OIM - Users provisioned with different resource form versions

Hi !!
we are having some problems with different resource form versions and maybe you can help us.
We have two different versions of one resource form. One of them has 2 extra fields.
Some users were provisioned with that resource with the previous form version (no extra fields) and some with the new one (extra fields).
The problem is that now, if we try to edit that resource for the users with the old version, we are not able to edit or even see the information for those extra fields.
It seems that they have been associated with the old version and we need to change it in order to make them use the new one. Is that possible? How can we fix that?
Thanks in advance.

Alternatively you can manually update the form version in the OIM database.
If it is a small number of forms it might be easier to do that then to bother with fvc.
Best regards
/Martin

Similar Messages

[OIM] Error in Direct Provisioning (with auto save form) - GTC DB App Table

Hi,
I am getting an error when setting up direct provision of a GTC DB App Conn using OIM access policy (and group membership) or through manual provisioning with prepopulate and auto save form.
Manual provisioning with prepopulate ONLY (not with auto save form) WORKS!!!
Some information about my OIM config:
- Prepopulate adapters are set up on both forms (parent and child)
- "Auto prepopulate" and "Auto save form" are set up at Process Definition
- For direct provisioning, I have created an access policy with an associated group which has a membership rule
What it is working:
- Provisioning manually, using prepopulate adapters only, not auto save form. Both tables are updated properly
- All *3 tasks are called and finished with status=Completed*: "System Validation", "Create User" and "Child Table UD_<connector child table name>_US row Inserted"
Testing direct provisioning:
- I have tested adding the resource manually with prepopulate and autosave form configured, and also through access policy/group membership. The error is the same on both tests
- The resource is displayed as provisioned and it is created an entry in the parent table of the resource, but not on child table
- I also observed that only: "System Validation" and "Create User" tasks were executed (status=Completed). But it is missing the task "Child Table UD_<connector child table name>_US row Inserted"
- The error log info displays only an error regarding to UGP table (Groups info) but I am not sure if that is the cause of entry creation on child table.
It seems the SQL stmt tries to get ugp_name (group name) using ugp_key but that has null value.
"SELECT ugp_name FROM ugp WHERE ugp_key=java.sql.SQLSyntaxErrorException: ORA-00936: missing expression"
Note: When testing manually (without auto save form), I got "SELECT ugp_name FROM ugp WHERE ugp_key=1" which it is the same SQL stmt but the value is provided.
My guess:
- It seems that error is aborting the whole execution process so "Child Table UD_<connector child table name>_US row Inserted" task does not run, even though previous tasks are finished with the status=Completed. Consequently, the entry is not created on child table.
Please, any guess or help would be very helpful. In case nothing works, I guess I will have to create and customize a "Update child Form" task as an workaround which would be called after "Create User" task.
Regards,
Hugo
My environment:
- Windows 2003, WebLogic 10.3.0.0, OIM 9.1.0.2 BL4, Oracle 10g, Java 1.6, DB App Table Connector 9.1.0.2 (from October 2009)
- Target Resource: Parent and Child Table (Oracle 10g - the same OIM DB)

An update:
I solved that error about "ORA-00936: missing expression" applying OIM 9.1.0.2 BP05. That was not impacting my issue regarding direct provisioning with auto save form and child form.
So please if anyone can confirm:
- Can I set up prepopulate adapters on child forms AND also use "auto save form" on GTC DB App Table connector?
If not, any suggestion?
Regards
Hugo

