Identity Managment

Query -To set status to Revoked for any resource for any user

2011-09-18T22:54:00.000-07:00

update oiu set ost_key=(select ost_key from ost where obj_key=(select obj_key from obj where obj.obj_name = 'AD User') and ost_status='Revoked') where oiu.orc_key in (
SELECT orc_key FROM ud_aduser WHERE ud_aduser_uid in ('test1')) ;
commit;

Query to find the rejected task in a package(Resource) for a particular task

2011-08-31T09:59:00.000-07:00

select usr.usr_login, pkg.pkg_name, mil.mil_name, oti.sta_bucket
from oti, orc, oiu, usr, mil, tos, pkg
where oti.orc_key = orc.orc_key
and   orc.orc_key = oiu.orc_key
and   oiu.usr_key = usr.usr_key
and   oti.mil_key = mil.mil_key
and   mil.tos_key = tos.tos_key
and   tos.pkg_key = pkg.pkg_key
and   pkg.pkg_name = 'AD User'
and   mil.mil_name = 'Create User';

Courtesy : Amitabh Gangwar

How to Disable Change Password At Next Logon in OIM 11g

2011-07-08T15:19:00.000-07:00

In OIM 9.1.0.2 there was a parameter that could be set to disable forced password changes:

System prop XL.ForcePasswordChangeAtFirstLogin

This parameter is no longer implemented in OIM 11g.

Steps

1. Go to WebLogic Domain ->
2. Right click and open 'System MBean Browser'
3. In the 'System MBean Browser' left panel, go to 'servername' -> Server: --> Application:oim --> XML Config --> Config --> XMLConfig.SSOConfig --> SSOConfig
4. Set the SsoEnabled flag to 'true' and apply

Then restart OIM server.

How to change the status in the Response Tab from R to C (Rejected/Completed)

2011-03-31T17:24:00.000-07:00

How to change the status in the Response Tab from R to C

1. First find the mil key for the task

select * from mil;

2. Find the sta key from sta table (R=1 and C=2)

3. Update the RSC Table

update rsc set sta_key = 1 where mil_key = 1300 and rsc_data = 'FAILURE';

Thanks

Table is missing in Form Desginer after editing GTC.

2011-01-13T16:22:00.000-08:00

Hi All,

I noticed this few times. While making changes in GTC - say from Full recon to incremental recon - UD_TABLE in form designer is missing in design console and we can see the table in The database.

Solution for this is check the FUG table and check the sdk entry for that table and if it is missing add it.

->select * from fug where sdk_key ='1'; - here whatever your sdk_key is for that table.

-> If not there , Add that entry - It goes out sometime.

-> update fug set fug_rowver= '0000000000000000' where sdk_key='1';

-> Also check for

select unique SDL_CURRENT_VERSION,SDL_LABEL, test.sdl.sdk_key
from test.sdk, test.sdl where sdk.sdk_name = 'UD_TEST' and sdk.sdk_key = sdl.sdk_key; (Here test. - where test is schema name)

->update ud_test set ud_test_version = 3;

select unique ud_test_version from test.ud_test;

This will update all the users to the new version - ud_test_version.

Thanks

Installation of Oracle Identity Analytics 11g

2010-09-30T16:37:00.000-07:00

1. What is OIA?

http://idm-oracle.blogspot.com/2010/07/oracle-identity-analytics.html

2. Oracle Identity Analytics Download Links :

http://www.oracle.com/technetwork/middleware/downloads/oid-11g-161194.html

3. For Oracle Identity Analytics Installation :

Details:

a. Java JDK 1.6.0_21 (http://java.sun.com/javase/downloads/)

b. Tomcat Application Server6.0.29 (http://tomcat.apache.org/download-70.cgi)

c. MySQL 5.1 Database (http://dev.mysql.com/downloads/mysql/)

d. OIA Setup (http://www.oracle.com/technetwork/middleware/downloads/oid-11g-161194.html

4. Installation Startup :

· JAVA SETUP

1. Install Java JDK on your machine

2. Set PATH in your environment variables

PATH=%JAVA_HOME%;%PATH%;C:\Windows;C:\Windows\system32;C:\Program Files\Java\jdk1.6.0_21\bin

3. Set JAVA_HOME = C:\Program Files\Java\jdk1.6.0_21

4. Go to Command Prompt and java –version to verify everything is correct.

· APPLICATION SERVER SETUP (TOMCAT)

1. Unzip Tomcat. Unzip tomcat-6.0.28-preconfigured.zip into your C/D/E drive.

2. E.g. Location is : E:\apache-tomcat-6.0.29

3. Set CLASSPATH in your environment variables

CLASSPATH = .;C:\apache-tomcat-6.0.29\lib\servlet-api.jar;C:\apache-tomcat-6.0.29\lib\jsp-api.jar;C:\apache-tomcat-6.0.29\lib\el-api.jar;C:\Servlets+JSP;..;..\..

