OIM Password Sync with SAP

Hi,
I have a requirement of password sync between OIM and SAP. Do you have any idea of how we can achieve this?
Is there any out of box connector for the password sync with SAP?
Please let me know.
thanks in advance
Edited by: IDMuser19 on Jul 26, 2010 2:17 PM

Ramesh,
Are you using the password hook or something from the framework?
The password hook only works with Microsoft Active Directory.
If you're using a framework task or other job or a custom task you almost always need a SSL enabled connection to the LDAP server.
Hope this helps.
Matt

Similar Messages

Error while password sync with Active directory.

Hi all.
Am doing active directory password sync with oim 11g but this gives an error
Debug [07/31/12 11:52:14] CONFIG VALUE LENGTH
Debug [07/31/12 11:52:14] 254
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14] Before adding configsync attributes
Debug [07/31/12 11:52:14]
sgslrgac instance
Debug [07/31/12 11:52:14] User Name --->
Debug [07/31/12 11:52:14] TEST.TEST10
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14] RelativeId:
Debug [07/31/12 11:52:14] 1122
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14]
sgsladac Instance
Debug [07/31/12 11:52:14]
LDAP Connected
Debug [07/31/12 11:52:14] search string :
Debug [07/31/12 11:52:14] (&(objectCategory=person)(objectClass=user)(sAMAccountName=TEST.TEST10))
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14] Connected to ADSI
Debug [07/31/12 11:52:14] After Search
Debug [07/31/12 11:52:14] SID::
Debug [07/31/12 11:52:14] S-1-5-21-449192332-2375483478-3823051035-1122
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14] DN::
Debug [07/31/12 11:52:14] CN=test test10,CN=Users,DC=thakralone,DC=com
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14] GUID:::
Debug [07/31/12 11:52:14] QHetRJE7hEKkG8PeqYRKlQ==
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14] after ladp search
Debug [07/31/12 11:52:14] Success sgsldpap
Debug [07/31/12 11:52:14]
Passlen populated :
Debug [07/31/12 11:52:14] 190
Debug [07/31/12 11:52:14]
Debug [07/31/12 11:52:14]
Moving sgsloidi from asynchSystem
Debug [07/31/12 11:52:14] Store Object populated
Debug [07/31/12 11:52:14] [getObjectGuid=QHetRJE7hEKkG8PeqYRKlQ==
getPasswordLen=190
getUserDn=CN=test test10,CN=Users,DC=thakralone,DC=com
getUserId=TEST.TEST10
Debug [07/31/12 11:52:14]
***end of status
Debug [07/31/12 11:52:14]
Out of sgsloidi from asynchSystem
Debug [07/31/12 11:52:14]
Before Free
Debug [07/31/12 11:52:14]
After Free
i have tried to reconfig and reinstall the connector but still the same issue.

Don't think so.
Reconcile will just find accounts that are out of sync (that is, that exist on one system but not the other). It doesn't update account attributes.
ActiveSync can identify and process changed records, but the password itself is hashed, so unless you can use the hashed password directly (and IDM can't) then you just would get "garbage" data via the sync.
I think you do need to use one of the PasswordSync tools for this, because they intercept the password change process before the password is hashed, allowing you to apply the changes in multiple locations.

