OIM: Query to get the request data

The following queries will serve as a good starting point to fetch the request data in OIM:

1. To get the request form data

select * from REQUEST_BENEFICIARY_ENTITYDATA where rbed_rbe_key IN
(select RBE_KEY from REQUEST_BENEFICIARY_ENTITIES WHERE AND RBE_REQUEST_KEY = '<RequestId>' ) ORDER BY RBED_RBE_KEY DESC;


2. To get child table data

select * from REQUEST_BENEFICIARY_ENTITYDATA where RBED_PARENT_KEY = '<RBED_>' AND RBED_PARENT_KEY IS NOT NULL;

RBED_PARENT_KEY is returned from the first query.

1.       

OIM-SOA: Populating wftask table with custom attributes

Many a times, for reporting or other purposes, we need to populate the data the wftask table(directly mapped to human task in composite) with some custom data.

This custom data can be data from the payload or any other data that is present in the composite.

Updating the wftask table with the composite data can avoid writing bpel apis and a query suffices in this case.

How to do it, is probability what you are interested in. This is done by a simple assignment in the human task.

1. Expand your human task in the composite. You should see a construct like 'taskName_AssignTAskAttributes'

    2. This is where you need to assign the variables. You can do it in design editor, or can copy the following lines in BPEL file.

<copy> 

      <from variable="inputVariable" part="payload" 

        query="/client:process/client:EntityKey"/> 

      <to variable="initiateTaskInput" part="payload" 

       query="/taskservice:initiateTask/task:task/task:customAttributes/task:customAttributeString1"/> 

</copy> 

<copy> 

  <from variable="inputVariable" part="payload" 

   query="/client:process/client:BeneficiaryLogin"/> 

  <to variable="initiateTaskInput" part="payload" 

   query="/taskservice:initiateTask/task:task/task:customAttributes/task:customAttributeString2"/> 

</copy>

You might want to edit the data in from and to depending on your exact requirement.

3. Now, once you deploy and test the composite. You will see the two columns 'customAttributeString1' and 'customAttributeString2' populated in your wftask table.

OIM: Create and deploy scheduled task

The following posts covers all aspects of developing and deploying a scheduled task in OIM and creating a scheduled job.

The post will cover the following tasks in detail:

>> How to create a scheduled task ?

>> How to package a scheduled task ?

>> How to deploy a scheduled task ? 

>> How to create a scheduled job ?

How to create a scheduled task

This includes the following items:

> Developing java class and creating jar file

> Creating plugin file

> Creating metadata file

Developing java class and jar files:

1. Create a java project in IDE of your choice

2. Import the following jars in your project class path:

common-logging.jar

eclipselink.jar

jrf-api.jar

oimclient.jar

spring.jar

wlfullclient.jar

3. Create a java class and extend the class oracle.iam.scheduler.vo.TaskSupport

4. You will have to implement the abstract methods of this class: execute, getAttributes and setAttributes

5. Don't worry about getAttributes and setAttributes. Remember, we are learning the basics and trying to get out first scheduled job up and running.
6. Execute method is what is called when the scheduled job is executed.
7. This method has an input argument as a HashMap, this map contains the value provided by you on the schedule job UI (The UI parameters are configured in an xml file, that we will see lator).
8. Implement your custom logic in this method:
      How to get the data from UI

String lookupName = (String) hashMap.get("Lookup Name");

      How to initializa API and write custom logic

       UserManager userManager = Platform.getService(UserManager.class);

       How to add custom logger

 Create LOGGER

 Add in logging.xml

  9. Create the jar file using IDE.

Creating plugin file: Always call it plugin.xml for ease of use

Create an xml file and change the bold parameters only, this file is self-explanatory. 

<?xml version="1.0" encoding="UTF-8"?>

  <oimplugins xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

<plugins pluginpoint="oracle.iam.scheduler.vo.TaskSupport">

<plugin pluginclass= "com.rohit.st.demo.SchedulerDemo" version="1.0" name="SchedulerDemo"/>

</plugins>

   </oimplugins>

Creating metadata file: This goes in MDS datastore, so provide a business friendly name

Create an xml file and change the bold parameters only, this file is self-explanatory. 

