OIM 11gR2 Design Console Access

Hello,
Could someone please tell me the minimum admin role(s) required to grant access to the OIM design console?
Thanks!
Ariel

Hi All,
I am using OIM 11g R2. OIM is running on linux server and Design console is intalled and accessing from windows machine. Able to login the 'xelsysadm' from design Console.
Not able to login from design console for 'oimadmin' user (user created by me).
Executed the following steps,
1) has given 'system Adminstrator' role from top(organization) -> Admin Role -> assigned 'System Adminstrator' Role to 'oimadmin' user.
2) User is 'Xellerate User' organization.
3) Changed User_Type from 'End-user' to 'End-user Administrator'
4) Restarted OIM server.
Still 'oimadmin' user is not able to login.
I would sincerely appreciate, solution for this.
Thanks in advance.

Similar Messages

Minimum permisions required to get Design Console access

Hi,
What are the minimum permissions required by User (expect for checking the Design Console checkbox on user profile) to access Design Console in OIM 11g R1 (11.1.1.5.0)?
Ofcourse, we donot want to add the user in System Admin group.
We just want that the user is able to modify the lookups thru' DC.
Thanks
Sid
Edited by: Sidharath on Dec 13, 2012 12:46 PM

11g: End-User Administrator (Select Design Console Access Attribute)
Permissions you can give :
Go to Role > Data Object permission > Select desired permissions from there
Metalink: ID 1495238.1]
R2: OIM 11gR2 Design Console Access

Design console access in OIM 11gR2

I need to create an user other than Xelsysadm to have access to design console in OIM11gR2. what are the steps in 11gR2. In R1 i used to select the Design console access checkbox while creating user manually. Is there any feature like that in 11gR2. Thanks in advance

provide Admin Role to the user.
goto-> organizatin-> search and select Top organization-> open detail page-> click on Admin Role-> select Adminrole(System Administrator or User Administrator etc.) -> click on Assign button-> select user and add it-> finally click on okay.
make sure you select the 'sub-organization hirearchy'

How to give design console access to the user from OIM GUI - OIM 11g R2

Hi,
Could you please let me know if there is any way to give Design Console access to a normal user in OIM 11g R2.
I tried by giving the access from backend by using DB command and I was able to give the design console access to the user.
But I need to give design console access to the user from OIM Interface.
Please let me know how to achieve this functionality.
Thanks

I have already used this approach by directly modifying the user record in DB.
I am looking if it is possible to give Design console access from OIM GUI, the way we use to give in OIM 11g R1.

OIM 11gR1 Design Console displays nothing

The Design Console stopped displaying anything: we can successfully connect to it, but it doesn't show anything at all, no object nor tree on the left/navigation pane, and all menu items are greyed-out. Any ideas what might be going on?
All Authorization policies seem to be fine (and besides, we haven't changed them), what could possibly cause this?
Thanks in advance...

So I figured-this out.
Not sure where tables UWP and WIN are properly documented, but it appears that WIN stores definitions of UI Objects (Menu Items, Menus, Forms, etc...), and UWP grants access to these UI Objects to OIM Roles.
In my case here, the issue occurred after installing the RACF v19 connector through the 'Manage Connector' Admin UI. This fails (I believe due to a bug in the connector itself), and the failure somehow wipes-out several rows from the UWP table. Rows that were granting access to SYS ADMIN to menus in Design Console.
To fix this is a matter of figuring-out which rows were deleted. I did by comparing the UWP table in the impacted environment (SandBox) to UWP in an environment where everythign works fine (QA). Once you get the delta, insert the missing rows through SQL into the UWP table in the impacted environment.

Can't login to OIM 11g Design Console after integrate with OAM 11g

Dear All,
After successfully integrate oim 11g with oam 11g, we cannot access the design console of oim 11g anymore (access denied).
Is it cause of oam protection?
Or do we have to do additional configuration?
Please help...
Thank you,
-heri-

962874 wrote:
Hi All,
I have installed and configured OAM,OIM,SOA under weblogic domain. After configured OAM on weblogic domain(by extending it)
I am getting the following error while login to oim console,design console .
<Jan 17, 2013 4:26:09 AM EST> <Warning> <Socket> <BEA-000449> <Closing socket as no data read from it on 172.16.30.107:57,579 during the configured idle timeout of 5 secs>
<Jan 17, 2013 4:26:10 AM EST> <Error> <Default> <BEA-000000> <Failed to communicate with any of configured Access Server, ensure that it is up and running.> Is the port 57,579 correct? Port numbers cannot have comma in them. Also try to telnet to that host and port from your machine to check if there is no network issue.
Regards,
Nani-Bikash
Edited by: 932574 on Jan 17, 2013 10:40 AM

