Problem with Access Policy

Question

Hi All!
OIM 11g:
1. I have installed DBUM 9.1.0.4
2. I have configured IT Resurce, and RO for granting user MS SQL User and database role (for example in HRData db)
3. I have created Role named: "HRData DB User" and Access Policy named: "HR Data DB User" wchich grants correct RO.
4. When role is granted by xelsysadm for specific oim user everything is OK.
Problem:
when user request for role: "HRData DB User" from Self-Service portal, and request is approved by xelsysadm, role is granted but RO is not granted. I have following error:
+<Nov 19, 2010 1:12:46 PM CET> <Error> <XELLERATE.SERVER> <BEA-000000> <Class/Method+
+: tcDataObj/eventPreInsert Error :Insert permission is denied>+
+<Nov 19, 2010 1:12:46 PM CET> <Error> <oracle.iam.accesspolicy.impl.handlers.provis+
ioning> <IAM-4030308> <An error occurred in oracle.iam.accesspolicy.impl.handlers.p
rovisioning.ProvisionAccountActionHandler while provisioning resource 161 to user 4
+3 and the cause of error is DOBJ.INSERT_PERMISSION_DENIED: H: You do not have permi+
ssion to insert this object..>
+<Nov 19, 2010 1:12:46 PM CET> <Warning> <oracle.iam.callbacks.common> <IAM-2030081>+
+<[CALLBACKMSG] Inside completion plugin for request 68.>+
+<Nov 19, 2010 1:12:46 PM CET> <Warning> <oracle.iam.callbacks.common> <IAM-2030082>+
+<[CALLBACKMSG] Inside completion plugin for request 68, target tye is Role and ope+
ration is SELFASSIGNROLES.>
+<Nov 19, 2010 1:12:46 PM CET> <Warning> <oracle.iam.callbacks.common> <IAM-2030082>+
+<[CALLBACKMSG] Inside completion plugin for request 68, target tye is RoleUser and+
operation is CREATE.>
Any suggestions?
best
mp

Answer 1

Hi Rajiv,
So, there is no way we can implement this?
My requirement is same as this,
OIM: Question about "Auto Save" option on Resource Object
I have a Resource Object that needs to be provisioned at least two ways:
1) thru an access policy by group membership
2) thru user self-request, who is not already in that group membership
The problem is if I don't check the "Auto Save" check box the automatic assignment thru access policy is not completing and If I do check the check box then user request is not letting the user to enter values into the resource form. Instead it is directly going to submit request. Looks like these are mutually exclusive.
Is there a way to make both work on the same Resource Object?
Thanks
SK