OIM integration with Windows CA

I am looking into how to integrate OIM with a Windows certificate authority and I wanted to see if anyone has looked into this issue.
From a business requirements standpoint I need to support three use cases:
• User creation
• User termination
• User rehire
User creation is simple as I just give the user an AD account and enable the autoenrollment on the AD side (http://technet.microsoft.com/en-us/library/cc731522.aspx)
Termination is a bit trickier as disabling the AD account does not revoke the certificate (and probably shouldn't). It seems like I need to make a specific call out to the windows CA. One option seems to be to execute the windows command line tool "certutil" through a Java wrapper. Has anyone any other suggestion? Is there perhaps a webservice available?
Rehire basically seems to need the same method as the termination case.
Best regards
/Martin

I did take a look at that API but it doesn't seem to include funtionality for actually revoking certs.
The cerificates are user certificates used to identify users to a WLAN installation.
(but I am not a c++ programmer so the problem may be me rathar than the API)
Best regards
/Martin
Edited by: martin.sandren on Sep 3, 2010 10:53 AM

Similar Messages

Flash Player integrated with Windows 8 has stopped working...can't seem to upgrade to newer version Flash Player ?

One day watched videos with no problem. Next day, can't watch videos! Site says I need Flash 10.0 or higher. When I try to check what version I have, it says that Flash player is integrated with Windows 8, no need to install Flash Player. I am thinking that there are newer versions of Flash Player than what is integrated with Windows 8, but it's like I'm going around in circles, can't seem to upgrade to a newer version.

First, confirm that ActiveX Filtering is configured to allow Flash content:
https://forums.adobe.com/thread/867968
Internet Explorer 11 introduces a number of changes both to how the browser identifies itself to remote web servers, and to how it processes JavaScript intended to target behaviors specific to Internet Explorer. Unfortunately, this means that content on some sites will be broken until the content provider changes their site to conform to the new development approach required by modern versions of IE.
You can try to work around these issues by using Compatibility View:
http://windows.microsoft.com/en-us/internet-explorer/use-compatibility-view#ie=ie-11
If that is too inconvenient, using Google Chrome may be a preferable alternative.

OIM Integration with Active Directory Federation Services (ADFS)

Hello friends
I have a question about the integration of Oracle Identity Manager with Active Directory which is federated with another external directory for ADFS. My question is:
What considerations should be to contemplate if I have an active directory federated environment when carrying out the integration with Identity Manager?
I use version 9.1.0.2 of Oracle Identity Manager with Microsoft Active Directory Connector User Management 9.1.1.7
Thanks for the support.

First consideration is that the OIM's target ADFS - in the federated scenario, will that participate as a Service provider or identity provider. I would think identity provider.
Next consideration: What all attributes are required to be played in the SAML assertion to the other end-point? All these attributes must be present and should be provisioned to the AD in this case.
So, OIM should be set up (UDF etc) to provision all those attributes needed in the SAML.
Next consideration: What all scenario to support? IdP initiated or SP initiated? If SP initiated, then process will hv to be defined if a user id does not exist in the AD of the OIM target. Will the request be failed or a in-time provisioning should happen.
Hope this helps.

OIM integration with MS CRM

Guys,
Anybody has ever done the MS CRM integration with OIM.
MY requirement is as follows
User initiates a self service request for the application and may populate some fields like country or primary service line (fields yet to be determined, but assuming the values for each field will be maintained in a lookup field)
First Approval Step: User’s Manager must complete any missing required attributes that the user didn’t fill and must also populate the access level field (values will be something like local, country, regional or global), but again these will be pulled from a lookup field. Manager provides first level approval
Second Approval Step: The owner approves/rejects the approval
Provision the user to the application (notification sent to the user), also, provision user to AD group for the application
Edited by: a73210 on Oct 28, 2009 10:42 PM

I don have exp with MS CRM but if you have APIs then you can buid your custom connector. And for other things of your requirement.
Just create an Object form with the fields as per ur requirement and use pre populate adapter to populate these fields.
While creating form fields go to Properties tab and select property Required = true for required fields.
And you can make fields mandatory while creating the form so OIM will validate automatically that whether required fields are filled or not.
Create an Approval Process.
Create two task Approval1 and Approval2 and assign both the tasks to two different approvers.
Go to Approval1 > Responses
Select Approve and below in Task to Generate select Approval2.
You are done with 2nd level of approval.