<scheduledTasks xmlns="http://xmlns.oracle.com/oim/scheduler">

<task>

<name>SchedulerDemo</name>

<class>com.rohit.st.demo.SchedulerDemo</class>

<description>SchedulerDemo</description>

<retry>5</retry>

<parameters>

<string-param required="true" encrypted="false" helpText="Lookup Name">Lookup Name</string-param>

<string-param required="true" encrypted="false" helpText="First Name">First Name</string-param>

<string-param required="true" encrypted="false" helpText="Last Name">Last Name</string-param>

</parameters>

</task>

</scheduledTasks>

How to package a scheduled task

1. Create a directory (let us call is SchedulerDemo directory, call anything)

2. Create the following directories inside the SchedulerDemo directory.

       lib - place your jar file in this directory

       config

       resources

3. Also place plugin.xml directly inside SchedulerDemo directory.

4. Create the zip file.

5. Place the zip file on the OIM server in the environment where you want to deploy it.

How to deploy a scheduled task

Deploying plugin:

6. Next you need to register the plugin(This zip file that you created will be deployed in OIM as a plugin).

7. Set ANT_HOME environment variable.

    export ANT_HOME=/apps/oracle/middleware/modules/org.apache.ant_1.7.1 (env specific)

8. Update PATH environment variable.

     export PATH=$JAVA_HOME/bin:$ANT_HOME/bin:$PATH

9. Navigate to $OIM_HOME/server/plugin_utility

10. Edit/Check ant.properties and set the following values:

    wls.home

    oim.home

    mw.home

11. Execute the following command:

    ant -f pluginregistration.xml register

12. In a new environment, sometimes an error is encountered:

     /pluginregistration.xml:72: Class not found: oracle.iam.platform.utils.ant.PasswordInputHandler

In which case, cross check your ant.properties and if the error persists, navigate to the location $WLS_HOME/server/lib

and run: java -jar wljarbuilder.jar

13. Once this is done, navigate back to $OIM_HOME/server/plugin_utility and execute ant -f pluginregistration.xml register

14. You will need to provide the following values to the script

    User name: xelsysadm

    Password: xelsysadm's password (enc specific)

    URL:  t3://OIM_HOST:OIM_PORT (env specific). like t3://rohitdemo:14000

15. Checkpoint: Once the script run successfully, query the plugins table to see that the plugin was deployed.

Registering Metadata:

Now you need to import the metadata file that you created inside the MDS data store. We will use weblogicImportMetadata utility to do the same.

16. Place the metadata file on the server.

17. Navigate to  $OIM_HOME/server/bin

18. Take a backup of weblogic.properties file

19. Edit weblogic.properties file 

20. Set the value of 'metadata_to_loc'

21. Set OIM_ORACLE_HOME same as OIM_HOME

22. Execute command:

 ./weblogicImportMetadata.sh

Provide the following values:

weblogic (NOT xelsysadm)

weblogic's password

t3://OIM_HOST:OIM_POST (NOT weblogic port but OIM's port)

How to create a scheduled job 

1. Create from sysadmin console

2. Search for task name configured in metadata file

OIM: Application Instance not visible in catalog

Check if the application exists in the APP_INSTANCE table:

select * from APP_INSTANCE where APP_INSTANCE_NAME like '<put application name here>';

If the application does not exists, you will have to either load or create an application first before it can be requested/viewed by catalog.

If the application instance is present, query the catalog table and check if the application is present in the catalog table:

select entity_name, ENTITY_DISPLAY_NAME, IS_DELETED, IS_REQUESTABLE from catalog where category = 'ApplicationInstance' AND entity_display_name like '<put application name here>';

If you get a result, it will mean that application is present in catalog but will not be requestable. Set 'IS_REQUESTABLE' flag to 1 and your application will be reflected in catalog.

If no result is returned by the query, it means that application is present in the application instance table but not in catalog table. To synch up the data, execute the OOTB scheduled task 'Catalog Synchronization Job' with the following parameters:

• Process Application Instances : YES
• Updated Date: Set to blank
• Mode: Full

Post the successful execution of the job, the application will be reflected in catalog.

OIM: Task Assignee not visible in track request

Sometimes, after you deploy your composite and raise a request which in turn invokes your custom composite, the following situation is encountered:
1. Request status shows 'Request Awaiting Approval'.
2. Task is assigned to the correct assignee and the assignee can see it in his/her inbox.
3. When anyone tracks the request, the request assignee are not visible.

