OIM password in target

Hi,
when admin changes it it is going in process form and database.When user login at change at next logon(first time) it is changing in process form and not in database? CAn u tell me what I need to do for that?
Thanks

Thanks,
yes, you need to create a custom password policy in OIM same policy as in enterprise directory.
You can have trigger on OIM Password (USR_PASSWORD) in trigger lookup. This will change the password of ED when the OIM password is getting changed.
Also, just check Resource Object of ED. It has password policy tab which can be used for password restrictions if someone is directly try to change password of ED(Its available in OIM R2 onwards)
Regards,
J

Similar Messages

Oim11g: Accessing oim password stored in CSF from pre-populate class

Can I access the oim password stored in CSF from the request template pre-populate class?
I am using hte following code from my class but its not working:
====================================
String oimUserName = "";
String oimPassword = "";
//get system administrator's credentials
oracle.security.jps.JpsContext ctx = oracle.security.jps.JpsContextFactory.getContextFactory().getContext();
final oracle.security.jps.service.credstore.CredentialStore cs = (oracle.security.jps.service.credstore.CredentialStore)ctx.getServiceInstance(oracle.security.jps.service.credstore.CredentialStore.class);
oracle.security.jps.service.credstore.CredentialMap cmap = cs.getCredentialMap("oracle.oim.sysadminMap");
oracle.security.jps.service.credstore.Credential cred = cmap.getCredential("sysadmin");
if (cred instanceof oracle.security.jps.service.credstore.PasswordCredential) {
oracle.security.jps.service.credstore.PasswordCredential pcred = (oracle.security.jps.service.credstore.PasswordCredential)cred;
char[] p = pcred.getPassword();
oimUserName = pcred.getName();
oimPassword = new String(p);
====================================

Try using the following code:
String oimUserName = "xelsysadm";
oracle.iam.passwordmgmt.internal.api.PasswordManager passwordManager = new oracle.iam.passwordmgmt.domain.PasswordManager();
String oimPassword = passwordManager.getUserPasswordFromDB(oimUserName, true);

Best way to store OIM password

What is the best way to store OIM password that is used to initiate OIM Client?

Best way, don't store it ;-) j/k. My opinion, if 11G then use FMW Credential Framework or you can just use the Weblogic encryption utility.
-Bikash

RE: Extracting OIM Password and Challenge Questions

Hi,
I am trying to look at the best way to extract OIM password and challenge questions from one system to another and wondered if any one could point me in the right direction. I am guessing that I need to use the UnauthenticatedSelfService API.
Regards,
Simon

//Get Challenge Questions
Long l = moResultSet.getLongValue("Users.Key");
>>
challengeQues = moUserUtility.getChallengeValuesForUser(l);
if(challengeQues != null) {
String s[] = challengeQues.getColumnNames();
for (int k = 0; k < challengeQues.getTotalRowCount(); k++) {
challengeQues.goToRow(k);
String question = challengeQues.getStringValue("Users.Password Challenge Question.Question");
String answer = challengeQues.getStringValue("Users.Password Challenge Question.Answer");

OIM password sync

Hi,
We are planning a OIM and OAM implementation.
We have Novell eDirectory in place with users in it. OAM is going to use the same eDir, so authentication will use the current password in eDir.
We also need to manage eDir as a target system on OIM.
The question is, can we sync passowords in eDir and OIM?
We have explored the following optoin:
1. Force users to change their password on first time login. Since OAM will be the one doing authentication, this will go through, and we update the password in OIM.
Does this sound feasible, any pointers?
-Boland

Not Sure if I understand your scenario. But...
OIM EDir connector can not sync pw from Edir to OIM.
So the best would be to use the OIM PW reset/self Service to reset pw in OIM and "push" it to edir trough the edir connector.
Because if you use the OAM pw change, then, as you are saying it will reset the pw in edir and you ll not have the same pw in OIM because it's not synced back to OIM...which may not be an issue at all depending what you are trying to achieve.
hth
Chris
Edited by: chris W on Dec 8, 2009 9:57 PM

How can I set OIM password policy for OID Users.

Hi,
For me the target resourec is OID. When I create users in OIM, they get provisioned to OID. Their password also gets stored in OID.
Now, I have a password policy in OIM. In that policy, the password exipration day is set to 28 days. After 28 days, the user's password will expire in OIM. Is there any way that password will also expire in OID too, so that user will not be able to login in OID?
Thanks in advance.