OIM integration with EBS

Integrating OIM 9102 with EBS 12.0.6 and using User Management with HR Foundation Connector.
while provisioning provided some dummy employee number for employee number and its giving the error and
mentioned some default values for Business group id and person type id in Lookup.Lookup.EBS.UMHRMS.Configuration like 212 and 13 its throwing error
DEBUG,20 May 2010 18:11:30,315,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagementHelper : setProcParamsWithFormData:: FINISHED
DEBUG,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagementHelper : createEBSEmployee : Callable Statement return value : 1
DEBUG,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagementHelper : createEBSEmployee : Person ID : 0
DEBUG,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagementHelper : createEBSEmployee:: FINISHED
INFO,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagement : createEmployee : Person ID returned after creating a person is invalid. Person ID = 0
DEBUG,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagement : createEmployee : Create employee result: ERROR
DEBUG,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagement : createEmployee:: FINISHED
DEBUG,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagement : createUserHRF : Result of createEmployee : ERROR
DEBUG,20 May 2010 18:11:30,430,[OIMCP.EBSUM],oracle.iam.connectors.ebs.usermgmt.integration.EBSUserManagement : createUserHRF : Status = ERROR

Hi!
How did you solve the error? We're facing the same one.
Have no idea what are we doing wrong

WLC integrating with Windows 2008 AD

Hi,
I want to integrate WLC with windows 2008 server. If anybody done this integration i would like to know what are the step i need to do in the Microsoft Side, If you have any document related to MS 2008 integration pls share the information with me.
Thanks in adavence.
Regards,
Sunish

Can you provide more detail around what you mean by integrate? I don't think a WLC can talk directly to AD (Kerberos, LDAP, or otherwise).
If what you mean by "integrate" is to be able to authenticate wireless users against AD, then you will need something to proxy that authentication. That is usually a RADIUS server. Cisco ACS and Microsoft IAS and two common RADIUS servers, both of which can talk to AD. Check out the Cisco ACS 4.2 configuration guide for a good example. Here's a link to an older Microsoft article, but it still applies to 2008 (Microsoft IAS is still included with Windows Server).
http://www.microsoft.com/downloads/details.aspx?familyid=0f7fa9a2-e113-415b-b2a9-b6a3d64c48f5&displaylang=en

OIM integration with Blaze Advisor

Here we are integrating Oracle Identity Manager with Fair Isaac Blaze Advisor.
Any document which talk about Blaze Advisor integration with Oracle Identity manager would be really helpful

Funny, I never thought I would see those two products together! I've been meaning to write a blog about our experience with OIM and JBoss Drools but I haven't gotten around to it (stay tuned) What are you trying to do with Blaze?
--deb (OIM AND Blaze Advisor expert)

Reader X integration with Windows Explorer and protected mode

Hello all.
I'm having some problems with Adobe Reader X under Windows 7 and it seems that I need to disable protected mode. I disabled it by unchecking the related option in edit-preferences, also I created the registry key for the local user (bProtectedMode = 0).
After doing that, the protected mode seems to be disables when I open pdf documents with Reader X, but it's still enabled when previewing documents thumbnails in windows explorer. The issue is that when I open a folder containing pdf files and left click or right click them, two AcroRd32.exe processes spawn and it seems to me that it's a protected mode behaviour (broker process + sandboxed renderer process).
I'd like to know if it's possible to fully disable protected mode so that it remains disabled even when I'm navigating directories with Windows Explorer and documents are previewed. My current Adobe Reader version is 10.1.3.
Thank you very much.

