Target resource provisioning and (very) specific worflow

Hello,
I'm looking to build a specific use case into OIM 11g and I would appreciate some guidance.
Upon AD account provisionning I want:
1. create the account and set a random temporary password
2. send an email to techies so with the account login and password so they can login as the user and setup his laptop
3. techies would then acknowledge that their job is done
4. OIM would reprovision another random password and set the "must change password" flag to true.
how would you do that? should I heavily customize the AD Create User adapter? how can I interact with SOA to get the acknowledgement? (or where/how could I do that?)
thanks for your help!

bcarlier wrote:
Hello,
I'm looking to build a specific use case into OIM 11g and I would appreciate some guidance.
Upon AD account provisionning I want:
1. create the account and set a random temporary password
Let the out of box create user be called here and on it's complete and success call up another custom task which will assign the manual task to the support person. Here you can attach email notification as well.
2. send an email to techies so with the account login and password so they can login as the user and setup his laptop
3. techies would then acknowledge that their job is doneOnce the techie will complete the manual provisioning task, on it's complete call the change password task.
4. OIM would reprovision another random password and set the "must change password" flag to true.
how would you do that? should I heavily customize the AD Create User adapter? how can I interact with SOA to get the acknowledgement? (or where/how could I do that?)You dont need SOA for it as you are just assigning a manual provisioning task and not an approval to the support person. You donot have to cutomize the create user adapter but just customize the provisioning workflow.
thanks for your help!
http://docs.oracle.com/cd/E21764_01/doc.1111/e14309/promgt.htm#BCEJHFBF
http://docs.oracle.com/cd/E21764_01/doc.1111/e14316/auth_selfservice.htm#CACBBJFC
HTH,
Bikash

Similar Messages

OW 8.1.1 p4 and AIX 6.1 as a target resource

HI,
We are using OW 8.1.1 p4 and want to provision to AIX 6.1 as a target resource. The release notes says IBM AIX 4.3.3, 5.2, 5L, 5.3, 6.0 are supported. Has anyone provisioned to AIX 6.1?
Regards
Arjun

Hi,
It happened that we have to integrate Siebel Finance To ADSI
have you confirmed that any of the questions you asked
If so
What have you use to connect Siebel with ADSI?
if you can refer us to a document or a certain methodology would be very thankful
Regards and thanks in advance

[svn:fx-trunk] 12663: Adding the resource bundle and fat-swc targets for osmf and textlayout.

Revision: 12663
Revision: 12663
Author:   [email protected]
Date:     2009-12-08 12:22:31 -0800 (Tue, 08 Dec 2009)
Log Message:
Adding the resource bundle and fat-swc targets for osmf and textlayout. Also for osmf adding the doc target. This new format that I added to the two project build files will be what we will use going forward for all projects. I have all the other projects modified and plan on checking them in soon. The format change will make adding new locales easier as well as adding the fat-swc target when needed.
QE notes: no
Doc notes: no
Bugs: no
Reviewer: gaurav
Tests run: checkintests
Is noteworthy for integration: no
Modified Paths:
    flex/sdk/trunk/frameworks/build.xml
    flex/sdk/trunk/frameworks/projects/osmf/build.xml
    flex/sdk/trunk/frameworks/projects/textLayout/build.xml
Added Paths:
    flex/sdk/trunk/frameworks/projects/osmf/bundles/
    flex/sdk/trunk/frameworks/projects/osmf/bundles/en_US/
    flex/sdk/trunk/frameworks/projects/osmf/bundles/en_US/osmf.properties
    flex/sdk/trunk/frameworks/projects/textLayout/bundles/en_US/textLayout.properties
Removed Paths:
    flex/sdk/trunk/frameworks/projects/osmf/src/OSMFDocClasses.as
    flex/sdk/trunk/frameworks/projects/textLayout/bundles/en_US/empty.properties

Thats good news.