OIM 10g Design console not working - Help Please

I recently Installed OIm 10g using Jboss as App Server.
When trying to run Designconsole after providing username/password I am getting the error message.
Please help
Error Keyword: DAE.CLIENT_NOT_BOUND
Description: Database client has not bound to the server-side database object. Either the client database object has never bound to the server-side database object, or the server-side database object is no longer accessible.
Remedy: Attempt to login again. If this fails, contact your system adminstrator.
Action: E
Severity: H
Help URL:
Detail:

Design console uses RMI.
Can you check if this port (RMI) has changed in your application server for any reason?
you can reinstall the design console, as it wont take more than 10 minutes to do it. If in a fresh installation you have the same behaviour, I'd bid that you have a wrong RMI port.
Regards,

OIM 11gR2 - Identity console - Search Users Page. Need to add employee number by default.

Hi,
I am new to oim 11gR2. I have a requirement , to add the employee number field in the user search box. I do not want to use the Add Fields button to add the employee number search field.
When any user goes to the search page, they must find the employee number field in the search box in addition to the other default fields like lastname, firstname, etc. Is it achievable? Thanks in advance.
If possible.... can you please provide the steps to achieve it?.. thanks

Karthik Perath
Thanks for the answer....... but I guess you misread the question. I am able to add new fields as columns to the search results table. My problem is I want to add the searchable field to the query form. Also, I do not want to use the Add Fields button (because that is a part of Saved Search which is Personalization and limited only to the creator) , I want the newly added searchable field. for example Employee Number ( which is not there by default) to be made available to all the end users of Identity Self Service system..... Hope you got the problem...

Replicating the app functionality from OIM 10g to OIM 11gR2

Hi,
I have a resource object with an object form and a process form and approval, provisioning configured in OIM 10g design console. Provisioning is manual provisioning assigned to a particular group based on a task assignment adapter. For replicating the same in OIM 11gR2 i followed the following steps.
1. Created a Resource object in Design console.
2. Created a dummy IT Resource ( Since while creating app instance it is having IT Resource as Mandatory field. * Is there any way to skip this as i do not have any IT resource in my original app as it is going for manual provisioning?)*
3. Created a process form in Design Console with the same fields as present in my 10g app process form.
4. Now i need to Create an app instance and select the created resource object and IT resoource. Also i need to create a form associated with the app instance in which i will add the fields as present in the object form in my 10g app. ( Here i am not understanding how data will flow from object form to process form since there is no data flow mapping here)
5. Other steps like creating the SOA composite with human tasks and deploying it and after that creating approval policies is pretty much clear.
Please clarify whether the steps are correct and also the queries which i have posted in between. Thanks in advance.
Regards,
Durgaprasad
Edited by: Durgaprasad on Jan 17, 2013 3:38 AM

Thanks Gyanprakash. Wll disconnected resource trigger our custom approval process if we select the resource name properly in scope in operational level approval policy. Have you tried a disconnected resource with your custom approval process. Because i read the following lines in admin guide
Oracle Identity Manager supports provisioning of disconnected resources by using the SOA worklist for manual provisioning of disconnected resources. After the role-based provisioning decision or SOA request approval is complete and the corresponding application instance is determined to be a disconnected application instance, a new SOA workflow is started. This new SOA workflow is assigned to the manual provisioning administrator.
So i thought disconnected app instance will have its own approval process configured during the creation and it will route accordingly. So just wanted to clarify how to make disconnected app instance to trigger our approval. will approval policay take care of it as i am going to select the name of the disconnected app in the scope field.

OIM 11gR2 not able to see forms within Design Console

Hi Guys
About the design Console, i'm not able to get any form when searching them within the design console...any idea?
I've already gone through the whole steps to configure the design console.
I gets "No record found for this query" even when i set a generic search.
Thanks!

have you install any Connector in OIM? If yes then the form will be available in the design console. Or if you have created manually using design console->form designer
While creating Application Instance we create some form top of the base form those form won't be available in design console. however you can search those as below:
login to sysadmin url->go to Form Designer-> select Resource and the name of the Resource Object and find forms for respective RO.
--nayan

