OIM manipulating provisioning - description on resource profile

Kamaraden!
I have an OIM installation with AD and Exchange connectors. When users are provisioned, going back to the resource profile, you can see the resource and several data, for example the Description field. For AD User, descriptions shows the windows logon name (what I think it is correct), and for Exchange, it shows a number (probably a key of some table). Trying to discover from where this description field is taken, I realized that it comes from the ORC table, ORC_TOS_INSTANCE_KEY (if I change it, it changes in the description of the resource profile too).
I have many questions about this. First of all, who puts this value in this field of the ORC table. I followed the provisioning tasks for AD and Exghange (Create User and Create Mailbox), and got inside the code (I decompiled it with cavaj), but the logic of the adapters attached to that process task and the code in the java classes, only creates efectively the user or the mailbox, and returns.. so, when the resource profile is being modified?
Other question related to that, is where are the conventions of the process tasks names for provisioning? For example, FIELD Updated reacts over the event of modification of FIELD. Create User sounds logic for provisioning when a resource is granted on an application, but Create Mailbox? How is this task attached with the provisioning submit of a resource?
DrLDAP

You are right, the number that you see in the description field in the resource profile is the ORC KEY. If you need to change this to show any value in the process form, you can do so by going to the provisioning workflow form in the design console and click of Map Descriptive field.
I dont think it has been documented anywhere about the field name<space updated> task.
The name Create User or Create Mailbox has no significance. you can really keep any name for the task. The way OIM understands that it needs to execute this task is if it sees the task is marked as "Required for Completion". all tasks marked required for completion will be executed by oim before it can say that provisioning has been completed. For e.g i a provisioning process all you might need to do is send a mail and not create any account etc.
then you have a task "Send mail" (or any name) mark the task as required for completion. Now when this resource is granted by the admin to the user, this task would have executed. The name is not of essence when it comes to provisioning.

Similar Messages

OIM - Users provisioned with different resource form versions

Hi !!
we are having some problems with different resource form versions and maybe you can help us.
We have two different versions of one resource form. One of them has 2 extra fields.
Some users were provisioned with that resource with the previous form version (no extra fields) and some with the new one (extra fields).
The problem is that now, if we try to edit that resource for the users with the old version, we are not able to edit or even see the information for those extra fields.
It seems that they have been associated with the old version and we need to change it in order to make them use the new one. Is that possible? How can we fix that?
Thanks in advance.

Alternatively you can manually update the form version in the OIM database.
If it is a small number of forms it might be easier to do that then to bother with fvc.
Best regards
/Martin

OIM 9.1.0.2 Resource Profile Query

Hello
I need to get the usr_key or any info on the users in OIM that have a certain condition. I have a number of OID resources for users that have a status or 'provisioned' but when looking at the resource tasks the system validation is set to 'cancelled'. Due to this, updates are not flowing to these users. I am looking through the tables to try to find the resource task list and the status info so I can find the system validation cancelled and location those users. Does anyone have a query to search through and find all users with system validation = canceled and resource status as provisioned? Any help you can give would be appreciated.
Thanks
Nick

I'm positive there's a great way to do it with SQL, but you'll need to look at 4 tables:
1) OBJ (Objects) - Here you are looking in OBJ_NAME for 'OID User', once found get the OBJ_KEY value for the row.
2) OST (Object Status) - In this table, you can find all the statuses for the OID User resource based on the OBJ_KEY value. Look for the applicable ones and get the OST_KEY value for each row.
3) OIU (Object Instance for Users) - Now you can query this table for all results where OST_KEY equals the desired values as found in step 2.
4) USR (Users) - Here you can get the User ID's (usr_login), User Key (usr_key) or any other value for users to help with the query.