Very specific question about iOS 7 and podcasts

I have a very specific question regarding the playback of podasts under iOS 7.
Right now, I've still got iOS 5.1.1 (iPhone 4S).
What I would like to have is a way to play an episode from a podcast that I have not yet finished, and when I double-click the ear-bud's middle button, then I would like to jump (skip) to the episode in the list, even if that episode is from a different podcast.
Right now, under iOS 5.1.1, I achieved that by creating a smart playlist in iTunes that collects all the episodes from all podcasts with a play count == 0.
This smart playlist is mirrored to the iPhone.
It works very well.
It seems to me that something like that is not possible under iOS 6, so I skipped that.
My question now is whether I can acheive this under iOS 7.
I would be most grateful if some kind soul could shed some light on that for me.
Best,
Gabriel.

Hi Larry,
Thanks very much for posting a reply.
I do absolutely intend to print a test copy first - but thanks to your advice at least know the spine is going to be ok!
I didn't realize that method would give me a nice landscape image of the unbound cover - I'd mistakenly remembered that it gave only one page at a time for front and back.
Thanks for helping out.
Best,
Marco

Error while performing OSB Resource Provisioning in OEM12c

Hi ,
I tried the following, but faced the below errors mentioned.
1.Log on to Oracle Enterprise Manager Cloud Control 12c Workspace using "sysman" userid
2. Navigate to Enterprise-> Provisioning and Patching-> Middleware Provisioning.
3. From the List of Deployment Procedure Names section, Select the Oracle Service Bus Resource Provisioning procedure from the list and click Launch.
4. In ‘Select Source’ page, Select ‘Oracle Service Bus Domain’ radio button
5. Click Browse icon and Select the specific Domain and also specify the BEA Home Directory and Click Next.
6. In ‘Select Projects’ page, in the Resource Summary section, Select the projects to export and deploy to the target OSB domain.
7. In ‘Select Target’ page, Select ‘Domain’ and’ BEA Home Directory’ in the ‘Target’ section
8. In ‘Set Credentials’ page, specify the login credentials of the source and target domains, hosts and Click Next
9. In ‘Schedule’ page, Specify a Deployment Instance name and Click Next.
10. In Review page, review the details you have provided for the Deployment Procedure
11. Click Submit to run the Deployment Procedure according to the schedule set.
12. In ‘Procedure Activity’ page, Click Status and view the details of the execution of each step.
The procedure activity is created successfully, but its completed with the following error in Transfer Jar File
Step: Create archive file from contents of directory (Failed)
Created /tmp/job_ft_D534213D48EC4E46E04333B6360AA560
Executing command /opt/em/core/12.1.0.2.0/bin/zip -rv /tmp/job_ft_D534213D48EC4E46E04333B6360AA560/src_archive_D534213D48EC4E46E04333B6360AA560.zip .
zip error: Nothing to do! (try: zip -rv /tmp/job_ft_D534213D48EC4E46E04333B6360AA560/src_archive_D534213D48EC4E46E04333B6360AA560.zip . -i .)
Process returned : 12. Illegal seek
Step: Create or prepare destination directory for commencing file transfer (Succeeded)
Step: Transfer archive file to destination (Error)
File does not exist or not accessible.sink operation skipped due to source operation failure
Kindly help here
Thanks

