Restrict list of Organizations on Create User form

Running OIM 11.1.1.5.0.
We have a couple of companies using our OIM for delegated administration. In the Create User form, if the user searches for an organization they see a list of all of our organizations not just the ones that they can place a user in.
If they place a user in an organization that is not in their auth policy they receive an error:
"You are either not authorized to create user in XXX organization or not authorized to create user in XXX organization without specifying a value for manager."
Is there any way to restrict the list of organizations in the search to the list in their auth policy?

I have have this:
Company A
-- Department A1 (although these are actually set as Organization type Company in OIM)
-- Department A2
Company B
-- Department B1
User Management Auth Policy for AdminA:
-- Data Constraint - Users who are members of Department A1, A2
But when AdminA uses Create User he gets a list of all Company and Department names in the Organization search popup.
Do I take it from your reply that this is supposed to work and it's something that I have setup incorrectly then?
Edited by: Ewan on May 4, 2012 7:37 AM

Similar Messages

  • Want to add a prepopulated User defined field in create user form

    Hi,
    I have an entity adapter which will perform a pre-insert check on the user group of the user logged in to the oim.
    If the logged in user belongs to a group say "IT ADMIN", another validation check will be imposed on the create user action performed by him.
    If not from "IT ADMIN" group then create user action will be handled normally.
    Now the catch is, how would I determine the group name of the user logged in from the adapter code I have written?
    I decided to keep an User defined field "Created by" in the create user form which will be non-editable and auto-prepopulated with the group name of the logged in user. This way I will be able to map the variable field from the User definition drop down list while mapping the adapter variables.
    May you please guide me how I can achieve this?
    Would highly appreciate suggestion/inputs.

    Thanks for all your replies!
    However I am still in dark.
    I tried to retrieve the groupname using tcUSerOperationsIntf. But iit tries to retrieve the group name of the user getting created.
    Please note, the group name I want is not of the user yet to get created, but that of the user creating it i.e., the logged in user.
    My requirement is to have this created_by field in the create user form already prepopulated with the group name of the logged in user.
    So that I can put a check based on this field value in the netity adapter.
    If the group is IT ADMIN then proceed with the validation.
    Else no validation required.
    In short, I want to know,how can I auto-prepopulate a UDF in Create USer form?

  • Mandatory Attributes in Create User Form

    Hi All
    i want to make the mandatory fields in create user form (ie Organization name) as optional.
    For this i edited the FormMetada.xml file by making optional as true. (in the attribute reference for Organization field in User management section), as mentioned in the docs.
    Now when i try creating user, it shows me 'You do not have permissions to perform this operation' error.
    while when i give some value in the organization field, then it creates the user.
    please provide some pointers in this regard.
    Thanks.

    You MUST provide an organizatation name. There is a system entity adapter on the Users data object. You cannot avoid populating this.
    -Kevin

  • I have date type list field in sharepoint list and i have created one form in sharepoint webpage.

    Hi All,
    i have date type list field in sharepoint list and i have created one form in sharepoint webpage.
    Now i want to save that field from shareepoint webpage, its declared "t1.text" but its showing error.
    How can i save this field?

    Hi AnilKarthink, 
    I wrote a Technet Wiki article on saving data to the various SharePoint fields. You can view it here: http://social.technet.microsoft.com/wiki/contents/articles/21801.sharepoint-a-complete-guide-to-getting-and-setting-fields-using-c.aspx
    Regards, Matthew
    MCPD | MCITP
    My Blog
    View
    Matthew Yarlett's profile
    See my webpart on the TechNet Gallery that allows administrative users to upload, crop and format user profile photos. Check it out here:
    Upload and Crop User Profile Photos

  • Gaps appear in IE 6 browser window for hidden fields in Create User form

    Hi,
    I need an urgent input on this one.
    I hid an OIM default attribute for users in the 'Create User' form by modifying clear_all_fields.js
    The field is hidden from the 'Create User' page fine!
    But if I open the page from Internet Explorer 6 it shows a gap in the place of the hidden field.
    For Mozilla 3.0.5 the gaps are not appearing.
    I tried removing these gaps by deleting the tags and the field in the clear_all_fields.js
    or, by reducing the dimension of the spacer.gif in GenerateCreateUserForm.jsp.
    But it reflected no change in the form look n feel.
    The requirement is to hide the fields and not remove them.
    Any suggestion as to what may be the way out?