Hi Fernando,
Here's a statement that hopefully helps or at least solves your mystery:
While Protected Mode can be disabled for PDFs viewed with the product, Adobe continues to protect you when 3rd party software invokes a Reader process; that is, Protected Mode sandboxing cannot be disabled for shell extensions. For example, when you use Windows Explorer to preview a PDF in the Preview Pane, it starts a Reader process to display the preview. In such cases, Task Manager shows that two AcroRd32.exe processes spawn and that the operation is occurring with Protected Mode enabled.
Ben

OIM integration with Microsoft CRM by using webservices? (OIM: Oracle Identity Management)

Hi Guys,
can you provide me integration document for my new project
OIM with Microsoft CRM, by using webservices.
Venkat
[email protected]

user1106726 wrote:
We currently have ILM 2007 in our environment with limited usage at the moment. We are looking at purchasing Oracle Identity Manager to implement an enterprise wide IAM solution.
We were wondering if it is possible to continue using ILM like a middleware between our AD forests and the Oracle IdM. Where the Oracle IdM is the overarching IAM solution and Microsoft ILM 2007/FIM 2010 is like the metadirectory for our AD forests.
Is this possible without installing the Oracle Management Connector on any of our DCs and using ILM as the directory that Oracle IdM connects to. All AD account provisioning/de-provisioning, acct updates, password sync/reset will be initiated from the Oracle IdM to ILM and then implemented on AD. In order words no direct interaction with AD domain controllers from Oracle IdM, everything will go to ILM and ILM in turn applies it to AD.
Is this possible?yes
>
Is there a custom connector that will work with ILM 2007/FIM 2010Yes, if you write one you will have a custom connector
>
Is this a simple customization or something that can be problematic and expensive?It won't be simple. Problematic and expensive maybe, depends on how good you are with OIM and ILM

OIM integration with OpenDJ : Issue with OU Reconciliation

Hi All,
I am trying to integrate OIM and OpenDJ for provisioning of users.I am facing issues with OU reconciliation. I had performed the following steps.
1. Copied OID 11.1.1.5 connector binaries under OIM_HOME\server\ConnectorDefaultDirectory.
2. Installed connector by choosing DSEE server from the list.
3. Create IT Rsource and Application instance.
4. Modified Lookup.LDAP.Configuration based on OpenDJ schema.
5. Modified "LDAP Connector OU Lookup Reconciliation" scheduled task parameters for IT resource name and executed it. it executes successfully without any errors but the OU from OpenDJ are not populated into the organization lookup( Lookup.LDAP.Organization - this is the Lookup name value specified in the scheduled task ).
6. I had enabled the connector logs for debugging, as per logs when the scheduled job is ran I can see the organizationunits from OpenDj in the logs. Even the logs states that scheduled task was executes successfully.
Please suggest why the lookup name is not being populated by the organizations. Please provide any suggestions or steps to debug this furthur.
For example, below lines from the logs shows the organization(ou=Internal) from OpenDJ.
[2013-01-13T01:55:16.040-08:00] [oim_server1] [TRACE] [] [ORG.IDENTITYCONNECTORS.LDAP.CONNECTOROBJECTUTIL] [tid: Thread-322] [userId: oiminternal] [ecid: 0000JkmuRveFg4Uay5R_6G1GwaZX000001,1:28786] [SRC_CLASS: com.thortech.util.logging.Logger] [APP: oim#11.1.2.0.0] [SRC_METHOD: debug] org.identityconnectors.ldap.ConnectorObjectUtil : createConnectorObject : ENTRY createConnectorObject(ldapGroups=org.identityconnectors.ldap.LdapConnection@1773f6bb,posixRefAttrs=ObjectClass: OU,posixGroups=org.identityconnectors.ldap.GroupHelper@22244683,roles=org.identityconnectors.ldap.EDIRRolesHelper@7b9153f7,parentDN=o=sca,rdnAttributes=ou=Internal,ou=External,ou=spe: null:null:{entryuuid=entryUUID: 873193ec-b60d-35fb-b7e2-f8da3c50aa8e, ou=ou: Internal, objectclass=objectClass: organizationalUnit, top},rdnAttributeType=[__NAME__, __UID__, objectClass, Organisation Unit Name, ou],value=true)
[2013-01-13T01:55:16.041-08:00] [oim_server1] [TRACE] [] [ORG.IDENTITYCONNECTORS.LDAP.LDAPENTRY] [tid: Thread-322] [userId: oiminternal] [ecid: 0000JkmuRveFg4Uay5R_6G1GwaZX000001,1:28786] [SRC_CLASS: com.thortech.util.logging.Logger] [APP: oim#11.1.2.0.0] [SRC_METHOD: debug] org.identityconnectors.ldap.LdapEntry : create : ENTRY create(baseDN=o=sca,*result=ou=Internal,ou=External,ou=spe*: null:null:{entryuuid=entryUUID: 873193ec-b60d-35fb-b7e2-f8da3c50aa8e, ou=ou: Internal, objectclass=objectClass: organizationalUnit, top})
[2013-01-13T01:55:16.041-08:00] [oim_server1] [TRACE] [] [ORG.IDENTITYCONNECTORS.LDAP.LDAPENTRY] [tid: Thread-322] [userId: oiminternal] [ecid: 0000JkmuRveFg4Uay5R_6G1GwaZX000001,1:28786] [SRC_CLASS: com.thortech.util.logging.Logger] [APP: oim#11.1.2.0.0] [SRC_METHOD: debug] org.identityconnectors.ldap.LdapEntry : create : RETURN create(baseDN=o=sca,result=ou=Internal,ou=External,ou=spe: null:null:{entryuuid=entryUUID: 873193ec-b60d-35fb-b7e2-f8da3c50aa8e, ou=ou: Internal, objectclass=objectClass: organizationalUnit, top}) returns: org.identityconnectors.ldap.LdapEntry$SearchResultBased@73366019
Thanks,
Anumolu.
Edited by: Anumolu111 on Jan 13, 2013 4:14 AM