How to enable only one resource profile outof 3 while disabling user in OIM

Hello,
I have 3 resource profile for AD user with 3 diffrent IT resources.
When i try to disable the user in OIM, then it disables all the resource profiles attached for that user.
I would like NOT to disable one of AD User Resource profile out of 3 .
How can I do that?
Thanks

This is the same post as one made about a week ago.
I would suggest the following:
1. Create an adapter that has an input of the domain, or some other identifying attribute. In this adapter, use logic to return a response of either DISABLE or DO_NOTHING.
2. Create a new Process Task called something like "Disable Resource Determiner". Attach your adapter you just made, and on your response codes, for DISABLE, trigger the disable task, and on DO_NOTHING, then do nothing... Set this adapter to be triggered on disable.
3. On your previous disable task, remove the disable trigger.
Now when your disable is triggered, you have logic to determine which target resource is being used, and then whether or not to disable the resource or do nothing.
-Kevin

Restrict the reources on OIM resource profile

Hi all,
Is it possible to restrict the resources that show up on the resource profile.
I have a requirement where AD administrators should o nly manage their resource.
Thanks,
M

Go to Resource Object and Remove the Allow All check box , it wont show up in resource file for any user
Also , check the Provision by Object Admin Only
Thanks
Regards
Edited by: Surendra Singh Khatana on Apr 7, 2010 11:39 PM

OIM: Hide provisioned roles/responsibilities in the modify provisioned resource request dataset

Hi,
We are provisioning Oracle E-Business Suite R12 through EBS UM connector. Is there a way where we can either hide the already provisioned EBS roles/responsibilities in the available list of roles/responsibilities or move these under Selected Responsibilities and make them non-editable ? I couldn't find a way to do that in the Modify Provisioned Resource E-Business Suite Request Dataset. Please advise
Thanking in Advance
Abir

1. End user raising the request is able to view the process form, I need to restrict few attributes i.e. position and responsiblity should not be visible to end userEnd user will see Application Instance Form and you can customize the UI to hide attributes
2. Position and Responsibility should be provided by approver (this is specified in request data set of provision resource)
Make your Java Code/Beans/Expression to show/hide attributes conditionally.
3. As per Oracle document there is no request data set for PROVISION and MODIFY resource. What is the replacement for this?Application Instance Form
4. After Request is raised it has been assgined to xelsysadm, how do i control the approval ?Approval Policies

Removing items in Resource Profile

Hello,
I had a poorly configured AD adapter while test provisioning a few users, and now the Resource Names are stuck in a permanent "Provisioning" status. Inside, all task say "Cancelled". Can I do anything to remove the bad "AD User" resources from a user's Resource Profile?
Thanks much
Alex

Certainly Yes. As you said that your tasks are in a status of canceled, so it means its equivalent to the Delete Resource use case. This process might be similar to the Task Archival process provided by the OOTB OIM. Refer the following section of the documentation for Section-10 Using the Task Archival Utility
http://download.oracle.com/docs/cd/E14049_01/doc.9101/e14059/tasks_archival.htm#sthref96
Hope it helps.
Thanks
Sunny

OIM-OID Provisioning - OID Group PrePopulate Approach :

Hi,
I am working on OID Connector 9.0.1.14 with OIM 11.1.1.5.
I have reconciled all the Roles and Groups from OID to OIM and can successfully provision users to the OID along with membership to these specific Roles and Groups.
I want to prepopulate the OID Group based on certain attribute from the OIM User form. My Approach so far is :
1) Created an Entity Adapter with a variable : say Org and GroupName.
2) Set the Logic as if Org = XYZ (+XYZ does exist on OIM+) set GroupName as = "OID Group 1" else set GroupName as = "OID Group 2"
3) Attached this adapter to the "OID User Group" form on the "Data Object Manager" at the pre-insert stage.
4) Mapped the Adapter variable as :
a) Org Maps to "Organization Definition" with the qualifier "Organization Name"
b) GroupName maps to the "Entity Field" with the qualifier "UD_OID_GRP_GROUP_NAME"
However nothing seems to happen when I create/modify a user with Orgization Name as XYZ and manually Provision the OID Resource. I can see the form but nothing is populated in the Group Field. Upon completing the request, I get the user provisioned to OID but without any Group information..
Is my approach right ? Am I missing something ?