    Thanks for the update Leonard. This would be an extremely useful plugin. I've been looking for it on http://labs.adobe.com/technologies/ under the plug-ins tab but have been unable to find it. It wasn't even there in the Pre-Release Programs. Is it located somewhere else or with a different name? Please let me know.
    Meanwhile, I've been trying to write my own VB script to get the button clicked. Here's what I've come up till now-
    FindText
    HiliteList.Add->CreateWordHilite->SetTextSelect->GetBoundingRect->PointToDevice
    The last function seems to be deprecated. Also there's nothing to connect the text highlighted by findtext with HiLiteList.Add. I guess
    I may have to use the JSO word search method.
    Any advice, as always, would be much appreciated.

  • How to avoid special charecters in create user form

    Hi all,
    I am new to Sun IDM.Please u people have to help me in giving the solution.
    Actually,in create user form ,we have first name and last name text fields.These two fields accept any special charecters.I want these fields to accept only alphabets.Do i need to create new rule for it?Please tell me the steps to be done to allow only alphabetic charecters in this fields.Thanks in advance,
    regards,
    suresh

    Hi,
    I should thank for the quick response u have done.But,still my problem was not solved.I did wat u hav said in the last reply...Now iam getting "1" in that create user form.I have send the XML code of the "isAlpha" and "Firstname"..Please check whether i have done any mistake..waiting for ur reply.
    <Rule name='isAlpha'>
    <Description>Tests to see if testStr is comprised of only alpha characters.</Description>
    <RuleArgument name='testStr' value='testStr'/>
    <block>
    <defvar name='testList'>
    <appendAll>
    <rule name='Alpha Numeric Rules:AlphaCapital'/>
    <rule name='Alpha Numeric Rules:AlphaLower'/>
    </appendAll>
    </defvar>
    <containsAll>
    <ref>testList</ref>
    <rule name='Alpha Numeric Rules:stringToChars'>
    <argument name='testStr' value='$(testStr)'/>
    </rule>
    </containsAll>
    </block>
    </Rule>
    <Field name='global.firstname'>
    <Display class='Text'>
    <Property name='title' value='_FM_FIRSTNAME'/>
    <Property name='size' value='32'/>
    <Property name='maxLength' value='128'/>
    </Display>
    <Validation>
    <rule name='Alpha Numeric Rules:isAlpha'>
    <argument name='global.firstname'/>
    </rule>
    </Validation>
    </Field>

  • Add user validation in create user form during Configure User Object Classe

    Hi friends,
    I like to add a user validation code (javaScript or PL/SQL) into create user form during Configure User Object Classes.
    Is any way to pick user information and role assignment for validation in Portal side?
    or pre event in OID provisioning befor loading LDAP?
    We like to make a rols assignment validation. But portal does not have this function.
    TOM, Any suggestion?
    Thanks!!

    after study, portal form --LOVGroupSearch take a  role search and display user name  for select role.
    Who know we are can find system object LOVGroupSearch in portal or OID?
    the source SCR as /oiddas/ui/oracle/ldap/das/search/LOVGroupSearch?title=Role%3Fredirect=/oiddas/ui/oracle/ldap/das/search/LOVGroupSearch%3Ftitle=Role
    When we search a role and added it. selected role appears in form Search and Select:.
    When click role name in Search and Select form. system will display Group Members and group owner.
    Who can find behind codes for this form or samilar pl/sql codes?
    Thanks!!

  • Why doesn't default CREATE USER form show a "Check"  Page before submitting

    Hi
    Interesting question.
    When I create a User (using my Customized Create User Form), and I press SAVE, the Form is submitted immediately. There is no "stop-and-check" page, which allows one to review the entries made BEFORE submitting the form itself.
    For example : when EDITING or UPDATING a User, and you press "Save", the form is not submitted right away. Instead, a new page opens, where you can review the changes you made, to ensure that they are correct. In fact, at the bottom of this new page, there are 4 standard buttons : SAVE...........RETURN TO EDIT............CANCEL
    This is a very good system, because it allows you to check your entries, and make sure they are correct, before pressing SAVE again to submit.
    However, the "Create User" form does not have this same arrangement.
    Is there any way to customize the Form, so that, when creating a User, and you press SAVE, a "check-page" first shows up (just like when updating/editing a user) ?
    Thanks

