Resource account attribute names during reconciliation

Hi,
I need to set some attributes when creating the IDM user during initial reconcilation from an LDAP resource. I understand only the waseset and LDAP user attributes are available during the reconciliation. Does anyone know how to refer to the resource account attributes?
I tried to put this in my proxyuser form:
<Field name='accounts[Lighthouse].uvaDepartment'>
<Derivation>
<invoke name='listToString' class='com.waveset.util.Util'>
<ref>accounts[LDAP].ou</ref>
<s>; </s>
</invoke>
</Derivation>
</Field>
uvaDepartment is a extended attribute in the IDM schema, and ou a multivalued LDAP atribute. But uvaDepartment remains empty.
Greetings,
Marijke

thanks,
I found out the problem was caused by not setting thel user password in the resource parameters page.
I set up a temporay form and debugged the attributes from the Active Directory. Somehow, the password has already been populated with a (random) value. To be sure, I'll use your suggestion to generate a temporary password to ensure it conforms to my own Password Policy :
        <invoke name='generatePassword'>
          <new class='com.waveset.provision.PasswordGenerator'>
            <ref>:display.session</ref>
          </new>
          <invoke name='getObject' class='com.waveset.ui.FormUtil'>
            <rule name='UWS-RLB-Utils:GetLightHouseContext'/>
            <s>Policy</s>
            <ref>My-Password-Policy</ref>
          </invoke>
          <new class='com.waveset.object.WSUser'/>
        </invoke>

Similar Messages

Resource account password set during User Update process.

Hi friends,
I added to the Update WF a step to initialize an account password when, during the update of the user, IDM creates the new resource account.
This is an initial password (known).
This event basically happens in two User's Update cases:
A. when the account was (accidentally) removed from the resource
B. when a new Role requires to add a new resource account to the user
In both cases IDM (re)creates the user account on the resource.
In order to set this account initial password, I check (in the Update WF) the value of 'user.update.toCreate': if it contains the resource name, then I set the pw after the account has been provisioned.
This method fails during case B. only when, for some reason, the resource account already exists BEFORE the update starts: even if the account is already there, IDM sets 'user.update.toCreate', leading my step to reset the account password to the initial value.
What could I check in order to avoid it? (I don't want to reset account passwords when linking existing accounts)
The only way I see at the moment would be to query the resource at the beginning of the Update WF to check if the account is already there...
MTIA

Hi,
Have you found a resolution to this problem?
Thanks
Edited by: sun_to_Orcl on Jan 31, 2010 8:28 PM

IDM : How to get the Resource name in Exclude Rule during Reconciliation?

Hi
Problem Statement => How to get the Resource name in Exclude Rule during Reconciliation.
Problem Description => Apparently, we use exclude rule for not consider some account during reconciliation.
I need the resource name in exculde rule during reconciliation. I tried with getResources() method which is an inbuilt method.But it gives all the resources are aviablable in the repository (IDM). I need only the current reconcilied resource name instead of fetching all the resouce.
Can any one please help how to get the resource name in exclude rule during reconciliation?
Thanks in advance for you help.
Thanks,
Chellappan

Hi,
Thanks for your reply.
I have 50 resouces and these resouces using the same kind of exclude rules. In the exclude rule, i am using resource name to do some work. If i get the resouce name in exclude rule, then i can use the same exculde rule for 50 resources. This will minimise the rule count from 50 to 1. For that, i need resouce name.
Thanks,
Chellappan Sampath.