You need to do the following.
1. Find the attribute in OID that determines the disable date.
2. Add a field to your provisioning process definition form.
3. Using a pre-populate adapter, use an input of your oim user account expiration date, and convert that to the format OID uses.
4. Update your lookup for provisioning attributes to include this new field to map the field name to the OID attribute.
5. Create an "Updated" task for this field so that when it gets changed, the new value is pushed to OID.
6. Create a user form trigger value for the field that maps to the oim user account expiration field. For this trigger, add a task to your oid provisioning process that does the same tasks as your pre-populate adapter to determine the new date value and pass it to the field on the process form.
Now when the OIM expiration date changes, this value will be passed to OID, and also when the account is first created.
Does this work for you?
-Kevin

Accessing the stored OIM password in CSF from SOA composite

Is there a guide on how to access CSF - OIM credentials from your SOA composite. I found this example ( http://docs.oracle.com/cd/E14571_01/doc.1111/e14309/soa_api.htm ) which hard codes the xelsysadm's password in the SOA composite. It says See SOA documentation for more information about how to get credentials from CSF inside a SOA composite. I can't find any documentation describing how to access the credentials.
I'm trying to access the lookup definitions I have defined in OIM.

This is the code to retrieve the username and password from the CSF:
>
     String oimUserName = "";
     String oimPassword = "";
     //get system administrator's credentials
     oracle.security.jps.JpsContext ctx = oracle.security.jps.JpsContextFactory.getContextFactory().getContext();
     final oracle.security.jps.service.credstore.CredentialStore cs = (oracle.security.jps.service.credstore.CredentialStore)ctx.getServiceInstance(oracle.security.jps.service.credstore.CredentialStore.class);
     oracle.security.jps.service.credstore.CredentialMap cmap = cs.getCredentialMap("oracle.oim.sysadminMap");
     oracle.security.jps.service.credstore.Credential cred = cmap.getCredential("sysadmin");
     if (cred instanceof oracle.security.jps.service.credstore.PasswordCredential) {
          oracle.security.jps.service.credstore.PasswordCredential pcred = (oracle.security.jps.service.credstore.PasswordCredential)cred;
          char[] p = pcred.getPassword();
          oimUserName = pcred.getName();
          oimPassword = new String(p);
>
It will retrieve the username and password for a map called "oracle.oim.sysadminMap" with key user of "sysadmin". In my instance, i have added xelsysadm and password for this key.
-Kevin

OIM Password sync connector installation issue

Hi All,
I am trying to configure password synchronziation between OIM & Active Directory. while installing AD Password Sync connector on AD Host it is returniing following.
Error occurred while uploading prepAD.ldif. , please refer to %TEMP%\oimpwdsync.log. Please upload
prepAD.ldif to Active Directory Domain Controller before applying ACLs.
Kindly suggest me on this.
Regards,
Madhu

I'm also getting the same error.
This is the content of the log file :
(Apr 14, 2011 6:19:27 AM), Install, com.oracle.installshield.adpwd.pathValidator, dbg, Directory does not exists, will get created at the installation time
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, attempting to use the current JVM
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, searching for a JVM
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.service.product.PureJavaProductServiceImpl$Installer, err, ProductException: (error code = 601; message="JVM not found")
STACK_TRACE: 8
ProductException: (error code = 601; message="JVM not found")
     at com.installshield.product.actions.JVMResolution.install(JVMResolution.java:171)
     at com.installshield.product.service.product.PureJavaProductServiceImpl$InstallProduct.checkUninstallerJVMResolution(PureJavaProductServiceImpl.java:4793)
     at com.installshield.product.service.product.PureJavaProductServiceImpl$InstallProduct.install(PureJavaProductServiceImpl.java:4554)
     at com.installshield.product.service.product.PureJavaProductServiceImpl$Installer.execute(PureJavaProductServiceImpl.java:3758)
     at com.installshield.wizard.service.AsynchronousOperation.run(AsynchronousOperation.java:41)
     at java.lang.Thread.run(Unknown Source)
(Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.execTool, err, Cannot run program "C:\Program": CreateProcess error=2, The system cannot find the file specified
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, ASCII file C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif does not exist and will be created.
(Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, gen exp
(Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif (The system cannot find the file specified)
Anyone fixed it. I have checked JAVA env is set in my machine
C:\>echo %JAVA_HOME%
D:\oracle\Middleware\jdk160_14_R27.6.5-32
C:\>java -version
java version "1.6.0_12"
Java(TM) SE Runtime Environment (build 1.6.0_12-b04)
Java HotSpot(TM) Client VM (build 11.2-b01, mixed mode)
Did anyone fix the issue?