Hi All,
I am trying to integrate OIM and OpenDJ for provisioning of users.I am facing issues with OU reconciliation. I had performed the following steps.
1. Copied OID 11.1.1.5 connector binaries under OIM_HOME\server\ConnectorDefaultDirectory.
2. Installed connector by choosing DSEE server from the list.
3. Create IT Rsource and Application instance.
4. Modified Lookup.LDAP.Configuration based on OpenDJ schema.
5. Modified "LDAP Connector OU Lookup Reconciliation" scheduled task parameters for IT resource name and executed it. it executes successfully without any errors but the OU from OpenDJ are not populated into the organization lookup( Lookup.LDAP.Organization - this is the Lookup name value specified in the scheduled task ).
6. I had enabled the connector logs for debugging, as per logs when the scheduled job is ran I can see the organizationunits from OpenDj in the logs. Even the logs states that scheduled task was executes successfully.
Please suggest why the lookup name is not being populated by the organizations. Please provide any suggestions or steps to debug this furthur.
For example, below lines from the logs shows the organization(ou=Internal) from OpenDJ.
[2013-01-13T01:55:16.040-08:00] [oim_server1] [TRACE] [] [ORG.IDENTITYCONNECTORS.LDAP.CONNECTOROBJECTUTIL] [tid: Thread-322] [userId: oiminternal] [ecid: 0000JkmuRveFg4Uay5R_6G1GwaZX000001,1:28786] [SRC_CLASS: com.thortech.util.logging.Logger] [APP: oim#11.1.2.0.0] [SRC_METHOD: debug] org.identityconnectors.ldap.ConnectorObjectUtil : createConnectorObject : ENTRY createConnectorObject(ldapGroups=org.identityconnectors.ldap.LdapConnection@1773f6bb,posixRefAttrs=ObjectClass: OU,posixGroups=org.identityconnectors.ldap.GroupHelper@22244683,roles=org.identityconnectors.ldap.EDIRRolesHelper@7b9153f7,parentDN=o=sca,rdnAttributes=ou=Internal,ou=External,ou=spe: null:null:{entryuuid=entryUUID: 873193ec-b60d-35fb-b7e2-f8da3c50aa8e, ou=ou: Internal, objectclass=objectClass: organizationalUnit, top},rdnAttributeType=[__NAME__, __UID__, objectClass, Organisation Unit Name, ou],value=true)
[2013-01-13T01:55:16.041-08:00] [oim_server1] [TRACE] [] [ORG.IDENTITYCONNECTORS.LDAP.LDAPENTRY] [tid: Thread-322] [userId: oiminternal] [ecid: 0000JkmuRveFg4Uay5R_6G1GwaZX000001,1:28786] [SRC_CLASS: com.thortech.util.logging.Logger] [APP: oim#11.1.2.0.0] [SRC_METHOD: debug] org.identityconnectors.ldap.LdapEntry : create : ENTRY create(baseDN=o=sca,*result=ou=Internal,ou=External,ou=spe*: null:null:{entryuuid=entryUUID: 873193ec-b60d-35fb-b7e2-f8da3c50aa8e, ou=ou: Internal, objectclass=objectClass: organizationalUnit, top})
[2013-01-13T01:55:16.041-08:00] [oim_server1] [TRACE] [] [ORG.IDENTITYCONNECTORS.LDAP.LDAPENTRY] [tid: Thread-322] [userId: oiminternal] [ecid: 0000JkmuRveFg4Uay5R_6G1GwaZX000001,1:28786] [SRC_CLASS: com.thortech.util.logging.Logger] [APP: oim#11.1.2.0.0] [SRC_METHOD: debug] org.identityconnectors.ldap.LdapEntry : create : RETURN create(baseDN=o=sca,result=ou=Internal,ou=External,ou=spe: null:null:{entryuuid=entryUUID: 873193ec-b60d-35fb-b7e2-f8da3c50aa8e, ou=ou: Internal, objectclass=objectClass: organizationalUnit, top}) returns: org.identityconnectors.ldap.LdapEntry$SearchResultBased@73366019
Thanks,
Anumolu.
Edited by: Anumolu111 on Jan 13, 2013 4:14 AM

