OIM 11gR2 - Task Assignment

There is an approval workflow in my current 10g environment, where approval is assigned to a particular user after running a task assignment adapter. The java code inside my task assignment adapter has the logic which gives the approver key as output. Based on this the task is assigned to that particular approver. In OIM 11gr2 since the approval workflow happens in SOA side how can i perform my java logic there and route the approval based on that. Thanks.

You can obtain user key either using expression rules or if logic is complex, you can use java embedding task to add your java code inside composite. Refer link here:
http://docs.oracle.com/cd/E21764_01/doc.1111/e14309/soa_api.htm
Check section: 26.2.3 Updating the SOA Composite
regards,
GP

Similar Messages

OIM 10g Task Assignment adapter

Hi All,
I have Task assignment adapter in place which assigns the task to the group in OIM - group decided on some condition.
I want to bypass this task assignment if user's manager is the member of decided group. Is it possible?
Any pointer would be a great help.
Thanks,
Pallavi

Add a task say "Check Manager" which will check whether user's manager is part of that group or not. Based on that send some response YES or NO
On YES, call "Approval" and attach task assignment adapter there.
On NO, you can attach any task if you want or leave it as it is.
Reference:
http://rajivdewan.blogspot.com/2010/07/multilevel-approval-workflow-in-oracle.html

OIM - Task Assignment Adapter - How to get the object instance key?

Hello experts,
I'm trying to use a task assignment adapter to assign an approval task dynamically. Basically, the user can request a resource like "CustomApp Profiles" and we create an object form to let them choose the profile that he needs. Each profile has an owner, which is populate in a Lookup (Owner is the code and Profile is the decode).
So, in the approval task, I need to get the profile selected by user in the object form and search into the lookup who is the owner of that profile. But I don't know how can I get the object instance key using the parameters that can be mapped to a task assignment adapter.
Looking into the OIM documents, I believe that the easier way is using the request key, because the REQ_KEY is a foreign key in OBI table.
Did anyone knows how can I get the object instance key using the request key? Can I use some API or should I execute a SQL statement directly in OIM database?
Best Regards,
Nitto

To retry a task that is in a rejected state, you use the SCH_KEY which is the task key. In OIM, all rejected tasks are listed in the OTI table. It contains all the important information about a rejected or pending task.
You can use the APIs found in the tcProvisioningOperationsIntf class to retrieve open tasks.
-Kevin

OIM: what parameters for the task assignment adapter?

Hi,
following the tip here: Re: how to use adapter to assign task to a specific user
I created a task assigment adapter and set the following by means of a simple java class:
Adapter return value for key="myapprover2"
Adapter return value for key type="User"
myapprover2 is the login name of a user in OIM.
It does not seam to work, because the approval task is assigned to the xelsysadm instead of myapprover2.
What I else need to do to get it working?
Thanks.

The key needs to be the Users.Key value returned in a string format to the Object variable holding the task assignment key variable.
-Kevin

OIM: what should return a task assignment ?

Hi,
I have written a task assignement adapter, which returns the login name of a user, as it appears in OIM "myappr1".
I have specified this adapter in the Assignment tab of a process task of an approval task.
The approval process and the task I wrote are correctly executed, however the approval request goes to xelsysadm rather then to myappr1 as I would expect.
What value should actually return the adapter?
Thanks much.

See I beleive that for a Task Assignment you must supply the target type within the adapter itself (and not on the Target Type field). Look for the following correction as well.
When you create this adapter you will find that there are two automatically included variables named Return Variable for Key and Return Variable for Key Type. In addition to the task you have already added for the selection of target user, also add another task for selection of target type. Do it as follows:
- Create a utility task. Select xlUtils.jar from API source.
- Select holdData for the method name.
- Now provide value for Return Variable for Key Type as Group (this would be a literal).
Try it out once again.
Thanks
Sunny

OIM task Assignment Tab

I am trying to understand how the assignment tab works. In process Def, I have a task, like create user. That has a assignment tab which has one entry in it. It has escalation time and a Default Rule. I entered an escalation time of 10 mins and then proceeded to create another entry below that. However, it says it needs a rule and the Default rule is not applicable since its already used by the first entry.
What rule do I need to create? What should be in that rule? Thanks in advance.