PASSWORD SYNC WITH AD

Hi All,
Please Help Regarding This Issue
I Cannot Resolve password sync with this AD
My Idm Version Is 9.1
My Active Directory Running on Windows 2003
=========================================================================================
My AD SYNC LOG
15 Sep 2008 19:05:51 INFO Logger created
15 Sep 2008 19:05:51 INFO Triggering Password Synchronization mechanism
15 Sep 2008 19:05:52 INFO Value of the installedFlag=>true
15 Sep 2008 19:05:52 INFO Password Reset Installed..get the ITResourceType and ITResourceName
15 Sep 2008 19:05:52 INFO IT ResourceType Name=> AD Server
15 Sep 2008 19:05:52 INFO ITResourceName=> ADITResource
15 Sep 2008 19:05:52 INFO Checking for OIM Server to synchronize password for the user--> IDMUSER
15 Sep 2008 19:05:52 INFO Port: 1099
15 Sep 2008 19:05:52 INFO Host: idmkuneh
15 Sep 2008 19:06:04 INFO OIM Server is up and running !!
15 Sep 2008 19:06:04 INFO Logging to OIM server
15 Sep 2008 19:06:04 INFO Logging into OIM Server with an auth mechanism
15 Sep 2008 19:06:04 INFO Necessary Configurations read
15 Sep 2008 19:06:04 INFO Logging into OIM Server with uname/pwd based auth
15 Sep 2008 19:06:04 INFO Finally !!
15 Sep 2008 19:06:04 INFO Before System.exit(0):
=========================================================================================
MY XLCONFIG.XML
- <xl-configuration>
<appServerName>jboss</appServerName>
- <Discovery>
- <CoreServer>
<java.naming.provider.url>jnp://idmkuneh:1099</java.naming.provider.url>
<java.naming.factory.initial>org.jnp.interfaces.NamingContextFactory</java.naming.factory.initial>
</CoreServer>
</Discovery>
- <Security>
- <XLSymmetricProvider>
- <KeyStore>
<Provider>com.sun.crypto.provider.SunJCE</Provider>
</KeyStore>
</XLSymmetricProvider>
- <XLPKIProvider>
- <KeyStore>
<Location>.xlkeystore</Location>
<Password encrypted="true">FlbwcjDZAB0hS3Q8F7PB4g==</Password>
<Type>JKS</Type>
<Provider>sun.security.provider.Sun</Provider>
</KeyStore>
- <Keys>
- <PrivateKey>
<Alias>xell</Alias>
<Password encrypted="true">FlbwcjDZAB0hS3Q8F7PB4g==</Password>
</PrivateKey>
</Keys>
<SignatureAlgorithm>SHA1withDSA</SignatureAlgorithm>
<SignatureProvider>sun.security.provider.Sun</SignatureProvider>
<VerifySigner>false</VerifySigner>
</XLPKIProvider>
</Security>
- 
- <ADSync>
- <Login>
<UseSignature>false</UseSignature>
<Username>xelsysadm</Username>
<Password encrypted="true">aPM3F6YImvbctkGkE4C4Ww==</Password>
</Login>
- <UserMatch>
- 
<MatchingMethod>UserID</MatchingMethod>
<FieldName>UD_ADUSER_LOGIN</FieldName>
<ResourceObject>AD User</ResourceObject>
</UserMatch>
- <Result>
<UpdateUDF>false</UpdateUDF>
<FieldName>USR_UDF_ADPWDRES</FieldName>
<SuccessValue>SUCCESS</SuccessValue>
<FailureValue>FAIL</FailureValue>
<AppendTimeStamp>true</AppendTimeStamp>
</Result>
- <ADConnectorConfig>
<Installed>true</Installed>
<ITResourceType>AD Server</ITResourceType>
<ITResourceName>ADITResource</ITResourceName>
</ADConnectorConfig>
</ADSync>
- <Cache>
- <XLCacheProvider>
<MultiCastAddress>10.10.10.30</MultiCastAddress>
</XLCacheProvider>
</Cache>
</xl-configuration>
=========================================================================================
Thanks Before
Gde

Which version of AD Connector and AD Pass Sync Agent are you using?
I think the Filed Name is now UD_ADUSER_UID.
Did you complete all the post installation steps of Password Sync Agent?

