Organization Admin control in OIM 11gR2

Question

Hi,
I was trying to configure Organization Admin control in OIM 11gR2. Our requirement is to configure roles having read access of organization (members of this role can only see the members of the organization but cannot update it), roles having admin control on organization (where members of this roles can read/write/execute member access). There should be different set of roles having access on different organization where members from one role cannot access the members of the other organization. I tried to configure these security models but the only thing i could find in organization is Admin Roles which also i couldn't able to configure very well :(. Can someone point me to the correct documentation or procedure/tool which we should use to achieve such functionality (These functionalities are very easily available in OIM 10g but couldn't find in 11gR2 :( )

Answer 1

If you add the members of a role to the Admin Roles of a given Organization (Specifically OrclOIMOrgViewer Admin Role). The users will be able to see the users in that organization.
A few things to consider:
Only xelsysadm or a users in the System Administrator Admin Role can assign users to Admin Roles within the scope of an Organization.
Here is a piece of code that you can use to programmatically add users to the Admin Role OrclOIMOrgViewer:
public List getScopedAdminRoleMemberships() {   // This one gets the list of all admin roles scoped by Organization
Hashtable env = new Hashtable();
env.put(OIMClient.JAVA_NAMING_FACTORY_INITIAL,"weblogic.jndi.WLInitialContextFactory");
env.put(OIMClient.JAVA_NAMING_PROVIDER_URL, "t3://<oim server host>:<oim port>");
OIMClient oimClient = new OIMClient(env);
try {
oimClient.login("xelsysadm", "<XELSYSADM Password>".toCharArray());
} catch (LoginException e) {
throw new RuntimeException(e.getMessage(), e);
AdminRoleService adminRoleSvc = oimClient.getService(AdminRoleService.class);
return adminRoleSvc.getScopedAdminRoles();
public AdminRoleMembership addAdminRoleMembershipFor(String userId, AdminRole role, String scopeId) {  // This method adds the user identified by userId (pass usr_key not usr_login) to the Admin Role in Org whose key (act_key) is
// passed as a parameter in the scopeId.
AdminRoleMembership membership = new AdminRoleMembership();
membership.setAdminRole(role);
membership.setUserId(userId);
membership.setScopeId(scopeId);
Hashtable env = new Hashtable();
env.put(OIMClient.JAVA_NAMING_FACTORY_INITIAL,"weblogic.jndi.WLInitialContextFactory");
env.put(OIMClient.JAVA_NAMING_PROVIDER_URL, "t3://<oim server host>:<oim port>");
OIMClient oimClient = new OIMClient(env);
try {
oimClient.login("xelsysadm", "<XELSYSADM Password>".toCharArray());
} catch (LoginException e) {
throw new RuntimeException(e.getMessage(), e);
AdminRoleService adminRoleSvc = oimClient.getService(AdminRoleService.class);
return adminRoleSvc.addAdminRoleMembership(membership);
This should give you what you need. Remember, the API's work with act_key and usr_key values don't use Org Names or User Logins.
Hope this helps.
Regards
Alex Lopez