OIM 11gR2 provisioning with GTC

Hello,
We are curently implementing Oracle Identity Manager 11gR2, and we are having difficulties with the implementation of the provisioning from OIM to the Target Systems exposed through a webservice on Oracle Service Bus.
We are using the Generic Technology Connectors as a basis of working. And initially we have created a GTC with only reconciliation Transport & Format Providers:
Connector Name TargetSystem1
Transport Provider (Provisioning):
Format Provider (Provisioning):
Transport Provider (Reconciliation): Database Application Tables Reconciliation
Format Provider (Reconciliation): Database Application Tables Reconciliation
We have configured the Process Definition of TargetSystem1 with all the operations (Create User, Update User, Enable User, Disable User, Delete User, etc.) connected with custom Java implementations, that are working just fine is we trigger them form Eclipse. The “Create User” task has only “Required for Completion”, “Allow Cancelation while Pending” and “Allow multiple instances” check boxes set to CHECKED; it also has all the fields in Integration TAB mapped, Responses mapped, but when we create a User in OIM and provision it with an account on the TargetSystem1_GTC Application Instance, the provisioning process in not accessing the “Create User” task to make the provisioning in the target system. The user that we are trying to provision has the account Status set to “Provisioning” and the Account Type set to “Unknown”. We have also checked the logs of OSB, but there is no activity there, because no request from OIM is being received.
After we investigated more closely the Oracle documentation for the Generic Technology Connectors we discovered that if we do not select Transport & Format Providers during the GTC creation, then the corresponding steps are not performed and they are not initialized, thus the provisioning cannot be done. The documentation also states that if we need to create custom providers in order to make the Provisioning with the GTC, but unfortunately we have no knowledge or any examples on how to do such custom providers for the provisioning of Users from OIM on the target systems via the Oracle Service Bus.
We have installed a second GTC with both provisioning and reconciliation Transport & Format Providers:
Connector Name: TargetSystem2
Transport Provider (Provisioning): Web Services
Format Provider (Provisioning): SPML
Transport Provider (Reconciliation): Database Application Tables Reconciliation
Format Provider (Reconciliation): Database Application Tables Reconciliation
The Web Services and SPML options were the only options that we could select from the out of the box connectors that are installed, and we did not find any other connectors in the download section of Oracle for this product, that can accommodate such communication. So, we configured the provisioning accordingly, and modified the “Create User” task from the TargetSystem2_GTC Process Definition, in order to use our custom adaptor instead of the adpTargetSystem2_GTC adapter that was preset when the TargetSystem2_GTC is created. But this does not help us, because the provisioning is not done, and the “Create User” task is not used. The user that we are trying to provision has the account Status set to “Provisioning” and the Account Type set to “Unknown”.
Next we tried to see if the GTC can be used to communicate directly with the OSB, using the Web Services Transport Provider and SPML Format Provider, and we did not make any modifications to the after the normal installation of the TargetSystem2 GTC. In this case the we can see that the OSB is being accessed by OIM, but unfortunately this case does not help us also, because the operations implemented on the OSB webservice have a different structure then the one SPML expects as default:
Caused by: com.thortech.xl.gc.exception.XSDValidationException: The SOAP response does not contain a valid SPML response type. Should be one of these -->addResponse modifyResponse deleteResponse resumeResponse suspendResponse setPasswordResponse
Do you have any suggestion on how to make the provisioning process work?
Edited by: user1717356 on 22.10.2012 03:22

Hi,
I think you need to put this check only for few attributes?
If Yes, then lets suppose you want to have a check for Country Field in Database which once modified by target Admin, then OIM should know.
1) Create one dummy field CountryDummy (Hidden) in OIM TargetProcess form and dont map it to any target attributes. This dummy field will only store values populated from OIM user profile to -> DB Connector Process Form.
2) On success of "Reconcilation Update Recievced", Put a custom process task which does a comparison with "CountryDummy" & "Country" and inform Admin using email notifications that this mismatch has been found.
HTH,
~J

OIM manipulating provisioning - description on resource profile

Kamaraden!
I have an OIM installation with AD and Exchange connectors. When users are provisioned, going back to the resource profile, you can see the resource and several data, for example the Description field. For AD User, descriptions shows the windows logon name (what I think it is correct), and for Exchange, it shows a number (probably a key of some table). Trying to discover from where this description field is taken, I realized that it comes from the ORC table, ORC_TOS_INSTANCE_KEY (if I change it, it changes in the description of the resource profile too).
I have many questions about this. First of all, who puts this value in this field of the ORC table. I followed the provisioning tasks for AD and Exghange (Create User and Create Mailbox), and got inside the code (I decompiled it with cavaj), but the logic of the adapters attached to that process task and the code in the java classes, only creates efectively the user or the mailbox, and returns.. so, when the resource profile is being modified?
Other question related to that, is where are the conventions of the process tasks names for provisioning? For example, FIELD Updated reacts over the event of modification of FIELD. Create User sounds logic for provisioning when a resource is granted on an application, but Create Mailbox? How is this task attached with the provisioning submit of a resource?
DrLDAP