How to have SAP password sync with Windows AD password

Hi All,
Can someone guide me with the setup required to have the SAP password to be in sync with the Windows Active Directory password?
Thanks
Vijay

Hello Vijay,
UME means User Management Engine which provides central user administration for all
Java applications. The UME is used as the default user store as of SAP Web Application
Server 6.40. The UME is integrated into SAP Web Application Server Java as a service.
The UME itself administers users and uses databases, directory services, or the
SAP ABAP user administration to store the data. With newer versions of SAP Web Application
Server, the UME is set as the default user store.
SAP recommends that, as of SAP Web Application Server Java
6.40, you use the UME, which is preconfigured by default during the
installation, as the user store.
The UME has its own user management administration console for
administering users. It allows to perform the routine tasks
of user administration, such as creating users and groups, role assignment,
and other actions.
The UME provides different self-service scenarios that can be used by
applications. For example, a user can change his or her data, or register as a
new user.
Security settings can be used to define minimum
password length and the number of incorrect logon attempts before a user is
locked etc
The UME logs unsuccessful logons,incorrect logon attempts,changes to user data etc
Hope this satisfies your querry to some extent.
Pl dont forget to award points if resolved.
Regards

AD password sync with SSL

Hello everyone
The following note is in AD Password sync.connector documentation:
Note: It is strongly recommended that you configure SSL
communication between the connector and Oracle Identity Manager
in your production environment.
However, the configuration of secure client operation (using SSL at the
server) affects all clients. This means that if you use SSL to secure
Oracle Identity Manager communication with the connector, then the
Oracle Identity Manager Design Console and any other custom clients
must also communicate with Oracle Identity Manager using SSL.
I've installed the connector and configured SSL and it is working fine. Design console can still connect to OIM without using SSL. What is this note all about?
Thanks

Because you have enabled both SSL and non-SSL port. Once you will disable the non-ssl (recommended in prod) you will not able to access the Design Console.
I am struggling to use PassSync with SSL. I have two DCs and I imported the certificate on both DCs. Installed the PassSync Connector with Use SSL value to "Yes" and giving OIM SSL port and OIM host name. However, PassSync is not working and log is showing OIM is down. I tested the https url of OIM from both DCs and able to access from there. Do you have any idea what could be the cause?
Thanks

OIM Password sync connector installation issue

Hi All,
I am trying to configure password synchronziation between OIM & Active Directory. while installing AD Password Sync connector on AD Host it is returniing following.
Error occurred while uploading prepAD.ldif. , please refer to %TEMP%\oimpwdsync.log. Please upload
prepAD.ldif to Active Directory Domain Controller before applying ACLs.
Kindly suggest me on this.
Regards,
Madhu

I'm also getting the same error.
This is the content of the log file :
(Apr 14, 2011 6:19:27 AM), Install, com.oracle.installshield.adpwd.pathValidator, dbg, Directory does not exists, will get created at the installation time
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, attempting to use the current JVM
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, searching for a JVM
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.service.product.PureJavaProductServiceImpl$Installer, err, ProductException: (error code = 601; message="JVM not found")
STACK_TRACE: 8
ProductException: (error code = 601; message="JVM not found")
     at com.installshield.product.actions.JVMResolution.install(JVMResolution.java:171)
     at com.installshield.product.service.product.PureJavaProductServiceImpl$InstallProduct.checkUninstallerJVMResolution(PureJavaProductServiceImpl.java:4793)
     at com.installshield.product.service.product.PureJavaProductServiceImpl$InstallProduct.install(PureJavaProductServiceImpl.java:4554)
     at com.installshield.product.service.product.PureJavaProductServiceImpl$Installer.execute(PureJavaProductServiceImpl.java:3758)
     at com.installshield.wizard.service.AsynchronousOperation.run(AsynchronousOperation.java:41)
     at java.lang.Thread.run(Unknown Source)
(Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.execTool, err, Cannot run program "C:\Program": CreateProcess error=2, The system cannot find the file specified
(Apr 14, 2011 6:19:38 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, ASCII file C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif does not exist and will be created.
(Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, gen exp
(Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif (The system cannot find the file specified)
Anyone fixed it. I have checked JAVA env is set in my machine
C:\>echo %JAVA_HOME%
D:\oracle\Middleware\jdk160_14_R27.6.5-32
C:\>java -version
java version "1.6.0_12"
Java(TM) SE Runtime Environment (build 1.6.0_12-b04)
Java HotSpot(TM) Client VM (build 11.2-b01, mixed mode)
Did anyone fix the issue?