    Hi
    Interesting question.
    When I create a User (using my Customized Create User Form), and I press SAVE, the Form is submitted immediately. There is no "stop-and-check" page, which allows one to review the entries made BEFORE submitting the form itself.
    For example : when EDITING or UPDATING a User, and you press "Save", the form is not submitted right away. Instead, a new page opens, where you can review the changes you made, to ensure that they are correct. In fact, at the bottom of this new page, there are 4 standard buttons : SAVE...........RETURN TO EDIT............CANCEL
    This is a very good system, because it allows you to check your entries, and make sure they are correct, before pressing SAVE again to submit.
    However, the "Create User" form does not have this same arrangement.
    Is there any way to customize the Form, so that, when creating a User, and you press SAVE, a "check-page" first shows up (just like when updating/editing a user) ?
    Thanks

  • Cannot create user form portal

    Hi
    We have installed NW 2004 server on windows SPS9
    While creating user form portal , i am getting the following error:
    ##0#0#Error#1#/System/Security#Java###An exception was thrown in the UME/ABAP user management connector. Message: . --> #2#BAPI_USER_CREATE1@QSACLNT000: ID=01, NUMBER=491, MESSAGE=You are not authorized to create users in group#BAPI_USER_CREATE1@QSACLNT000: ID=01, NUMBER=491, MESSAGE=You are not authorized to create users in group#
    #1.5#000C295F1EB3004900000003000000B80004346CD09B385F#1183541868109#com.sap.security.core.persistence.datasource.imp.R3Persistence#sap.com/irj#com.sap.security.core.persistence.datasource.imp.R3Persistence.createPrincipalDatabag()#J2EE_ADMIN#313##pun45idmqa45vm1_QSA_5696050#Guest#104e58202a1211dcab81000c295f1eb3#Thread[PRT-Async 0,5,PRT-Async]##0#0#Error#1#/System/Audit#Java###An exception was thrown in the UME/ABAP user management connector. Message: . --> #2#BAPI_USER_CREATE1@QSACLNT000: ID=01, NUMBER=491, MESSAGE=You are not authorized to create users in group#com.sap.security.core.persistence.datasource.PersistenceException: BAPI_USER_CREATE1@QSACLNT000: ID=01, NUMBER=491, MESSAGE=You are not authorized to create users in group
                at com.sap.security.core.persistence.datasource.imp.R3PersistenceBase.handleBapiRet2Table(R3PersistenceBase.java:3136)
                at com.sap.security.core.persistence.datasource.imp.R3Persistence.doBapiUserCreateChange(R3Persistence.java:5265)
                at com.sap.security.core.persistence.datasource.imp.R3Persistence.doDispatchWrite(R3Persistence.java:3622)
                at com.sap.security.core.persistence.datasource.imp.R3Persistence.createPrincipalDatabag(R3Persistence
    Any clue what has to be dome to make it working
    Best Regards
    Manoj

    Hi Manoj,
    Looks like your Portal uses the ABAP backend system QSACLNT000 as the
    UME. Please ensure that the user being used to create other users in the portal
    has sufficient permissions in the backend system also.
    Regards
    Srikishan

  • OIM 11gR2 Add combo box UDF on Create User Form

    Hi.
    We have created a new UDF on user form. It is a lookup field and has the following lookup associated: "Lookup.Users.Continente"
    "Lookup.Users.Continente" has two values, both of them checked as Enabled.
    From the form designer all the values are displayed when selecting one default value so it is reading correctly from the lookup.
    We published the sandbox after this.
    Then we created a new sandbox and tried to add that field to the Create User Page. We went to "Create User Page", customize it and add content from "Data Component - Catalog" -> "userVO" -> Select the UDF, clicked on "Add" and selected "ADF Select One Choice".
    A new combobox is added but no values are shown. We have plublished the sandbox, restarted OIM, purged cache, etc... but it still shows an empty combo box. We have also tried adding it as "ADF Input List of values" but it does not add the field to the create user page.
    Any ideas of what are we doing wrong?
    The idea is very simple, just create a field with the same behaviour as, for example,  "User Type" field. A combobox that displays the enabled values from a lookup...
    We have also tried creating the UDF cheking the searchable option, searchable picklist and all the possible combinations.
    Thanks in advance!!

    oim version is oim 11gR2 with BP4

  • Select list in a manually created tabular form

    I created a select drop down item in a manually created tabular form. When I run the page, it also shows the null value '%'. How do I edit this?
    This is the line I am using in the SQL:
    htmldb_item.select_list_from_query(34,IN_PGRS_STAT_DSC,'select distinct STAT_DSC, STAT_DSC from PROJECT_STATUS_REF') IN_PGRS_STAT_DSC,