4. Test the Server: Go to E:\apache-tomcat-6.0.29\bin and click on startup –Serve r should be started.

5. Check http://localhost:8080

· SETUP MYSQL DATABASE

1. Download the installation setup from the link provided above.

2. Typical Setup

3. Skip Sign-Up

4. Make sure "Configure the MySQL Server now" is checked

5. "Detailed Configuration"

6. "Developer Machine"

7. "Multifunctional Database"

8. "InnoDB Tablespace Settings" - leave everything default

9. "Decision Support (DSS)/OLAP"

10. Make sure "Enable TCP/IP Networking" is checked and leave the port number at 3306 (at this point, if you have a firewall, it will usually try to access itself on the localhost)
Leave "Enable Strict Mode" checked

11. "Standard Character Set"

12. Check "Install as Windows Service" and I would recommend leaving "Launch the MySQL Server automatically" checked.

13. Enter a root password (and remember/write it down) and I would recommend leaving "Enable root access from remote machines" unchecked

14. Then hit "execute" and it'll install and set it up.

· SETUP ORACLE IDENTITY ANALYTICS

1. Create a folder E:\OIA and copy the download installation from the link above and extract it. It should look like below:

sample

conf

reports

legal

rbacx.war

2. This will be your RBACX_HOME, set the environment variable.

3. From sample folder, copy import and export directories and paste it to RBACX_HOME.

4. Setup database for OIA, use the schema script from RBACX_HOME\db folder.

For e.g. to load schema on mySQL database, use script named rbacx11.1.1.3.0_mysql_schema.sql

Go to mySQL folder on your drive through command prompt.

5. mysql> \.rbacx-11.1.1.3.0_mysql_schema.sql

6. Go to RBACX_HOME\conf folder and copy jdbc.properties from folder of name of your db to conf folder.

For e.g in case of mysql, copy jdbc.properties file from RBACX_HOME\conf\mysql folder and paste it to conf folder.Edit this properties file as per your database details. For instance, in case of mysql, replace $SERVER_NAME with host name of your database and port with 3306 (default for mysql)

7. Edit iam.properties file in RBACX_HOME\conf folder by replacing $RBACX_HOME with path of RBACX_HOME (so for our eg. it will be E:/OIA)

Extract rbacx.war from RBACX_HOME into temp folder.(e.g. C:\temp) [What we will do is to make some changes, add couple of jars and repack it again and deploy on server]

Now navigate to C:\temp\WEB-INF directory and edit below entry in log4j.properties file

log4j.appender.file.file=logs/rbacx.log (default)

log4j.appender.file.file=E:/OIA/logs/rbacx.log

8. Similarly make changes to conf-context.xml file in C:\temp\WEB-INF folder. Replace $RBACX_HOME with path of RBACX_HOME

9. Copy below jars to C:\temp\WEB-INF\lib folder

1. jasper-jdt.jar (http://dlc.sun.com/rolemanager/Certification_And_Reporting)

2. jdbc driver for your database(mysql drivers are already included in lib folder so no need to add them ) For Oracle it would be ojdbc5.jar or ojdbc6.jar

3. Jars for the connectivity of the provisioning server, you will integrate with OIA.

(If OIM is provisioning server then get jars from ext and lib folder of your OIM_HOME)

(They are also available at http://dlc.sun.com/rolemanager/Provisioning_Server_Connectivity/)

10: Pack the folder C:\temp

C:\> cd C:\temp

C:\> jar -cvfm rbacx.war .

Step12: Use this war to deploy on your application server. Copy rbacx.war in WebApps folder of Tomcat and start the server.

Start the server and access the console using url

http://hostname:port/rbacx/

Default user name is rbacxadmin and password is password.

Customizing OIM 11g Logo (Oracle identity Manager 11g)

2010-09-23T13:45:00.000-07:00

1. Shutdown the OIM Server and Console

2. Navigate to \OIM_HOME\server\apps\oim.ear\iam-consoles-faces.war\images directory

3. Copy the demo.png file to this directory (this will change OIM logo to whatever logo we will give in this file)

4. Using the text editor , open the Admin.jspx file, located in the OIM_HOME\server\apps\oim.ear\admin.war\pages directory.