OIM Password Sync Installation on Windows Core Server 2008

Hi,
Did anyone ever installed AD Password Sync connector on windows core 2008 server, please provide the steps for that?
Server Core doesn't have GUI, it uses command prompt to install. I tried to installed but it corrputed the server itself.
Please let me know if anyone has prior experience on that.
Thanks,
Amitesh

Hi,
Yes in Browser, the response is perfect. The only issue is in Calling inside in any file, i even tried Javascript's XML dom to load it, but same result, the file is just loading and never loads completely. I also tried using an SWF file with AS3 code to load XML inside as3 and send the result to any JS function.
The output comes using trace in as3, but when it comes to browser, the same loading happends and result never loads.

OIM 11g Sync with Active Directory

Hi, I need to configure OIM 11g 11.1.1.3 Sync with a AD (Windows server 2003), I believe this is not possible (in this release), but, I am trying to configure through OVD but the queries of creation Containers throw errors.
Can be configured through OVD ??
Sync with AD will be supported in future Releases?
Thanks!!

From the installation media, copy and extract contents of the bundle/ActiveDirectory.Connector-1.1.0.6380.zip file to the CONNECTOR_SERVER_HOME directory
Refer http://docs.oracle.com/cd/E22999_01/doc.111/e20347/deploy.htm#CHDDJGIG

ADLDS password sync with DB2

We have one application for storing ID & password and that working fine. How we have to sync those users and passwords with ADLDS.
1. Can the LDS server be configured to use the MD5 hashed password, either directly from the database or by periodic import?
2 Can the LDS server be configured to use the other plain text credentials, either directly from the database or by periodic import?
AliahMurfy

I don't believe you can sync with any free software from Microsoft, but you coul duse a product from Dell.
Quick Connect Connector
http://software.dell.com/products/quick-connect-for-base-systems/quick-connect-connector-matrix.aspx
Paul Bergson
MVP - Directory Services
MCITP: Enterprise Administrator
MCTS, MCT, MCSE, MCSA, Security, BS CSci
2012, 2008, Vista, 2003, 2000 (Early Achiever), NT4
Twitter @pbbergs http://blogs.dirteam.com/blogs/paulbergson
Please no e-mails, any questions should be posted in the NewsGroup.
This posting is provided AS IS with no warranties, and confers no rights.

OIM password sync

Hi,
We are planning a OIM and OAM implementation.
We have Novell eDirectory in place with users in it. OAM is going to use the same eDir, so authentication will use the current password in eDir.
We also need to manage eDir as a target system on OIM.
The question is, can we sync passowords in eDir and OIM?
We have explored the following optoin:
1. Force users to change their password on first time login. Since OAM will be the one doing authentication, this will go through, and we update the password in OIM.
Does this sound feasible, any pointers?
-Boland

Not Sure if I understand your scenario. But...
OIM EDir connector can not sync pw from Edir to OIM.
So the best would be to use the OIM PW reset/self Service to reset pw in OIM and "push" it to edir trough the edir connector.
Because if you use the OAM pw change, then, as you are saying it will reset the pw in edir and you ll not have the same pw in OIM because it's not synced back to OIM...which may not be an issue at all depending what you are trying to achieve.
hth
Chris
Edited by: chris W on Dec 8, 2009 9:57 PM

