Restricting administrator tab to user created with default role OIM 11g R2

Hi,
I have a query, if we create a user in OIM 11g R2 without any admin role and then login to Self Service screen (Identity) with the newly created user, we can see the Administration Tab is visible to the user.
Is this mean that by default user is having admin role assigned to him to do some of the admin activities.
Please let me know how to control this behavior and not to show the Administration tab to the user until and unless he is having some admin roles assigned to him.
Please help.

You can hide Administration tab for normal users using EL's. By default users will get this tab when they login to identity console even though admin role is not assigned to them. But if you do any operation on any users, request will be raised accordingly.
Check this link to configure EL's http://docs.oracle.com/cd/E27559_01/dev.1112/e27150/uicust.htm#autoId18

Similar Messages

Error in creating approval policy in OIM 11g

hi...
i am trying to create approval policy in OIM 11g. But after giving the details for first step, it gives the following error-
"Approval policy validation failed with oracle.iam.request.exception. ApprovalPolicyServiceException:An error occured while searching request model <policy name>"
Please let me know the coz of this error and the way to resolve it.

If you are using JDeveloper , can you able to get class after giving "." .If yes no than it is the problem with the jar file you are using .Check whether you can able to import oracle.iam.authzpolicydefn.api.Feature.
Thanks ,
Animesh anand

How to create Authorization policy using OIM 11g API

Hi,
Could you please let me know how to create Authorization policy using OIM 11g API.
Thanks

Constructing A Policy Programmatically
http://docs.oracle.com/cd/E27559_01/dev.1112/e27154/cons_policy_prog.htm#CHDHACBF
api ref for PolicyStore
http://docs.oracle.com/cd/E21764_01/apirefs.1111/e22649/oracle/security/jps/service/policystore/PolicyStore.html#createApplicationPolicy_java_lang_String_
something like below code to start with
try {
JpsContextFactory ctxFact;
ctxFact = JpsContextFactory.getContextFactory();
JpsContext ctx;
ctx = ctxFact.getContext();
PolicyStore ps = ctx.getServiceInstance(PolicyStore.class);
if (ps == null) {
// if no policy store instance configured in jps-config.xml
System.out.println("no policy store instance configured");
return;
ApplicationPolicy ap = ps.createApplicationPolicy("Trading", "Trading
Application","Trading Application.");
} catch (JpsException e) {
}

User Created with profile type null

I am trying to create a new user by writing following line:
createUserControl.createUser(getUsername(), getPassword(), super.getRequest());
But user_security table doesn't insert any new record and console displays message
saying:
UserName created with Profile Type null.
Any suggestions?
Ajay

user560883 wrote:
Hi
DB Version Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
OS RHES 5U2
I created a profile MYPROFILE and set the value of Concurrent Sessions (Per User) to 30. DB was bounced after creating the profile. I made this profile default for a particular user "MYUSER". I verified that by querying DBA_USERS (select profile from dba_users where username like 'MYUSER';) I checked v$session with that particular user after sometime and noticed that it was showing 34 sessions. Some ACTIVE and some INACTIVE.
My question is, if I have set the maximum limit of concurrent sessions per user to 30 in myprofile and made this the default profile for MYUSER, then how come i am still able to see more than 34 sessions of myuser regardless of the status? I am not sure if this is relevant or not but the IDLE TIME is set to 15 minutes.
Thank you for your helpDid you set the parameter resource_limit=true ? You must do it before you test sessions_per_user. You can do so like the following,
alter system set resource_limit=true;After this again try and post the feedback.
HTH
Aman....

How to access OS User created with "identified externally"

I am able to
SQL> create user ops$deskuser identified externally;
while deskuser is one of my OS user.
I believe it is a very easy question, however I just do not know how to access this user from sqlplus., please help
Thanks in advance