Here is what I have done for a client. My requirement was for a given department, a user must have a list of groups provisioned to them. So here is what i've done:
1. Create a lookup that has Code Key = Department, Decode = CN of the groups in a delimited format.
2. Create a provisioning task that will look at the department code from the user form, reference the lookup and find the decode values. Split them based on a delimiter. Then using each value, lookup the code key value from the real lookup that contains the full distinguished name of the group in the OID Group lookup. I even appened the IT Resource Key and ~ so that my search would be Decode or Code = "IT Resource Name~CN=<CN VALUE>%". This would return only the single group code key value. And then i add it to the child table. Repeat this for all the values in the delimited field.
3. Create a provisioning task that removes the values from the child table based on the delimited value. You'll need to search through the existing child table values.
Once you have the 2 tasks, you'll want to add a value to the your Lookup.USR_PROCESS_TRIGGERS that is your group determining field. Create your task name in this lookup. On your provisioning workflow, for the Adding of the groups task, make this unconditional, and have a preceding task of the Create User. Give it the name from your Lookup.USR_PROCESS_TRIGGERS and append " - Add Groups" to the task name. Create another task called the same, but append " - Delete Groups" to the task name. On the Add Groups task, make the preceding task the Delete groups. When you map your inputs to the adapters, on the delete, select the old value check box from the User Form so that you get the old value. Now, when the value changes on the user form, it will first remove the old groups, then add the new ones. All this will be done using the child table APIs, so that the existing Insert and Delete task triggers for your child table will run.
-Kevin

OIM 11gR2 provisioning with GTC

Hello,
We are curently implementing Oracle Identity Manager 11gR2, and we are having difficulties with the implementation of the provisioning from OIM to the Target Systems exposed through a webservice on Oracle Service Bus.
We are using the Generic Technology Connectors as a basis of working. And initially we have created a GTC with only reconciliation Transport & Format Providers:
Connector Name TargetSystem1
Transport Provider (Provisioning):
Format Provider (Provisioning):
Transport Provider (Reconciliation): Database Application Tables Reconciliation
Format Provider (Reconciliation): Database Application Tables Reconciliation
We have configured the Process Definition of TargetSystem1 with all the operations (Create User, Update User, Enable User, Disable User, Delete User, etc.) connected with custom Java implementations, that are working just fine is we trigger them form Eclipse. The “Create User” task has only “Required for Completion”, “Allow Cancelation while Pending” and “Allow multiple instances” check boxes set to CHECKED; it also has all the fields in Integration TAB mapped, Responses mapped, but when we create a User in OIM and provision it with an account on the TargetSystem1_GTC Application Instance, the provisioning process in not accessing the “Create User” task to make the provisioning in the target system. The user that we are trying to provision has the account Status set to “Provisioning” and the Account Type set to “Unknown”. We have also checked the logs of OSB, but there is no activity there, because no request from OIM is being received.
After we investigated more closely the Oracle documentation for the Generic Technology Connectors we discovered that if we do not select Transport & Format Providers during the GTC creation, then the corresponding steps are not performed and they are not initialized, thus the provisioning cannot be done. The documentation also states that if we need to create custom providers in order to make the Provisioning with the GTC, but unfortunately we have no knowledge or any examples on how to do such custom providers for the provisioning of Users from OIM on the target systems via the Oracle Service Bus.
We have installed a second GTC with both provisioning and reconciliation Transport & Format Providers:
Connector Name: TargetSystem2
Transport Provider (Provisioning): Web Services
Format Provider (Provisioning): SPML
Transport Provider (Reconciliation): Database Application Tables Reconciliation
Format Provider (Reconciliation): Database Application Tables Reconciliation
The Web Services and SPML options were the only options that we could select from the out of the box connectors that are installed, and we did not find any other connectors in the download section of Oracle for this product, that can accommodate such communication. So, we configured the provisioning accordingly, and modified the “Create User” task from the TargetSystem2_GTC Process Definition, in order to use our custom adaptor instead of the adpTargetSystem2_GTC adapter that was preset when the TargetSystem2_GTC is created. But this does not help us, because the provisioning is not done, and the “Create User” task is not used. The user that we are trying to provision has the account Status set to “Provisioning” and the Account Type set to “Unknown”.
Next we tried to see if the GTC can be used to communicate directly with the OSB, using the Web Services Transport Provider and SPML Format Provider, and we did not make any modifications to the after the normal installation of the TargetSystem2 GTC. In this case the we can see that the OSB is being accessed by OIM, but unfortunately this case does not help us also, because the operations implemented on the OSB webservice have a different structure then the one SPML expects as default:
Caused by: com.thortech.xl.gc.exception.XSDValidationException: The SOAP response does not contain a valid SPML response type. Should be one of these -->addResponse modifyResponse deleteResponse resumeResponse suspendResponse setPasswordResponse
Do you have any suggestion on how to make the provisioning process work?
Edited by: user1717356 on 22.10.2012 03:22