See
http://download.oracle.com/docs/cd/E14049_01/doc.9101/e14061/resmgt.htm#BABIHAIJ
You have to create Task Assignment Rule for this. That Task Assigment Tab is used for assigning that task to someone.
Suppose you have approval workflow and you have create Approval Task in that. Then you can assign it to anyone to approve that task.
In Task assignment tab, you select the user or group who will be responsible for completing that task. If you are giving some time duration in Escalation then it will escalate after that particular time but it tales value in ms.

Manual Task Complete in OIM 11gR2

Hi All,
I am facing the problem with setting the task response complete manually.
1) Created Disconnected Resource (Dummay Resource).
2) Created Create User Task in Process Definition and assigned this task to SupportGroup (Which is working fine).
3) Created Change First Name task to update the first name in the process from whenever it gets updated and assigned the task to SupportGroup to set the task complete manually.
When i update the first name in the user form the task it is autocompleting in OIMINTERNAL user name. in the resource history the
task status is showing as completed.
Assigned to is showing supportGroup.
Completed By OIMINTERNAL user.
How can fix this.
Thank you

Hi Kunwar,
Thanks for the reply..Yes by default the task will get assigned to xelsysadm i changed it to supportgroup.and it is getting assigned to supportgroup now..but it is auto completing..below is the scenario
1.User gets provisioned to Disconnected Resource.
Task assigned to SupportGroup (if you check the resource history create user task will be in pending state untill some body from the Support group set the response as complete) once somebody from this group set the response to complete the status will be provisioned.
2.User Profile Get updated (First name , last name got updated) task is assigned to SupportGroup.
But when i open the resource history change First Name will be in Complete state it should be in pending state.(it is auto completing using OIMINTERNAL user.
Thank you

Replicating the app functionality from OIM 10g to OIM 11gR2

Hi,
I have a resource object with an object form and a process form and approval, provisioning configured in OIM 10g design console. Provisioning is manual provisioning assigned to a particular group based on a task assignment adapter. For replicating the same in OIM 11gR2 i followed the following steps.
1. Created a Resource object in Design console.
2. Created a dummy IT Resource ( Since while creating app instance it is having IT Resource as Mandatory field. * Is there any way to skip this as i do not have any IT resource in my original app as it is going for manual provisioning?)*
3. Created a process form in Design Console with the same fields as present in my 10g app process form.
4. Now i need to Create an app instance and select the created resource object and IT resoource. Also i need to create a form associated with the app instance in which i will add the fields as present in the object form in my 10g app. ( Here i am not understanding how data will flow from object form to process form since there is no data flow mapping here)
5. Other steps like creating the SOA composite with human tasks and deploying it and after that creating approval policies is pretty much clear.
Please clarify whether the steps are correct and also the queries which i have posted in between. Thanks in advance.
Regards,
Durgaprasad
Edited by: Durgaprasad on Jan 17, 2013 3:38 AM

Thanks Gyanprakash. Wll disconnected resource trigger our custom approval process if we select the resource name properly in scope in operational level approval policy. Have you tried a disconnected resource with your custom approval process. Because i read the following lines in admin guide
Oracle Identity Manager supports provisioning of disconnected resources by using the SOA worklist for manual provisioning of disconnected resources. After the role-based provisioning decision or SOA request approval is complete and the corresponding application instance is determined to be a disconnected application instance, a new SOA workflow is started. This new SOA workflow is assigned to the manual provisioning administrator.
So i thought disconnected app instance will have its own approval process configured during the creation and it will route accordingly. So just wanted to clarify how to make disconnected app instance to trigger our approval. will approval policay take care of it as i am going to select the name of the disconnected app in the scope field.

OIM 11gR2- Approved Requests remain in Operation Initiated Status

Hi,
We are using OIM 11gR2 and we are seeing the following behaviour whenver we request for Application Instance
1) End User logs in and requests for Application Instance.
2) The request is created and assigned to the manager for approval.
3) Manager logs in and approves the request.
4) The Requested resource is assigned to the user and the status of the resource is Provisioned. All the tasks in the Resource History are in Completed status.
5) If we see the status of the request, it remains in Operation Initiated status.
We expect the status of the Request to be Request Completed and not remain in Operation Initiated. We are sending a mail notification to the manager once resource is provisioned.
If we remove the notification part, the status of the Request is coming as Request Completed as expected. However with notification getting triggered we are getting problem.
Please suggest a solution.
Thanks and Regards,
Mayuri
Edited by: 943112 on Mar 11, 2013 7:09 AM

Usually after the request is approved and if there is any pending task in provisioning it goes to 'Post Operation Processing Initiated' status. If 'Task to Object Status' mapping is not done properly the request stays in the same status even though all the tasks are completed.
check this link for various request status
http://docs.oracle.com/cd/E27559_01/user.1112/e27151/req_mangmnt_user.htm#BGBGIIDH
In your case it is going to 'Operation Initiated' status when notification is attached. Can you tell where have you triggered notification? In SOA approval task or in Provisioning process? If it is in SOA check whether proper status is returned to the callback webservice after that. Else if it is in provisioning check for task object status mapping.