5. Locate the following line of code :

6. Below this line add the following code:

7. Locate the following line of code :

8.Below this line add the following code

9. Save your changes to the Admin.jspx file.Close the file.

10. Restart OIM, you can see the change logo in the homepage of the console.

Field added in Lookup.USR_PROCESS_TRIGGERS are missing (Changes in GTC)

2010-09-20T20:26:00.000-07:00

Task in Lookup.USR_PROCESS_TRIGGERS is missing if any modifications in GTC.

Solution :

When you add a UDF to Lookup.USR_PROCESS_TRIGGERS you also need to create a field type lookup for that field.
Please see the below example:
1. Create two UDF fields USR_UDF_1 and USR_UDF_2
2. Add the following in Lookup.USR_PROCESS_TRIGGERS
USR_UDF_1 - TaskUDF1
USR_UDF_2 - TaskUDF2
3. Created a new lookup
Code: LookupUDF1
Field: USR_UDF_1
Field Type radio checked
Group: Users
data:
UDF1 - TestUDF1
4. Created a new GTC connector
Results for Lookup.USR_PROCESS_TRIGGERS:
USR_UDF_1 - TaskUDF1 -> remains after the GTC creation
USR_UDF_2 - TaskUDF2 -> is deleted because it has no field type lookup

So please note that the added new row in Lookup.USR_PROCESS_TRIGGERS must be a valid usr table column. If this newly added row doesn't exist as field type lookup, it will be filtered out in OIM code.

How to disable a user for the targets using Generic Technology Connector(OIM)

2010-09-20T15:17:00.000-07:00

1.Find out the disable user field in the target(Field which we want to change in the target when user is disabled from OIM and to What) e.g. Active to Disabled, Yes to No.

2.Once done, create a lookup in oim (Status.Lookup)

3.Go to your GTC and add the lookup.status in the status lookup code and field name in the status attribute as shown below and then test it.

OIM Generic Technoloy Error-Reconciliation Issue

2010-08-31T13:19:00.000-07:00

2010-08-30 12:47:33,055 [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] ERROR XELLERATE.SERVER - Class/Method: tcRCE/createUserRecord encounter some problems: {1}
java.lang.NullPointerException
at com.thortech.xl.dataobj.util.tcAttributeSource.getAttrColumnName(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.createUserRecord(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.applyActionRules(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.checkDataSorted(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.eventPostUpdate(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.update(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcTableDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.finishDataReceived(Unknown Source)
at com.thortech.xl.schedule.jms.reconOffline.ProcessOfflineReconMessages.finishReconciliationEvent(Unknown Source)
at com.thortech.xl.schedule.jms.reconOffline.ProcessOfflineReconMessages.execute(Unknown Source)
at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
at com.thortech.xl.schedule.jms.messagehandler.ReconMessageHandlerMDB.onMessage(Unknown Source)
at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4659)
at weblogic.jms.client.JMSSession.execute(JMSSession.java:4345)
at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3821)
at weblogic.jms.client.JMSSession.access$000(JMSSession.java:115)
at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5170)
at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:528)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
2010-08-30 12:47:33,058 [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] ERROR XELLERATE.SERVER - Class/Method: tcDataObj/save Error :Data Update Failed
2010-08-30 12:47:33,059 [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] ERROR XELLERATE.DATABASE - Class/Method: tcDataBase/rollbackTransaction encounter some problems: Rollback Executed From
java.lang.Exception: Rollback Executed From
at com.thortech.xl.dataaccess.tcDataBase.rollbackTransaction(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.rollback(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.doRollback(Unknown Source)
at com.thortech.xl.dataobj.tcDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcTableDataObj.save(Unknown Source)
at com.thortech.xl.dataobj.tcRCE.finishDataReceived(Unknown Source)
at com.thortech.xl.schedule.jms.reconOffline.ProcessOfflineReconMessages.finishReconciliationEvent(Unknown Source)
at com.thortech.xl.schedule.jms.reconOffline.ProcessOfflineReconMessages.execute(Unknown Source)
at com.thortech.xl.schedule.jms.messagehandler.MessageProcessUtil.processMessage(Unknown Source)
at com.thortech.xl.schedule.jms.messagehandler.ReconMessageHandlerMDB.onMessage(Unknown Source)
at weblogic.ejb.container.internal.MDListener.execute(MDListener.java:466)
at weblogic.ejb.container.internal.MDListener.transactionalOnMessage(MDListener.java:371)
at weblogic.ejb.container.internal.MDListener.onMessage(MDListener.java:327)
at weblogic.jms.client.JMSSession.onMessage(JMSSession.java:4659)
at weblogic.jms.client.JMSSession.execute(JMSSession.java:4345)
at weblogic.jms.client.JMSSession.executeMessage(JMSSession.java:3821)
at weblogic.jms.client.JMSSession.access$000(JMSSession.java:115)
at weblogic.jms.client.JMSSession$UseForRunnable.run(JMSSession.java:5170)
at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:528)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
2010-08-30 12:47:33,060 [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] ERROR XELLERATE.JMS - An error occurred while processing the off lined reconciliation events