You are right, the number that you see in the description field in the resource profile is the ORC KEY. If you need to change this to show any value in the process form, you can do so by going to the provisioning workflow form in the design console and click of Map Descriptive field.
I dont think it has been documented anywhere about the field name<space updated> task.
The name Create User or Create Mailbox has no significance. you can really keep any name for the task. The way OIM understands that it needs to execute this task is if it sees the task is marked as "Required for Completion". all tasks marked required for completion will be executed by oim before it can say that provisioning has been completed. For e.g i a provisioning process all you might need to do is send a mail and not create any account etc.
then you have a task "Send mail" (or any name) mark the task as required for completion. Now when this resource is granted by the admin to the user, this task would have executed. The name is not of essence when it comes to provisioning.

How OIM user provisioning automatically

Hi,all
I have integrated OIM with OID by OID connector,now I want to implement that OIM user is provisioned automatically to oracle ldap as soon as i create a user account through OIM admin console,what should i do?could u give me some detailed instrution?
Thanx in advance.

Hi,
Go to design console->Resource Management->Rule Designer
.Give the Name of Rule
.Select General as Type
.Click on Add Rule and then slelect the user profile data and give the value on which you want auto membership.
You can define your rule there.For example
Organization Name= IT
Please let me know if you have clarification.
Regards
Nitesh
.

User Account with different languages

Dear Friends,
I need to have one user account with a different langauge, i.e. I need that when a partucular user log-in, the system swithch to spanish, and when one other user log-in the system goes back to english.
Is ti possible? and How?
Thanks for your help.
Federico.

is GREEK just not a supported language
You can see exactly what languages are supported in the OS X tech specs:
http://www.apple.com/macosx/techspecs/
In addition, the Tiger that comes with Intel Macs has Russian.
A Greek add-on is only available via Rainbow and 3rd party patches. One is mentioned here, I don't know if it works right or causes problems.
http://betabug.ch/blogs/ch-athens/124

User provisioning with Sun Directory Server

I'm migrating from the internal user data store to external with Sun Directory Server as the LDAP backend and I'm unable to provision new users. I use unidssearch to list the unprovisioned accounts and it lists the user I'd like to provision. I then execute 'uniuser -user -add "DID=uid=testy,ou=People,dc=domain,dc=com" -n 10' which returns an Insufficient access right error. When I look at das.log I see the following entry...
DATE = Thu May 10 10:25:09 2007
PID = 440; TID = 1095888896
LOG TYPE -> DEBUG
FUNCTION NAME -> ctldap_CalUserUpdateByDirectoryId
dn: uid=testy,ou=People,dc=domain,dc=com
changetype: add
ctCalXItemId: 00010:00500
o: Domain Corporation
objectClass: ctCalUser
This entry tells me that uniuser is try to do an LDAP_ADD on an existing object in the directory when it should do a LDAP_MODIFY.
Does anyone know why this is?

the unidsacisetup(8) command can be used to add the ACI for Sun Directory server. The ACI it sets is a little to loose for my liking so I modified it slightly.
Original:
(target="ldap:///dc=domain,dc=com") (targetattr = "*") (version 3.0; acl "Calendar Administrators Group"; allow(all) groupdn = "ldap:///cn=OracleCalendarAdminGroup,ou=OracleCalendar,dc=domain,dc=com";)
Modified:
(target="ldap:///dc=domain,dc=com") (targetattr = "*") (version 3.0; acl "Calendar Administrators Group"; allow(read,write,compare) groupdn = "ldap:///cn=OracleCalendarAdminGroup,ou=OracleCalendar,dc=domain,dc=com";)

Regarding user provision with disable and locked status

Hi All,
what i need to do if i want to provision a user with disabled and locked status for first time.
i am using OIM 11g
Can any one please help me out in this.
Regards
Prasad

You can provision a user into EBS.
Call "*Disable User*" task on SUCCESS of Create User task in EBS process defn.
Let me know if you see any challenges in this approach.
If target application supports Lock Status then you can add a task and attach adapter to lock that account and call in the same way.