Hi,
I think you need to put this check only for few attributes?
If Yes, then lets suppose you want to have a check for Country Field in Database which once modified by target Admin, then OIM should know.
1) Create one dummy field CountryDummy (Hidden) in OIM TargetProcess form and dont map it to any target attributes. This dummy field will only store values populated from OIM user profile to -> DB Connector Process Form.
2) On success of "Reconcilation Update Recievced", Put a custom process task which does a comparison with "CountryDummy" & "Country" and inform Admin using email notifications that this mismatch has been found.
HTH,
~J

OIM 10g - Provisioning issues

Hi Gurus,
I have the following situation in the OIM:
I have 2 resources (A and B). B is configured to Allow Multiple and depends that A is provisioned.
The resource A is already provisioned. So, when I need to provision B, is being showed to user fill out the resource forms of the B as well as of the resource A, and the workflow's process of A is triggered again.
This is causing a bad user experience.
Any tip in this behavior.
TIA,
Carlos

Kevin,
The resource form is necessary because I have a lot target attributes I do not have in the user definition.
But the my principal concern is, should the resource form of the resource A (already provisioned) be showed to the user for filling out? The request was did only for the resource B. Is this behavior correct?
Detail: When the resource A is not in Depends On tab, the A's resource form is not showed during request.

OIM (Xellerate) Provisioning Functionality with Web Services

Hi,
Has anyone had any experience with needing to issue user provisioning requests to Oracle Identity Manager (formally Xellerate) using web services?
I envision that it would most likely involve using SPML as the standard communication protocol within the SOAP messages.
From my readings, the current version of OIM does not offer web services as one of its interfaces, but I'd like to check if anyone has already done this themselves?
Any help is appreciated.
Thanks.

If you have made some custom connector using internal oim api, you can made your own web service interface but outside of OIM infrastructure.
We have made some custom connector test directly from Eclipse, before integrate it inside OIM, so if you want to provide a web service interface to publish some OIM funtionality should be possible do it using OIM API.
using generic connector let you use only a SPML webservice for provisioning resources, your webservice must parse the SPML message and then run your own logic, however you must login to OIM and then assign the resource to the user using the connector, There is not a web service interface to do it outside OIM infrastructure.

Provision non root resource object

Hi all!
I have sucessfully made configuration with OIM and ESSO-PG with MS ADAM based repository. Now I'd like to provision some non root resource objects to my repository for user, but I wonder how to do it. I have one process - AD USER, and most of my users reside in AD. Do I need to create dummy process definition to attach Passlogic task for it? Or there is another solution to acomplish this?
Best
Mariusz

I mean provision non root resource object such as new credentials set for application in esso repository (in esso repository it is vGOSecret class). For example I have root resource object for esso (one for esso repository and it is related to AD_USER process) and I can have many non root resources objects (for example DB, iPlanet and these are related to iPlanet_User, DB_User process). In my configuration I'd like to provision new non resources objects for users, but my users are in AD mainly. Thanks for Your reply!
Best
Mariusz

OIM Failed provisioning

Hi All
I have integrated OIM with OID as target resource. Suppose OID goes down for some time. I want to know whether OIM will automatically retry the failed tasks in case the target OID was down for some time or the OIM admin will have to retry the task manually again.
How do we keep a track of how many tasks have failed since the OID was down. Has someone faced such case in past.
Thanks

How do we keep a track of how many tasks have failed since the OID was down.
Another possible approach is, create a group say OID Support Officer and give him menu item To-Do List Open Tasks menu item to see Open Provisioning Tasks in Admin Console. In OID process definition go to Assignment tab of Create User task then select target type as Group and select this group under Group lookup.
Now login as user who belongs to the group OID Support Officer and you can see number of rejected tasks under Open Provisioning Tasks.