Problem connection in OIM 9.1 with SAP user managment

Hi!
When I want to provision a sap user management resource to an user, it appeared this problem.
2008-07-30 14:50:52,587 INFO [XL_INTG.SAPUSERMANAGEMENT] Create User Request
2008-07-30 14:50:52,587 INFO [XL_INTG.SAPUSERMANAGEMENT] userId :PRUEBA4803, userGroup:AUDITOR_ARG,lastName:prueba4803,firstName:prueba4803,userTitle:0003,langComm:S,department:,langLogIn:,timeZone:,telephone:,extension:,Fax:,email:,dateFormat:1,decimalNotation:Y,function:,roomNo:,floor:,building:,code:,commType:,alias:,startMenu:000,userType:A,sapUserId:,empId:PRUEBA4803,fromHRMS:
2008-07-30 14:50:52,587 INFO [XL_INTG.SAPUSERMANAGEMENT] SAP Create Connection Request
2008-07-30 14:50:52,587 INFO [XL_INTG.SAPUSERMANAGEMENT] Inside XLSAPUTILITIES
2008-07-30 14:50:52,587 INFO [XL_INTG.SAPUSERMANAGEMENT] SAP Create Connection Requesting****
2008-07-30 14:50:52,587 INFO [XL_INTG.SAPUSERMANAGEMENT] START SAP Connection creation.
It is strange because it was working all right since 3 months ago and in these 2 last weeks, it is frequently this problem. Sometimes it works sometimes it does not.
Of course, I tried the connection between OIM and SAP, with the SAP login, and the connection is all OK.
My oim vertion is 9.1 and the SAP User Management connector is 9.0.4.1.
Did anybody have this problem before?
Bye!

Oh I forget, when I restart the application server, in my case the jboss, the problem is fixed. Strange...

Zen Password sync with win2k (Not grey box issue)

Is there anyway to automatically sync a users Novell password and their
local win2k password? We have our Novell accounts set to prompt form a
password change every 90 days. We a group of users that are bouncing
around from PC to PC and they may not use a PC for over 90 days and are
prompted to manually sync their windows password with their Novell
password.
The only solution I can come up with is to give them NT accounts to
eliminate the local windows password problem. Under the Novell 4.9SP2
client and earlier: If they use one PC and don't bounce around their Zen
policy automatically updates the local windows password when a 90 day
Novell password change takes affect. This isnt the case when they bounce
to another PC that they haven't logged in for over 90 days where their
windows password is different from their Novell password.

On Fri, 21 Jan 2005 14:14:40 +0000, dunlevyt wrote:
> Is there anyway to automatically sync a users Novell password and their
> local win2k password? We have our Novell accounts set to prompt form a
> password change every 90 days. We a group of users that are bouncing
> around from PC to PC and they may not use a PC for over 90 days and are
> prompted to manually sync their windows password with their Novell
> password.
What about Dynamic Local User?
It will handle this perfectly for you.
The following link contains information about this policy
http://tinyurl.com/68yzo
-Jared
Novell Support Forums SysOp

Checking user password status with SAP JCO

I am using Jco 2.1. Is it possible to get the status of the user's password (expired or not) using Jco, or is there any BAPI which can do this task. I get an exception in Jco when the user is locked or does not have any access to the respective function groups, but no exceptions in this case. It allows the user to conenct to SAP even when the password has expried.
In the code, I am using JCo Client connect and disconnect. It connects sucessfully, even when the password has expired in SAP.
Many thanks in advance. Any pointers to this issue is appreciated.
Regards,
Siva

Note [161146|http://service.sap.com/sap/support/notes/161146] says:
As of Release 46C, you can prevent the RFC logon with an expired or initial password by setting the profile parameter rfc/reject_expired_passwd (that is, rfc/reject_expired_passwd = 1).
After you added the profile parameter, you must restart the server.
So this is a general behavior for all RFC connections and not only for new users. That's why I told you to be careful.
And furthermore Harald is right. It should be clear what an initial password is. And when the password is regarded as expired can be configured with the profile parameters described in note [862989|http://service.sap.com/sap/support/notes/862989].