AD-OIM password synchronization connector error

Hi,
I have installed the AD password synchronization connector 9.1.1. to Windows 2003 SP2 server successfully. When I reset the users password I can see from the 20091217OIMMain.log file the following errors:
Debug [12/17/2009 2:08:31 PM] The SOAP start element is
Debug [12/17/2009 2:08:31 PM] <SPMLv2Document xmlns="http://xmlns.oracle.com/OIM/provisioning">
Debug [12/17/2009 2:08:31 PM] The SOAP end element is
Debug [12/17/2009 2:08:31 PM] </SPMLv2Document>
Debug [12/17/2009 2:08:31 PM] The path is
Debug [12/17/2009 2:08:31 PM] /spmlws/HttpSoap11
Debug [12/17/2009 2:08:31 PM] End of sgsloidi::setParameters
Debug [12/17/2009 2:08:31 PM] <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"><env:Header/><env:Body><env:Fault xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"><faultcode xmlns="">env:Server</faultcode><faultstring
xmlns="">Internal Server Error</faultstring><faultactor xmlns=""></faultactor></env:Fault></env:Body></env:Envelope>
Debug [12/17/2009 2:08:31 PM] Inside sgsloidiOIMGeneralErrorHandler
Debug [12/17/2009 2:08:31 PM] Unable to update USR_NAME. There are error messages in the searchReponse. Please check log for details
Debug [12/17/2009 2:08:32 PM] Password updation failed in child process
Where is this searchResponce log file? I tried to see all the Windows log files, which has been updated after my password reset, but none of them has any errors which makes sense or the time would match. Also in 20091216043_PasswordChange.log everthing seems to go okay.
SPML web service is deployed and up and I can hit that URL from my machine. I don't get any printouts to the OIM log file.
Any ideas...? Thanks a bunch!
-J-

1. Check your ports, make sure they are open.
2. For password sync you'll need to have SSL certificates configured so AD, OIM and the connector can talk securely. Make sure the proper keystore is used and certificate is present on all 3 (the connector includes the guide to install them)
With the above I got my connector working to this point. Hope that helps.
- JP

Trusted Recon OIM Password Setup

Hi Experts.
My User profiles are stored in Oracle Data base table and I am reconciling the users every 10 minutes using the trusted reconciliation. I have done the following mapping in GTC in admin Console.
Source Attribute Name = OIM Attribute Name
first_name = First Name
User_ID = User ID
Last_Name = Last Name
UserType = User Type
Password = Password
employeeType=Employee Type
Department = Organization
After Mapping is Done and I have run the reconciliation using the adminconsole > Resource Management > Manage Schedule Task > my trust_gtc
I am getting the following error while running the reconciliation. The error details are given below.
ERROR,20 May 2010 14:00:57,015,[XELLERATE.DATABASE],Class/Method: tcDataBase/rollbackTransaction encounter some problems: Rollback Executed From
java.lang.Exception: Rollback Executed From
at com.thortech.xl.dataaccess.tcDataBase.rollbackTransaction(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.rollback(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.doRollback(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcTableDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.createUserRecord(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.applyActionRules(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.checkDataSorted(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.eventPostUpdate(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.update(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcTableDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.finishDataReceived(Unknown Source)
at com.thortech.xl.schedule.jms.reconOffline.ProcessOfflineReconMessages.finishReconciliationEvent(Unknown Source)
at com.thortech.xl.schedule.jms.reconOffline.ProcessOfflineReconMessages.execute(Unknown Source)
at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
at com.thortech.xl.schedule.jms.messagehandler.ReconMessageHandlerMDB.onMessage(Unknown Source)
at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4547)
at weblogic.jms.client.JMSSession.execute(JMSSession.java:4233)
at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3709)
at weblogic.jms.client.JMSSession.access$000(JMSSession.java:114)
at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5058)
at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:516)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
I have fixed the above problem using the design console > Process Management >my trust_GTC > reconciliation field mappings and edit the Password field and it mapped to User Password to Identity. After mapping the Password to Identity then reconciliation went successfully. After that I couldn't able to login to admin console using the password as provided in the reconciliation mapping. I am getting error Invalid User.
But I am able to login to the admin console with user name and password as the same (User ID).
I couldn't figure out what went wrong. Why password is taking as user name in the password field while doing the trusted reconciliation.
Any body face this issue. Please help me.
Thanks
IDMOIM.