This is because, the task was not correctly associated with the request.
To associate the task,
1. Open your .bpel file in jdeveloper.
2. Double click on the human task that was invoked.
3. In the 'Initiator' field in 'General' tab, give the login of the requester:
<%bpws:getVariableData('inputVariable','payload','/ns3:process/ns4:RequesterDetails/ns4:Login')%>

4. Now, navigate to 'Advanced' tab and give requestID in the 'Identification Key' field.

5. Redeploy the composite and test.

OIM: Release a claimed task

Detailed Steps:

1. Login into BPM worklist URL (http://hostname:port_number/integration/worklistapp).

a. Please note that ‘port_number‘ is soa server’s port(8001).

2. In the left hand navigation tree, click on ‘Administrative Tasks’

3. Click on the ‘pencil icon’ on the top of the navigation tree to edit the inbox settings. Specifically, we are adding more column in the main window.

4. Click on  the down arrow next to the ‘magnifying glass’ icon on top of the main window and select ‘Advanced’

a. This is used to specify the search filter. This is a one-time activity, search filter can be saved as a view.

5. Specify the search condition

6. As per the search conditions, this will give you all the tasks which satisfy all the following conditions:

a. Are raised for disconnected provisioning.

b. Are acquired by a user with user login as ‘RAGNI’

c. Are in ‘assigned’ status.

7. All tasks will be displayed, satisfying the search criterion.

8. You can select the claimed task and, and from the ‘Actions’ dropdown select ‘Release’ to un-

claim

OIM: ORA-12899: value too large for column "WFMESSAGEATTRIBUTE"."STRINGVALUE" (actual: 2003, maximum: 2000)

The request fails with an error message: ORA-12899: value too large for column "WFMESSAGEATTRIBUTE"."STRINGVALUE" (actual: 2003, maximum: 2000)

The root cause is simple, OIM allows justification of 4000 characters but SOA supports justification of maximum of 2000 characters

We need to restrict justification to 2000 characters in OIM. 

Justification is a inputText field in ADF’s terms and one of the fields property is ‘Maximum Length’. 

Solution: Create a SB,  update the maximum length property to 2000 and test.

ORA-03115: unsupported network datatype or representation

So, I created a connection with weblogic data source and tried to execute a query and got the following error:
ORA-03115: unsupported network datatype or representation[[
 java.sql.SQLException: ORA-03115: unsupported network datatype or representation

The solution is simple,
Instead of
                  resultSet = preparedStatement.executeQuery(myQuery);
use
                   resultSet = preparedStatement.executeQuery();

OIM: User unlock query

The following query can be executed to unlock an OIM user:

UPDATE USR SET USR_LOCKED=0,USR_LOGIN_ATTEMPTS_CTR=0, USR_LOCKED_ON = null,USR_MANUALLY_LOCKED = null  WHERE USR_LOGIN='<PROVIDE_USER_LOGIN>';

OIM: Troubleshooting Reconcilliation

1. Each instance of the recon schedule job execution process is associated with an unique identifier – the Job ID. This job ID is created when createReconciliationEvent() method is called from the recon code.

2. All the monitoring happens on the basis of job ID. Useful tables are:

• recon_jobs
• recon_batches
• recon_events
• ra_* staging tables
• orchevents
• orchfailedevents

3. Job ID can be found in two ways:

• By searching for the recon event created by the scheduled job 
• By querying the recon_jobs table

4. Tables involved in recon process:

• RECON_JOBS
• RECON_BATCHES
• RECON_EVENTS
• RA_* TABLES

5. Helpful SQLs:

--RECON_JOBS

select count(*) from recon_jobs

select * from recon_jobs order by rj_start_time DESC

select * from recon_jobs where rj_name = 'HRMS Trusted User Recon' order by rj_start_time DESC

select distinct(rj_job_status) from recon_jobs

--RECON_BATCHES

select * from recon_batches where rj_key = '386261'

select count(*) from recon_batches where rj_key = '386261'

--RECON_EVENTS

select * from recon_events where rj_key = '386261'

select re_key, rj_key, usr_key, RE_CHANGE_TYPE, RE_STATUS, RE_LINK_SOURCE from recon_events where rj_key = '386261'

select count(*) from recon_events where rj_key = '386261'

select DISTINCT(RE_CHANGE_TYPE) from recon_events  --DELETE, CHANGELOG, REGULAR

select DISTINCT(RE_STATUS) from recon_events

select DISTINCT(RE_LINK_SOURCE) from recon_events

6. Recon Batch Size System Property: OIM.ReconBatchSize

This property is used to specify the batch size for reconciliation. You can specify 0 as the value for this to indicate that the reconciliation will not be performed in batches.

