Provision one OIM account to multiple resource accounts

Hello everyone,
We have a requirement to provision some OIM accounts more than once to the same target source. For example provision some user to two accounts in the target source, one normal account with the same user ID and another administrator account prefixed with "HS_". Is it possible?
Thanks in advance

It is possible as long as you check "allow multiple" in the resource object. Also, if you want to do auto-provisioning using Access Policy, you need to be on 9.1.0.2 BP12. Earlier release doesn't support provisioning to multiple instance of a same resource object using access policy.

Similar Messages

Multiple Accounts on Multiple resources through ActiveSync

Hi,
I am trying to create multiple accounts on multiple resource through activesync. But i am able 2 create on a single resource... below is the code
<Field name='NDSFilter'>
<Disable>
<isFalse>
<contains>
<ref>accountInfo.assigned</ref>
<s>Dev-NDS</s>
</contains>
</isFalse>
</Disable>
<Field name='newAccountRequest'>
<Expansion>
<block trace='true'>
<s>Dev-NDS</s>
</block>
</Expansion>
</Field>
<Field name='global.NdsUname'>
<Expansion>
<block>
<s>NdsFour</s>
</block>
</Expansion>
</Field>
<Field name='global.NDSOU'>
<Expansion>
<block>
<s>ADK</s>
</block>
</Expansion>
</Field>
<Field name='accounts[Dev-NDS].waveset.generate'>
<Default>
<s>true</s>
</Default>
</Field>
</Field>
<Field name='DSFilter'>
<Disable>
<isFalse>
<contains>
<ref>accountInfo.assigned</ref>
<s>UOS-AssociatesLDAP</s>
</contains>
</isFalse>
</Disable>
<Field name='newAccountRequest'>
<Expansion>
<block trace='true'>
<s>UOS-AssociatesLDAP</s>
</block>
</Expansion>
</Field>
<Field name='accounts[UOS-AssociatesLDAP].accountId'>
<Expansion>
<block trace='true'>
<s>AccountTwo</s>
</block>
</Expansion>
</Field>
<Field name='global.OU'>
<Expansion>
<block trace='true'>
<s>UOS-MultiAccounts</s>
</block>
</Expansion>
</Field>
<Field name='accounts[UOS-AssociatesLDAP].waveset.generate'>
<Default>
<s>true</s>
</Default>
</Field>
</Field>
Can anyone pls suggest me the solution...
Thanks in advance
Kiran

Thanks for the reply... in my case this would be done by the active synch process so no GUI form is required. I will be getting a list of application ID for the user by LDAP AS. One i get it i will have to parse it and get the list of application user id. I am passing those ID;s to a workflow where I am forming the resource name as you mentioned
for example:
If i get user1#user2#user3 from AS i am separating them based on # using split and getting 3 different user id;s
now i am forming a string with the resource name and passing it to the sub process in which i am checking out the user object, setting the user attributes and checking in the new view.
user1#LDAP
user2#LDAP|1
user3#LDAP|2
Problem ; When i run this user1 is getting created in LDAP but user2 and user3 are not. There entry is getting created in IDM.
When I open the IDM object I get a yellow triangle (warning) and if I open the user object and hit save button IDM creates the user account on the LDAP.
any help for further solving this problem would be appreciated.
Regards,

Assigning Multiple Resource Accounts to IdM User Account in IdM 7.0

Hi All -
Has anyone tried assigning multiple resource accounts to a IdM User with IdM 7.0 by creating a Account type using Identity Rules. I tested it on Simulated Resource and it works fine. But for Active Directory, which has personal accounts and Admin accounts on different OU on AD, when I am trying to do the Bulk Upload. The bulk upload is able to do link up the Admin account on AD to user account. But then it tries to create an additional account as well even though the user that executed the Bulk action has a Blank form assigned. Has anyone been able to figure this out yet ? If yes, can you please provide some inputs on this ?

Hi All -
Has anyone tried assigning multiple resource accounts to a IdM User with IdM 7.0 by creating a Account type using Identity Rules. I tested it on Simulated Resource and it works fine. But for Active Directory, which has personal accounts and Admin accounts on different OU on AD, when I am trying to do the Bulk Upload. The bulk upload is able to do link up the Admin account on AD to user account. But then it tries to create an additional account as well even though the user that executed the Bulk action has a Blank form assigned. Has anyone been able to figure this out yet ? If yes, can you please provide some inputs on this ?

