.Integer" column="id">
<generator class="increment"/>
</id>
<property name="name" type="java.lang.String" column="name"/>
<property name="did" type="java.lang.Integer" column="did"/>
<property name="price" type="java.lang.Double" column="price"/>
<many-to-one name="dealer" class="com.mapping.Dealer" column="did" insert="false" update="false"/>
</class>
</hibernate-mapping>
hibernate.cfg.xml
<?xml version='1.0' encoding='utf-8'?>
<!DOCTYPE hibernate-configuration PUBLIC
"-//Hibernate/Hibernate Configuration DTD//EN"
"http://hibernate.sourceforge.net/hibernate-configuration-3.0.dtd">
<hibernate-configuration>
<session-factory>
<property name="hibernate.connection.driver_class">com.mysql.jdbc.Driver</property>
<property name="hibernate.connection.url">jdbc:mysql://localhost/hibernate</property>
<property name="hibernate.connection.username">root</property>
<property name="hibernate.connection.password"></property>
<property name="hibernate.connection.pool_size">10</property>
<property name="show_sql">true</property>
<property name="dialect">org.hibernate.dialect.MySQLDialect</property>
<property name="hibernate.hbm2ddl.auto">update</property>

<mapping resource="com/mapping/Dealer.hbm.xml"/>
<mapping resource="com/mapping/Product.hbm.xml"/>
</session-factory>
</hibernate-configuration>
it throws the following example:
log4j:WARN No appenders could be found for logger (org.hibernate.cfg.Environment).
log4j:WARN Please initialize the log4j system properly.
%%%% Error Creating HibernateSessionFactory %%%%
org.hibernate.InvalidMappingException: Could not parse mapping document from resource com/mapping/Dealer.hbm.xml
     at org.hibernate.cfg.Configuration.addResource(Configuration.java:575)
     at org.hibernate.cfg.Configuration.parseMappingElement(Configuration.java:1593)
     at org.hibernate.cfg.Configuration.parseSessionFactory(Configuration.java:1561)
     at org.hibernate.cfg.Configuration.doConfigure(Configuration.java:1540)
     at org.hibernate.cfg.Configuration.doConfigure(Configuration.java:1514)
     at org.hibernate.cfg.Configuration.configure(Configuration.java:1434)
     at com.HibernateSessionFactory.initSessionFactory(HibernateSessionFactory.java:39)
     at com.HibernateSessionFactory.getInstance(HibernateSessionFactory.java:23)
     at com.mapping.JoinExample.main(JoinExample.java:19)
Caused by: org.hibernate.InvalidMappingException: Could not parse mapping document from input stream
     at org.hibernate.cfg.Configuration.addInputStream(Configuration.java:514)
     at org.hibernate.cfg.Configuration.addResource(Configuration.java:572)
     ... 8 more
Caused by: org.dom4j.DocumentException: hibernate.sourceforge.net Nested exception: hibernate.sourceforge.net
     at org.dom4j.io.SAXReader.read(SAXReader.java:484)
     at org.hibernate.cfg.Configuration.addInputStream(Configuration.java:505)
     ... 9 more
org.hibernate.HibernateException: Could not initialize the Hibernate configuration
     at com.HibernateSessionFactory.initSessionFactory(HibernateSessionFactory.java:56)
     at com.HibernateSessionFactory.getInstance(HibernateSessionFactory.java:23)
     at com.mapping.JoinExample.main(JoinExample.java:19)
regards,
Maheshwaran Devaraj

I also faced same problem when i wrote my first hibernate mapping file, this error will accur because of bad xml parser design, the parser developer did not even validate and remove blank lines from xml before parsing it, becuse of that if there is first blank line in your xml mapping file then we will get "The processing instruction target matching "[xX][mM][lL]" is not allowed" error.
Solution: Just check is there any blank line at the begining of your hibernate mapping file if so remove that then it will works fine.

Could not parse mapping document form resource

What is meaning of this error
Could not parse mapping document from resource user.hbm.xml
log4j:WARN No appenders could be found for logger (org.hibernate.cfg.Environment).
log4j:WARN Please initialize the log4j system properly.
Exception in thread "main" java.lang.NullPointerException
at UserClient.main(UserClient.java:39)

I also faced same problem when i wrote my first hibernate mapping file, this error will accur because of bad xml parser design, the parser developer did not even validate and remove blank lines from xml before parsing it, becuse of that if there is first blank line in your xml mapping file then we will get "The processing instruction target matching "[xX][mM][lL]" is not allowed" error.
Solution: Just check is there any blank line at the begining of your hibernate mapping file if so remove that then it will works fine.