Hi,
This is default functionality of OIM when you create a user through Recon its user id will be mapped as his password.
If you have different password for created user you can achieve the same through Per-Insert adpater.
Let me know if you have any query for the same...
Regards
Alabhya Goel

OIM Password Sync with SAP

Hi,
I have a requirement of password sync between OIM and SAP. Do you have any idea of how we can achieve this?
Is there any out of box connector for the password sync with SAP?
Please let me know.
thanks in advance
Edited by: IDMuser19 on Jul 26, 2010 2:17 PM

Ramesh,
Are you using the password hook or something from the framework?
The password hook only works with Microsoft Active Directory.
If you're using a framework task or other job or a custom task you almost always need a SSL enabled connection to the LDAP server.
Hope this helps.
Matt

OIM Password Provisioning to E-Business Suite HRMS

Hi Experts,
I am new to OIM. I need steps for Password Provisioning from OIM to E-Business Suite. Provide me with the steps for the same.
Thanks in Advance,
Sandy.

http://download.oracle.com/docs/cd/E11223_01/doc.910/e11203/intro.htm#BABJACAA
for *1.6.2 Attribute Mappings for Provisioning* & *1.4.8 Account Password Management*

[OIM] error while target reconciliation

I want to reconcile the users from the target oid to do account linking. We do not want to reconcile multi valued attributes so i have removed the multi valued group and role entries from object reconciliation profile, process definition and also from the recon lookup. But even after that i am facing the issue as mentiioned below.
<Exception in OID:tcTskOIDUserReconciliation:reconcileUser() Oim Child Table Name is null based on child mapping UserRole>What could be causing this still ?

First of all, let's get things working...
Then we can do R&D on this error
Let's follow step by step..
First of all, undo everything and make it OOTB connector... No change from your side...
Test for one user only..
It works and child tables in process form are getting populated...
Good... Then Remove ONLY Child Form mapping in the "Reconciliation Field Mappings"... Do NOT TOUCH ANYTHING ELSE...
Create Reconciliation Profile (if using OIM 11G)
Then again, for the same user, make some minor change, say in the first name in the target system, add 1... Just minor change...
Then again execute recon for this user only... Keep the logs open...
Ideally, every thing should happen smoothly... Event should be generated and the new first name is populated in the process form... That's it... Nothing should happen to the Child Form... No UserRole related issues should appear...
If again the same issue appears, then something else in the OOTB connector has been tampered with...
And if it is OIM 11G, and I have seen many issues regarding Create Reconciliation Profile NOT reflecting the new Reconciliation configuration, that would be entirely another issue..
My point is:- Simply removing the Child Form mapping in the "Reconciliation Field Mappings" should be sufficient to fulfil your requirement...
And if any other issue arising from connector tampering or inconsistent behavior of Create Reconciliation Profile appears, that's another point altogether...
So, please first try what I have suggested...

OIM Password Policies

Hello All
I have a number of users setup in OIM and am using it for provisioning. I have the users in different organizations based on class of user and permissions to the portal. I have a need to have different password policies based on the organizations of the users. I looked through and it doesn't look like you can assign a password policy to an organization. Do you know of a way to assign users in org1 password policy A and others different policies? I looking at the xellerate users resource object and thought maybe I could do a rule to look for org1 but not sure if this is possible. Any help you can give would be appreciated.
Thanks
Nick

in terms of using an entity adapter, how would you go about doing that? Would it be based on user insertion or update? also, when trying to add a password policy, it asks for a rule then the policy, is there a way to develop a rule to use when assigning the password policy?
Nick

OIM Password Management

Does OIM has a capability of sending email when user password is about to expire? We are trying to hook it up with AD and try to override AD policy with OIM if it has that feature.

There is already a default scheduled task for this process. If you have a password policy created, there is a warn time which will send an email every day from the warn time till the expiration time. You will need to check the scheduled tasks and see if they are enabled and check which email definition is tied to the scheduled task to send.
-Kevin

OIM password in target

Similar Messages

Maybe you are looking for