1 Source Account to Multiple HFM Accounts?

Is it possible to map a single source account to multiple hfm accounts in FDM?
Currently, I have a 1 for 1 mapping.
Source Account 1 => HFM Account 1
I have a situation where I would like to have a 1 to many mapping.
Source Account 1 => HFM Account 1
Also, Source Account 1 => HFM Account 2
If this is possible - my next concern will be how to map 1 source item to multiple hfm dimensions (UD1, UD2)
Thank you for your considerations.
-David

Hi Kelly,
Thank you for the response. I found what I was looking for in an answer from Oracle:
Use Logic Accounts
What you will need to do is use Logic Accounts inside of FDM. Logic Accounts are ways to duplicate records in the trial balance. This way they can be adjusted (possibly for a 40/60 split for example) and pushed via mapping into the appropriate accounts.
Logic is applied at import and before mapping and is subject to normal FDM procedures. This means that if you push two different values into the same Logic Account, they will be 'summed,' and if you forget to create map entries for your Logic Accounts they will fail validation.
The best suggestion I have is for you to also look into the FDM Administrators guide. Available from the Web interface via the 'Help' menu. This will provide examples as well as a more descriptive answer.
Please let me know if you have any further questions
-ODM

Sharing one iphoto library between multiple user accounts

I hav an extensive photo library and would like to share this across multiple users on the one computer. Am I able to do this without having to move the library to an external hard drive?

What you mean by 'share'.
If you want the other user to be able to see the pics, but not add to, change or alter your library, then enable Sharing in your iPhoto (Preferences -> Sharing), leave iPhoto running and use Fast User Switching to open the other account. In that account, enable 'Look For Shared Libraries'. Your Library will appear in the other source pane.
Any user can drag a pic from the Shared Library to their own in the iPhoto Window.
Remember iPhoto must be running in both accounts for this to work.
If you want the other user to have the same access to the library as you: to be able to add, edit, organise, keyword etc. The problem here is that OS X works very hard to keep your data safe and secure from the other users. You're trying to beat what's built in to the system. So, to beat the system
Quit iPhoto in both accounts
Move the iPhoto Library Folder to an external HD set to ignore permissions. You could also use a Disk Image or even partition your Hard Disk.
In each account in turn: Hold down the option (or alt) key and launch iPhoto. From the resulting dialogue, select 'Choose Library' and navigate to the new library location. From that point on, this will be the default library location. Both accounts will have full access to the library, in fact, both accounts will 'own' it.
However, there is a catch with this system and it is a significant one. iPhoto is not a multi-user app., it does not have the code to negotiate two users simultaneously writing to the database, and trying will cause db corruption. So only one user at a time, and back up, back up back up.
Lastly: This method seems a little clunky at first, but works very well. Most importantly, it uses the System to do the job for you.
Create a new Account on your Mac, call it Media. Create an iPhoto Library there. (BTW: This will work for iTunes too.)
Enable Sharing on the Library:(Preferences -> Sharing), leave iPhoto running and use Fast User Switching to open the other accounts. In those accounts, enable 'Look For Shared Libraries'. The Library will appear in the other source pane.
This means that both users will be able to see the pics. If you want to use a pic then simply drag it from the shared Library to your own in the iPhoto Window. This means that each user can have their own edits.
If you want to add photos to the Library: Log into the Media account for that purpose.
To make it all seamless: Set your Mac to log into the Media Account automatically. Set iPhoto to launch on log-in. Then switch to your own account using Fast User Switching.
Net result: a Library that's permanently available to all users but also protected. Each user can have their own versions of the pics if they want.
No partitioning, no permissions issues. Uses no extra disk space. What's not to like?
Regards
TD

Is there a way to default send from one mail account across multiple mail accounts?

I have a user who has her own Exchange mailbox account. I have added two separate Exchange mail accounts. I want to be able to force her (even if she is in one of the other two mail accounts) to send from her own Exchange account. I know you can manually change it every time, but is there a way to force it automatically? Thanks.

Nope. There is no universal mailbox on the iPhone.

Setting up multiple email accounts on multiple .mac accounts

There are three of us in the household, all with our own .mac accounts (created off of one master account) and our own usernames on this computer. I have set up multiple email accounts and am having trouble getting those accounts organized into Mail. Can I set it up such that each user can access his/her email when logged into his/her respective area on this mac? For example, I want to be able to log in as myself and read my email, then let my wife log into her area and read her email. I have tried and really messed it up. We can read mail but not send it. When i try to send a message pops up informing me that "cannot send message using the server (server name here). Try again later."