Hi,
I have resolved the issue with the help of cluster admin
Regards
Mitesh

OIM 11g - Reconciliation of Target Resource Status

Hi,
We're working with OIM 11.1.1.5.2 and connectors DBUM 9.1.0.4 and MSAD 9.1.1.7.
Provisioning and reconciliation seem to be working correctly, but we found that the status of the resource is not getting reconciled on OIM console.
For example, if we provision an user with an Oracle Database account, and then lock the account on the database, when we run reconciliation the event is generated and finished with "update succeded", we go to the UD_DB_ORA_U table and find that the field UD_DB_ORA_U_LOCK has a "LOCKED" value, then if we check the logs we can see that the connector is correctly mapping the resource status with the OIM object status:
prepareTargetUsersRecordInOIMFormat : record value : LOCKED
prepareTargetUsersRecordInOIMFormat : map : {OPEN=Enabled, 1=Disabled, YES=Disabled, 0=Enabled, EXPIRED & LOCKED=Disabled, NO=Enabled, LOCKED=Disabled}
prepareTargetUsersRecordInOIMFormat : roValue : TEMPORARY_TABLESPACE_QUOTA
prepareTargetUsersRecordInOIMFormat : Temp RO value : null
prepareTargetUsersRecordInOIMFormat : reconData : [{Default Tablespace=27~USERS, Authentication Type=PASSWORD, Password=Dummy, Default Tablespace=27~USERS, Authentication Type=PASSWORD, Password=Dummy, Default Tablespace Quota=, Profile Name=27~USUARIOS, IT Resource=Oracle, User Name=USPRUEBA65, Temporary Tablespace=27~TEMP, Account Status=LOCKED, Status=Disabled, Global DN=, Privilege List=[], Role List=[{Role Admin Option=NO, Role Name=}], Temporary Tablespace Quota=}]
prepareTargetUsersRecordInOIMFormat:: FINISHED
But, even though the reconciliation has succeded the administrative console shows the account on "Enabled" status, and when I check the OIU table i can see that the OIM object status is still enabled.
I found some threads related to this issue, the most similar was this one: Reconciliation for the deleted user accounts on Target Resource but everything there do not seem to be of much help because all tasks described are already done by the connector installation (at least in msad and dbum connectors).
This problem is happening both for Active Directory and Oracle Database Users, maybe we're missing something but based on the documentation for both connectors we thought it was an OOTB functionality. Is there some system property or connector parameter we need to configure to make this work?
Thanks.
Edited by: fmc on Jul 26, 2012 12:53 PM

Hi Pallavi,
Well, you were right after all, we were mixing 2 totally different problems here and it got us confused.
The problem with the DBUM connector was exactly what you said, a bug in the connector, just needed to modify the connector task object to status mapping. We were checking the Reconciliation Update Received task on AD and we thought it would be the same, and it was obviously not. Well, in this case teh recon event was being generated but nothing happened, after we changed the process task it worked like a charm.
On the other hand, the problem with the AD reconciliation was that our search filter on the recon job was configured to ommit accounts with the disabled status (!(userAccountControl=66050)), it was certainly a silly problem, never thought we had that in the filter (it's a huge filter and we didn't pay attention to that clause the first time around) but everything is working now, thanks!

Axis resource allocation and the MID-7654

Hello All,
I am currently transferring my application over to use the MID-7654 instead of third party drives. Below is the start up process I am using to allocate the axis resources:
//kill and disable all axes
flex_stop_motion(boardID,0,NIMC_KILL_STOP,0x000F);
  flex_enable_axes(boardID,0,3,0x00);
//unmap all axis resources
  flex_config_axis(boardID,NIMC_AXIS1,0,0,0,0);
  flex_config_axis(boardID,NIMC_AXIS2,0,0,0,0);
  flex_config_axis(boardID,NIMC_AXIS3,0,0,0,0);
  flex_config_axis(boardID,NIMC_AXIS4,0,0,0,0);
//map encoder resources to axes 1 and 2
  flex_config_axis(boardID,NIMC_AXIS1,NIMC_ENCODER1,0,0,0);
  flex_config_axis(boardID,NIMC_AXIS2,NIMC_ENCODER2,0,0,0);
  //enable axes 1 and 2
u8 mask = MASK1|MASK2;
status = flex_enable_axes(boardID,0,3,mask);
Basically, I want to use the encoder resources for each axis for position/velocity monitoring and control the analog outputs directly to change the torque of the motors. Since my impedance control software is closing the position and velocity loops, I do not want to use the PID controller onboard the PCI-7344.
The above code worked fine with the third party drive. However, after starting up my application with the MID drive, all of the orange inhibit LEDs turn on and remain that way (I assume it is to do with killing and disabling all of the axes and not mapping output resources to them). Since I wasn't previously using the inhibit output from the motion controller, my application worked fine with the third party drive (I was still able to read the encoder feedback information).
Also, when I was using the MAX '1-D interactive' interface to verify my encoder feedback, if I move either encoder immediately after initialization the 'Motor off' and 'Following error' lights turn red. I assume this is due to the encoder moving without a command sent from the motor).
Can anyone see any problems with the above code segment or suggest an initialization procedure that would solve my problems. Or if all else fails, is it possible to control the inhibit signals directly to enable/disable the axes on my own?
Wow... I certainly rambled on a bit there.... If you need clarification on any points let me know. Also, I am on a bit of a time crunch, so a prompt reply would be greatly appreciated.
Thanks,
Chad