Load from Resource in IDM 5.0 SP5

I have installed IDM 5.0, SP 5, with Sun Java System Application Server 8. I have 2 resources, one LDAP (Sun Directory Server 5.2, SP 3) and one Active Directory.
I have just completed a 'Load from Resource', and loaded user information from the LDAP resource, which created 43 thousand or so user objects in IDM. I have 2 questions:
1. The load took a loooong time - 1 day, 4 hours. Is this normal? I am currently loading information for approximately 19 thousand accounts from the AD resource, which looks like it will take a similar amount of time per account (still running at the moment).
2. Now, when I select the 'Accounts' tab in the admin console when logged in as configurator, the list of accounts never appears. The browser session (mozilla) will die after about 2 minutes. The only way I can view user account information is to select the stop button in the browser immediately after selecting the 'Accounts' tab, and then select the 'Find Users' button on the left hand pane.

The load of the AD accounts (21,000) has now finished. This took 23 hours!!
I have analyzed, to some extent, the load process, from the LDAP perspective, and what appears to be happening is:
1. IDM queries LDAP for the number of account entries defined by the block count (1000 in my case) in the IDM resource definition. I suspect this is being done with an ldapsearch, perhaps with the -x and -S options, as the LDAP log details a query, then a sort on uid EVERY time the 1000 entries are retrieved. This, however, is only a minor part of the issue, as the sort takes about 5 minutes on the LDAP server. This would only account for about 200 minutes of my 1day, 4 hours.
2. After the block of 1000 is retrieved, IDM seems to go off into limbo for about 1 hour each time, with the appserverDAS process consuming about 30-40% CPU. I have an oracle database for the indexes, and that seems to be pretty relaxed during this time - there is some activity, but not in any real anger like the application server.
I can't analyze what's going on with the AD load, as I am not the custodian of the AD servers, and prefer to know as little as possible about them ;-)
I suppose this is not too much of a problem, as I will only performing the 'load from resource' once when we go into production, but I am concerned about the impact of a reconcilliation. I will start one immediately, and respond with itming when it finishes.
As for the list of users, how can I stop the account list from being the first thing accessed when I select the 'Accounts' tab? I would prefer not to have to import all accounts into a separate org just to facilitate access to the interface.
BTW - to be consistent with the documentation, shouldn't the references to 'Accounts' within the interface really read 'Users'. As I read the documentation, a 'User' is an IDM object which may (or may not) have resource 'Accounts'. If they are to be referred to as 'Accounts', then the two Users 'Configurator' and 'Administrator' should not appear there, as they do not, by default, have a resource equivalent. Or maybe I'm just a pedant :-)
Anyway, thanks for any help you can provide.

Accountguid update for the AD users in idm

Hi
We have the users in idm with Active Directory resouce assigned, but with out accountguid in the resource info.
for fixing them we are writing process to reprovision. But we are not able to set accountguid for the users.
<Action id='1' name='Get End User View' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='getView'/>
<Return from='view' to='user'/>
get objectGUID from AD
<set name='user.accounts[ActiveDirectory].accountGUID'>
<concat>
                         <s><GUID=</s>
                         <ref>objectGUID</ref>
                         <s>></s>
                    </concat>
</set>
<Action id='0' process='Provision'>
<Argument name='op' value='reProvision'/>
          <Argument name='user' value='$(user)'/>
Can any one please help me this
Thanks

Hi
Some of our user's aready exists in AD before creating the users in idm.
When our process create the users in idm it is just linking the users with AD account using below code and creating in idm, But idm AD adapter is not auotmatically putting the GUID. So we need to manully set those users.
<set name='user.accounts[ActiveDirectory].accountId'>
<ref>str_existentADAccount</ref>
</set>
<set name='user.accounts[ActiveDirectory].identity'>
<ref>str_existentADAccount</ref>
</set>
<Activity id='11' name='Provision'>
<Action id='0' process='Provision'>
<Argument name='op' value='provision'/>
<Return from='applicationError' to='error'/>
<Return from='userCreated' to='userCreated'/>
</Action>
Please let us know if we need to change any thing.
Thanks