    And the select list doesn't work. It gives me an error message if I have the form to display one extra empty record and the select list. But even with the select list, if I don't include the extra row, it works properly.
    report error:
    ORA-06550: line 1, column 13:
    PLS-00103: Encountered the symbol "COLLECT" when expecting one of the following:
    := . ( @ % ;
    ORA-06550: line 1, column 82:
    PLS-00103: Encountered the symbol ";" when expecting one of the following:
    . ( , % from
    What I also realized is that the drop down shows the value 7. But the table is empty with no records. I have no idea where this number 7 is coming from?
    Message was edited by:
    user494578
    Message was edited by:
    user494578

  • OIM 11gR2 - custom attribute with illegal binding on Create User form in published sandbox

    Hi,
    I think I have managed to paint myself into a corner!
    In OIM 11gR2 I have added a number of custom attributes to the "User Form" - some Text-, some Lookup-type attributes.
    While customizing the "Create User" page within a sandbox and adding a SelectOneChoice item and fiddling around with its binding, I was distracted by a phone call and the browser timed out.
    The binding property on the new item is now not correct and the sandbox has unfortunately been published, and I am now unable to enter the "Create User" page - when I try, I get the following:
    <Sep 23, 2013 2:39:11 PM CEST> <Warning> <oracle.adf.view.rich.component.fragment.UIXRegion> <ADF_FACES-00009> <Error processing viewId: /user/createView URI: /oracle/iam/ui/runtime/form/view/pages/userCreateForm.jsff actual-URI: /oracle/iam/ui/runtime/form/view/pages/userCreateForm.jsff.
    javax.el.PropertyNotFoundException: Target Unreachable, 'ekstraresource1__c' returned null
            at com.sun.el.parser.AstValue.getTarget(AstValue.java:108)
            at com.sun.el.parser.AstValue.isReadOnly(AstValue.java:149)
            at com.sun.el.ValueExpressionImpl.isReadOnly(ValueExpressionImpl.java:248)
            at oracle.adfinternal.view.faces.renderkit.rich.EditableValueRenderer._getUncachedReadOnly(EditableValueRenderer.java:486)
            at oracle.adfinternal.view.faces.renderkit.rich.EditableValueRenderer.cacheReadOnly(EditableValueRenderer.java:416)
            at oracle.adfinternal.view.faces.renderkit.rich.LabeledInputRenderer.beforeEncode(LabeledInputRenderer.java:128)
            at org.apache.myfaces.trinidad.render.CoreRenderer.encodeEnd(CoreRenderer.java:340)
    <Sep 23, 2013 2:39:11 PM CEST> <Warning> <oracle.adf.view.rich.component.fragment.UIXRegion> <ADF_FACES-00009> <Error processing viewId: /catalog-tf/cart-details URI: /oracle/iam/ui/catalog/pages/cart-details.jsff actual-URI: /oracle/iam/ui/catalog/pages/cart-details.jsff.
    javax.el.PropertyNotFoundException: Target Unreachable, 'ekstraresource1__c' returned null
            at com.sun.el.parser.AstValue.getTarget(AstValue.java:108)
            at com.sun.el.parser.AstValue.isReadOnly(AstValue.java:149)
            at com.sun.el.ValueExpressionImpl.isReadOnly(ValueExpressionImpl.java:248)
            at oracle.adfinternal.view.faces.renderkit.rich.EditableValueRenderer._getUncachedReadOnly(EditableValueRenderer.java:486)
            at oracle.adfinternal.view.faces.renderkit.rich.EditableValueRenderer.cacheReadOnly(EditableValueRenderer.java:416)
            at oracle.adfinternal.view.faces.renderkit.rich.LabeledInputRenderer.beforeEncode(LabeledInputRenderer.java:128)
            at org.apache.myfaces.trinidad.render.CoreRenderer.encodeEnd(CoreRenderer.java:340)
    Caused By: java.io.IOException: javax.el.PropertyNotFoundException: Target Unreachable, 'ekstraresource1__c' returned null
            at oracle.adfinternal.view.page.editor.renderkit.PageCustomizableRenderer.encodeAll(PageCustomizableRenderer.java:764)
            at oracle.adf.view.rich.render.RichRenderer.encodeAll(RichRenderer.java:1396)
            at org.apache.myfaces.trinidad.render.CoreRenderer.encodeEnd(CoreRenderer.java:341)
            at org.apache.myfaces.trinidad.component.UIXComponentBase.encodeEnd(UIXComponentBase.java:767)
            at javax.faces.component.UIComponent.encodeAll(UIComponent.java:937)
            at org.apache.myfaces.trinidad.render.CoreRenderer.encodeChild(CoreRenderer.java:405)
    etc.
    Of course the sandbox should not have been published - but it is - and I am stuck trying to figure out how to somehow undo this mess.
    Is it possible to clean up this mess by diving to the database and removing some rows from the right tables - or perform some other operations undo my mistake?
    Thanks in advance,
    - Tom