Chad,
I'm a bit astonished that you don't want to use the PID controller on the board. Onboard PID control is one of the main reasons why you would like to use a motion control board instead of a simple multifunction I/O device. The onboard PID loop of the 7344 can run with up to 16 kHz with very low jitter whilst using the DACs directly from your host application will result in a control loop with less than 200 Hz and a high amount of jitter - even if you were using a real-time OS. This will result in poor control behavior.
This is caused by the architecture of the board. The DACs can be controlled directly by the DSP on the board with high rates in a determenistic way but the host can access them only through the board's µController that runs the host communication in 5 ms cycles that can't be synchronized with the application on the host PC. So for this usecase a combination of e. g. a PCI-6229 (multifunction DAQ board with 4 analog outputs) and a PCI-6601 (4 counters with direct quadrature encoder connectivity) would do a much better job at even a lower price.
With this said I really can't reccomend the usage of a PCI-7344 as a pure I/O-board. Please provide some information why you want/need to choose this approach. There are a lot of options to build customized motion control systems. Please follow this link for some further information.
A key feature of every control system is deterministic behavior so you will need to run your application on a real-time OS. Otherwise you won't be able to get a reliable control behavior.
I can give you some more specific advice if you post some background information about your application.
Best regards,
Jochen Klier
National Instruments Germany

Reconciliation for the deleted user accounts on Target Resource

Hi,
I am trying to run reconciliation on a DB Table as the target resource. It is linking the user accounts that are present in the target resource.
But for the user accounts that are deleted on the target resource Reconciliation is not showing any action on the IdM user accounts under resource profile. The resource object link still shows the status "Provisioned".
Ideally when the users are deleted on the target resource User's profile, Does it require any customizations to make the resource assignment status to "revoked" instead of "Provisioned".
Any response would be of great help.
Thanks in advance.

See there could be two possibilities only:
*1) User Status Recovery via trusted Reconciliation*
Associated field in OIM responsible for it - Status field of OIM User Profile -> Check Process Definition for Xellerate User or any Trusted resource in "Reconciliation Field Mappings" section
Valid values are : Active, Disabled and Deleted
*2) Account Status Recovery via target Reconciliation*
Associated field in OIM responsible for it - OIM_OBJECT_STATUS field from Process Data Field -> Check Process Definition for Your custom resource of DB App Table in "Reconciliation Field Mappings" section
Valid values are : Enabled, Disabled and Revoked
So you are trying to achieve the second part.
Hope its clear.
Thanks
Sunny

Resource Bundles and Embedded fonts - best practice

Hello,
I am in digging into creating a localized app and I would
like to use embedded fonts.
Ideally, I would like to have two locales (for example), each
with a different embedded font and/or unicode range.
For example, how do I set up my localized app so that EN uses
Arial (Latin Range), and JP uses Arial Unicode MS with Japanese
Kanji unicode range ?
Note that I do know how to embed fonts with different ranges,
I just don't know how to properly embed them into resource bundles
and access them easily in style sheets.
Thanks!
-Daniel

Hello!
This is a very pertinent question, however as many things in life there is no one size fits all here.
We basically recommend, as best practice, to allocate for each specific context only the estimated needed resources. These values should always come from a previous study on the network patterns/load.
To accomodate for growth and scalability it is strongly advised to initially keep as many resources reserved as possible and allocate the unused resources as needed. To accomplish this goal, you should created a reserved resource class, as you did already, with a guarantee of 20 to 40 percent of all ACE resources and configure a virtual context solely with the purpose of ensuring that these resources are reserved.
As you might already know ACE protects resources in use, this means that when decreasing a context's resources, the resources must be unused before then can be reused by other context. Although it is possible to decrease the resource allocations in real time, it typically requires additional overhead to clear any used resources before reducing them.
Based on the traffic patterns, number of connections, throughput, concurrent SSL connections , etc, for each of the sites you will be deploying you will have a better idea on what might be the estimated needed resources and then assign them to each of the contexts. Thus this is something that greatly depends on customer's network environment.
Hope this helps to clarify your doubts.