Getting error while re-setting password of user in IDM 7.1

Hi All,
We are getting below error in job log while resetting password of users through IDM UI in IDM 7.1.
Please note that user has been created in backend through IDM only and we are putting 7 character long password only.
Also, password reset task has been maintained in Password Policy Tab.
The attribute values maintained in Pass for password reset are:
logonuid %MSKEYVALUE%
password $FUNCTION.sap_getPassword(%MX_ENCRYPTED_PASSWORD%)$$
changetype modify
Also, scripts maintained are: sap_encryptPassword and sap_getPassword
Could you please help!!!
Job log:
putNextEntry failed storing90000004
Exception from Modify operation:com.sap.idm.ic.ToPassException: User 90000004 does not exist Password is not long enough (minimum length: 7 characters) Internal error: FM SUSR_USER_READ, exception: 1 Inconsistency with address
Thanks
Aditi

Hi Steffi,
Yes, we have tried with 7, 8, 9 and 10 character long passwords, but no one worked.
Yes, the user existed, however we tried with another user and this time the error is:
putNextEntry failed storing9PATHAKR
Exception from Modify operation:com.sap.idm.ic.ToPassException: Password is not long enough (minimum length: 7 characters).
Attached is screen shot of password policy tab.
Thanks
Aditi

How to deploy jar file for use within mapping user-defined fcn

Hi all,
I have a java class I'd like to called from a mapping user-defined function.
Here's what I've done (but hasn't worked)
1. Added 'package com.<mycompany>.xi.util.base64 to the source class file and compiled it.
2. Created a sda with a plain provider.xml file, i.e. no references were made to any other library files.
3. Deployed the sda to the xi 3.0 j2ee server successfully using SDM.
4. Under the Visual Admin tool, I see that the library was deployed successfully.
5. In the import text box in the user-defined function (design time), I enter com.<mycompany>.xi.util.base64.*.
A syntax check returns an error indicating the package could not be found.
Can anyone give me pointers as to how I can get this working?
Thanks,
--jtb

Hey James,
No! That's not the right way!
What you have done is for accessing external JMS & JDBC drivers in their corresponding adapters. For the access inside a mapping user defined function, it's enough if you import the jar files.
Look at this blog and you will be very clear!
/people/divya.vidyanandanprabhu/blog/2005/06/28/converting-xml-to-pdf-using-xi
regards,
Felix

How to map user-defined fields in XML communication on SRM site

Hi All!
We use the External sourcing scenario and we transfer requirements from ERP in SRM through XI (PurchaseRequestERPSourcingRequest_In)
We should transfer the user-defined fields, but we can not map it in SRM site.
We have enhanced enterprise service in XI, have realized BADI PUR_SE_PRERPSOURCINGRQCO_ASYN on ERP site.
I see the XML message with ours z-fields in tr. SXI_MONITOR (into SRM), but I can not find it in BBP_PDISC.
We try to use BADI BBP_SAPXML1_IN_BADI (there is no method for SC), and BADI /SAPSRM/BD_SOA_MAPPING (z-fields is empty)
Someone can tell how to map user-defined field for SC?
Thanks in advance
Evgeny Ilchenko

Hello, Julia
We have found solution our problem
We have enhanced standard service in a new enhancement name space and defined own enhancement elements in our namespaces. Then these enhancement elements refered to the SAP standard Enterprise Service.
But In our new interfaces were different XML namespaces
When we have correct an error we could use the next BADI
on ERP site: PUR_SE_PRERPSOURCINGRQCO_ASYN
on SRM site: /SAPSRM/BD_SOA_MAPPING
BR,
Evgeny

Create ABAP user in IDM UI

Hello all,
I have the below error while create abap user in IDM UI, this is new IDM demo setup, user delete/modify, password update, role assignment working as expected.
create user provisioning hit error on prepare provisioning phase. I can see from the log missing mx_attribute_name but not sure what it is.
i went through the SCN but couldnt get much info on missing attibute basically I am not an IDM developer, really appreciate if some one help me solve this error.
Thanks in advance
sai

Thanks for the reply Matt,
i manage to figure out the problem, when i assign role PRIV:<rep>:ONLY user got created in back-end system.
Thanks
sai

Ip port-map user on ASR 1000 IOS XE

Hi.
I'm trying to build a firewall and wanted to use the "ip port-map user-xxx ..." command to make a custom protocol that I could then use in protocol statement insice a class-map type inspect.
Is this yet another thing missing from IOS XE, like the lack of object-group command?
Best regards.

