Identity Management Insights

Was using Sun Identity Manager worth it?

Mr. I — Tue, 02 Mar 2010 12:38:10 +0000

With Oracle’s announcement of the demise of Sun IDM I have been wondering whether or not the transition from an in-house identity management solution to a third party solution was worth the investment in time and effort? Did we gain anything with Sun IDM that wasn’t already there with our legacy applications? To answer that question [...]

Oracle Formally Announces Plans for Sun Identity Manager

Mr. I — Fri, 29 Jan 2010 00:00:37 +0000

Oracle has completed their acquisition of Sun. During a live webcast on the 27th of January Oracle announced their intentions for the major Sun product lines including Sun Identity Manager. You can find archives of many of the webcasts at Oracle’s Sun Product Strategy site. The first thing I noted was that Oracle does not intend [...]

The Good, The Bad & The Ugly

Mr. I — Mon, 18 Jan 2010 01:45:28 +0000

I received an email asking why I keeping using Sun Identity Manager if I disliked the product as much as I do. The truth is that I don’t dislike it, but I sure don’t love it either. Sun Identity Manager solves a provisioning problem for me but at a much higher time investment than I’d [...]

Q&A: IDM 9.0 Release Date?

Mr. I — Fri, 15 Jan 2010 03:31:16 +0000

RK writes: Can you please let me know the approximate release date of SUN IDM 9.0? I’ve been thinking about this too. I’ve got a quite a bit of work upcoming in my IDM environment and it might make sense to do it after the next release. I’m just a regular customer (not a professional services provider) [...]

Custom Workflows in the End-User Interface

Mr. I — Wed, 13 Jan 2010 10:17:57 +0000

There are many cases when one wants to execute a custom workflow in the end user interface. Workflows in Sun IDM are so flexible that they can be configured to resolve many business needs. So implementing custom workflows and exposing them using the end user interface seems natural. However, unless you’re careful, executing a custom [...]

Adding and Removing Deferred Tasks Using a Workflow

Mr. I — Mon, 04 Jan 2010 12:00:06 +0000

The new year often brings about many changes in an organization using any sort of identity management software. A common task is to provision (or remove) attributes from a user, such as updating a role or removing access to a given resource on a specific date. In many cases this is accomplished through the use [...]

Netbeans 6.8 & the Sun IDM Plugin

Mr. I — Mon, 14 Dec 2009 12:29:57 +0000

In what seems like a repeat post, Netbeans 6.8 was recently released. This release of Netbeans 6.8 heralds support of the Java 6 EE specification. That’s always nice for us Java developers. So, does it work with the Sun IDM plugin? Well, not the released 8.1 plugin. That plugin suffers from the same problem the [...]

On Security

Mr. I — Wed, 09 Dec 2009 22:43:35 +0000

<rant>Well, some of you may have noticed that the site was down for a bit today. I hate to say it but the site got hacked. I wish the root problem was due to a bad password I used, a keyboard logger or something at least a little bit complex. It turns out that my [...]

Q&A: Using Database Stored Procedures

Mr. I — Thu, 03 Dec 2009 17:00:46 +0000

JV writes: In my company there is a Stored Procedure I should call from IDM. This SP do the provision in SQL Server resource (they want to take advantage from this automation). Researching I’ve found out some ideas but I think it could be a simpler way to do it. In Sun Identity Manager, the default database resource adapters or connectors [...]

Why I dislike Active Sync Input Forms

Mr. I — Tue, 01 Dec 2009 17:00:43 +0000

If you haven’t guessed I really dislike using active sync input forms in Sun Identity Manager. I don’t feel they offer any value to the IDM developer. First, active sync workflows are generally faster to execute than active sync input forms. This is because the checking in and out of the user view is in [...]

Q&A: Transitioning from ActiveSync Forms to Workflows

Mr. I — Mon, 30 Nov 2009 21:05:06 +0000

Bill S writes: I was interested to see that you prefer rules to forms for A/S operations. I have been using forms primarily, but now I am building my first A/S rule. I’m having a hard time finding an example, though. Can you point me to any examples of these kinds of activeSync rules? Specifically: I know how [...]

What’s the difference between reconciliation and active sync?

Mr. I — Thu, 26 Nov 2009 21:05:20 +0000

I was scanning the Sun IDM forum today and found this old thread got resurrected. The original post, from almost two years ago, asked a very simple question: What is the difference between reconciliation and active sync? The post was revived recently with a couple of answers but I felt they were overly complex in [...]

The Future of Sun IDM with Oracle (Update)

Mr. I — Tue, 17 Nov 2009 19:56:49 +0000

After I wrote the last post I continued to dig around for more concrete information about what Oracle is planning on doing with Sun IDM. I found this informative link posted at the end of October which described some of the intentions Oracle has towards many of the Sun products. Contained within it was an [...]