OIM approval / provisioning workflows

Hi All
I have a query about OIM approval / provisioning workflows.
Application X (e.g. Active Directory) has an OOTB connector which can provision the user and manage his role in the application. The user can raise request for role change via OIM Admin console.
My query - Can I configure access policy/user group for creation of a base user identity in the application X. This will create user identities for all users in application X without any roles. Later user should be able to request for roles and upon approval, his role should be updated in application X.
Can this scenario can be implemented with any OOTB connector with provisioning and role approval workflows in place. Do you see any complexity in this. Please provide your comments.

The base provisioning van be done using access policies.
If you want request based role management in pre OIM 11g you would have to do it over custom ROs. There are a couple of ways to do this.
The easiest way to do is to combine the approaches in these two postings and create a custom RO that moves the user into an OIM group that has an attached access policy that manipulates the child table on the base target system RO.
http://iamreflections.blogspot.com/2010/09/oim-howto-one-resource-object-per.html
http://iamreflections.blogspot.com/2010/09/oim-howto-target-system-group.html
Please take a look and see if this is understandable. I probably should write another entry that addresses this specific use case.
/Martin

Error : Severity and Description Path Resource Location Creation Time Id

i have this error :
Severity and Description Path Resource Location Creation Time Id
invalid character or markup found in script block. Try surrounding your code with a CDATA block. essai/src essai.mxml Unknown 1236103965593 182
my source is attach code
Many thanks for your help ,
Lionceau,