I was facing this issue yesterday.

Solution :

This issue occurs due to Bad Mapping. You should go in Process Definition-Reconciliation Field Mapping and Check all the mapping Correctly.

To see the details error in the log :
make Xellerate.JavaClient= DEBUG
and search for "display name" and "attr src "

Just before the null pointer exception, you will see the field name,which is not mapped properly.

Please let me know if any issues

Oracle Identity Analytics

2010-07-24T14:43:00.001-07:00

Oracle Identity Analytics

· Oracle Identity Analytics formerly known as Sun Role Manager.

· Oracle Identity Analytics is software that provides a comprehensive role lifecycle management and identity compliance solution that enables companies to proactively enforce internal security control policies and automate critical identity management process.

· Features of Oracle Identity Analytics

1. Role-based access control and identity-based controls automation

2. 360-degree view of access data through multilevel attestation

3. Automated removal of unauthorized access through out-of-box integration with Oracle Identity Manager and Oracle Waveset.

4. Complete role lifecycle management

5. Preventive simulation and detective controls for segregation of duties

6. Compliance and operational dashboards

7. Identity Warehouse with business-friendly glossary

Source : Oracle White Paper.

Schedule Task -From OIM Process Form to Text File

2010-07-21T14:43:00.000-07:00

Hi All,

I designed a custom Schedule task last week.

OIM has a process form, resource object, and process Defn.

Case : All the users from reconciliation come into OIM and through automated policy get provisioned to the process Form.Custom Scheduled Task picks up all the users from the process form, which is present for any application (Table)(Dynamic Code) and places it in the text File. I have created a dynamic look-up in which you can enter all the fields in the code key which you need in the text file and decode key any label name appended with 00,01,02, etc. This numbering will put it in a sequence you want in a text File.

One more Thing I took care of is, suppose you are writing to text file, and other application comes to pick up the file. So, I have moved the file to temp location and once Schedule task is complete, then move to final location.

In Schedule task I have created five attributes.

FilePath (Temporary Location)
File Location(Final Location)
Look-up name
File Name
Process Form name (Table Name)

This is the dynamic one, which can be used for any process form in OIM and then push it in a text File or From any table and push it in a text File.

Thanks

User from the Approver Group Submits the Request (OIM)

2010-06-15T15:00:00.000-07:00

Hi All,
You designed a workflow for the request.

Generally a request is submitted by a user /manager to get access to a particulate resource.Then request goes to higher approval group for approval.

Consider, a user from higher approval group submits the request for a particular user it goes for approval to second user in that group by default as first person in that group is submitting the request. If you are sending email notifications, you will need to build a custom code to send email notification to second user for approving the request if higher priority user submits the request. Custom Java code needs to be implemented for this scenario in OIM.
I have implemented this requirement .Please put your comments if you need any help related to similar scenario.

Thanks

Email Notification on Field Update to a Particular Group(OIM)

2010-06-15T14:36:00.000-07:00

Hi All,
One more Scenario which I implemented recently :

If any fields are updated in OIM(oracle Identity Manager) a mail should go to administrator group with the old value and new value of that fields. It was dynamic , you can add any field in future if you want and you can delete any field too.

Email were sent only to specific users with special roles ( A lookup was created in OIM and if any user has any one or more roles from those 7 roles and any extra roles which is not in that list) a mail will go to that user who is considered as a Special user.(Privileged user).

One more lookup was created in OIM for attributes which should go in email ( Any attributes which are present in this lookup are updated from OIM) .Old and new values of those attributes will go in the mail. It was dynamic you can add any attribute in this lookup and it will go in the mail.

One more thing which I took care of is Whenever a new user is created a mail should not go as old value will be blank.

Please let me know if you are implementing any similar scenario and need help.Post the comment with your email address and I will get back to you.