OIM 11gR2 : User groups not visible on UI

Hello Experts,
I have a requirement in which i need to assign the user provisioned to AD to some group(s) depending upon certain conditions like BU, Location etc. I created a Process Task adapter for the same and am able to successfully assign the users to the desired groups.
But i am able to check for this validity from the Backend only.
Ideally the groups assigned to the user must be visible after following these steps:
*1. Search for a user provisioned to AD.
2. Go the the Accounts tab.
3. Click on the AD account (to which the user has been provisioned)
4. A process form is displayed in the lower half of the webpage which also shows the information regarding the groups assigned to the User. But the groups are not getting displayed.*
Kindly Help.
Edited by: IDM_newbie on Jan 24, 2013 11:24 PM

But sir, the groups are listed under the Accounts tab. Is there any schedule job provided by OIM 11gR2 which results in the display of Groups assigned to the user as well under the Accounts tab ?
Edited by: IDM_newbie on Jan 25, 2013 1:51 AM

OIM 11gR2 user not provisioning to Active Directory (11.1.1.5 connector)

Hello all,
I'm trying to set up an OIM 11gR2 instance to work with Active Directory with the Active Directory 11.1.1.5.0 connector. I've full installed both OIM and AD on separate servers, and I've installed the AD 11.1.1.5 connector on OIM. I have configured Active Directory properly (connector on OIM and the connector server on the AD server-side), and have set up the two IT Resources on OIM. I can run, for example, the Active Directory Organization Lookup Recon job and have it return results in the Lookup window.
My problem is that I cannot get it to provision to a user. I've created an Application Instance and Form for Active Directory, attached the Form, associated them with the appropriate resources (AD User), and added them to the Catalog, and then gone through the process of adding an account to the user, selecting the Application Instance, adding it to the cart, checking out, filling out the fields (Password, User ID, UPN, First Name, Last Name, Common Name, and Organization Name), and then submitting the request. This is all done as the xelsysadm admin user, but it still results with the account stuck on "Provisioning" because the "Create User" task failed due to a Connector Error (the reason stated is just a repeat of "Create Object" failed).
Anyone know what I'm missing here?
Thank you!
Edited by: 939908 on Nov 12, 2012 6:36 AM

Hey 833249, thanks for your reply
The organization field attribute is filled in correctly, in that the OU I selected exists in AD.
These are the errors listed in the connector server log:
+11/9/2012 9:07:07 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception occured during the creation of directory entry.+
+11/9/2012 9:07:07 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception Message : Logon failure: unknown user name or bad password.+
+11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception Stack Trace : at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)+
at System.DirectoryServices.DirectoryEntry.Bind()
at System.DirectoryServices.DirectoryEntry.get_NativeObject()
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.GetDirectoryEntry(String path, ActiveDirectoryConfiguration configuration) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1423
+11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryConnector Method -> Create, Message -> Encountered Excetion: Unable to get the Directory Entry+
+11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryConnector Method -> Create, Message -> Stack Trace: at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.GetDirectoryEntry(String path, ActiveDirectoryConfiguration configuration) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1456+
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.DirectoryEntryExists(String path) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1512
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryConnector.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryConnector.cs:line 219
ConnectorServer.exe Error: 0 : Org.IdentityConnectors.Framework.Common.Exceptions.ConnectorException: Unable to get the Directory Entry
at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryConnector.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryConnector.cs:line 368
at Org.IdentityConnectors.Framework.Impl.Api.Local.Operations.CreateImpl.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\ApiLocalOperations.cs:line 388
at Org.IdentityConnectors.Framework.Impl.Api.Local.Operations.ConnectorAPIOperationRunnerProxy.Invoke(Object proxy, MethodInfo method, Object[] args) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\ApiLocalOperations.cs:line 244
at ___proxy1.Create(ObjectClass , ICollection`1 , OperationOptions )
at Org.IdentityConnectors.Framework.Impl.Server.ConnectionProcessor.ProcessOperationRequest(OperationRequest request) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\Server.cs:line 609
I'm not sure why the username/password error could be occurring, as those fields in the AD IT Resource are correct (I've run AD recon jobs that have connected properly). Is there something I'm missing?

