OOTB Request Based Provisioning in OIM 11g

Hi Experts,
I am new to 11g approval work flow.
I am able to do following thing:
1) User login to OIM self user page.
2) User is able to raise request for new resource XYZ Resource.
3) On succesful submission, the Request goes to approval and its assigned to XELSYSADM
4) Once the xelsysadm is approving the request, the user gets access to XYZ Resource.
The above workflow is working.
I want instead of Xelsysadm, the request should get assigned to user's manager.
Is it possible to achieve OOTB?
Please reply!!
Regards,
J

Just wanted to add
There are three levels of approvals:
Template Level -- 1st Level
Request Level -- 2nd Level
Operation Level -- 3rd Level
set the Request Level to Auto Approval by checking the box on the request templateThis will Auto Complete the Template Level Approval
In case if you want to Auto Approve the Request Level then you need to create Approval Policy.
Request Level and Operation Level are handled at APPROVAL POLICY.

Similar Messages

Unable to configure Request based provisioning in OIM 9.1.0.1

Hi,
I have been trying to configure request based provisioning wherein Admin can request to provision a resource for a certain user. I have checked on the Auto Prepopulate and Auto Save options in the Process Definition. The problem which I am facing is that if I uncheck the Auto save option, admin's request is completed properly and an Approval request is generated. If the admin approves it, the resource status is set to Provisioning. Inside the resource object, there's only one task System Validation with status completed. The process form is empty if I view it. But if i go to edit i can see the fields being populated. After saving the form, i can see the data in the "View" option too. After this, I am able to add a task "Create User" and provision the user to Active Directory.
But if i check the Auto Save option in the Process definition, the request is completed but no approval task is generated. There is nothing in the User's resource profile as well.
What could be the reason for this and what could be a probable solution in such a scenario? I seek all your help in order to resolve this issue.

I have configured the approval tasks and the provisioning is working fine. The error which i am facing now is with 2nd level approver. I want the first level approver to be the requestor's manager, which is working fine. But when i am trying to fetch the Manager details of the requestor's manager (Requestor->Manager-> Manager), I am facing the below error.
Running GETSECONDLEVELAPPROVERTYPEUSER
2012-10-31 13:20:28,956 INFO [STDOUT] Target Class = com.pldt.adapter.ad.TaskAssignment
2012-10-31 13:20:28,957 INFO [STDOUT] Running GETSECONDLEVELAPPROVERKEY
2012-10-31 13:20:28,957 INFO [STDOUT] Target Class = com.pldt.adapter.ad.TaskAssignment
2012-10-31 13:20:28,957 INFO [STDOUT] ***************************Inside getSecondLevelApprover***************
2012-10-31 13:20:28,974 INFO [STDOUT] **************************usrKey**********1
2012-10-31 13:20:29,039 INFO [STDOUT] *****************ResultSet1***********Thor.API.tcMetaDataSet@5b895cb9
2012-10-31 13:20:29,080 INFO [STDOUT] *****************ResultSet2***********Thor.API.tcMetaDataSet@68d6c6eb
2012-10-31 13:20:29,080 ERROR [STDERR] java.lang.ClassCastException: java.lang.Long cannot be cast to java.lang.String
2012-10-31 13:20:29,081 ERROR [STDERR]      at com.thortech.xl.adapterfactory.events.tcAdpEvent.setKeyValue(Unknown Source)
2012-10-31 13:20:29,081 ERROR [STDERR]      at com.thortech.xl.adapterGlue.ScheduleItemEvents.adpGETSECONDLEVELAPPROVER.implementation(adpGETSECONDLEVELAPPROVER.java:56)
2012-10-31 13:20:29,081 ERROR [STDERR]      at com.thortech.xl.client.events.tcBaseEvent.run(Unknown Source)
2012-10-31 13:20:29,081 ERROR [STDERR]      at com.thortech.xl.dataobj.tcDataObj.runEvent(Unknown Source)
2012-10-31 13:20:29,081 ERROR [STDERR]      at com.thortech.xl.dataobj.tcScheduleItem.handleTaskAssignPostInsert(Unknown Source)
2012-10-31 13:20:29,081 ERROR [STDERR]      at com.thortech.xl.dataobj.tcScheduleItem.eventPostInsert(Unknown Source)
2012-10-31 13:20:29,082 ERROR [STDERR]      at com.thortech.xl.dataobj.tcDataObj.insert(Unknown Source)
I am passing the user key of the manager to fetch his manager's data. Please suggest a resolution for this.