oracle@mini:~> sqlplus system
SQL*Plus: Release 10.1.0.3.0 - Production on Sun Nov 13 21:11:47 2005
Copyright (c) 1982, 2004, Oracle. All rights reserved.
Enter password:
Connected to:
Oracle Database 10g Enterprise Edition Release 10.1.0.3.0 - Production
With the Partitioning, OLAP and Data Mining options
SQL> create user ops$pops identified externally;
User created.
SQL> grant connect to pops;
Grant succeeded.
SQL> exit
Disconnected from Oracle Database 10g Enterprise Edition Release 10.1.0.3.0 - Production
With the Partitioning, OLAP and Data Mining options
oracle@mini:~> su - pops
\Password:
Illinois isn't exactly the land that God forgot -- it's more like the
land He's trying to ignore.
pops@mini:~> . oraenv
ORACLE_SID = [pops] ? orcl
pops@mini:~> sqlplus /
SQL*Plus: Release 10.1.0.3.0 - Production on Sun Nov 13 21:16:59 2005
Copyright (c) 1982, 2004, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.1.0.3.0 - Production
With the Partitioning, OLAP and Data Mining options
SQL>

Is oracle user created by default during installation of OEL 5

i want to know that is oracle user and its groups already created by default during installation of OEL 5.5 ??

user13376823 wrote:
i want to know that is oracle user and its groups already created by default during installation of OEL 5.5 ??Why would it? It's just an operating system. It doesn't know or care what applications you may or may not choose to install at any time in the future after it (the OS) is installed, nor does it know or care about the requirements of any application you may choose to install at any time in the future.

Creation of BP with default role

Hi ,
   I have a requiement where in I want a Business Partner to be created with a default role ,i.e CRM006. I can do this in GUI with the help of authorizations.
But the same does not work in PCUI.
My requirement is whenever a user creates a Business Partner, Role CRM006 automatically gets assigned to it.
please sugest something.
Help will be apreciated.
Regards
Sourabh Verma

Hi PREMKUMAR LNS,
you can easily implement BADI: BADI_CRM_BP_UIU_DEFAULTS
IF_UIU_BP_DEFAULTS~GET_DEFAULT_VALUES
and write something like this:
assign cr_me->('TYPED_CONTEXT') to <typed_context>.
if sy-subrc = 0.
    lr_typed_context ?= <typed_context>.
    if lr_typed_context is bound.
      assign lr_typed_context->('HEADER') to <context_node>.
      if sy-subrc = 0.
        try.
            lr_node            ?= <context_node>.
          catch cx_sy_move_cast_error. "EC_NOHANDLER
        endtry.
        if lr_node is bound.
          lr_coll_wrapper ?= lr_node->collection_wrapper.
          if lr_coll_wrapper is bound.
            try.
                lr_current ?= lr_coll_wrapper->get_current( ).
                check lr_current is bound.
controllo la tipologia di account
                zbp_category = lr_current->get_property_as_string( 'BP_CATEGORY' ).
               zbp_group    = lr_current->get_property_as_string( 'BP_GROUP' ).
                if zbp_category = '1'.
                elseif zbp_category = '2'.
              Set default role at creation to "Relation"
                   break domino.
                    zobp_category = lr_current->get_property_as_string( 'BP_ROLE' ).
                    if zobp_category is initial.
Here you are setting the default role
                  lr_current->set_property( iv_attr_name = 'BP_ROLE'
                                   iv_value = 'BUP002' ).
                    endif.
                else.
                endif.
              catch cx_sy_move_cast_error.
            endtry.
          endif.
        endif.
      endif.
    endif.
endif.

Email notification for user created through reconciliation in OIM

Hi..
I have done the following configurations for email notification when user is created through reconciliation in OIM
Configuring IT Resource
Name     Email Server
     Type      Mail Server
     Authentication     FALSE
     Server Name     *.*.*.*
     Username
     Password
Creating email definition with the following values
Name     Create User Email Notification
     Type     Provisioning Related
     Language     en
     Region     US
     Object Name     Xellerate User
     Process name     Xellerate User
     From     User
     User Login     Xelsysadm
     Subject      User Created
Add Email notification in a new process task with name Notify
Process definition     Xellerate User
     Task     Notify
     Disable Manual Insert     Enable
     Required for Completion     Enable
     Allow Cancellation while Pending     Enable
     Handler Name     tcComplete Task
     Assignment Rule     Default
     Target Type     User
     User     Xelsysadm
     Email name     Create User Email Notification
     Send Email     Enable
     Notification Assignee     Enable
     Email      Create User Email Notification
     Status     Completed
Xelsysadm has a valid email id. Now when I am reconciling any user, two mail notifications are being sent. Not able to know from where these two notifications are being triggered.
Am i suppose to make any changes in the configurations?
Edited by: Amruta Agarwal on Sep 28, 2011 4:21 AM