Different user options with different sets of questions

Is there a way I can have two different options and when the user clicks on option A a whole set of questions/form fields appear. Or if they select option B a whole different set of questions/form fields appear?
How would I go about programming something like that?
Hopefully I was clear enough. Thanks so much! :)

Hi Arnold,
SAP Logon Tickets issued by the Portal contain two user ids, basically one for Java Systems and one for ABAP systems. See also note 843061 for details.
You do not need passwords for the reference system, if the user mapping is maintained by the user administrator, and the UM property ume.usermapping
.admin.pwdprotection is set to false, see http://help.sap.com/saphelp_nw04/helpdata/en/fe/d22a41b108f523e10000000a155106/frameset.htm. If you set the mapped user id programmatically, or if you retrieve it from an LDAP server, you also do not need to verify the ABAP password of the user (see https://media.sdn.sap.com/javadocs/NW04/SP12/ume/index.html and http://help.sap.com/saphelp_nw04/helpdata/en/0b/d82c4142aef623e10000000a155106/frameset.htm).
Best regards,
Joerg

GW user provisioning with iManger

I've just updated to Groupwise 2014, and everything seems to be working smoothly, but I need to clear a few things up regarding GW account creation.
In the past, I've manually created users with C1, and I used a template that had Groupwise PO information in it, and it all worked well. I can still create users with this template in C1 with the 2012 snapins, and everything seems to still work fine in GW2014, but I assume this isn't supported. Creating a user with iManager (with the GW plugins) with this same template does not create a Groupwise account at all, and I can't set GW info at user creation; I have to open the user after creation, go to the Groupwise tab, and pick the PO that they should belong to, and I can't actually change any groupwise options, like groups, visibility, nicknames, etc. In this case, the user gets created in GW, but the GW info (like email address, PO, etc) never makes it back into eDir. I do have email publishing enabled for the directory, but it doesn't seem to be doing anything.
My question is this: If I create a directory user and want to have a GW account automatically created for them at account creation time, what is the correct way to do that in 2014?
Thanks!
Adam

I've added a significant amount more GroupWise 2014 functionality since the v20 release. Jrbimprt and gwusers can both create users in GroupWise 2014 and make associations. But it is still not possible to create users via a template because there are no appropriate attributes which can be assigned to the template to identify the target 2014 system and the post office in which to create users. The 2012 attributes are not suitable e.g. "NGW: Post Office" must hold an eDir object name. Hence my suggestion to Novell. If necessary I'll provide my own aux class definition, but as I think such an aux class could be widely used, it is better for Novell to provide a standard definition than for 3rd party developers to each devise similar but different
schemes.
Contact me direct if you want to try the post v20 enhancements.
John

OIM user defined field in process form

I am trying to create a user defined field (UDF) in a process form. The UDF would be a drop down list of values for the status field.
I've tried to do this by going to the Administration list, and double clicking on User Defined Field Definition. Then selecting the Form Designer. I can add a column but I cannot add values to the drop down. I know I'm probably doing this wrong.
How do I add a UDF drop down and its values to a process form?
Thanks!

1. Create lookup table for the drop down contents.
2.In the process form--->go to the properties tab-->select the User defined filed name-->add property--->property Name drop down list -->select lookup code-->in the property value-->provide the lookup table name-->save
Edited by: user13513300 on Feb 24, 2011 1:45 AM

Encountering OBJECT, EMBED, and APPLET Tags With Different Plug-in Versions

i have two versions of jvm version 1.4.2.3 and version 1.5 and i am trying to enforce an applet to work with the oldest version
i was trying to do so using the classid attribute in the OBJECt tag as follows
clasdid="clsid:CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA"
but whan i run it the applet uses version 1.5
are there other preferences that i need to perform in order that it will work