Can I set it up such that each user can access his/her email when
logged into his/her respective area on this mac? For example, I want
to be able to log in as myself and read my email, then let my wife log
into her area and read her email.
Yes and this is how it should be done with each user's email account only created in Mail under their computer login account so each user's email along with all other data is kept separate and protected in their own home folder/directory. Of course this only works when disabling automatic login.
Who is your ISP used for connecting to the internet and is each user/family member also accessing an email account that is provided by your ISP?
Something to try first and this must be done with the .Mac SMTP server in Mail for each user's login account.
Go to Mail > Preferences > Accounts and under the Account Information tab for the .Mac account preferences at the SMTP server selection, select the Server Settings button below.
Enter 587 in place of 25 in the Server Port field and when finished, select OK to save the changed setting.

Linking Multiple Resource Accounts via Active Sync

Ok guys/gals the scenario is... We have one idm account linked to accounts on one resource, and we want to be able to link them up via Active Sync...We don't care about the attributes, just want to make sure that if a another account for a user is created outside of IDM we can grab it and link it. So far, I've seen that the active sync process will see the new account, correlate it to a user, but it will not link the user...And outside of doing a custom Process Rule workflow, I'm not seeing any other way to get the accounts to link via active sync. Is what we are trying to do a reconciliation thing only? Have I missed something?

Yes. You can add a field to your ActiveSync form to do this: Here is an example with AD:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE Configuration PUBLIC 'waveset.dtd' 'waveset.dtd'>
<Configuration name="Sample ActiveDirectory ActiveSync Form" wstype="UserForm">
     <Extension>
          <Form name="Sample ActiveDirectory ActiveSync Form">
               <Field name="processType">
                    <Default>
                         <s>NONE</s>
                    </Default>
               </Field>
               <Field name="dispatcher">
                    <Expansion>
                         <cond>
                              <eq>
                                   <upcase>
                                        <ref>feedOp</ref>
                                   </upcase>
                                   <s>UPDATE</s>
                              </eq>
                              <block>
                                   <set name="update.selectAll">
                                        <s>false</s>
                                   </set>
                                   <dolist name="resObj">
                                        <ref>waveset.accounts</ref>
                                        <block>
                                             <set name="resName">
                                                  <get>
                                                       <split>
                                                            <ref>resObj</ref>
                                                            <s>:</s>
                                                       </split>
                                                       <i>1</i>
                                                  </get>
                                             </set>
                                             <set>
                                                  <concat>
                                                       <s>update.accounts[</s>
                                                       <ref>resName</ref>
                                                       <s>].selected</s>
                                                  </concat>
                                                  <s>false</s>
                                             </set>
                                             <cond>
                                                  <match>
                                                       <ref>resName</ref>
                                                       <ref>activeSync.resourceName</ref>
                                                  </match>
                                                  <cond>
                                                       <eq>
                                                            <ref>
                                                                 <concat>
                                                                      <s>waveset.accounts[</s>
                                                                      <ref>resName</ref>
                                                                      <s>].accountGUID</s>
                                                                 </concat>
                                                            </ref>
                                                            <ref>activeSync.objectGUID</ref>
                                                       </eq>
                                                       <set name="resourceName">
                                                            <ref>resName</ref>
                                                       </set>
                                                  </cond>
                                             </cond>
                                        </block>
                                   </dolist>
                                   <cond>
                                        <isnull>
                                             <ref>resourceName</ref>
                                        </isnull>
                                        <set name="processType">
                                             <s>LINK</s>
                                        </set>
                                        <set name="processType">
                                             <s>UPDATE</s>
                                        </set>
                                   </cond>
                              </block>
                         </cond>
                    </Expansion>
               </Field>
               <Field name="IAPI.cancel">
                    <Expansion>
                         <s>true</s>
                    </Expansion>
                    <Disable>
                         <eq>
                              <ref>processType</ref>
                              <s>LINK</s>
                         </eq>
                    </Disable>
               </Field>
               <Field name="doLinking">
                    <Expansion>
                         <block>
                              <append name="waveset.resources">
                                   <ref>activeSync.resourceName</ref>
                              </append>
                              <set>
                                   <concat>
                                        <s>waveset.accounts[</s>
                                        <ref>activeSync.resourceName</ref>
                                        <s>].accountId</s>
                                   </concat>
                                   <ref>activeSync.identity</ref>
                              </set>
                              <set>
                                   <concat>
                                        <s>waveset.accounts[</s>
                                        <ref>activeSync.resourceName</ref>
                                        <s>].sAMAccountName</s>
                                   </concat>
                                   <ref>
                                        <s>activeSync.sAMAccountName</s>
                                   </ref>
                              </set>
                              <set>
                                   <concat>
                                        <s>waveset.accounts[</s>
                                        <ref>activeSync.resourceName</ref>
                                        <s>].accountGUID</s>
                                   </concat>
                                   <ref>activeSync.objectGUID</ref>
                              </set>
                         </block>
                    </Expansion>
                    <Disable>
                         <neq>
                              <ref>processType</ref>
                              <s>LINK</s>
                         </neq>
                    </Disable>
               </Field>
          </Form>
     </Extension>
     <MemberObjectGroups>
          <ObjectRef type="ObjectGroup" id="#ID#Top" name="Top"/>
     </MemberObjectGroups>
</Configuration>