Sorry re-read your issue again. I believe there are two notifications because you have added your notify task in the process definition and OIM OOTB sends a notification when a user is recon'd. Thus remove your task or disable the OOTB notification. The property is Recon.SEND_NOTIFICATION
HTH,
BB
Edited by: bbagaria on Oct 7, 2011 9:13 AM

User List with their roles

Hi Guys,
I want a list of all users in the database with their specified roles.
Any help will be appreciated.
Regards,

I was confused that GRANTEE is USERNAME and I am still confused. No need to be confused because docs are saying :
GRANTEE     VARCHAR2(30)          Name of the user or role receiving the grant
http://docs.oracle.com/cd/B19306_01/server.102/b14237/statviews_4064.htm
Probably you are not seeing all/some user names, because chances are that some privileges are granted to role but not directly to the users. Users are accessing those privileges via role. See example :
SQL> select * from v$version;
BANNER
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
PL/SQL Release 11.2.0.1.0 - Production
CORE    11.2.0.1.0      Production
TNS for 64-bit Windows: Version 11.2.0.1.0 - Production
NLSRTL Version 11.2.0.1.0 - Production
SQL> create user test identified by test;
User created.
SQL> grant connect,resource to test;
Grant succeeded.
SQL> create role testrole;
Role created.
SQL> grant select on scott.emp to testrole;
Grant succeeded.
SQL> connect test/test
Connected.
SQL> SELECT GRANTED_ROLE FROM USER_ROLE_PRIVS;
GRANTED_ROLE
CONNECT
RESOURCE
SQL> connect scott/tiger
Connected.
SQL> grant testrole to test;
Grant succeeded.
SQL> connect test/test
Connected.
SQL> SELECT GRANTED_ROLE FROM USER_ROLE_PRIVS;
GRANTED_ROLE
CONNECT
RESOURCE
TESTROLE
SQL> select * from scott.emp;
     EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM     DEPTNO
      7369 SMITH      CLERK           7902 17-DEC-80        800                    20
      7499 ALLEN      SALESMAN        7698 20-FEB-81       1600        300         30
      7521 WARD       SALESMAN        7698 22-FEB-81       1250        500         30
      7566 JONES      MANAGER         7839 02-APR-81       2975                    20
      7654 MARTIN     SALESMAN        7698 28-SEP-81       1250       1400         30
      7698 BLAKE      MANAGER         7839 01-MAY-81       2850                    30
      7782 CLARK      MANAGER         7839 09-JUN-81       2450                    10
      7788 SCOTT      ANALYST         7566 19-APR-87       3000                    20
      7839 KING       PRESIDENT            17-NOV-81       5000                    10
      7844 TURNER     SALESMAN        7698 08-SEP-81       1500          0         30
      7876 ADAMS      CLERK           7788 23-MAY-87       1100                    20
     EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM     DEPTNO
      7900 JAMES      CLERK           7698 03-DEC-81        950                    30
      7902 FORD       ANALYST         7566 03-DEC-81       3000                    20
      7934 MILLER     CLERK           7782 23-JAN-82       1300                    10
14 rows selected.
SQL>Regards
Girish Sharma

Error encountered during provisioning of user to SAP CUP in OIM 11g R1 BP07

We recently updated our environment from 11.1.1.5 BP05 to 11.1.1.5 BP07.
We are facing an issue with provisioning users to SAP CUP system. We receive an error specifying :
Response: oracle.iam.connectors.sap.cup.ws.submitreq.ObjectFactory
Response Description: Unknown response received
However, we are unable to find any errors related in the log file. The SAP UM connector version is 9.1.2.5. Please let us know the cause of this issue.