Error while starting OIM admin and design console

Hi all,
I have OIM 9.10.2 deployed on Jboss 4.2.3GA with oracle 10g as database.Installation was successfull and after that we tried some simple use cases on that.
This time after starting Jboss it gave an error "Network Adapter cannot be connected".
It came because RMI port was in use and because of the change in IP Address,we changed both of them.
changed RMI port in jboss-service.xml
changed IP address to Host name in xlconfig.xml,jboss.profile.xml and xell-ds.xml files
But now when we run server and try to access the consoles we get the following errors -
Admin console error - OIM admin page opens stating the error "System error was encountered"
Design console error - Oracle Identity Manager Design console could not allow you log in
Diagnostic dashboard error - Invalid username or password ( i m sure of the id and pwd )
Jboss logs -
2010-10-22 16:30:10,986 WARN [XELLERATE.DATABASE] Trying to get the connection count : 3
2010-10-22 16:30:10,986 WARN [org.jboss.resource.connectionmanager.JBossManagedConnectionPool] Throwable while attempting to get a new connection: null
org.jboss.resource.JBossResourceException: Could not create connection; - nested throwable: (java.sql.SQLRecoverableException: Io exception: The Network Adapter could not establish the connection)
2010-10-22 16:30:10,986 WARN [XELLERATE.DATABASE] Trying to get the connection count : 4
2010-10-22 16:30:10,986 ERROR [XELLERATE.DATABASE] Class/Method: DirectDB/getConnection encounter some problems: Error while retrieving database connection.Please check for the follwoing
Database srever is running.
Datasource configuration settings are correct.
2010-10-22 16:30:10,986 ERROR [XELLERATE.DATABASE] Class/Method: tcServerProperties/initServerProperties encounter some problems: {1}
java.lang.NullPointerException
     at com.thortech.xl.dataaccess.util.tcServerProperties.<init>(Unknown Source)
16:30:10,986 ERROR [XIMDD] Class/Method: UserVerificationServlet/loginUser encounter some problems: RuntimeException; nested exception is:
java.lang.NullPointerException
Thor.API.Exceptions.tcAPIException: RuntimeException; nested exception is:
java.lang.NullPointerException
at Thor.API.tcUtilityFactory.getPropertyValue(Unknown Source)
at Thor.API.tcUtilityFactory.<init>(Unknown Source)
at com.thortech.xl.systemverification.webapp.UserVerificationServlet.log
inUser(Unknown Source)
Please suggest what might be the change that affected our OIM instance and how can we solve this problem.
Thanks,
Deepika

Hi Sunny,
I checked both the files you mentioned both of them are correct.Changed the RMI port in jboss-service.xml to its original value.Still I am facing the same error :(
2010-10-27 10:40:56,821 WARN [XELLERATE.DATABASE] Trying to get the connection count : 1
2010-10-27 10:40:56,837 WARN [org.jboss.resource.connectionmanager.JBossManagedConnectionPool] Throwable while attempting to get a new connection: null
org.jboss.resource.JBossResourceException: Could not create connection; - nested throwable: (java.sql.SQLRecoverableException: Io exception: The Network Adapter could not establish the connection)
     at org.jboss.resource.adapter.jdbc.xa.XAManagedConnectionFactory.createManagedConnection(XAManagedConnectionFactory.java:155)
     at org.jboss.resource.connectionmanager.InternalManagedConnectionPool.createConnectionEventListener(InternalManagedConnectionPool.java:619)
     at org.jboss.resource.connectionmanager.InternalManagedConnectionPool.getConnection(InternalManagedConnectionPool.java:264)
     at org.jboss.resource.connectionmanager.JBossManagedConnectionPool$BasePool.getConnection(JBossManagedConnectionPool.java:613)
     at org.jboss.resource.connectionmanager.BaseConnectionManager2.getManagedConnection(BaseConnectionManager2.java:347)
     at org.jboss.resource.connectionmanager.TxConnectionManager.getManagedConnection(TxConnectionManager.java:330)
     at org.jboss.resource.connectionmanager.BaseConnectionManager2.allocateConnection(BaseConnectionManager2.java:402)
     at org.jboss.resource.connectionmanager.BaseConnectionManager2$ConnectionManagerProxy.allocateConnection(BaseConnectionManager2.java:849)
2010-10-27 10:40:56,837 ERROR [XELLERATE.DATABASE] Class/Method: DirectDB/getConnection encounter some problems: Error while retrieving database connection.Please check for the follwoing
Database srever is running.
Datasource configuration settings are correct.
2010-10-27 10:40:56,852 ERROR [XELLERATE.WEBAPP] Class/Method: tcWebAppSettingsAction/execute encounter some problems: RuntimeException; nested exception is:
     java.lang.NullPointerException
Thor.API.Exceptions.tcAPIException: RuntimeException; nested exception is:
     java.lang.NullPointerException
     at Thor.API.tcUtilityFactory.getPropertyValue(Unknown Source)
-Deepika