7. Drilling into a single event

Tables used: recon_events, recon_batches, orchevents, orchfailedevents

• Get event id of the event from the UI
• Run the following SQLs:

select rb_key from recon_events where re_key = '2989631'

select rb_note from recon_batches where rb_key = '12962'

select * from orchevents where processid='572404' ORDER by orchorder  -- processid=obtained from rb_note column ALSO This would give the details of the all the Event handlers invoked including their execution order and their status

select * from orchfailedevents where processid='572404'

OIM: Understanding Approval Workflow Rule Evaluation

When an operation (bulk or non-bulk) is being performed, approval workflow rule evaluation takes place in the following way:

1. The approval workflow rules associated with the operation being performed are evaluated one by one, in the order in which they are configured.
2. Rule evaluation stops, and the outcome, which is workflowID or Direct, of the matched rule is returned.
3. Approval workflow rule evaluation stops at the first matching rule, which is the rule that evaluates to true, and that rule's outcome is returned as the result.
4. For a Bulk operation, if none of the rules match, then the SOA composite configured in defaultRequestApprovalComposite of SOAConfig is returned implicitly.
5. For a non-bulk operation, if none of the rules match, then the SOA composite configured in defaultOperationApprovalComposite of SOAConfig is returned implicitly.

If the approval workflow rule evaluation returns a WorkflowID, for example UserManagerApproval, then a request is created and the corresponding ASYNC orchestration is initiated. As part of the orchestration, there is a possibility that some of the data submitted by the user is modified or added. As a result, a different workflow ID than UserManagerApproval might be applicable. To handle such scenarios, approval workflow rules are re-evaluated before the workflow is initiated. If the re-evaluation results in a different workflowID, for example HRManagerApproval, then HRManagerApproval is initiated.

Source: https://docs.oracle.com/cd/E52734_01/oim/OMADM/workflowrules.htm#OMADM5385

OIM: PS3 Exporting the Approval Workflow

Deployment Manager supports moving the approval workflow rules from test to production. When you invoke the deployment manager export, select Policy and export the necessary workflow rules.

OIM: Catalog's 'Risk Level' on UI to 'item_risk' data base mapping

ITEM_RISK (catalog table in database)	Risk Level on UI
1
2
3	Low Risk
4
5	Medium Risk
6
7	High Risk

OIM: FVC (Form Version Control Utility) Alternate Query

If new fields are added in the Process Form, that fields will not be available for the users who already have the account provisioned. In this case, OIM provides and OOTB utility to update the process form for such(provisioned) accounts, called Form Version Control Utility (FVC).

An alternate approach to this is executing the following query to update such accounts:

Update <process_form_UD_table> set process_form_table_version = (Select sdk_active_version from sdk where sdk_name='process_form_UD_table');

OIM: PS3 Sizing Guide

OIM PS3 sizing guide can be found at the following location:

http://www.oracle.com/technetwork/middleware/id-mgmt/oim11g-sizingguide-194346.pdf

OIM Error: java.io.InvalidClassException: oracle.iam.request.vo.BasicRequest; local class incompatible:

Error while running RequestService API

Exception in thread "main" javax.ejb.EJBException: failed to unmarshal interface oracle.iam.request.vo.Request; nested exception is: 

java.io.InvalidClassException: oracle.iam.request.vo.BasicRequest; local class incompatible: stream classdesc serialVersionUID = -5945010536412041491, local class serialVersionUID = -7263199514123717932; nested exception is: java.io.InvalidClassException: oracle.iam.request.vo.BasicRequest; local class incompatible: stream classdesc serialVersionUID = -5945010536412041491, local class serialVersionUID = -7263199514123717932

java.io.InvalidClassException: oracle.iam.request.vo.BasicRequest; local class incompatible: stream classdesc serialVersionUID = -5945010536412041491, local class serialVersionUID = -7263199514123717932

Solution:

Copy the 'oimclient.jar' and 'eclipselink.jar' from the location 'MIDDLEWARE_HOME/Oracle_IDM1/server/client/oimclient.zip' and add the same in your classpath.