Hello Damjan,
You are right Sr,
ASR ZBFW does not support user defined port-mapping
Now, you could match the traffic with an ACL and inspect it, the ZBFW will not break the connection, it will actually be succesfull so even though the command is not supported on the ASR1K you could still make it happen
EDIT: If you are going to create a user-defined protocol the ACL would be the same thing,
If you are trying to map a standard protocol to a non-standard protocol then you need to use the IP port-map command (not supported ASR1K)
So bottom line: In your case with the ACL you will be more than fine
For Networking Posts check my blog at http://laguiadelnetworking.com/
Cheers,
Julio Carvajal Segura

Can i able to do DBUM trusted recon without mapping User Login

Hi All,
Is is it possible to do dbum trusted reocon without mapping User Login field? , As it going to create automatically using post process event handler.
I am able to recon when i map userlogin otherwise not. But my need is userlogin shud create automatically. How can i achieve this
Any suggestions????
Regards,
user7609

This approach will be working fine with first time recon(New user creation) and you don't need to do anything extra.
But, the problem will ocur in case of update (next time recon of same user). As the userlogin is mapped with the target source and you have changed it using post process event handler. So, the same record it will consider as updatable and it will again try to update the existing user login. Yes, you can, call your event handler on update as well. So that it will update again to previous. This will be worst approach. beacause, It will process the same record always .
Again I suggest you. Better Go for transformation. which will serve your purpose. In this case you do not need to map user login from trusted source. transformation class will generate user login on pre-insert.

XSLT Mapping - user defined Extension function

Hi to all,
can somebody helps me, please?
I need an own function, that can be used by the XSL Mapper. First I have only tried the sample given in Path <BPELPM>\integration\orabpel\samples\demos\XSLMapper\ExtensionFunctions
There is a java file with the defined functions and a xml file with the definition of this function for the mapper and last but not least a jar-file with the java class.
I have copied the jar to <JDEV_HOME>\jdev\lib\ext directory and in JDeveloper I have added SampleExtensionFunctions.xml to Tools->Preferences->XSL Map -> "User Defined Extension Functions Config File" field. After a restart of JDeveloper I find 2 new functions in the "User Defined Extension Functions" component palette page when a XSL Map is open. That's fine.
But if I test the mapping I get an error: "Failed to transform source XML.
java.lang.NoSuchMethodException: For extension function, could not find method org.apache.xpath.objects.XNodeSet.replaceChar([ExpressionCotext,]#STRING, #STRING)."
What is wrong?
Thanks in advance of your answer
best regard,
uno

Oracle XML support Extension function.
For example:
If we would like to import FAQDBUri.class with user-defined java functions, like TranslateDBUri(), we can write XSL file like this:
<xsl:template match="/" xmlns:dburig="http://www.oracle.com/XSL/Transform/java/FAQDBuri">
<xsl:variable name="urladd" select="dburig:TranslateDBUri($url)"/>