Email Notification and Re-Assignment of the Task( Escalation)(OIM)

2010-06-14T15:01:00.000-07:00

Hi All,
Last week, There was a new requirement which was quite Tedious and complex.

Scenario : A request is submitted by a user. Request goes to User Manager .User's manager approves the request.

After Manager approval - there were two more Level of Approvals.

1. Higher Manager Approval
2. Administrator Approval

After Manager approves the request, the request goes to the Highest priority User in the group "Higher manager Approval ". If he doesn't reply for 3 days, then

1. Email Notification should go to second user in that group and task should be reassigned to him(Second User in that group).(Schedule task was written to acheive this)
Similarly, for the Administartor Approval group was done.

In the email notifications all the details were provided like who submitted the request, for who request was raised, for which resource, details of creation of request etc.

If you need any help in escalation for approval task.Please reply to this post with your email.I can help you with the code.

Thanks

How to insert the Request Details link in OOTB Email Notification

2010-04-20T15:46:00.000-07:00

Hi All,

Scenario : User submits the request for the access to the application. Requests goes to Manager/Administrator in email and you want to insert the request link in the email so they can directly open it.

It can be done in following way. SSO needs to be enable to use this.

To be used in Email Template is

http://example.oracle.com:8080/xlWebApp/requestDetail.do?startIndexOfPage=1&searchResults.sortColumn=&backToListCode=BACKTO_APPROVALSSEARCHRESULTS_SELF&entityKey=&method=requestDetail&userAction=new&refreshData=false

Thanks to Ramesh.I came to know this from him.

OIM Description Field Change

2010-03-29T13:00:00.000-07:00

Today, I came up with a unique requirement,

We wanted to change the description field with Userid when a user is provisioned or disabled from the key.

For Example,

Here Change Description from key to Username.

Steps:

1. Go to Process Definition.
2. Click Map Descriptive Field
3. Click on User Login
4. Save
5. Done.

After changing the output will be like this,

This case is useful when a user is disabled and user’s last name gets changed then Userid changes then we can keep track of resources for old user id and new user id.

Email Notification when a User is Created in OIM

2010-03-24T13:38:00.000-07:00

import java.util.Properties;

import javax.mail.Message;
import javax.mail.MessagingException;
import javax.mail.Session;
import javax.mail.Transport;
import javax.mail.internet.InternetAddress;
import javax.mail.internet.MimeMessage;

public class JavaMail
{

public void sendEMail(String firstName,String emailId,String userPassword)
{

try
{

StringBuffer stringBuffer=new StringBuffer();

Properties prop=System.getProperties();
prop.setProperty("mail.smtp.host","xyz.wmv.abc");
Session session=Session.getDefaultInstance(prop);
MimeMessage message=new MimeMessage(session);

stringBuffer.append("Hi, "+firstName);
stringBuffer.append("

Thank you for registering! We are pleased to welcome you to Test Mail.

");
stringBuffer.append("

To start using Test Page right now, please go to http://testoim:8080/xlWebApp/ and login using the following information:

");
stringBuffer.append("

If you have any difficulties logging into Test, please reply to this email with a description of what you are encountering and we will respond back as soon as possible.

");
stringBuffer.append("

Thank you,

");
stringBuffer.append("

Test Company
");
stringBuffer.append("Test Administration

");

//From Email Address goes here...
message.setFrom(new InternetAddress("oimadmin@test.com"));

//To Email Address goes here..
message.addRecipient(Message.RecipientType.TO,new InternetAddress(emailId));
message.setSubject("***Welcome to Test! You are registered.***");
message.setContent(stringBuffer.toString(),"text/html; charset=UTF-8");
Transport.send(message);

}
catch(MessagingException e)
{
e.printStackTrace();
}

}

}

Steps :

1. Create a jar file from this code by changing the host name in the code.
2. Create the adapter in OIM and put it as a dependant on successful user creation and mail will go to the user from oimadmin@test.com with his userid and password.

Please mail me if you have any questions.