How to Configure OIM 9.1 for Request-Based Provisioning

Hi experts,
I am new to OIM and need to know how to configure request based provisioning. Here is the scenario.
My environment has two target systems (Sun LDAP and Novell EDirectory) configured for provisioning to OIM 9.1
A user should be able to login, request either or both (SUN LDAP and EDir) for self or others.
Now the request should go to an admin for approval.
Once approved, the requested accounts should be created on the target systems.
Please guide me on the procedure to be followed.
Many thanks in advance

You will have to download the standard out of box connector for these target systems & will have to import it through the Deployment manager into OIM. Then you will have to create the Process definition of approval type & attach it to the same resource object. Please read the belo link before implementing any thing. This will provide you a better idea.
http://download.oracle.com/docs/cd/E10391_01/doc.910/e10363.pdf

How can I get approver of a request in request based provisioning

How can I get the approver of a request in Request Based Provisioning if the request is assigned to a group of user.
I need to get the actual approver (the one who logged in and approved amongst the approver group ) while the provisioning process gets executed.
Also,
as provisioning is triggered , can i put some value into a feild of the obj/process form.
Thanks

You can see the OSI table..
Also you can see Request History API.

Display Value/Description in Lookup During Request-Based Provision

Hello everyone! I'm currently using a lookup for a list of values during a request-based provision. I've created the request page, however, selecting the attributes isn't working the way I would like it to. For whatever reason, it's only displaying the Description or Decode value during the request. However, during direct-provisioning, I can see both, and when I choose one, the Value or Encode value is what is propagated to the OID. How can I configure my request-based lookup to show both the value and the description like it is shown during a direct provision? Here is the metadata I'm using:
<AttributeReference
available-in-bulk = "true"
length = "50"
widget = "text"
type = "String"
attr-ref = "UD_ULHOST"
name = "Unix Linux Hosts">
<AttributeReference
name = "Host"
attr-ref = "Host"
type = "String"
length = "50"
widget = "lookup"
available-in-bulk = "true"
lookup-code="ULHst">
</AttributeReference>

Can I designate my lookup code in that, though?
I have a lookup named LKTst with the following
Encode Decode
ServerA Group1
ServerB Group1
ServerC Group2
Can I still reference this lookup from the query? And if so, how?
Thank you for your help!

Customizing Request Application Flows in OIM 11g?

To all:
I'm trying to work through a scenario using Request Templates - I'm not sure that this approach is possible using configuration approaches and wanted to see if anyone has any useful feedback. First, let me describe the problem I'm attempting to solve:
- The users who will be using self-service will be somewhat restricted on what they can do: basically, once they have an account in OIM (this is 'automatic' from a reconciliation - there's no self-registration or user creation) they can request access to a small number of applications.
The ideal flow that we would like to follow is:
Step 1: Log in to OIM.
Step 2: Create Request
Step 3: Select the Application for requested access and the requested role.
Step 4: Enter an effective date and justification.
Step 5: Submit
... something 'application focused', not 'resource focused' as the end user community is not particularly aware (nor do they really need to be) about the details of how a user is authenticated.
I can get 'close' to this using a request template, with this flow:
Step 1: Log in to OIM
Step 2: Create a request.
Step 3: Select a Request Template. (I named the template after the application - "Select App Account")
Step 4: Select Your Resource (only one in this case - restricted to "AD User")
Step 5: Enter information about the AD account. (I can restrict this down to only allow for group selection, which is great.)
Step 6: Enter effective date, justification
Step 7: Submit
So the only thing I'd really like to 'skip' (or somehow default) is the selection of a resource and skip that step - because the template only allows for a single selection anyway, and having an extra step with a single selection that may only muddle the process would be detrimental to the usability of the request.
Is this a modification that we can make to the request flow ("If only one resource, default and move on") - or will we need to create some form of customized request process using the APIs?
I've dug into the JSF navigation in the iam-console-faces WAR file; it seems that navigation is tied up in the backing beans - has anyone else used Request Templates to meet this type of need?
My thanks in advance for any insight you can provide!