One main apple account and multiple icloud accounts

Help please! We have one main apple account/ID that we use for purchases. I have set up seperate iCloud accounts for my 3 kids so that our information (mail, contacts, etc) is kept seperate. I have enabled the restrictions on their iPods also.
It looked like I had everything separated correctly, they had their own contact book, their own email account, and were (hopefully) able to only iMessage/Facetime with the contacts that are loaded in their phone. I went to test this by going to iMessage and started to type one of the pre-loaded contacts in their phone and all my personal contacts showed up. I do not want my kids accidentlly iMessaging my contacts. How are these getting pulled in? I can not find in settings anywhere where to turn this off. My contacts are not listed in their contact book on their iPod?
Thank you so much for your help!

My kids favorite games are mindcraft and flappy bird and when I mentioned restoring their phone they were a bit worried. Looks like I might need some quiet time to read that document over and see if their is a way to save their info in the games. Looks like there might be? If I can figure that out then I will for sure restore their phones. In the meantime I am telling them to be super careful not to send mass text to my contacts Thank you for your help!

Using one music library with multiple user accounts

I want to use one Music Library and be able to have all my computer user accounts be able to access it. Article 93195 does not work for some reason. It is easy to share music over a network but not on the same computer? This can't be. I have talked to several Apple "Geniuses" and they all scratch their head. One guy could do it in Leopard, but not in Tiger. Could it have something to do with the permissions of the Itunes Music Folder? Any help would be appreciated. This is driving me crazy.

1 Quit iTunes.
2 Drag your entire *iTunes folder* from /Username/Music to /Users/Shared.
3 Log out.
1 Log in on your other account(s).
2 Start iTunes and immediately press an hold the Option key.
3 iTunes will ask to *Create new library* or *Choose existing library*. Select *Choose existing library*.
4 Select the *iTunes library file* in the *iTunes folder* in /Users/Shared.
5 Now go to File -> *Add to library* and select the *iTunes music folder* located in /Username/Music.
6 - iTunes will add all the music in from this account to the main iTunes music folder/library.
7 Delete the *iTunes folder* in /Username/Music
8 Restart iTunes normally (don't hold Option). Everything should be there.
9 Quit iTunes and log out of the account.
10 Do the above steps for all users. Don't do the first 1-3 steps. Start at the second series.
Log into your account, start iTunes normally and all music should be there.
Whenever any of you do anything in iTunes, it will be seen by all since you are using one and the same iTunes library file.
Create a "main" playlist for each user with their own music. Create a smart playlist and set it to Playlist is not the playlist you created above. Select this and it will show you everything NOT in your playlist. Do the same for the others. This will help when adding only the music you want your own playlist.
Note that iTunes can only be opened by one user at a time. If you have Fast user switching enabled, the other users must quit iTunes in order for anyone else to use it.

Single GL account for multiple Bank account ID

Hello all,
we are implementing bank statement integration.
First we have to define the related GL accounts CoA of course.
My problem is that we have thousands of bank accounts. usually best practice is to create one GL account for one bank account ID.
This would imply that we create thousands of GL accounts...a situation we would like to avoid
It seems possible to use one GL for several bank account ID ? However I wonder if this does not raise problems for bank statement reconciliation.
Has anyone encounter such context ? What kind of solutions are possible ?
Thanks for your help !