The future of Sun IDM with Oracle

Mr. I — Sun, 15 Nov 2009 00:57:36 +0000

With Oracle’s acquisition of Sun nearing completion I’ve been asked by one of my managers to re-evaluate the upgrade I’m planning from 7.1 to 8.1. In addition to evaluating the upgrade, I’ve also been asked to re-evaluate the cost of running Sun Identity Manager or even any other 3rd party identity management software. Over the last [...]

Expansions in Form Fields

Mr. I — Sat, 07 Nov 2009 20:31:20 +0000

Expansions are a basic part of form processing. In some cases, it is necessary or useful to have a form field be definitively set to a value and yet have it still be a constructed value. To do this, Sun IDM provides the <Expansion> xml element for form fields. The expansion itself can be a [...]

Default Form Fields

Mr. I — Tue, 27 Oct 2009 14:31:00 +0000

In my post on Form Processing, I briefly covered off how Sun Identity Manager uses forms to display and manipulate data. One of the tools available for data manipulation is the <Default> field tag. This tag is used to, you guessed it, calculate a default value for a field. To be more precise, the default [...]

Form Validation

Mr. I — Fri, 23 Oct 2009 22:17:30 +0000

In an earlier post I went over a very high level overview of form processing. In this “back-to-basics” post I’ll cover off one aspect of form processing: form validation. Form validation is used to ensure that data entered in the form or values derived and used by the form are in a sane state before the [...]

Reversible Encryption

Mr. I — Wed, 21 Oct 2009 18:55:13 +0000

MF wrote me an email inquiring about how encrypted data was handled in Sun IDM. Encryption in Sun Identity Manager is a funny thing that is deceptively simple to use. Encrypted data is a unique data type that is distinctly different than other data types (strings, lists, maps, etc) supported by Sun IDM. Encrypted data [...]

Q & A: Generating a Password in a Workflow (or a Form)

Mr. I — Wed, 14 Oct 2009 22:36:33 +0000

SK asks: “How can you generate a password for a user that is already provisioned in IDM? I’ve got a deferred workflow set up to modify a user under a specific condition but I can’t seem to find a way to generate a password for a user based on a password policy that is not [...]

Workflow Transitions and Error Handling

Mr. I — Sat, 10 Oct 2009 00:58:03 +0000

Workflows can have a general high-level transition. They can be useful for workflow level error handling. If you define a transition at the “top” level of the workflow it will be called in between each activity. For example: <?xml version='1.0' encoding='UTF-8'?> <!DOCTYPE TaskDefinition PUBLIC 'waveset.dtd' 'waveset.dtd'> <TaskDefinition ...> <Extension> <WFProcess name='Your workflow'> [...]

ActiveSync Data Processing Using Workflows

Mr. I — Sat, 03 Oct 2009 16:45:35 +0000

In my last post I covered off a very high level description of active sync processing using forms. Workflows may be used as an alternative to using forms to process active sync data. In many cases, using workflow rather than a form will result in a performance increase as well. ActiveSync Form Processing Review If you recall, [...]

ActiveSync Data Processing Using Forms

Mr. I — Wed, 23 Sep 2009 12:55:41 +0000

Over the last few posts I’ve covered off what active sync is and how it scans for data in a database resource. This post will cover how active sync forms can be used to process data from an active sync enabled resource. Basic Explanation At the very most basic level, active sync data processing forms is nearly [...]

Database ActiveSync Search Predicates

Mr. I — Wed, 16 Sep 2009 03:39:18 +0000

One of the most common resources to connect to Sun Identity Manager using ActiveSync is a database. For ActiveSync to work properly on a database table you need a column on the table that indicates the time of last update. For many tables this is a “lastupdate” column that is set to update automatically during [...]

What is ActiveSync?

Mr. I — Sun, 06 Sep 2009 23:02:33 +0000

Over the last few weeks I’ve had a few questions regarding ActiveSync. The questsions have ranged from requests about the definition of ActiveSync to low level implementation details on custom ActiveSync adapters. I thought I’d try to tackle some of the questions starting with the high level definition of ActiveSync. At its most basic, ActiveSync is [...]

Reverse Repository Indexes [Update]

Mr. I — Thu, 03 Sep 2009 17:44:58 +0000

Hot on my last post about reverse indexes is the IDM 8.1 Patch 4 release. Of interested regarding the IDs of objects in the repository is the following fix in the patch set: 17303 Make generated repo IDs unique in the first few characters. I’d like to think my post has something to do about it but [...]