    oim version is oim 11gR2 with BP4

  • How Can we change the Lookup in the Create User Form ??? Please Help

    Hi ,
    Can anyone let me know that how can the Value of the Lookup be changed in the Organization ? Like when we click on the Lookup of the Organization we see the names of the companies with Radio Boxes and we select a Company. If I want another value to be added beside the company then How I need to do that ? eg:
    Org1: com1
    Org1: com2
    Org2: com3
    Org3: com4
    This lookup How can I do it ?

    With what you are referring to, there is no lookup required.
    When you log into your administration console, you can create a new organization:
    Organizations --> Create.
    After you create, there will be more than the default organizations.
    However, if you want to create a new organization type (Company, Department, etc) you can do this by:
    Go to your Design Console --> Administration --> Lookup
    Search for: Lookup.Organization.Type
    Add a new value.
    Save your formOnce you are done, go and create a new organization like before, and in the drop-down, that type will appear.

  • Unable to see web service listed  while  creating the form on webservice

    Hi All,
    i created a web service reference and tested it and i m even getting the response of it .
    but i m unable to see the webservice being listed ...while creating a form on webservice .
    whereas if i create a process on webservice .. i can find webservices in the webservice list .(.the webservice which i created in the shared component)
    can anyone help me ...
    Thanks & Regards,
    Nandini Thakur.

    that should be an easy one. you might not have the GP roles needed. give to your user the caf roles in the UME

  • OIM 11GR2 - mechanism for restoring default adf user forms - create user

    Hi All
    Our developers has pubkished multiple OIM sandbox and create user form is broken
    : the user creation form does not appear - only a html <div> tag .
    The developer reverted the form using the em/console - then he ran the catalog sync job but all he can acheive is a blank form not the original user create forms
    How do we restore the forms to thier original state.
    Thanks

    Not sure if this helps. But try these steps mentioned in the developer's guide. Once I did some UI customization in identity console and could not load my page after that. I followed these steps and was successfully able to restore it back. You can give a try and in step 6 try to select some known sandbox name which did not have any issues.
    1. Login to Oracle Enterprise Manager.
    2. In Application Deployments, select oracle.iam.ui.console.self-service.ear.
    3. On the top-right of the page, select Application Deployment, and then select MDS Configuration from the list.
    4. At the bottom of the screen, select Runtime MBean Browser under the Advanced Configuration section. The right side of the screen refreshes.
    5. Click the Operations tab.
    6. Scroll down and identify the listMetadataLabels MBean operation and invoke it. Select the MBean operation that does not take any parameters. Select the sandbox precreate that you want to restore, and copy it to the clipboard.
    For example, the value you copy can be similar to: Creation_IdM_test_09:25:00.
    7. Click Return to go back to the Operation tab.
    8. Find the promoteMetadataLabel MBean operation.
    9. Invoke the promoteMetadataLabel MBean operation, and enter the value that you copied in step 6.
    10. Restart Oracle Identity Manager.

Maybe you are looking for

  • Dunning Letter XML not displaying XML version of Dunning Letter

    I have changed the Output Format for "Dunning Letter Print from Dunning Letter Generate" to XML. When I run the Dunning Letter Generate process, though, the XML output in the Dunning Letter Print from Dunning Letter Generate does not display the XML

  • Manage multiple accounts on one lap top

    How do  manage multiple accounts on one lap top? y wife and me have separate Apple ID's and one lap top at home. We have synced our data on the lap top and now face a situation where in her contacts are on my contact list on the phone and vice versa.

  • Tranferring purchases from old phones to Mac

    I have recently purchased a Mac Pro workbook. My old computer is a windows based pc. I have had an iTunes account for 5 years plus. Over this period there have been various purchases made on 3-4 phones as I have upgraded. When I attach my iPhone and

  • Using Host in Forms is not freezing the caller

    I am using the Host built-in command to launch a web page from a client/server Forms6i application.  I've found there are many different ways I can do this: I can hardcode the path of the browser executable,      host('"C:\Program Files\Internet Expl

  • Tabs and address bar gone in fullscreen

    I can't access my tabs or address bar in fullscreen on macbookpro. It only started doing this today