OIM Integration with Oracle Retek -- Suggestions / Prior Experience ?

Hello,
We are looking to integrate OIM with Retek suite for user management (Automated Provisioning / Termination etc).
Has anyone done this before ? Is DB connector feasible option ? Any whitepapers ?
Thanks,

'Oracle Identity MANAGEMENT' is a high level view of the digital lifecycle and is a suite of Identity Management products from Oracle. There is a product 'Oracle Identity MANAGER' which is primarily a provisioning tool. Its confusing and misleading when people refer both as OIM.
In order to synch/integrate Oracle Internet Directory (OID) and Active Directory (AD), or OID and any 3rd party directory, we need not install Oracle Identity Manager. During the installation of OID, it'll guide you to install Oracle Application Server Infrastructure.

Reader X plugin integration with Windows Explorer 8 and Protected Mode

Hello
I am viewing pdfs with Reader 10.1.3 within ie8 on XP
I have a Reader plug-in (WordFinder.api) that works ok with Protected Mode disabled.
Unfortunately I have customers that require Protected Mode enabled and this stops the plugin working.
Within my code, calling DdeConnect returns 0 (fail)
I have populated and enabled the ProtectedModeWhitelistConfig.txt but cannot account for the final access error for DINPUTWINMM
Here is the log...
[10:19/13:34:19] Adobe Reader Protected Mode Logging Initiated
[10:19/13:34:19] Found custom policy file: C:\Program Files\Adobe\Reader 10.0\Reader\ProtectedModeWhitelistConfig.txt
[10:19/13:34:19] Adding custom policy: PROCESS_ALL_EXEC = C:\Program Files\Adobe\Reader 10.0\Reader\plug_ins\WordFinder.api
[10:19/13:34:19] Adding custom policy: REG_ALLOW_ANY = HKEY_LOCAL_MACHINE\SOFTWARE\Adobe*
[10:19/13:34:19] Adding custom policy: REG_ALLOW_ANY = HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joy stick\Winmm*
[10:19/13:34:19] Adding custom policy: REG_ALLOW_ANY = HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystic k\Winmm*
[10:19/13:34:19] Adding custom policy: REG_ALLOW_ANY = HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing
[10:19/13:34:19] Adding custom policy: REG_ALLOW_ANY = HKEY_CURRENT_USER\SOFTWARE\Adobe*
[10:19/13:34:19] Adding custom policy: REG_ALLOW_ANY = HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication*
[10:19/13:34:19] Adding custom policy: REG_ALLOW_ANY = HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings*
[10:19/13:34:19] Adding custom policy: EVENTS_ALLOW_ANY = MSFT.VSA*
[10:19/13:34:19] Adding custom policy: EVENTS_ALLOW_ANY = _fCanRegisterWithShellService
[10:19/13:34:19] Adding custom policy: EVENTS_ALLOW_ANY = DINPUTWINMM
[10:19/13:34:19] Adding custom policy: MUTANT_ALLOW_ANY = \BaseNamedObjects\*RasPBFile*
[10:19/13:34:23] CreateEvent: STATUS_ACCESS_DENIED
[10:19/13:34:23] name: DINPUTWINMM
Can I add DINPUTWINMM? and if so what is the syntax.
Thankyou
Nick