Hi ,
For bank reconcilition purpose it is always recommended that we go by individual GL account , as it is advisable for effective and correct reconcilliation.
At least as per my shot on the subject i would recommend that for incoming and outgoing bank accounts you should create 1 GL account each for each bank . for main bank again you can rethink and make it a consolidated one .
secondly , please take the details as to how is bank submitting the information is it branch wise or are the providing consolided statement for reconcilliation .
do revert back if you are still stuck up .
Hope this suffices .
Regards ,
dev.

Connect Microsoft Account to Multiple Domain Accounts

We are currently trialing windows 8.1 tablets in a school environment and would like for the students to have access to the 'Windows Store'
All students log in with a domain account. (Their own domain account)
All of these tablets are being imaged Via SCCM 2012 Task Sequence.
What I would like to see happen either during the SCCM TS or via GPO or some other method would be to have the same Microsoft account connected to anyone logging into these devices this way the student would never require the account credentials
and they would never be prompted to log into the store as well as be able to openly download and install free apps... I'll tackle the paid app issue separately...
I would enable the GPO:
computer configuration\windows settings\security settings\local policies\security options\'accounts: block Microsoft account'
so that they couldn't link any additional personal Microsoft accounts.
thoughts?

More update...
created the following script (autoit) to create the appropriate reg key entries to connect a Microsoft account to the current logged on user.
#include <Security.au3>
Local $aArrayOfData = _Security__LookupAccountName(@UserName)
$SID = $aArrayOfData[0]
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\", "AccountsCount", "REG_DWORD", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\", "AssociatedCount", "REG_DWORD", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\", "CID", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\", "Keywords", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "AccountType", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "ChildFlags", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "DefaultCredSaved", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "DisplayName", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "FirstName", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "Flags", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "Keywords", "REG_SZ", "<Enter Applicable Value>")
RegWrite("HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\StoredIdentities\<Microsoft Live Account Name>\" & $SID, "LastName", "REG_SZ", "<Enter Applicable Value>")
I am applying this script on logon to the users so they all end up using the same account to access the store.
last challenge is to set it so they don't have to enter a password. where is the password stored?????

Multiple YouTube Accounts

My Google+ account has multiple YouTube accounts under it, one public and one private one - both using the same address.
iMove seems to default to the public account ... how do I set iMovie to select the proper account?

you can only log in to one youtube account on the appletv.

Resource account creation

I want to call some stored procedures against an AS400 when IDM creates (and deletes) an account on an AS400 server. How does one find out when a resource account is created or deleted against a resource, in the IDM work flows?
Douglas

I solved my problem. The issue was that while I did map the attributes correctly in the resource schema, I had failed to make the attributes global in the configuration. Once the attributes were made global things worked a lot better.

ActiveSync - link resource account and password push

Is it possible to push a password from an IDM account to a resource account at the same time as linking the two accounts, during ActiveSync?
Scenario: I have an account in IDM and an account on a resource. I use ActiveSync to "discover" the account on the resource and link the IDM account with the resource account. At the same time I would like to push the IDM password to the resource. Thereby, synchronizing the IDM password with the resource password.
I have unsuccessfully tried to accomplish this in many ways:
1) Within the Admin GUI, I've edited an account and when I assign the resource to the account the password in IDM does not push to the resource.
2) Within ActiveSync, I have used global.password, password.password, password.confirmPassword, password.targets, password.accounts[resource].selected
NOTES:
- when the account exists on the resource and IDM links to the resource account, the password does not push
- when the account does not exist on the resource and IDM is required to create the resource account, the password is pushed
At this point my guess is that I will have to kick off a workflow to trigger the password push as the ActiveSync cannot handle linking and subsequently updating an attribute on that resource at the same time. Any ideas would be helpful. Thank you in advance.

I have been able to successfully push the password to the resource both during activesync and within the Admin console. However, I have found some inconsistencies with IDM that might need attention or an explanation.
First off, the key to pushing the password from IDM to the resource in the above scenario is....within the Resource Schema don't map IDM user attribute "password" but map an attribute such as "resource_password" to the password field on the resource. When I did this, I was able to provision the resource to the user in IDM and push the password to the existing resource account.
Secondly, there is an inconsistency with IDM and how it treats password and the other fields. I mapped lastname to a field on the resource. From the admin console, I edited the user and the only change I made was to provision the resource to the user (Resources tab). After saving this user, the lastname field from IDM was updated on the resource.
Why doesn't this work with password?

Provision one OIM account to multiple resource accounts

Similar Messages

Maybe you are looking for