Problem connecting to OIM instance with the Design Console

Hello,
I've got questions about how to use the design console to connect to an OIM instance. I'm not the one who has set up the instance and the one who did cannot help me much. He did give me root access on the machine though.
So first, I'm wondering how do I figure out which port I should connect to. All the doc I can find says that default port is 14000, but I don't understand what it's referring to. I can access to the Web Administration page for Fusion Middleware Control by going to <server_ip>:7001/em. Should I use port 7001? I can figure out that 14000 might not be the correct port because "netstat" does not show anything listening on that port.
My second question is related to the credentials I should use to login to the console. According to the doc and tutorials I found, the user should be xelsysadm. However the person who has set up the instance does not remember having explicitly set a password for this user. Is it possible to log in to the console using the weblogic admin user?
I've tried a couple of things, but nothing has worked so far. I always get an error of some some sort. I always get an Invalid Login, except when I log in with the weblogic user and set the following properties in xlconfig.xml:
ApplicationURL= http://<server_ip>:7001/xlWebApp/loginWorkflowRenderer.do
java.naming.provider.url= t3://<server_ip>:7001/oim
With these config, I get this exception:
javax.naming.NameNotFoundException: While trying to lookup 'ejb.stateful.tcDataBase#com.thortech.xl.ejb.interfaces.tcDataBaseRemote' didn't find subcontext 'stateful'. Resolved 'ejb'
So that's pretty much where I'm at. I can't find any information that can help me, so any hint would be appreciated.
Thanks for your time,
jtellier

try to login in weblogic console the port will be 7001. if you are able to do this then
goto->service->security->realim->select user and groups (try to find the correct path)
create user and then assign administrator groups to this user
login with this user/password into OIM
But for design console you don't need any url. if it is configured. go to <IDM_HOME>/designconsole/ and run xlclient.sh
--nayan

OIM Design console fails to logon.

Hi, I am unable to log into the OIM Design console with xelsysadm. I got the below error. Please help me.
Additional Info: I'm working with Oracle Identity Manager running on Centos 4.4 with Oracle 10.2.0.1.0 DB and BeaWeblogic 10.3.
Error gathered from Oracle Identity Manager Client:
java.lang.NullPointerException
at com.thortech.xl.dataaccess.tcDataBaseClient.bindToInstance(Unknown Source)
at com.thortech.xl.dataaccess.tcDataBaseClient.<init>(Unknown Source)
at com.thortech.xl.server.tcDataBaseClient.<init>(Unknown Source)
at com.thortech.xl.client.dataobj.tcDataBaseClient.<init>(Unknown Source
at com.thortech.xl.client.base.tcAppWindow.internalLogin(Unknown Source)
at com.thortech.xl.client.base.tcAppWindow.login(Unknown Source)
at com.thortech.xl.client.base.tcAppWindow.<init>(Unknown Source)
at com.thortech.xl.client.base.tcAppWindow.main(Unknown Source)

Additional logs from weblogic domain: Please tell me how can I isolate this problem. Thanks in advance.
ERROR,25 May 2009 19:50:00,025,[XELLERATE.ACCOUNTMANAGEMENT],Class/Method: tcUtilityFactory/tcUtilityFactory(Hashtable env, tcSignatureMessage poUserIDMessage) encounter some problems: javax.security.auth.login.LoginException: java.lang.SecurityException: [Security:090304]Authentication Failed: User xelsysadm javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User xelsysadm denied
javax.security.auth.login.LoginException: javax.security.auth.login.LoginException: java.lang.SecurityException: [Security:090304]Authentication Failed: User xelsysadm javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User xelsysadm denied
at weblogic.security.auth.login.UsernamePasswordLoginModule.login(UsernamePasswordLoginModule.java:199)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:683)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:680)
at javax.security.auth.login.LoginContext.login(LoginContext.java:579)
at Thor.API.Security.LoginHandler.weblogicLoginHandler.login(Unknown Source)
at Thor.API.tcUtilityFactory.<init>(Unknown Source)
at com.thortech.xl.scheduler.core.quartz.QuartzWrapper.execute(Unknown Source)
at org.quartz.core.JobRunShell.run(JobRunShell.java:178)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:477)
ERROR,25 May 2009 19:50:00,026,[XELLERATE.SERVER],Class/Method: QuartzWrapper/execute encounter some problems: javax.security.auth.login.LoginException: javax.security.auth.login.LoginException: java.lang.SecurityException: [Security:090304]Authentication Failed: User xelsysadm javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User xelsysadm denied
Thor.API.Exceptions.tcAPIException: javax.security.auth.login.LoginException: javax.security.auth.login.LoginException: java.lang.SecurityException: [Security:090304]Authentication Failed: User xelsysadm javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User xelsysadm denied
at Thor.API.tcUtilityFactory.<init>(Unknown Source)
at com.thortech.xl.scheduler.core.quartz.QuartzWrapper.execute(Unknown Source)
at org.quartz.core.JobRunShell.run(JobRunShell.java:178)
at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:477)
Edited by: user11120117 on May 28, 2009 1:26 AM