AD provisioning in a specific OU

Hi Experts,
Is it possible to change the provisioning for the Plugin "Create AD User" so that I can provision 'in a specific OU?
For example:
User X should I be added in the AD domain under "OU = Internal". Is it possible to target the user-provisioning to the OU structures of the AD?
By dedault the defined "starting point" and the MSKEYVALUE is used for the "dn".
What are your experiences?
Thank You!
Gerhard

Hi Deepak,
I would suggest you to do the following way.
1. Create a table in IDM and maintain the Bracnh to OU mapping, say in the table tblBranchtoOU.   Ex:
Branch     OU
Branch-A   OU1
Branch-B   OU2
Branch-C   OU3
2. Create an attribute MX_Branch which lists the available branches. to list the available branches from this table. configure the MX_Branch attribute as below.
3. Configure your UI task for user creation such that, it lists the Branch values to select the branch during the user creation.
4. Write a script that accepts the Branch as input and do a look up on the table that is created in step 1 and return the corresponding OU.
5. Add this script to the plugin task for AD, "SAP Create ADS User"
6. In the destination tab of this pass, for the AD attribute dn, change the value based on your requirement according to the script. something like in
   below    screenshot.
In IDM, you can achieve a solution in multiple ways it depends on you, which logic you want to use.
Thanks,
Krishna.

Query to retrieve list of users who do not have a resource provisioned

I am trying to get a list of user who do not have a particular resource provisioned. I cannot seem to find a table that links the resource object information and User information. I need to generate a CSV file. Has anyone done this before or have any ideas. If so any information would be very helpful.
Thanks

select * from usr where usr.usr_key not in (
select usr.usr_key from oiu, usr, obi, obj, ost
where oiu.usr_key=usr.usr_key
and oiu.obi_key=obi.obi_key
and obi.obj_key=obj.obj_key
and obj.obj_name = :obj_name
and oiu.ost_key=ost.ost_key
and ost.ost_status not in ('Revoked'))
-Kevin

Is there any way I may set low resources priority for a specific job or even all SQL jobs?

Is there any way I may set low resources priority for a specific job or even all SQL jobs?
Our database is quite big and everything works OK and very fast, except SQL jobs which are used mainly for maintenance purposes.
I have one specific job which runs for 2 minutes and takes a lot of resources which may affect execution of other stored procedure which should be executed fast.The worst part is that this job has to be executed during the most active working hours. It does
not matter for me how long will it take to execute this job. I just do not want it to use so much resources.
Also I noticed when SQL backup job (takes about 4 minute) is scheduled it also takes a lot of resources and sometimes because of that I am receiving "login timeout" error on my web site.

depending on you sql server version and edition, you can use resource governor and limit the cpu and memory.
in most typical cases , you can use the session user name and times and classify the how much cpu and memory they can use. refer : https://msdn.microsoft.com/en-us/library/cc645892.aspx
but in your case, the problem seems to be with the maintenance jobs which could run as sql server service account.
also, if the backup are third party tool backup, you can specify the priority level and other options etc to make it less priority.
it is possible to do that even with native backups such as specifying the limiting buffercount, max transfer size, if the server is memory pressured. sometimes, stripping the backups to multiple sets across different devices, could help as well. even though
stripping the backups can introduce another complexity.
may be you need to rethink you back up\recovery strategy.
Hope it Helps!!

Fixed PPM/PDS resource consumption and fixed PPM/PDS material consumption

hi experts
while going through help.sap to find out the meaning of linear optimization i came across two phrases ""fixed PPM/PDS resource consumption and fixed PPM/PDS material consumption"" i have worked on SCC03 PPM and curto_simu PDS but i couldn't make out what these phrases means . my perception is that every shop floor operator is given a target to produce certain number of quantities per shift on a production line .Does these phrase means that ?? or it has some other connotation. ??
experts can you please provide clarity on those phrases.what does it actually mean ?

sahu it is even more confusing see "Fixed PPM consumption is the fixed time required independent of quantity produced.""
fixed time of what ?? is it the resource timing or shift timing
Time required to produced material consumption quantity = Fixed cons + variable cons
can i say it is the time required to produce a given lot size quantity ??
sahu would you please put it in very layman terms.