look my source :
<![CDATA[
import mx.controls.Alert;
import com.adobe.rtc.events.SessionEvent; //utilisé
pour les trois blocs
import com.adobe.rtc.messaging.UserRoles; //utilisé
pour les trois blocs
import com.adobe.rtc.collaboration.AudioPublisher; //
AudioPublisher me sert pour la gestion du microphone
import com.adobe.rtc.collaboration.AudioSubscriber; // me
sert pour choisr l' aboné écouté
//import com.adobe.rtc.collaboration; // me sert pour la
gestion du microphone
//import com.adobe.rtc.clientManagers;// me sert pour la
gestion du microphone
import com.adobe.rtc.events.StreamEvent;// pour le son
(audio xml)
import mx.events.ItemClickEvent; //pour le son ( audio xml)
import mx.controls.Label;
import mx.core.UIComponent; // me sert pour la gestion du
microphone
import flash.events.EventDispatcher;// me sert pour la
gestion du microphone
// import com.adobe.rtc.components:ResizableCanvas; amettre?
//debut bloc share
import
com.adobe.rtc.sharedManagers.descriptors.FileDescriptor;
import mx.utils.UIDUtil;
import mx.collections.ArrayCollection;
import com.adobe.rtc.collaboration.FileSubscriber;
import com.adobe.rtc.sharedManagers.UserManager;
import com.adobe.rtc.messaging.NodeConfiguration;
import com.adobe.rtc.events.CollectionNodeEvent;
import com.adobe.rtc.collaboration.FilePublisher;
import com.adobe.rtc.sharedManagers.FileManager;
[Bindable]
private var applicationTitle:String = "File Publisher
Example";
// list of managers
private var _fileManager:FileManager;
private var _filePublisher:FilePublisher;
private var _fileSubscriber:FileSubscriber;
private var _userManager:UserManager;
// our datagrid dataprovider will use this collection
[Bindable]
private var _fileDescriptors:ArrayCollection = new
ArrayCollection();
// file sharing group id, it is similiar to that of folder
concept
private var _groupid:String = "_filePublisherExample";
//fin bloc share
//debut bloc camera
import com.adobe.rtc.events.UserEvent;
import com.adobe.rtc.events.SharedPropertyEvent;
import com.adobe.rtc.events.ConnectSessionEvent;
import mx.controls.Button;
import com.adobe.coreUI.controls.CameraUserBar;
import mx.core.UITextField;
import com.adobe.rtc.events.SharedPropertyEvent;
import com.adobe.rtc.sharedModel.SharedProperty;
import com.adobe.rtc.collaboration.WebcamSubscriber;
import mx.containers.VBox;
import com.adobe.rtc.events.UserEvent;
import com.adobe.rtc.sharedManagers.StreamManager ;
import
com.adobe.rtc.sharedManagers.descriptors.StreamDescriptor ;
private var currentSubscriber:WebcamSubscriber ;
private var sharedProperty:SharedProperty ;
* This example shows how the camera component can be used
with a publisher and a
* number of subscribers. The publisher has a big view while
subscribers have a small view.
* A shared property is used to pass the stream to the
publisher's user interface.
* Every user is provided with play and pause handlers.
private function onCreationComplete():void
sessionManager.roomManager.autoPromote = true ;
sessionManager.roomManager.guestsHaveToKnock = false ;
sharedProperty = new SharedProperty();
sharedProperty.isSessionDependent = true ;
sharedProperty.sharedID = "webcamShare2" ;
sharedProperty.connectSession = sessionManager ;
sharedProperty.subscribe();
sharedProperty.addEventListener(SharedPropertyEvent.CHANGE,onChange);
sessionManager.userManager.addEventListener(UserEvent.USER_REMOVE,onUserRemove)
* @private
protected function onUserRemove(p_event:UserEvent):void
if ( sharedProperty.value &&
p_event.userDescriptor.userID == sharedProperty.value[0]) {
sharedProperty.value = [] ;
* When the main big stream changes, all users can view it
via the sharedProperty.
private function onChange(p_evt:SharedPropertyEvent):void
if ( currentSubscriber != null ) {
clickedContainer.removeChild(currentSubscriber);
currentSubscriber.close();
currentSubscriber = null ;
if ( sharedProperty.value == null ||
sharedProperty.value.length == 0 ) {
return ;
currentSubscriber = new WebcamSubscriber();
currentSubscriber.connectSession = sessionManager ;
currentSubscriber.subscribe();
currentSubscriber.webcamPublisher = webCamPub ;
currentSubscriber.publisherIDs = sharedProperty.value ;
currentSubscriber.addEventListener(UserEvent.USER_BOOTED,onCleared);
currentSubscriber.addEventListener(UserEvent.STREAM_CHANGE,onCameraPause);
clickedContainer.addChild(currentSubscriber);
invalidateDisplayList();
* If the big image is stopped, clear it.
private function onCleared(p_evt:UserEvent):void
if ( sessionManager.userManager.myUserRole ==
UserRoles.OWNER ) {
sharedProperty.value = [] ;
* Clicking on the small image below makes it large.
private function onClick(p_evt:MouseEvent):void
if ( (p_evt.currentTarget is WebcamSubscriber) &&
!(p_evt.target.parent is CameraUserBar)) {
sharedProperty.value = (p_evt.currentTarget as
WebcamSubscriber).publisherIDs;
* Handler for a user pausing the camera.
protected function onCameraPause(p_evt:UserEvent):void
var userStreams:Array =
sessionManager.streamManager.getStreamsForPublisher(p_evt.userDescriptor.userID,StreamMan ager.CAMERA_STREAM);
if (userStreams.length == 0) {
trace("onCameraPause: no userStreams");
return;
for (var i:int = 0; i< userStreams.length ; i++ ) {
if (userStreams
.type == StreamManager.CAMERA_STREAM ) {
break;
var streamDescriptor:StreamDescriptor = userStreams;
if ( streamDescriptor.streamPublisherID ==
sessionManager.userManager.myUserID ) {
sessionManager.streamManager.pauseStream(StreamManager.CAMERA_STREAM,!streamDescriptor.pa use,streamDescriptor.streamPublisherID);
* Handler for a user stopping the camera.
private function onBooted(p_evt:UserEvent):void
if ( (p_evt.currentTarget is WebcamSubscriber) &&
(p_evt.userDescriptor.userID == sessionManager.userManager.myUserID
|| sessionManager.userManager.myUserRole == UserRoles.OWNER)) {
webCamPub.stop();
if ( (p_evt.currentTarget.parent as VBox).getChildAt(1) is
Button ){
((p_evt.currentTarget.parent as VBox).getChildAt(1) as
Button).label = "Start" ;
if ( sharedProperty.value && (sharedProperty.value
as Array)[0] == p_evt.userDescriptor.userID ) {
sharedProperty.value = [] ;
]]>
</mx:Script>

OIM manipulating provisioning - description on resource profile

Similar Messages

Maybe you are looking for