OIM: Update 'xelsysadm' Password In Working OIM Environment

1. Login to Oracle Identity Manager Self Service as Oracle Identity Manager administrator and change the xelsysadm's password.
2. Also update the password in the OIMAdmin key under the oracle.wsm.security map in CSF.

If you have OIM-OAM integration environment with OVD and an LDAP in the back end, you need to change the xelsysadm password at following places.

1. Change xelsysadm password in Identity Self service console.
2. Change OIMAdmin password from EM Console under Weblogic domain -> iam domain -> security ->credentials - > oracle.wsm.security folder.
3. Change xelsysadm password in Directory side using ldap. Because change in xelsysadm password will NOT be propagated to LDAP. One need to manually update the password in LDAP directory as well.

OIM Query: List of roles without access policy attached

SELECT
  ugp1.ugp_name AS "Role Name",
  ugp1.UGP_DISPLAY_NAME AS "Role Display Name",
  ugp1.UGP_DESCRIPTION AS "Description",
  ugp1.UGP_CREATE AS "Create Date"
FROM ugp ugp1
WHERE ugp1.ugp_name not in (select  ugp.ugp_name
from pol
left join pog on pog.pol_key=pol.pol_key
join ugp on ugp.ugp_key = pog.ugp_key)
;

OIM SOA - Callback Server URL location

1. Login into EM console.
2. Right click on SOA -> SOA_INFRA -> SOA Administration -> Common Properties
3. The callback server url will be inside Server URLs section

Callback server URL location

OIM: Connector List and Downloads

The list of all OIM connectors and the download links can be found at the following location:
http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/connectors-101674.html

Oracle Identity Manager Connector	Version Number
BMC Remedy Ticket Management	9.0.4.12
BMC Remedy User Management	11.1.1.6.0
BOX	11.1.1.5.0
CA ACF2 Advanced	9.0.4.20
CA Top Secret Advanced	9.0.4.20
Concur	11.1.1.5.0
Connector Server This version is backward compatible with earlier versions of the Connector server and therefore can be used for all ICF Connectors.	11.1.2.1.0
Database Applications Table	11.1.1.6.0
Database User Management	11.1.1.8.0
Flat File	11.1.1.6.0
Fusion Applications	11.1.1.5.0
Generic SCIM	11.1.1.5.0
Generic REST	11.1.1.5.0
Generic Script	11.1.1.5.0
GoogleApps	11.1.1.7.0
Go To Meeting	11.1.1.5.0
IBM Lotus Notes/Domino	11.1.1.6.0
IBM OS/400 Advanced	11.1.1.6.0
IBM RACF Advanced	9.0.4.25
IBM RACF Standard	9.0.4.12
Identity Cloud Service	11.1.1.5.0
JDEdwards EnterpriseOne	11.1.1.6.0
Microsoft Active Directory User Management	11.1.1.6.0
Microsoft Active Directory Password Synchronization Please apply AD Password Sync connector patch 25028999 (9.1.1.5.15) after downloading from MOS (My Oracle Support).	9.1.1.5
Microsoft Exchange	11.1.1.6.0
Microsoft Windows	9.0.4.12
Novell eDirectory	9.0.4.14
Novell GroupWise	9.0.4.12
Office365	11.1.1.5.0
Oracle CRM OnDemand	11.1.1.5.0
Oracle e-Business Employee Reconciliation	11.1.1.5.0
Oracle e-Business User Management	11.1.1.5.0
Oracle Internet Directory	11.1.1.6.0
Oracle Retail Warehouse Management System	9.0.4.12
PeopleSoft Campus Solutions	11.1.1.5.0
PeopleSoft Employee Reconciliation	11.1.1.5.0
PeopleSoft User Management	11.1.1.6.0
RSA Authentication Manager	11.1.1.5.0
RSA ClearTrust	9.0.4.12
Salesforce	11.1.1.5.0
SAP Employee Reconciliation	9.1.2.6
SAP Success Factor	11.1.1.5.0
SAP User Management Engine	11.1.1.9.0
SAP User Management	11.1.1.7.0
ServiceNow	11.1.1.5.0
Siebel User Management	11.1.1.6.0
Sun Java System Directory	9.0.4.15
UNIX	11.1.1.7.0
WebEx	11.1.1.5.0
WebServices	11.1.1.5.0