How to Run a Request Set on specific days and at specific hours

Hi community,
The question is simple, how to rin a Request Set on Specific Days and at Specific hours?
Let me explain the scenario.
E-Business Suite, Release 11.5.9.
We have a request set under Sysadmin user. This Request set is running 24x7, during all year, and we want to restrict the execution from Monday to Friday since 08:00 a.m. to 20:00 p.m. in order to increase the productivity of our system and more over, to avoid the size increase of a table (OE_EXPOSURE_INTERFACE)
The Request Set includes 5 Requests:
10. Workflow Background Process.
20. GUZMAN: Cálculo metodo pago en pedidos.
30. GUZMAN: Exposición de crédito externo.
40. Credit Exposure Import.
50 Initialize Credit Summaries Table.
As you can see three of them are standar Oracle Order Management Processes and two of them are custom Oracle Order Management Processes; and the requests must be executed in that order.
We have just thinking about to create a Custom Manager with a workshift from Monday to Friday since 08:00 a.m. to 20:00 p.m., and include the requests as specialization rules or assigning those request to a Request Type and then include that Request Type as specializated rule, but this does not assure us that the request will be executed in that order.
Any suggestion?
Thanks a lot for your answer in advice.
Luis.

Hi Anchorage,
It could be a solution, but not the exact solution that we want. Let me say why.
With the Request set we have the security that each concurrent request is executed when the prior one finishes; is that to say 20, does not begin till 10 finishes, and 30 does not begin till 20 finishes and so on. The most critical concurrent requests are 40 and 50, cause those are the ones that import an external credit exposure in the OE_EXPORURE_INTERFACE table (40) and are the ones that delete those external credit exposures imported (50). The problem is (and we do not know why) that these actions makes grow the size of the table and each time the 40 and 50 processes takes more minutes to finish. That's why we need to truncate the table in order to avoid the excesive grow of itself.
Making each process independent, with a begining time and hoping and expecting that the following one does not begin till the prior one ends is not an admisible or realizable solution due to the problem with the 40 and 50 processes.
So at the end, we need a request set in order to know that each one began when the prior one ends.
And Due to in order to truncate the table, as I said before, the processes that have a relationship whit it, must be stopped (just the 40 and 50 processes) prior to the truncation.
So as you see, it is difficult, very difficult.
Regards.

Is it possible to patch Global Zone and only specific Non-Global Zones?

Hi Champs,
Is it possible to patch Global Zone and only specific Non-Global Zones? Idea is to patch DEV-zones only on the system & test applications and then patch only the STG-zones on same server!
Not sure if it is possible but just throwing a question...
Cheers,
Nitin

M10vir wrote:
Yes, if you have branded (non-sparse) zone!Branded zones and sparse zones don't have the relation that you imply. In Solaris 10, native zones can be sparse or whole-root (non-sparse, as you say). Zones that are not native zones are branded zones. Branded zones on Solaris 10 include Solaris Legacy Containers, previously known as Solaris 8 Containers and Solaris 9 Containers. That add-on product allows you to run Solaris 8 and Solaris 9 application environments under a thin layer of virtualization provided by the brands framework. solaris8 and solaris9 branded zones can be patched independently of each other and of the global zone.
Solaris 11 has no "native zones" - all zones use the brands framework. The "solaris" brand does no emulation and in that respect is very similar to native zones on Solaris 10. Solaris 11 also provides Solaris 10 Zones via the solaris10 brand. This allows zones or the global zone from a Solaris 10 system to be transferred to a Solaris 11 system and run as solaris10 zones. When running on Solaris 11, solaris10 zones can each be patched independently from each other and the Solaris 11 global zone. Technically, Solaris 11 doesn't have patches - it just has newer versions of packages to which the system is updated.

Target resource provisioning and (very) specific worflow

Similar Messages

Maybe you are looking for