Deleting IDM user accounts during reconciliation

Hello All,
We have an authoritative data source which is a MySQL database. I have loaded all the users from the DB into IDM. What I want to know is can we delete the user in IDM when the user account is deleted from the MySQL database?
How can I achieve this during reconciliation?
Any help would be highly appreciated.
Thank you very much.
Vamsi

I think you need to use the per account workflow, which is part of the recon policy. It should be something like:
<Extension>
<WFProcess name='UC2 ORA Per Acct Workflow' title='UC2 ORA Per Acct Workflow'>
<Variable name='userName' input='true'/>
<Variable name='accountId' input='true'/>
<Variable name='loginApplication' input='true'/>
<Variable name='resource' input='true'/>
<Activity id='0' name='start'>
<Transition to='Sync Attributes'>
<eq>
<ref>initialSituation</ref>
<s>AR_SITUATION_NAME_UNMATCHED</s>
</eq>
</Transition>
<Transition to='Deprovision User'>
<eq>
<ref>initialSituation</ref>
<s>AR_SITUATION_NAME_DELETED</s>
</eq>
</Transition>
<Transition to='Disable User'>
<eq>
<ref>initialSituation</ref>
<s>optional logic here</s>
</eq>
</Transition>
<Transition to='Clear Task Results'/>
<WorkflowEditor x='38' y='177'/>
</Activity>
<Activity id='1' name='Sync Attributes'>
<Variable name='WF_ACTION_ERROR'/>
<Variable name='user'/>
<Action id='0' name='Checkout User' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkoutView'/>
<Argument name='type' value='User'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='authorized' value='true'/>
<Argument name='Form' value='UC2 ORA Per Acct Form'/>
<Variable name='view'/>
<Return from='view' to='user'/>
<Return from='WF_ACTION_ERROR' to='ERROR'/>
</Action>
<Action id='1' name='Checkin User Object' application='com.waveset.session.WorkflowServices'>
<Condition>
<isnull>
<ref>WF_ACTION_ERROR</ref>
</isnull>
</Condition>
<Argument name='op' value='checkinView'/>
<Argument name='view'>
<ref>user</ref>
</Argument>
</Action>
<Transition to='Clear Task Results'>
<isnull>
<ref>WF_ACTION_ERROR</ref>
</isnull>
</Transition>
<Transition to='end'/>
<WorkflowEditor x='259' y='7'/>
</Activity>
<Activity id='2' name='Deprovision User'>
<Variable name='WF_ACTION_ERROR'/>
<Variable name='user'/>
<Action id='0' name='Checkout User' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkoutView'/>
<Argument name='authorized' value='true'/>
<Argument name='type' value='Deprovision'/>
<Argument name='id' value='$(accountId)'/>
<Variable name='view'/>
<Return from='view' to='user'/>
<Return from='WF_ACTION_ERROR' to='ERROR'/>
</Action>
<Action id='1' name='Select All Accounts for Deprovision'>
<expression>
<set name='user.resourceAccounts.selectAll'>
<s>true</s>
</set>
</expression>
</Action>
<Action id='2' name='Checkin User Object' application='com.waveset.session.WorkflowServices'>
<Condition>
<isnull>
<ref>WF_ACTION_ERROR</ref>
</isnull>
</Condition>
<Argument name='op' value='checkinView'/>
<Argument name='view'>
<ref>user</ref>
</Argument>
</Action>
<Transition to='Clear Task Results'>
<isnull>
<ref>WF_ACTION_ERROR</ref>
</isnull>
</Transition>
<Transition to='end'/>
<WorkflowEditor x='308' y='241'/>
</Activity>
<Activity id='3' name='Disable User'>
<Variable name='WF_ACTION_ERROR'/>
<Variable name='user'/>
<Action id='0' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='disableUser'/>
<Argument name='accountId' value='$(accountId)'/>
<Argument name='doWaveset' value='true'/>
</Action>
<Transition to='Clear Task Results'>
<isnull>
<ref>WF_ACTION_ERROR</ref>
</isnull>
</Transition>
<Transition to='end'/>
<WorkflowEditor x='390' y='387'/>
</Activity>
<Activity id='4' name='Clear Task Results'>
<Action id='0' application='SET_RESULT_LIMIT'>
<Argument name='limit' value='0'/>
</Action>
<Transition to='end'/>
<WorkflowEditor x='351' y='104'/>
</Activity>
<Activity id='5' name='end'>
<WorkflowEditor x='691' y='50'/>
</Activity>
</WFProcess>
</Extension>
Reg/Suveer

Attributes in resource account exclusion rule

Hi,
In the resource account exclusion rules, by default I see only accountID and Operation as the available attributes. Is there any way we can get other resource account attrbutes e.g distinguishedName in case of an Active Directory resources. In this case schema mapping has accountId mapped to sAMAccountName.
Thanks,
kIDMan.