1. Login to Design Console and open your GTC provisioning process definition , then Add a new task called "Notify Email".
2. Check Required for Completion, Allow Cancel and optionally Disable Manual Insert.
3. In the Integration tab, add tcCompleteTask
4. In the assignment tab, add an entry with the Default rule, target type of User, and for the User field pick an existing user with a valid email address in their User Profile.
5. In the Notification tab add an entry and check Assignee, (You can select User, Manager etc ) have the Status field set to C and for the Email field pick a Provisioning type of Notification Template that you have already created.
N.B: 7. Make sure the IT Resource and email configuration properly otherwise you will not get the mail.
Thanks
Tamim Khan

Error while creating authorisation policy using OIM 11g API

Hi,
We have a requirement to create ‘Authorization Policies’ (assign Data Constraints, Permissions & Assignments) using OIM 11g API’s. I am using ‘oracle.iam.authzpolicydefn.api.PolicyDefinitionService & oracle.iam.authzpolicydefn.vo.AuthzPolicy’. But when I am trying to attach Entity/Feature (User Management) to authorisation policy, it is throwing exception. Below is the code snippet which I am trying to implement.
Line1: PolicyDefinitionService policyService = oimClient.getService(PolicyDefinitionService.class);
Line2: AuthzPolicy authPolicy = new AuthzPolicy();
Line3: authPolicy.setName("Test Authz Policy");
Line4: authPolicy.setDisplayName("Test Authz Policy Dsp Name");
Line5: authPolicy.setDescription("Test Authz Policy Description");
Line6: Feature feature = oimClient.getService(Feature.class);
Line7: Action featureAction = feature.getAction(FeatureManagerConstants.Features.USER_MGMT.getId());
Line8: List<Action> actions = new ArrayList<Action>();
Line9: actions.add(featureAction);
Line10: authPolicy.setActions(actions);
Line11: policyService.createPolicy(authPolicy);
Exception: oracle.iam.platform.utils.NoSuchServiceException: java.lang.ClassNotFoundException: oracle.iam.authzpolicydefn.api.FeatureDelegate
The above exception is throwing at Line6.
Let me know if anyone implemented.
- Kalyan Mutya

If you are using JDeveloper , can you able to get class after giving "." .If yes no than it is the problem with the jar file you are using .Check whether you can able to import oracle.iam.authzpolicydefn.api.Feature.
Thanks ,
Animesh anand

Creating a Request via OIM 11g API

I'm trying to create a request in OIM using the API. I found this post ( OIM 11g - Setting Process Form Data through Request API ) which has the code to do it but I'm getting an error:
Here is what I have
OIMClient client = getOIMClient(url, username, password);
      long resKey = 0L;
      String str = null;
      String resourceKey = null;
      Map<String, String> searchMap = new HashMap<String, String>();
      tcResultSet resultSet = null;
      RequestData requestData = null;
      Beneficiary beneficiary = null;
      RequestBeneficiaryEntity entity = null;
      List<Beneficiary> beneficiaryList = new ArrayList<Beneficiary>();
      List<RequestBeneficiaryEntity> entityList = null;
      List<RequestBeneficiaryEntityAttribute> entityAttrList = null;
      String RESOURCE = "TESTRESOURCE_GTC";
      tcITResourceInstanceOperationsIntf operations = client.getService(tcITResourceInstanceOperationsIntf.class);
      Map<String, String> conditions = new HashMap<String, String>();
      conditions.put("IT Resources.Name", "TESTRESOURCE_GTC");
      resultSet = operations.findITResourceInstances(conditions);
      resKey = resultSet.getLongValue("IT Resource.Key");
      resourceKey = Long.toString(resKey);
      RequestBeneficiaryEntityAttribute parantAttr = new RequestBeneficiaryEntityAttribute();
      parantAttr.setType(TYPE.String);
      parantAttr.setName("Title");
      parantAttr.setValue("Mr.");
      entityAttrList = new ArrayList<RequestBeneficiaryEntityAttribute>();
      entityAttrList.add(parantAttr);
      entity = new RequestBeneficiaryEntity();
      entity.setEntityKey(resourceKey);
      entity.setEntityType(RequestConstants.RESOURCE);
      entity.setEntitySubType(RESOURCE);
      entity.setEntityData(entityAttrList);
      entityList = new ArrayList<RequestBeneficiaryEntity>();
      entityList.add(entity);
      System.out.println("*********** USR KEY" + usrKey);
      beneficiary = new Beneficiary();
      beneficiary.setBeneficiaryType(Beneficiary.USER_BENEFICIARY);
      beneficiary.setBeneficiaryKey(usrKey);
      beneficiary.setTargetEntities(entityList);
      beneficiaryList.add(beneficiary);
      requestData = new RequestData();
      requestData.setRequestTemplateName("Self-Request Resource");
      requestData.setJustification("Test");
      requestData.setBeneficiaries(beneficiaryList);
      UnauthenticatedRequestService reqsrvc = client.getService(UnauthenticatedRequestService.class);
      str = reqsrvc.submitRequest(requestData);
      System.out.println("Value from submitRequest : '" + (str != null ? str : null) + "'");I'm getting
<Feb 14, 2012 4:53:24 PM EST> <Error> <oracle.iam.request.impl> <IAM-2050128> <Invalid beneficiary key was specified for Self-Request. >
oracle.iam.request.exception.InvalidRequestDataException: IAM-2050128:Invalid beneficiary key was specified for Self-Request.
I can see that USER KEY is getting populated.
Edited by: DJ on Feb 14, 2012 4:59 PM
Edited by: DJ on Feb 14, 2012 5:00 PM