Hi Fernando,
Here's a statement that hopefully helps or at least solves your mystery:
While Protected Mode can be disabled for PDFs viewed with the product, Adobe continues to protect you when 3rd party software invokes a Reader process; that is, Protected Mode sandboxing cannot be disabled for shell extensions. For example, when you use Windows Explorer to preview a PDF in the Preview Pane, it starts a Reader process to display the preview. In such cases, Task Manager shows that two AcroRd32.exe processes spawn and that the operation is occurring with Protected Mode enabled.
Ben

OIM Integration with LotusDomino

Hi,
While provisioning the userA data from OIM to LotusDomino the userA contains the Email address, and if the UserB also have the same name as of UserA then there will be collision in E-mail id's.
How OIM or we need to take care that the e-mail names of diffrent users of same names should not collide in e-mail names...
Early reply is appreciated

There are a couple of different options to do this.
First check if the cobol system has a user management solution like RACF or perhaps even an LDAP based user store.
If that doesn't work check with the current sys admin how they manage users now. It is quite common that they use an SSH or telnet based client and in that case you can implement it using either the standard connectors or custom connector using screen scraping. Not fast or efficient but works.
Sometimes the user store is actually a db table and in that case you can use the db connector.
Hope this helps
/Martin

Integrating with Windows o/s

I'm a small business owner and seriously thinking of making the leap to Apple. Enough blue screens, hardware and software failures, blah blah blah. I have four years worth of business files saved to MS Word, MS Outlook, MS Excel, MS Powerpoint, MS Project. Can I easily access these files, saved on external hard drive, via new Mac Book (thinking of getting the 15" Mac Book with Retina Display ... happy to pay the $ for piece of mind). Most appreciate any comments from everyone.

edex67 wrote:
All those files will work, apart from Project. For Project, you will need to install Windows on your Mac. You could always move over to OmniPlan.
Depending upon the version of Project, I have had some success using "OpenProj" on MacOS to read MS-Project files, thus allowing me to migrate tehm to my Mac as well. OpenProj is also freeware, so it might be worth checking out as well.
If the original poster has the option, it might be worth copying some of their files onto an external HD and taking that with them to an Apple Store. The sales rep should be able to get a tech over to help you see how each one would load on a new Mac before you make the purchase. In a worst case scenario, you could always load Windows on your new Mac (either native using Boot Camp, or virtual using Paralles, VMWare Fusion, Virtual Box, etc.) and your existing WIndows software would then be able to access the files, but you would stillbe running Windows. Granted, the Windows problems you are having do sound more hardware related, so this might be all you need to correct your frustration, but you will be happier using Mac OS on your Mac hardware if you can...

Cisco Secure ACS 4.1 with Windows Database

I have ACS 4.1 integrated with Windows Database (check mark in allow Remote DialIn).
When we terminate a employee do I have to also delete their ACS User Profile?
If I delete the user in AD will they automatically delete the user in ACS?
Where can I read more about this?

Hi,
If you delete the user in AD, then it would not authenticate the user even if the dynamic mapped user exists in the ACS database, as the password would not be verified from the AD for the user.
The dynamically mapped user entry would still exist in ACS and would not get deleted if the user is deleted from AD.
tnx
somishra

OIM integration with Windows CA

Similar Messages

Maybe you are looking for