Looks like ony accountId...
[http://forums.sun.com/thread.jspa?forumID=764&threadID=5325186|http://forums.sun.com/thread.jspa?forumID=764&threadID=5325186]

How to find out if a user has no more resource accounts?

I want to check to see if a user has no more resource accounts tied to it. The only resource account left is Lighthouse and nothing else.
Do you know how I do this?
Thanks

I was able to find disabled users using the below code. Does anyone know how I can find users who have only Lighthouse account and nothing else? I want to add this to the search criteria.
<Action id='0' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='queryObjectNames'/>
<Argument name='type' value='User'/>
<Argument name='single' value='false'/>
<Argument name='attributes'>
<map>
<s>lhdis</s>
<s>true</s>
</map>
</Argument>
</Action>

User status during reconciliation

Hi All,
I have configured AD connector for reconciliation and it is working fine. Also I have created Resource Object, Process Definition and form for multiple resources of AD, during reconciliation when event is linked user status is set to 'Provisioning' instead of 'Provisioned' as per the default functionality and during the successive recon the status is changed to 'Enabled'.
Can any one please tell me what configuration might be missing due to which the status is set to 'Provisioning' at first time.
Any pointers in this regards will be appreciated.
TIA

After successful target source recon, the status should be 'Enabled' or 'disabled' depending on the user account status in AD. Can you look at the tasks that are executed when the status is set to 'provisioning'? Which task fails? what is logged in the logs? Could be that 'Get ObjectGUID' task is not completed and it completes before the next run of the scheduler, which is why it works fine in second run.

Add user to role during reconciliation

Hi,
I have this scenario:
We have a database resource on which we run reconciliation to link accounts to our users in IDM.
I also have roles that contains this resource. When the reconciliation runs I would like to add the user
to that role, instead of linking the user to the resource account directly.
Our problem now is that if users gets linked to the resource, and then gets the role, if the role is removed, the user still has the link to the resource.
Did that make any sense?
I'm guessing that I need to use the "per account workflow" to make this happen, but I'm not sure how to do write this workflow.
Regards,
Henrik

Hi Henrik,
You could do it during reconciliation with a per-account workflow.
Another approach is to use a regular workflow that lists users with accounts on that target resource and processes each of them to remove any unneeded direct assignments. That is what I went with, and I run the workflow periodically.

ActiveSync - link resource account and password push

Is it possible to push a password from an IDM account to a resource account at the same time as linking the two accounts, during ActiveSync?
Scenario: I have an account in IDM and an account on a resource. I use ActiveSync to "discover" the account on the resource and link the IDM account with the resource account. At the same time I would like to push the IDM password to the resource. Thereby, synchronizing the IDM password with the resource password.
I have unsuccessfully tried to accomplish this in many ways:
1) Within the Admin GUI, I've edited an account and when I assign the resource to the account the password in IDM does not push to the resource.
2) Within ActiveSync, I have used global.password, password.password, password.confirmPassword, password.targets, password.accounts[resource].selected
NOTES:
- when the account exists on the resource and IDM links to the resource account, the password does not push
- when the account does not exist on the resource and IDM is required to create the resource account, the password is pushed
At this point my guess is that I will have to kick off a workflow to trigger the password push as the ActiveSync cannot handle linking and subsequently updating an attribute on that resource at the same time. Any ideas would be helpful. Thank you in advance.

I have been able to successfully push the password to the resource both during activesync and within the Admin console. However, I have found some inconsistencies with IDM that might need attention or an explanation.
First off, the key to pushing the password from IDM to the resource in the above scenario is....within the Resource Schema don't map IDM user attribute "password" but map an attribute such as "resource_password" to the password field on the resource. When I did this, I was able to provision the resource to the user in IDM and push the password to the existing resource account.
Secondly, there is an inconsistency with IDM and how it treats password and the other fields. I mapped lastname to a field on the resource. From the admin console, I edited the user and the only change I made was to provision the resource to the user (Resources tab). After saving this user, the lastname field from IDM was updated on the resource.
Why doesn't this work with password?