While creating a request to provision iPlanet User one of the errors I was getting:
oracle.iam.request.exception.RequestServiceException: IAM-2050061:Type mismatch for the attribute Server. The type passed is String, but the corresponding type in the data set is Long.:Server:String:Long
So I replaced the value of the attribute Server to the IT Resource.Key which is 5. After making the changes, it goes through approvals with no problems, but when I approve all the work items, it errors out with an error:
Error occurred while provisioning resource with key 45 to user 5
User Key is 45 and Resource Key is 5. I'm not sure why it swapped it.
Here is the code I'm using:
public static void createRequest(String userLogin, String templateName, String resourceName, HashMap<String, Object> attrs, OIMClient client) {
    try {
      String usrKey = searchUserByLogin(userLogin, client).get(0).getId();
      long resKey = 0L;
      String str = null;
      String resourceKey = null;
      Map<String, String> searchMap = new HashMap<String, String>();
      tcResultSet resultSet = null;
      RequestData requestData = null;
      Beneficiary beneficiary = null;
      RequestBeneficiaryEntity entity = null;
      List<Beneficiary> beneficiaryList = new ArrayList<Beneficiary>();
      List<RequestBeneficiaryEntity> entityList = null;
      List<RequestBeneficiaryEntityAttribute> entityAttrList = new ArrayList<RequestBeneficiaryEntityAttribute>();
      tcITResourceInstanceOperationsIntf operations = client == null ? Platform.getService(tcITResourceInstanceOperationsIntf.class) : client.getService(tcITResourceInstanceOperationsIntf.class);
      Map<String, String> conditions = new HashMap<String, String>();
      conditions.put("IT Resources.Name", resourceName);
      resultSet = operations.findITResourceInstances(conditions);
      resKey = resultSet.getLongValue("IT Resource.Key");
      resourceKey = Long.toString(resKey);
      for (String attr : attrs.keySet()) {
        RequestBeneficiaryEntityAttribute parantAttr = new RequestBeneficiaryEntityAttribute();
        if (attrs.get(attr) instanceof String) {
          parantAttr.setType(TYPE.String);
          parantAttr.setName(attr);
          parantAttr.setValue(String.valueOf(attrs.get(attr)));
          entityAttrList.add(parantAttr);
        } else if (attrs.get(attr) instanceof Long) {
          parantAttr.setType(TYPE.Long);
          parantAttr.setName(attr);
          parantAttr.setValue(String.valueOf(attrs.get(attr)));
          entityAttrList.add(parantAttr);
        } else {
          // do nothing
      entity = new RequestBeneficiaryEntity();
      entity.setEntityKey(resourceKey);
      entity.setEntityType(RequestConstants.RESOURCE);
      entity.setEntitySubType(resourceName);
      entity.setEntityData(entityAttrList);
      entityList = new ArrayList<RequestBeneficiaryEntity>();
      entityList.add(entity);
      beneficiary = new Beneficiary();
      beneficiary.setBeneficiaryType(Beneficiary.USER_BENEFICIARY);
      beneficiary.setBeneficiaryKey(usrKey);
      beneficiary.setTargetEntities(entityList);
      beneficiaryList.add(beneficiary);
      requestData = new RequestData();
      requestData.setRequestTemplateName(templateName);
      requestData.setJustification("Test");
      requestData.setBeneficiaries(beneficiaryList);
      System.out.println("Resource Keys " + resKey + " " + resourceKey);
      System.out.println("User Key " + usrKey);
      RequestService reqsrvc = client == null ? Platform.getService(RequestService.class) : client.getService(RequestService.class);
      str = reqsrvc.submitRequest(requestData);
      System.out.println("Value from submitRequest : '" + (str != null ? str : null) + "'");
    } catch (Throwable t) {
      t.printStackTrace();
}Edited by: DJ on Feb 16, 2012 5:01 PM