Design console 11gR2

I am trying to connect with Design Console 11gR2 from Windows host (to remote OIM server)
It is trying to go to t3://localhost when launching xlclient. Need to change this localhost to remotehost.
Is edit in xlconfig sufficient?

The following steps are to be done in order to setup design console on windows.
1. Go to cd wlserver_10.3/server/lib/
2. java -jar ../../../modules/com.bea.core.jarbuilder_1.7.0.0.jar
3. wlfullclient.jar will be created under wlserver_10.3/server/lib/
4. Copy to designconsole folder’s ext folder
5. Go to cd /opt/oracle/fusion/Middleware/oracle_common/modules/ oracle.jrf_11.1.1/
6. Copy jrf-api.jar to ext folder
7. Transfer designconsole folder to desktop
8. add wlfullclient.jar and jrf-api.jar to classpath.bat
9. change xlclient.cmd for JDk etc
@echo off
setlocal
call classpath
REM SET DEBUG_OPTS=-classic -Xdebug -Xnoagent -Djava.compiler=NONE -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5001 -DXL.RedirectSysOutErrToFile=TRUE -DXL.SysOutErrLogFile=.\logs\Client.System.Out.Err.log
REM Make sure to remove java.naming.provider.url and read it from the configuration
REM once the JNDI Profiles are implemented.
REM make sure you are using j2sdk1.4.2_05
"C:\Program Files\Java\jdk1.6.0_29\bin\java" %DEBUG_OPTS% ^
-DXL.ExtendedErrorOptions=TRUE -DXL.HomeDir=C:\oracle\OracleClients\11gLabR2\xlclient ^
-Djava.security.policy=config\xl.policy ^
-Dlog4j.configuration=config\log.properties ^
-DAPPSERVER_TYPE=wls ^
-Dweblogic.security.SSL.trustedCAKeyStore=%TRUSTSTORE_LOCATION% ^
-Djava.security.manager -Djava.security.auth.login.config=config\authwl.conf ^
com.thortech.xl.client.base.tcAppWindow -server server
endlocal
9. Chech xlconfig.xml for appURL etc

OIM 9.1 Time-out problem with Design Console

If I leave the design console running for any length of time, making updates result in the following error:
17:36:52,578 ERROR [ACCOUNTMANAGEMENT] Class/Method: tcDataBase/getUser encounter some problems: Invalid user found: xelsysadm
java.lang.RuntimeException: Invalid user found: xelsysadm
at com.thortech.xl.server.tcDataBase.getUser(Unknown Source)
at com.thortech.xl.dataobj.tcSVP.isOperationAllowed(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.isUpdatePermissible(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.eventPreUpdate(Unknown Source)
at com.thortech.xl.dataobj.tcSVP.eventPreUpdate(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.update(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.save(Unknown Source) ...
Closing the Design Console and re-launching produces similar errors. I must stop and restart the JBOSS server to get access again. My environment is Windows 2003 with JBOSS and an 11g database.
Any help on what to look for would be appreciated.
KC

You are correct. If you pre-populate, it will be the requester. The requester would need to manually populate the field during the request with the requestee information. And there is only one form available. You can however, after submission of the request, get the request data, parse the Consolidated Request Data to determine the id's in the request field, and then return appropriate responses to trigger the tasks needed. This will still be a problem in the long run because you can't change the requestee information for each approval task. You're pretty much out of luck on this one.
-Kevin

OIM 11gR2 Design Console Access

Similar Messages

Maybe you are looking for