Create or link a resource-account

Hi all,
I create idm-users based on an hr-system, but don't assign them roles or resources during creation. Later, roles are assigned to those accounts which can imply resources.
To keep it simple, there is a role "member in active directory" and when this role is assigned, a distinguished name shold be constructed and the resource account should be created.
This is simple and works. :-)
However, this process is slow and some admins just can't wait and they manually create an account in our active directory. They follow the same naming conventions, so when a role is assigned to the idm-account, SIM tries to create an account in the AD, finds one and links it. This is exactly what I want to happen.
But: SIM assigns default values for the resouce account, e.g. default group memberships. Currently I can't detect that there are already values (since according to SIM the account doesn't exist yet) and customised group memberships are overwritten by SIM.
That's BAD.
Any suggestions how to handle this setup would be greatly appreciated.
Yours,
Patrick.

HI,
I dont mean to be rude or anything; but, it might be a good idea to tell those "admins" directly NOT to create accounts themselves!
IDM's purpose, after all, is to manage situations like these. IDM is, and should be, the only "governing body";
IDM is a complicated enough software, without having to create more problems for it. Which is exactly what your "admins" are doing by side-stepping IDM and creating accounts themselves in the Resource.

How to change the attribute name for a relation

When the Data Modeler engineers a logical model into a relational model it create table columns for the relations. The names of the generated columns are listed in the attributes list in the properties dialog of the relation. The actual name of the attribute gets calculated by the attribute name of the entity which is part of the relation. This is okay, if there is only one relation between two entities. But when there are two relations between two entities the second attribute gets a stupid number suffix. This makes it impossible to give the attribute a useful semantic meaning.
When I engineer the model into a relational model I can change the column name in the relational model. Changing the column name in the relational model is not perfect but it would be okay for me, if it would not be overwritten during the next engineering run.
So I have two questions:
How can I change the attribute name in the attributes section of the properties dialog of a relation? See here for screen shot:
http://public.ceving.de/2012050300/relationattribute.png
And if it is not possible:
How can I preserve any changes on column names in the relational model during a re-engineering run?
Edited by: 931739 on 03.05.2012 08:07

Hi,
I've logged an Enhancement request on this.
I don't believe it's possible to change it from the Entity or Relationship dialog, as it's not updatable in these dialogs.
What you can do is change it in the Relational Model, and then reverse engineer the change back to the Logical Model.
David

How to assign different passwords for different resource accounts

Hi everyone,
We have a situation where we have users with two resource accounts. They have different passwords with different lengths.We are using Flat file active Sync adapter to create users in both resources and there we are setting passwor.password field. But we need to set different passwords to every resource account and it is obviosly it can not be done with password.password field. We tried e password view before provisioning where we chekout the user and set the follwing parameters:
<set name='userview.resourceAccounts.selectAll'>
<s>false</s>
</set>
<set name='userview.resourceAccounts.currentResourceAccounts[RES1].selected'>
<s>true</s>
</set>
<set name='userview.resourceAccounts.password'>
<ref>accountId</ref>
</set>
<set name='userview.resourceAccounts.confirmPassword'>
<ref>accountId</ref>
</set>
But it did not worked. So is there a way to set different passwords to different accounts in SUN IDM?
Oh and forgot to mention we are using Sun Idm 8.1 patch 9.
Best regards.