Lookup.USR_PROCESS_TRIGGERS not working with trusted reconciliation oim 11g

Hi,
I am facing one issue while running the trusted incremental reconciliation in OIM 11g.
In the bulkEvent of the event handler I am checking if the operation is MODIFY then I am comparing some attributes and based of that result I am performing some action.
Now the issue is that if the first name or last name of the users gets changed in OIM due to trusted reconciliation then the Change First Name or Change Last Name Process task should get execute on the resources provisioned to the user. This is not happening in my case.
I tried modifying the first name of the user via UI and then the Change First Name Process task got executed.
Please let me know if I need to do some thing extra to get this working.
Thanks

Hi,
Try creating a custom adapter and attach the adapter to the process task which you have created. This adapter should read the user profile value and populate in the AD provisioning form. Then test the flow for one attribute. As I am suspecting that there would be an issue with OOTB adapter.
Regards
Sai

Problem with EventHandler in OIM 11g

Hi All,
I followed the Part I(Chapters 6,7 & 30) in pdf file shown below
http://download.oracle.com/docs/cd/E14571_01/doc.1111/e14309.pdf
I developed the plugin and registered the plugin for custom eventhandler.
Iam not able to see the defined eventhandler in design console .
I am running weblogicImportMetadata.bat (import specific metadata files into the MDS database) as specified in pdf document after making necessary changes.
After restarting OIM server ,the server is not starting , and showing errors like " target invocation exception","null pointer exception" etc.
Have anyone done the EventHandler in OIM 11g , if anyone done please provide the followed document link.
Please suggest to solve the issue.
Thanks & Regards
Satish
Edited by: satish on Sep 17, 2010 4:53 PM
Edited by: satish on Sep 22, 2010 3:14 PM

Hello Satish,
You won't find the eventhandler in the design console. This is by design.
I had a similar error. Hope this helps you.
Verify your EventHandlers.xml file. For me one of the entries, particularly stage="preprocess" had the letter 's' in uppercase (Stage="preprocess"). This was the source of my error below.
<An error occurred while initializing service : {0}
java.lang.NullPointerException
Caused by: oracle.iam.platform.utils.ServiceInitializationException: java.lang.NullPointerException
<Nov 2, 2010 12:30:55 PM PDT> <Warning> <oracle.iam.platform.utils> <IAM-0070016> <An error occurred while initializing service : oracle.iam.platform.kernel.OrchestrationEngine>
<Nov 2, 2010 12:30:55 PM PDT> <Warning> <oracle.iam.platform.utils> <IAM-0070016> <An error occurred while initializing service : {0}
java.lang.NoClassDefFoundError: oracle/iam/platform/kernel/impl/KernelObjFactory
There is definitely a lack of clear documentation around developing plugins (e.g. oim.home in ant.properties should point to OIM home/server).
I worked with Oracle support and provided some feedback. They are going to publish a KB article soon. I now have a preprocess eventhandler that seems to work.

Can approver modify user's request form in OIM 11g?

Dear All,
In OIM 10g, the approver of a request can modify user's request form, we just need to configure the permission in OIM. But, can we do it in OIM 11g?
If can, how can i configure it?
really need your help guys,, :D
Thank you,
--herry

Hi user12841694,
Thanks for the suggestion. But, the data (field) that can be modified by the approver is very limited. We cannot attach multi-valued attribute there (like Child Form).
Regards,
---herry

Restricting administrator tab to user created with default role OIM 11g R2

Similar Messages

Maybe you are looking for