Pre populate adapter in OIM 11gr2 not triggered in database

Hello,
Folowing is the steps for creation of pre populated adapter in OIM
** we have created one form in OIM which is provisioned to Database**
Steps
· Installed GTC connector for Database Web App 9.*
· Created new user and Table in Database
· Created IT resource for Database
· Created Sandbox, App Instance and Form, published sandbox
· Started catalog synchronization job scheduler
· Created user and and request account to app instance.
* select application instance to catalog and checkout.
** we have created adapter as per the following link
http://idmrockstar.com/blog/2009/08/how-to-create-a-prepopulate-adapter-in-oim/
create a pre populated adapter that will populate the firstname of user in email using java class
source code:
public class AdapterClass{
public String email( String fname )
return fname;
Steps:
1) In the design console I have open the Adapter Factory and create a new adapter name :firstname
adapter type: pre-populate rule generator
click on save
2) select variable list tab:
variable name:Firstname
type:String
Map to : Resolve at runtime
click on save
3) select Adapter Task tab
* click add and select logical task
* select SET VARIABLE and click continue
* Operand Type:variable
* Operand Qualifier : FIrstname
click save and save the adapter
4) compile the java class into jar file and move the jar file into OIM_HOME\server\JavaTasks
5)Create a new Adapter with the following"
Adapter name:Email
Adapter type: Pre-populate rule Generator
click save
6) select variable list tab:
variable name: var1
Type:String
Map to:Resolve at runtime and click save
7) select Functional Task tab:"
select java click continue
select the following information:
Task name:email
Api source: JavataskJar:Adapterclass.jar( the jar file which you have create)
application api: adapteclass
click save
8) In the Application method parameters,select the first input: String
Cange Map to:Adapter variables
Set the name to:var1 and click save
9) select the output:STring
change map to:Adapter variables
set name to: return variable
10) click save and save the adapter and click on Build
Adapter is now build the next step isto join it to the form
** join the adapter to the form**
Steps:
1) click on form designer and search the related form which we have created
2) In the respective form click on create a new version and create a new version
3) and then click on Pre populate tab and click on ADD
4)select adapter field to firstname
Rule : default
Adapter : Firstname
and click on save
5) In the adapter variable field click on firstname and fill the following
map to: Process data
Qualifier : firstname
6) Repeat steps 3 to 5 to map the email adapter
7) click on save.
Now we have done with all the steps and now we have created one User submit the user
we have click on request acounts ---> search the catalog and select the application instance (select the app instance "database provisioning") ---> add to cart ---> and check out ---> fill the form leaving email field --> ready to submit ---> submit
now we have check this user in database but still pre populated fields are not reflected. since this not working so we have found the other three links
Re: OIM 11gR2 - Prepopulate Field Empty Problem
http://fusionsecurity.blogspot.in/2013/01/populating-request-attributes-in-oim.html
http://identityandaccessmanager.blogspot.in/2011/07/prepopulate-adapter-in-oim-11g.html
according to these links they mention to implements the prepopulationadapter interface into the java class and create the plugin.xml for the class which we have used in jar.
so we prepared a plugin.xml
<?xml version="1.0" encoding="UTF-8" ?>
<oimplugins xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<plugins pluginpoint="oracle.iam.request.plugins.PrePopulationAdapter">
<plugin pluginclass= "com.oracle.demo.iam.prepop.plugin.UserLoginPrePop" version="1.0" name="UserLoginPrePop">
<metadata name="PrePopulationAdapater">
<value> My_users::email</value>
</metadata>
</plugin>
</plugins>
</oimplugins>
and the java class which implements "PrePopulationAdapter".
they mention to put that jar into one directory named "lib"and paste the xml and lib folder into the OIM_HOME\server\plugin
BUt we stuck on how to configure the adapter or what is the next steps for the above process. or there is something that we have missed in the process
please do reply its urgent
Regards,
Tushar Palekar