Dewan.Rajiv wrote:
It's a new flow which Oracle has introduced in OIM 11g. You can't skip that selection until you do modification in OOTB UI.
RO is mandatory thing to raise request so you can go for custom UI (Need ADF Knowledge) in which you'll ask end user to select other things except that Resource and you'll fetch RO name from some configuration file for using in request APIs.Thanks - it looks like customizing the OOTB UI might not be possible - rather than using ADF/Faces configuration files, most of the navigation redirects seem to be 'hidden away' in compiled class files. (My original thought: add some kind of filter and/or extension to an ADF Task Flow that governs the request application flow - but there are not task flow files to modify?)

Issues with offline provisioning in OIM 11G

We are facing an issue with OIM 11G where we are trying to provision few resources via offline provisioning. Ths issue is that when I do a provisioning/disable/enable on the resource the status of the resource says something like "provisioning in queue/Disable in queue/Enable in queue". This is not happenning all the time but seems to be consistent when I repeatedly disable/enable the resource. Once the status of hte resource remains "in queue" it is never changed back to the actual status which says provisioned/disabled/enabled. Can anyone provide me an insight of what is happenning here and how the offline events are processed within OIM? Is there any way to get the status of the resource back to normal? Please let me know.
Thanks!

Check
http://docs.oracle.com/cd/E14899_01/doc.9102/e14761/offline_prov.htm
Configuring the Remove Failed Off-line Messages Scheduled Task
Configure the Remove Failed Off-line Messages scheduled task to schedule deletion of failed requests from the OPS table. While configuring this scheduled task, set a value for the Remove Failed Messages Older Than (days) attribute.
Regards
Shashank

Request Administrator isuse in OIM 11g

I assignd one OIM user (12345) to role as "Request Administrator" and trying to search all the requests raised in OIM.
I am not able to see all requests .It shows the requests only raised for 12345 user or raised by 12345 user but not other users request.
Please let me know the reason.
Thanks for help.

user123456 wrote:
What do you mean by Claim/acquire the task?There's a small button on top of the page in OIM UI which you can click to acquire the task to your self from some else.
There must be some Role in OIM 11g who can manage all the tasks/requests irrespective of whether it's created by them or assign by them.I doubt if that's simple, why want one single role to manage everything while you are assigning it to some other? Assign it to this role always then!
Do you have any idea about such kind of Role?No
Thanks !!

Steps to enable Automatic provisioning in OIM 11g

Hi,
I am trying to configure my OIM 11g to automatically provision the resource into OID.
I am able to do the provisioning manually but as per my requirement, when I register the user details in OIM the record must be created in OID automatically.
Can u please mention the steps I must follow for the same.
Regards

Hi Pk
I Checked the task "System Validation" status for the Resource.It was Pending as told I selected Auto Save in the process definition of the resource in design console.
Now my resource gets provisioned but only when I attach user to the Role created by me. By default user gets attached to the All Users Role.
What configuration changes should i make so that the user on creation gets attached to custom Role created by me.
Regards

AD Provisioning in OIM 11g R2

Hi everyone,
I want to provisioning to AD.
I create a Application Instance and I create form.
Then I go details of a user, and a go Accounts tab and I enter "Request Account".
Then I search catalog screent and add to cart then complete the operation ?
This is enough for provisioning ?
What is the meaning of "entitlement" ?
Do I have to execute Entitlement List scheduled job?
Do I have to do provisioning via "Entitlement"(in users detail screen)?
Thanks.
Best Regards.