I actually managed to change the required password but i copied this in Provision externeal Resources.
<Action id='1' name='Check out password view' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkoutView'/>
<Argument name='type' value='Password'/>
<Argument name='id' value='$(accountId)'/>
<Argument name='authorized' value='true'/>
<Argument name='subject' value='Configurator'/>
<Argument name='TargetResources'>
<List>
<String>RES1</String>
</List>
</Argument>
<Return from='view' to='userview'/>
</Action>
<Action id='2' name='reset password'>
<expression>
<block name='reset password' trace='true'>
<set name='userview.resourceAccounts.selectAll'>
<s>false</s>
</set>
<set name='userview.resourceAccounts.currentResourceAccounts[RES1].selected'>
<s>true</s>
</set>
<set name='userview.resourceAccounts.password'>
<ref>accountId</ref>
</set>
<set name='userview.resourceAccounts.confirmPassword'>
<ref>accountId</ref>
</set>
</block>
</expression>
</Action>
<Action id='3' name='check in password view' application='com.waveset.session.WorkflowServices'>
<Argument name='op' value='checkinView'/>
<Argument name='view' value='$(userview)'/>
<Argument name='authorized' value='true'/>
<Argument name='subject' value='Configurator'/>
</Action>

Workflow Attribute Names

Answer me this...
When you create a workflow in the Workflow builder, one is FORCED to have the item level and function level attribute internal names to be all uppercase. Fine. So I make a work attr called MY.ATTR.NAME.
But then, in a PL/SQL function, I am allowed to call WF_ENGINE.GetItemAttrText(itemtype,itemkey,'MY.attr.NAME') and it will fail. It will fail because there is no such attribute called MY.attr.NAME and that is because the workflow builder creates all attributes with uppercase names.
Why in the GetItemAttr and GetActivityAttr functions does Oracle not call UPPERCASE on the names? It would only make sense, so that there is a normalized form of attribute naming? Or make the search for attribute names case-insensitive. Looking at the function body, neither is done. Why is that?
Its forcing me to wrap the Oracle-provided functions with my own that call UPPERCASE on the attr names and then call the Oracle functions because I have many users who will be creating workflows and their corresponding PL/SQL functions and I'd like to make it as painless as possible.

Raja,
How does one go about opening an ER? Through my MetaLink account?
I mean, its not absolutely necessary although I would like to see it in a future patch or version. I just didn't understand the logic behind it... Force users to be able to create only uppercased attribute names but when they go to retrieve them, allow any capitalization. That just leaves room for unnecessary errors.

Resource.adapters attribute

The IDM documentation states you must add your new custom resource to the waveset.properties file in $WSHOME/config. It states it must be placed under the resource.adapters entry or it will not be recognized.
However, when I look through the Waveset.properties file, the only mention of "resource.adapters" is in a comment area for ResourceManagerVersion:
# ResourceManagerVersion
# Specifies the version of the Resource Manager to be used. The
# Resource Manager controls the list of available resources.
# Additional resources are specified in the resource.adapters
# attribute above.
However, there is NO resource.adapters attribute in this file. Is there a sample of how this attribute needs to be formatted and the syntax one should use?