AD Password Sync connector 9.1.1 With OIM 11g R2 - ERROR OVER SSL

I have set up AD password sync with from AD to OIM 11G R2
The password syncs from AD to OIM 11G R2 on non ssl port 389.
But if fails on SSL Port 636.
Errors in OIMMain.Log:_
Debug [10/11/2012 10:49:34 AM] Inside ConnectToADSI
Debug [10/11/2012 10:49:34 AM]
ldap_connect failed with
Debug [10/11/2012 10:49:34 AM] Server Down
Debug [10/11/2012 10:49:34 AM]
Steps Carried Out thus far:_
AD is up and running.
Configured AD Password Sync Connector on 636 and selected ssl.
Created Certificate on OIM host, configured custom identity key store on weblogic. Restarted Weblogic.
Imported Certificate to AD. After this, restarted the AD
I can Telnet port 636 from OIM Box and also connect to AD through LDAP Browser on 636 and view OU and CN, so this seems fine.
Provisioning from OIM through Connector Server to AD works over SSL and this works fine.
Help would be appreciated.
Many Thanks

This question is now been fixed.
Instead of explicitly stating 636 for SSL,
Use the same port 389 for ssl and also configured oim port to be 140001 which is the ssl port for oim in the configuration of OIM Password Sync.
Export Certificates from AD to java security keystore and to weblogic keystore
Export .pem certificate created on OIM host machine to AD.
Restart weblogic, oim and AD
Everything would work fine.
For all the other information, refer to doc.
Thanks

AD Password Sync Connector in SSL Mode

Hi,
The AD Password Sycn connector works fine with non-SSL , but not in SSL mode.
This is the log generated-
Debug [11/19/12 15:35:08] Start getting config parameters from registry
Debug [11/19/12 15:35:08] oimhost is
Debug [11/19/12 15:35:08] abc.com
Debug [11/19/12 15:35:08]
Debug [11/19/12 15:35:08] oimport is
Debug [11/19/12 15:35:08] 14001
Debug [11/19/12 15:35:08]
Debug [11/19/12 15:35:08] oimsslclient is
Debug [11/19/12 15:35:08] PwdSync
Debug [11/19/12 15:35:08]
Debug [11/19/12 15:35:08] oimuserattr is
Debug [11/19/12 15:35:08] Users.User ID
Debug [11/19/12 15:35:08]
Debug [11/19/12 15:35:08] oimusessl is
Debug [11/19/12 15:35:08] Y
Debug [11/19/12 15:35:08]
Debug [11/19/12 15:35:08] oimappservertype is
Debug [11/19/12 15:35:08] 1
Debug [11/19/12 15:35:08]
Debug [11/19/12 15:35:08] End of sgsloidi::getConfigParamters
Debug [11/19/12 15:35:08] Inside sgsloidi::setParameters
Debug [11/19/12 15:35:08] The SOAP start element is
Debug [11/19/12 15:35:08] <processRequest xmlns=""><sOAPElement>
Debug [11/19/12 15:35:08] The SOAP end element is
Debug [11/19/12 15:35:08] </sOAPElement></processRequest>
Debug [11/19/12 15:35:08] The path is
Debug [11/19/12 15:35:08] /spmlws/OIMProvisioning
Debug [11/19/12 15:35:08] End of sgsloidi::setParameters
Debug [11/19/12 15:35:09] Look for client cert
Debug [11/19/12 15:35:09] Search the opened store
Debug [11/19/12 15:35:09] Inside sgsloidiOIMDownErrorHandler
Please suggest.

Instead of explicitly stating 636 for SSL,
Use the same port 389 for ssl and also configure oim port to be same(ex:140001) which is the ssl port for oim in the configuration of OIM Password Sync.
Export Certificates from AD to java security keystore and to weblogic keystore
Export .pem certificate created on OIM host machine to AD.
Restart weblogic, oim and AD
Everything would work fine.
For all the other information, refer to doc.

OIM Password Sync with SAP

Similar Messages

Maybe you are looking for