I create a Application Instance and I create form.
Then I go details of a user, and a go Accounts tab and I enter "Request Account".
Then I search catalog screent and add to cart then complete the operation ?
yes this is fine. hope you have populated form data at this place
This is enough for provisioning ?
Yes this is enough for provisioning.
What is the meaning of "entitlement" ?
entitlement holds the target system multivalued attribute like role,group, responsibility. In earlier version of OIM for viewing group/role you have to go to process form->child form which was quite tedius. Now you have the entitlement tab which hold all the child table data together( ie: role, group..etc)
Do I have to execute Entitlement List scheduled job?
yes, To link entitlements to the application instance we have to run this job. after running job you can go to sysadmin->appinstance-> search appinstance->Click the Entitlements tab, and verify that the entitlements are displayed or not.Even the entitlements are available in catalog after running this job. so, you can request it from catalog directly
Do I have to do provisioning via "Entitlement"(in users detail screen)?
yes for multivalued attribute you can request via 'Entitlement' tab.

User Provisioning in OIM 11g to Oracle DB 11g R2

Hi All,
We have installed OIM 11.1.1.5. We have created User in OIM and wanted to provision it to database 11g R2. For this we have created a table in DB.
We are not sure about the next steps or which connectors to use....
Experts can u please guide me through steps or link or snapshots to achieve the above scenario?
Regards,
Newbie

Hi Kevin,
Thanks , that was a complete document.
However I achieved User Provisioning by creating GTC. This i found in below document-
http://tooweaktogivein.com/2010/02/16/oim-provisioning-db/
Now my query is how do i fetch the values entered in UDF by admin (User Form) to the Form which comes when we select Resource Object (probably process form as i don't see any option as Object form in 11.1.1.5).
Currently- 1. Admin creates user
2. Admin selects Resource Object (Created via GTC)
3. Admin has to re-enter the values which we created in our table (To be stored in DB).
Summary- how to populate the values entered in step 1 to step 3
Thanks & Regards,
Newbie

How to retrieve Request Form Data in OIM 11g for SOA workflows

Hi,
I have a business requirement wherein, I need to retrieve a field's value inside my SOA composite for further processing and decide on the Approver of the Request. Say for e.g. I'm having a field *"Country"* inside my Request Form, and what i need to do is, as soon as the request form is submitted, I need to retrieve the value for *"Country"* attribute inside my SOA Composite using Payload, and further process it. This scenerio is with respect to provision an application instance to a user.
Now, in a similar scenario, where I was trying to create a user of type *"Contractor"*, I had used Request Service Api to retrieve the Basic information of the userform submitted, and decide on approval. Fortunately, the basic data like, First Name, Last Name, Login etc was successfully being fetched from the Request and I was able to perform further operations.
Unfortunately, the same code which was working for Creation of a User, is not working when I'm trying to provision an application instance to the user.
Below is the code which worked fine for me to retrieve basic request data for user creation, and isn't working for provisioning application instance:
RequestService reqSvc = (RequestService)oimClient.getService(RequestService.class);
String reqId = ((oracle.xml.parser.v2.XMLElement)getVariableData("inputVariable", "payload", "/ns3:process/ns4:RequestID")).getText();
System.out.println("request ID: " reqId);+
Request req = reqSvc.getBasicRequestData(reqId);
List <RequestEntity> targetEntities = req.getTargetEntities();
System.out.println("targetEntities : " targetEntities);+
System.out.println("------------");
for (RequestEntity rea : targetEntities)
+{+
List <RequestEntityAttribute> attributes = rea.getEntityData();
for( oracle.iam.request.vo.RequestEntityAttribute attribute : attributes)
+{+
System.out.println("Attribute.getName() : " attribute.getName().toString());+
     if(attribute.getName().equals("User Manager"))
     +{+
beneficiaryManagerKey = attribute.getValue().toString();
     System.out.println("User Manager : " beneficiaryManagerKey);+
+}+
     e+lse if(attribute.getName().equals("User Login"))+
     +{+
userid = attribute.getValue().toString();
     System.out.println("User Login : " userid);+
+}+
+}+
+}+
Any pointers to this would be of a great help.
Regards