Here's the context diff of the changes I made to AIXResourceAdapter:
$ diff -c AIXResourceAdapter.java MyAIXResourceAdapter.java
*** AIXResourceAdapter.java     Thu Jul 21 12:14:38 2005
--- MyAIXResourceAdapter.java   Thu Jul 21 12:33:27 2005
*** 46,58 ****
   * Resource adapter supporting AIX version 4.3 (and possibly other versions)
   * by using shell script commands through a scripted connection.
! public class AIXResourceAdapter
      extends UnixResourceAdapter
      implements Constants {
!     public static final String code_id = "$Id: AIXResourceAdapter.java,v 1.2.6
.2 2005/04/08 04:42:54 rsanchez Exp $";
!     private static final String CLASS = "com.waveset.adapter.AIXResourceAdapte
r";
      // Resource attribute name of the host used to communicate with the
      // resource.
--- 46,58 ----
   * Resource adapter supporting AIX version 4.3 (and possibly other versions)
   * by using shell script commands through a scripted connection.
! public class MyAIXResourceAdapter
      extends UnixResourceAdapter
      implements Constants {
!     public static final String code_id = "$Id: MyAIXResourceAdapter.java,v 1.2
.6.2 2005/04/08 04:42:54 rsanchez Exp $";
!     private static final String CLASS = "com.waveset.adapter.MyAIXResourceAdap
ter";
      // Resource attribute name of the host used to communicate with the
      // resource.
*** 147,154 ****
      // Prototype xml for resource.
      static final String prototypeXml =
!         "<Resource name='AIX' class='com.waveset.adapter.AIXResourceAdapter'"
!             + " typeString='AIX' typeDisplayString='"+RAMessages.RESTYPE_AIX+"
' supportsScanning ='true'>\n"
              + " <ResourceAttributes>\n"
              + "    <ResourceAttribute name='"+RA_HOST+"' displayName='"+RAMess
ages.RESATTR_HOST+"' type='string' multi='false'"
              + " description='" + RAMessages.RESATTR_HELP_115 + "'>\n"
--- 147,154 ----
      // Prototype xml for resource.
      static final String prototypeXml =
!         "<Resource name='MyAIX' class='com.waveset.adapter.MyAIXResourceAdapte
r'"
!             + " typeString='MyAIX' typeDisplayString='My AIX' supportsScanning
='true'>\n"
              + " <ResourceAttributes>\n"
              + "    <ResourceAttribute name='"+RA_HOST+"' displayName='"+RAMess
ages.RESATTR_HOST+"' type='string' multi='false'"
              + " description='" + RAMessages.RESATTR_HELP_115 + "'>\n"
*** 311,324 ****
       * No argument constructor.
!     public AIXResourceAdapter() {
          super();
       * Constructor
!     public AIXResourceAdapter(Resource res, ObjectCache cache) {
          super(res, cache);
$
       * No argument constructor.
!     public MyAIXResourceAdapter() {
          super();
       * Constructor
!     public MyAIXResourceAdapter(Resource res, ObjectCache cache) {
          super(res, cache);
*** 3886,3898 ****
          private ArrayList _userList;
          private int _userIndex = 0;
          private String _error = "";
!         private AIXResourceAdapter _adapter = null;
          private ScriptToken.Capture _blockCaptureToken = rootPromptCaptureToke
n;
          private final int USERSTOITER = 20;
!          * @deprecated Use BlockAcctIter(AIXResourceAdapter, CaptureList) inst
ead.
          public BlockAcctIter(int blockSize, CaptureList captureList)
              throws WavesetException
--- 3886,3898 ----
          private ArrayList _userList;
          private int _userIndex = 0;
          private String _error = "";
!         private MyAIXResourceAdapter _adapter = null;
          private ScriptToken.Capture _blockCaptureToken = rootPromptCaptureToke
n;
          private final int USERSTOITER = 20;
!          * @deprecated Use BlockAcctIter(MyAIXResourceAdapter, CaptureList) in
stead.
          public BlockAcctIter(int blockSize, CaptureList captureList)
              throws WavesetException
*** 3904,3910 ****
              start();
!         public BlockAcctIter(AIXResourceAdapter adapter,
                               CaptureList captureList)
              throws WavesetException
--- 3904,3910 ----
              start();
!         public BlockAcctIter(MyAIXResourceAdapter adapter,
                               CaptureList captureList)
              throws WavesetException
          {

Document Access for resource accounts

Hello,
Anyone know if it is possible to create a shared folder in a resource account and import documents into it?
We want to have an admin account which would be used to hold forms, policies, etc. When its created under a user account and the user moves on we have to recreate the shared folders with documents etc. If it was a resource account we could just change ownership.
Thanks,
Tom

Hello Danita,
So would this be a simple properties change of the "Author"? Or some other attribute from Console One or something.
Thanks!
Tom
Originally Posted by dzanre
taphillips wrote:
> Thanks for the reply. I suppose we would have to find a way to change
> ownership of docs when a user moves on...
That's easy enough to do. Easier if you remember to do it before you delete the
user account (i.e., you can reassign all documents from user1 to user2). But if
you forget there is a routine to run to assign all "orphaned" docs to a
particular account as well.
Danita
Novell Knowledge Partner
Are you a GroupWise Power Administrator? Join our site.
http://www.caledonia.net/register
If you find this post helpful and are logged into the web interface,
show your appreciation and click on the star below...

Resource account attribute names during reconciliation

Similar Messages

Maybe you are looking for