hii i have followed all your steps regarding the pre populated adapter ,but no luck.
java code :
package com.oracle.demo.iam.prepop.plugin;
import java.io.Serializable;
import oracle.iam.request.plugins.PrePopulationAdapter;
import oracle.iam.request.vo.RequestData;
public class Userfname implements PrePopulationAdapter {
public Serializable prepopulate(RequestData requestData){
String fname = "xyz";
System.out.println("Returning fname ==== " + fname );
return fname ;
2)i have create a jar for this code and paste it into lib folder.
3) i have create a plugin.xml
<?xml version="1.0" encoding="UTF-8" ?>
<oimplugins xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<*plugins pluginpoint="oracle.iam.request.plugins.PrePopulationAdapter">*
*<plugin pluginclass= "com.oracle.demo.iam.prepop.plugin.Userfname" version="1.0" name="Userfname">*
*<metadata name="PrePopulationAdapater">*
*<value>register::LAST_NAME</value>*
*</metadata>*
*</plugin>*
*</plugins>*
*</oimplugins>*
4)i register the plugin using ant -f pluginregistration.xml register
5)i have restartthe oim server and then i create a user using the same app instatnce in which i have create the form(ie.register),and
request acount-->select app instance ---> add to cart
but the last name xyz as per the java code is not reflected in the dadbase table.
please help
tushar palekar

OIM 11gR2 - unable to suppress display of iPlanet process form

OIM 11gR2 or 11.1.2
SJSDS Connector 9.0.4
I have configured the SJSDS connector, it resource, etc and am able to manually/directly provision iPlanet User to an OIM user through the identity interface.
I have configured the process form to pre-populate all necessary fields.
I have checked the Auto Save Form checkbox within the iPlanet User Process Definition.
It is my expectation that when an administrator directly assigns the resource to a user they will not be presented with the process form. However, when we directly assign the resource, the process form is displayed causing the administrator to submit the form.
I have double checked the documentation regarding Auto Save Form within the Developer's Guide for Oracle Identity Manager 11g Release 2 (11.1.2) - E27150-03 and the Oracle® Identity Manager Connector Guide for Sun Java System Directory Release 9.0.4 - E10446-12 and I believe my expectations are correct.
1) Has anyone successfully suppressed the process form while direct or manually provisioning SJSDS through the identity interface?
2) Could the Auto Save Form be only related to request-based provisioning?
Thank you in advance.

These are also good questions but I'll give details :-)
1) Does that make the "Auto Save Form" checkbox useless? -
NO, If you don't do this then your Provisioning will stuck into System Validation.
2) Can you "Auto Save" the Application Instance form?
NO, as per Oracle either hide these attributes or delete these attributes but there's no clean way to delete such things.
Question For You:
If you don't want to Auto Save your Application Instance Form then why did you create that.
Workaround:
If you don't want Application Instance then create one more Application Instance without any form

OIM 11gr2 On-behalf removal of accounts/entitlements

Hi,
We have a requirement with our client where a user can request for removal of accounts/entitlements on behalf of other user.
We understand add request process onbehalf of some user but not sure about onbehalf removal process.
Please let me know if accounts/entitlement removal can be raised on behalf of other user. Is it supported out of box? If not is it possible doing some customization?
Thanks

But sir, the groups are listed under the Accounts tab. Is there any schedule job provided by OIM 11gR2 which results in the display of Groups assigned to the user as well under the Accounts tab ?
Edited by: IDM_newbie on Jan 25, 2013 1:51 AM

Authorization Policy for Modify user in OIM 11gR2

Hi Experts,
Requirement: I want the users in particular org not to modify certain user attributes and users from other org should be allowed to modify user.
I have created user1 whose organization is org1 and role is role1. I have also created user user2 under same org and same role. I assigned the Admin Role "User Administrator" role to user2.
So If user2 from same org1 tries to modify certain attributes then OIM should throw error message. I have completed till this.
But when the user from diff org say org2 with Admin Role "User Administrator" tries to modify user, OIM is not allowing to modify user which should not be the case.
I want the Auth Policy to trigger only for Org1. I have specified the below condition for my custom policy in OES admin console but it is not triggering.
The condition is
IF ( OrclOIMTargetEntity = 'true' AND OrclOIMUserOrganizations = 'true' AND STRING_AT_LEAST_ONE_MEMBER_OF(OrclOIMUserOrganizations,['25','1000000']) = true )
What am I missing?
Any help is much appreciated.

Hi
Can anyone let me know the steps to restrict modify user operation for the users belonging to specific organization in OIM 11gR2. The condition which I specified under Authorization Policy in APM console is not triggering at all.
Thanks!

OIM 11gR2 - Task Assignment

Similar Messages

Maybe you are looking for