Hi,
Suggest you look at:
http://java.sun.com/j2se/1.4.1/docs/guide/plugin/developer_guide/using_tags.html
and also:
http://java.sun.com/products/plugin/versions.html
They are not light reading but should provide insight on this topic.
Louis

OIM 10g - Provisioning issues

Hi Gurus,
I have the following situation in the OIM:
I have 2 resources (A and B). B is configured to Allow Multiple and depends that A is provisioned.
The resource A is already provisioned. So, when I need to provision B, is being showed to user fill out the resource forms of the B as well as of the resource A, and the workflow's process of A is triggered again.
This is causing a bad user experience.
Any tip in this behavior.
TIA,
Carlos

Kevin,
The resource form is necessary because I have a lot target attributes I do not have in the user definition.
But the my principal concern is, should the resource form of the resource A (already provisioned) be showed to the user for filling out? The request was did only for the resource B. Is this behavior correct?
Detail: When the resource A is not in Depends On tab, the A's resource form is not showed during request.

Provisioning with the AD connector (MSFT_AD_91150)

Hi friends,
I configured the AD Connector version: MSFT_AD_91150 in Oracle Identity Manager 11g.
Scenario Tested:
1. It created the user in Oracle Identity Manager 11g.
2. Resource was manually assigned to the user AD User created.
3. Check Active Directory is user-provisioned.
4. User was successfully created in Active Directory.
5. Accessed at the workstation with the user provisioned. For example: user/password = user1/xell2011
Final result:
- The user can not access the workstation with the password provided in the procurement process manually.
- The user can access the workstation when no password is entered. For example: user/password = user1/(blank)
- The connector is not sending the password.
Any suggestions to solve this problem

Friend Kevin,
I have connected with a ldap browser to Active Directory, these are the values of the classes when:
-(A) The user is created in the Active Directory directory
-(B) The user is created through Oracle Identity Manager (provisioned)
*(A) User created in Active Directory in the organization identitymanager*
dn: CN=jlk, OU=identitymanager, DC=businessvk,DC=com
displayName: jlk
givenName: jlk
sAMAccountType: 805306368
primaryGroupID: 513
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
badPasswordTime: 0
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=businessvk,DC=com
cn: jlk
userAccountControl: 66048
userPrincipalName: [email protected]
dSCorePropagationData: 16010101000000.0Z
codePage: 0
distinguishedName: CN=jlk,OU=identitymanager,DC=businessvk,DC=com
whenChanged: 20110406115109.0Z
whenCreated: 20110406115100.0Z
pwdLastSet: 129465642609525000
logonCount: 1
accountExpires: 9223372036854775807
lastLogoff: 0
lastLogonTimestamp: 129465642697181250
objectGUID:: 77+9UO+/vdqp77+977+9Qu+/ve+/ve+/ve+/vQ9J77+9
lastLogon: 129465642697181250
uSNChanged: 43491
uSNCreated: 43485
objectSid:: AQUAAAAAAAUVAAAAx5Pvv73qnoF/77+977+9w7JXBAAA
countryCode: 0
sAMAccountName: jlk
instanceType: 4
badPwdCount: 0
name: jlk
*(B) Users provisioned with Oracle Identity Manager, in the organization identitymanager*
dn: CN=dr.SUSE, OU=identitymanager, DC=businessvk,DC=com
displayName: dr.SUSE
givenName: [email protected]
sAMAccountType: 805306368
primaryGroupID: 513
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: user
badPasswordTime: 0
objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=businessvk,DC=com
mail: [email protected]
cn: dr.SUSE
initials: suse@b
userAccountControl: 66080
telephoneNumber: 14521111
userPrincipalName: [email protected]
dSCorePropagationData: 16010101000000.0Z
codePage: 0
distinguishedName: CN=dr.SUSE,OU=identitymanager,DC=businessvk,DC=com
whenChanged: 20110406115400.0Z
whenCreated: 20110406115358.0Z
pwdLastSet: 129465644405150000
logonCount: 0
accountExpires: 129472488000000000
lastLogoff: 0
objectGUID:: Iu+/ve+/vTFWKjFO77+977+9VO+/vQ==
sn: dr.SUSE
lastLogon: 0
c: DE
uSNChanged: 43498
uSNCreated: 43494
objectSid:: AQUAAAAAAAUVAAAAx5Pvv73qnoF/77+977+9w7JYBAAA
countryCode: 0
sAMAccountName: [email protected]
instanceType: 4
badPwdCount: 0
name: dr.SUSE
Thanks.