List <RequestEntity> targetEntities = req.getTargetEntities();
System.out.println("targetEntities : " + targetEntities);
System.out.println("------------");
The above piece of code retrieves the attributes and their values from the request form while creating a user, but not from the request form, which provisioning a resource to a user.
Regards,

Exchange 2010 Provisioning from OIM 11g

I am having trouble provisioning to Exchange 2010. The error I am receiving is "Empty Arguments Passed in either Root Context,Admin FQDN,Admin Password,Server Address,Port Number in the IT Resource." I don't recall setting any of these parameters as part of the Exchange IT Resource. Do these come from the AD IT Resource or some Lookup object that I have missed? During the request I only specified AD Server, Mail Store and Mail Alias.
Thanks,
Pete

Check the values in ADITResource. Yes these come from ADITResource.

Modify the request by approvar in OIM 11g

Hi,
I have a requirement where- an approver needs to update few fields in the request form and then approve the request.
I am using Oracle 11g R1.
Please let me know how to achive this.

You need to configure your Approval Policies and rule within them to apply to your requests appropriately. By default there is a Request Level, and Operation Level approval (there is also template, but not needed). If you have not configured an approval policy that will cover your request, then it will require those approvals.
-Kevin

Issue with deleting a group using Request APIs in OIM 11g R1

Hi,
I am facing an issue with Request Based provisioning in OIM 11g R1.
I am currently testing a scenario where i have imported a data set for 'Modify Provisioned Resource' and am able to add a group/entitlement to an already provisioned resource by using the following code :
        RequestBeneficiaryEntityAttribute childEntityAttribute= new RequestBeneficiaryEntityAttribute();
        childEntityAttribute.setName("AD User Group Details");
        childEntityAttribute.setType(TYPE.String);
        List<RequestBeneficiaryEntityAttribute> childEntityAttributeList=new ArrayList<RequestBeneficiaryEntityAttribute>();
        RequestBeneficiaryEntityAttribute attr = new RequestBeneficiaryEntityAttribute("Group Name", <group>,                                                                       RequestBeneficiaryEntityAttribute.TYPE.String);
        childEntityAttributeList.add(attr);
        childEntityAttribute.setChildAttributes(childEntityAttributeList);
        childEntityAttribute.setAction(RequestBeneficiaryEntityAttribute.ACTION.Add);
        beneficiaryEntityAttributeList = new ArrayList<RequestBeneficiaryEntityAttribute>();
        beneficiaryEntityAttributeList.add(childEntityAttribute);
        beneficiarytEntity.setEntityData(beneficiaryEntityAttributeList);
This works fine for adding a group but if i try to remove a group by changing the action to Delete in the same code, the request fails. The only change made is in the following line:
childEntityAttribute.setAction(RequestBeneficiaryEntityAttribute.ACTION.Delete);
Could you please suggest where can this possibly be wrong.
Thanks for your time and help

Hi BB,
I am trying to follow up your response.
You are suggestng to use prepopulate adapter for to populate respource object name, that means We have to just use an sql query from obj tabke to get the resource object name. right ?? it could be like below, what should I have entity-type value here ??
<AttributeReference name="Field1" attr-ref="act_key"
available-in-bulk="false" type="Long" length="20" widget="ENTITY" required="true"
entity-type="????"/>
<PrePopulationAdapter name="prepopulateResurceObject"
classname="my.sample.package.prepopulateResurceObject" />
</AttributeReference>
<AttributeReference name="Field2" attr-ref="Field2" type="String" length="256" widget="lookup-query"
available-in-bulk="true" required="true">
<lookupQuery lookup-query="select lkv_encoded as Value,lkv_decoded as Description from lkv lkv,lku lku
where lkv.lku_key=lku.lku_key and lku_type_string_key='Lookup.xxx.BO.Field2'
and instr(lkv_encoded,concat('$Form data.Field1', '~'))>0" display-field="Description" save-field="Value" />
</AttributeReference>
Then I need think about the 'Lookup.xxx.BO.Field2' format.
Could you please let me know if my understanding is correct?? What is the entity-type value of the first attribute reference value?
Thanks for your all help.

OOTB Request Based Provisioning in OIM 11g

Similar Messages

Maybe you are looking for