Problem in getting Portal Mapped user and password in Web Dynpro iView

I am developing a webdynpro iview.My app need to read mapped user and password form a system in Portal runtime.
I used the following codes in my Web Dynpro java program:
     IWDClientUser user = WDClientUser.getCurrentUser();
     IUser iuser = user.getSAPUser();
     IUserMappingService iums = (IUserMappingService)WDPortalUtils.getServiceReference(IUserMappingService.KEY );
//     IUserMappingService iums = (IUserMappingService)
//     PortalRuntime.getRuntimeResources().getService(IUserMappingService.KEY);
     IUserMappingData iumd = iums.getMappingData (systemalias, iuser);
     Map map = new HashMap ();
     iumd.enrich(map);
     String userid = (String)map.get( "user" );
     String pwd = (String)map.get ("mappedpassword");
I've add a sharing references in project properties,the value is "PORTAL:sap.com/com.sapportals.portal.prt.service.usermapping.IUserMappingService"
But when I run the iview on my Portal, it goes wrong, the message is:
com.sap.engine.services.deploy.container.DeploymentException: Clusterwide exception: Failed to prepare application ''local/HomePage'' for startup. Reason= Clusterwide exception: Failed to start dependent library ''com.sapportals.portal.prt.service.usermapping.IUserMappingService'' of application ''local/HomePage''. Status of dependent component: STATUS_MISSING. Hint: Is the component deployed correctly on the engine?
    at com.sap.engine.services.webdynpro.WebDynproContainer.prepareStart(WebDynproContainer.java:1490)
    at com.sap.engine.services.deploy.server.application.StartTransaction.prepareCommon(StartTransaction.java:231)
    at com.sap.engine.services.deploy.server.application.StartTransaction.prepareLocal(StartTransaction.java:184)
    at com.sap.engine.services.deploy.server.application.ApplicationTransaction.makeAllPhasesLocal(ApplicationTransaction.java:365)
    at com.sap.engine.services.deploy.server.application.ParallelAdapter.runInTheSameThread(ParallelAdapter.java:117)
Anybody can help me?And are there anyother methods can get mapped user and password of Portal systems in Web Dynpro JAVA.

Hi Wayne,
      Did you added com.sap.security.api.jar to your webdynpro project. if not follow this steps.
1. Right-click the project in Eclipse or SAP NetWeaver Developer Studio.
2. Select Properties.
3. Choose Java build path -> Libraries -> Add Variable -> Select variable WD_RUNTIME -> Extend -> com.sap.security -> lib -> com.sap.security.api.jar.
I hope this should solve your problem.
Regards, Suresh KB

How to Map user in EP 7

Hi
I am using EP 7. In user mapping for system access tab i got the IDES system which i have configured. My doubt is in Mapping Data option which User id and password do i need to mention .
Is it portal user id and password or
R3 user id and password
If it is portal user id and password where should i mention R3 user id and password
I am using user mapping type as UIDPW
Please help me....
Regards
Sowmya

Hi,
Hope that is not problem with system but permission. Have a look at these threads.
1) Some Users Can Not Select System
2) Problem in viewing the various systems.....
3) http://help.sap.com/saphelp_nw04s/helpdata/en/15/74ce1925fe4fe6a058dec056ef5f6f/frameset.htm
Check the line "Map users with VC Role to a user with read permissions to the required back-end system."
4) Not getting the Systems while clicking "Select Data Services"
Regards,
Harini S

How to determine that the Mapped User Id has the active r/3 account?

Hi Experts,
I have a requirement to determine the whether the mapped user ID in portal has active or inactive user account in R/3.
For example:
We have implemented SSO between WAS & backed R/3. Now the user has the active poratl account but the R/3 account is inactive or locked due to some reason. Now in this situation when user logs in and hit the application then the screen display's the 500 internal server error which is not understood by the client. The requirement is to display the custom message instead of 500 internal server error inorder to direct the user that his account is inactive or locked in R/3.
I have to handle this within the WDinit method of the Componenet controller which will stop the processing if incase the above is true and display the appropiate Error Message.
Hope I am clear in statement above.
Looking for your prompt reply.
Thanks
Shobhit Taggar

Hi
import com.sap.security.api.IUserAccount;
See this link
http://www.sdn.sap.com/irj/scn/index;jsessionid=(J2EE3417300)ID1438221150DB00601362742208939333End?rid=/library/uuid/40d562b7-1405-2a10-dfa3-b03148a9bd19&overridelayout=true
Kind Regards,
Mukesh.

Error in retrieving the mapped user??

I am using this code for retireval of the mapped user data:
IPortalRuntimeResources obj1 = PortalRuntime.getRuntimeResources();
IService obj2 = obj1.getService(IUserMappingService.KEY);
IUserMappingService iums = (IUserMappingService)obj2;
but I m not able to proceed beyond this line:
IUserMappingService iums = (IUserMappingService)obj2;
the system is not giving any exception bcoz the loggers in the catch block are not printed. but its not executing beyond this line.
I m using EP6.0 SP9.
I m trying this code in the RF framework(Repository Manager)
Kindly help.

See Current portal User? - Please do not crosspost.

Mapping users from resources to user in IDM

Similar Messages

Maybe you are looking for