Copy user attribute from different user to user currently being edited

Dear all,
I'm somehow stuck with a requirement I've to implement.
I've to copy some user attributes from one user to another. I learned that I should be able to use "getResourceObject" for
this and I tried to implement this in my user form:
<Field name='otherUser_actvtGrps'>
<Display class='Text'>
<Property name='title' value='otherUser_actvtGrps'/>
</Display>
<Default>
<set name='otheruser'>
<invoke name='getResourceObject' class='com.waveset.ui.FormUtil'>
<select>
<ref>context</ref>
<ref>:display.session</ref>
</select>
<s>SAP_System_A</s> 
<s>User</s>
<s>TemplateUser</s> 
<null/>
</invoke>
<ref>otheruser.user.attributes.activityGroups</ref> 
</set>
</Default>
</Field>
But this does not return anything..
Any ideas what I did wrong ?
Many many thanks for any help/ideas !
Best regards
Joerg

Do you know where to get some docs about the topics you mentioned ?
1. Your adapter might not to support Resource Objects of type User.ResourceReference manual, the "Resource Object Management" section in each adapter chapter. Also the resource description in XML has the ObjectTypes section, for example, for Active Directory adapters:
<ObjectTypes>
    <ObjectType name="Group" nameKey="UI_RESOURCE_OBJECT_TYPE_GROUP" icon="group">
      <ObjectClasses operator="AND">
        <ObjectClass name="Group"/>
      </ObjectClasses>
      <ObjectFeatures>
        <ObjectFeature name="create"/>
        <ObjectFeature name="update"/>
        <ObjectFeature name="delete"/>
      </ObjectFeatures>
      <ObjectAttributes idAttr="distinguishedName" displayNameAttr="samAccountName" descriptionAttr="description" objectClassAttr="objectclass">
        <ObjectAttribute name="cn" type="string"/>
        <ObjectAttribute name="sAMAccountName" type="string"/>
2. You can fetch the complete user view with all resource account information.You will find many examples in IdM XPRESS samples.
Get user view using LighthouseContext and user accountId
<invoke name='getView'>
<invoke name='getLighthouseContext'>
    <ref>WF_CONTEXT</ref>
</invoke>
<concat>
    <s>UserViewer:</s>
    <ref>accountId</ref>
</concat>
<Map>
</Map>
</invoke>Or with WorkflowServices (see BusinessAdministration manual):
<Action id='0' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='getView'/>
<Argument name='viewId'>
    <concat>
      <s>User:</s>
      <ref>accountId</ref>
    </concat>
</Argument>
<Return from='view' to='user'/>
</Action>
3. You can fetch resource account info directly using ResourceAdapter API (not too well documented way).Example in Java:
    LighthouseContext ctx = <get context here>;
    // Get resource object
    Resource res = (Resource) ctx.getObject(Type.RESOURCE, <resource name>);
    // Pack resource and user accountId into a ResourceInfo object
    WSUser user = new WSUser();
    ResourceInfo info = new ResourceInfo();
    info.setAccountId(accountId);
    info.setResource(res);
    info.setAttributes(null);
    user.setResourceInfo(new ResourceInfo[] {info});
    // Rertrieve ResourceAdapter object
    ResourceAdapter ra = ResourceOp.findAdapter(res, res.getCache());
    // Get account info into the 'user' object
    WSUser result = ra.getUser(user);
    // Now you can get account status from ResourceInfo ...
    info = result.getResourceInfo(res);
    // ... and account attributes from WSAttributes
    WSAttributes attributes = result.getWSAttributes();
    ...

OIM - Users provisioned with different resource form versions

Similar Messages

Maybe you are looking for