Thanks

java.lang.RuntimeException: Could not find the OffLine WLST class

2010-03-10T16:03:00.000-08:00

Hi All,
I was doing installation of Oracle identity Manager 9.1.0.1 on Weblogic 10.3.0.0 Clustering environment.I came across a issue related to WLST offline class error.

oracle/oim/xellerate/setup/setup.xml:443: The following error occurred while executing this line:
/oracle/oim/xellerate/setup/weblogic-setup.xml:196: java.lang.RuntimeException: Could not find the OffLine WLST class
at org.apache.tools.ant.ProjectHelper.addLocationToBuildException(ProjectHelper.java:539)
at org.apache.tools.ant.taskdefs.Ant.execute(Ant.java:384)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:275)
at org.apache.tools.ant.Task.perform(Task.java:364)
at org.apache.tools.ant.Target.execute(Target.java:341)
at org.apache.tools.ant.Target.performTasks(Target.java:369)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1216)
at org.apache.tools.ant.Project.executeTarget(Project.java:1185)
at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:40)
at org.apache.tools.ant.Project.executeTargets(Project.java:1068)
at org.apache.tools.ant.Main.runBuild(Main.java:668)
at org.apache.tools.ant.Main.startAnt(Main.java:187)
at org.apache.tools.ant.launch.Launcher.run(Launcher.java:246)
at org.apache.tools.ant.launch.Launcher.main(Launcher.java:67)

I tried different things like
1.checking all paths are set correct JAVA_HOME,BEA_HOME.
2.Checking version of Weblogic
3. ./wlst.sh
4. java weblogic.WLST and many other approach.Final solution is listed below :

Solution :
There is an existing Bug 8431390 - WLST NOT WORKING IF WE USE NON-DEFAULT INSTALLATION (WL_HOME OUTSIDE BEA_HOME)

As per this bug, the issue can be reproduced as follows:

Steps to reproduce:
1. Install WLS 10.3GA (essex) kit in a non-default fashion (WL_HOME outside
BEA_HOME)
2. Go to ur $WL_HOME/common/bin directory and execute wlst.cmd
3. It exits with the following exception:
java.lang.RuntimeException:could not find the OffLine WLST class

I have set up the same-way that's why.

OIM-Approval Workflows

2010-03-09T17:05:00.000-08:00

Hi All,
I came through this scenario.
Scenario : A request is submitted by the Requester or User to get access through OIM. Once the request is submitted by the user, either user/Manager/Higher Administrator should be able to approve the request untill manager does not approve the request.Once the request is approved by manager,no one should be able to edit the request.

Steps and JAVA Code :

Assumption: Approval with multi-level approvals already exists for the Resource XXX.
1. Create a jar from the below code and place it into OIM_HOME/xellerate/JavaTasks
a. Import XML TaskAdapter.xml(Email me if you need this file)(Creation of Adapters)
2. Modify the Object Form (Design Console -> Development Tools -> Form Designer).
a. Add two String type fields into it and specify any :
i. Response
ii. RequestId
b. Make these two fields hidden from “Properties” Tab
c. Add any other fields as per requirement.
3. Modify the Approval Process for “XXX Resource Object”.
a. Create Task Named as “Update Request Id”
i. Attach adpCopyValue adapter and do the mapping as follows:
1. Input -> Request Info -> Request Id
2. Adapter Return Value -> Object Data -> RequestId
4. Go To Data Object Manager in Design Console and Search for Resource Object Form for Resource XXX.
a. In Pre-Update -> Assign -> adpRequestPermission adapter.
b. Do the mapping as follows:
i. ReqId -> Entity Field -> ResquestId (Field name will be as created in 2.a.ii)
ii. Adapter Return Value -> Entity Field -> Response (Field name will be as created in 2.a.i)
5. Error Message is “ADAPTER.PERMISSION.ERROR”. You can change the description of the error as per requirement. (Design Conole -> Development Tools -> Error Message Definition and search for “ADAPTER.PERMISSION.ERROR” as code key)

JAVA CODE :

package com.requestmodify.adapter;

import java.util.HashMap;
import java.util.Hashtable;
import Thor.API.tcResultSet;
import Thor.API.tcUtilityFactory;
import Thor.API.Operations.tcRequestOperationsIntf;
import Thor.API.Operations.tcUserOperationsIntf;
import com.thortech.util.logging.Logger;
import com.thortech.xl.crypto.tcCryptoUtil;
import com.thortech.xl.crypto.tcSignatureMessage;
import com.thortech.xl.util.config.ConfigurationClient;

public class RequestModifyPermisions {
public static Logger logger = Logger.getLogger("UPDATE.LOGGERS");
String response = null;
HashMap requestAssignMap = new HashMap();
HashMap requestMap = new HashMap();
HashMap userMap = new HashMap();
int countRequestAssignedToUser;
long managerKey;

ConfigurationClient.ComplexSetting config = ConfigurationClient.getComplexSettingByPath("Discovery.CoreServer");
final Hashtable env = config.getAllSettings();

public String modifyRequest(String reqId) {
logger.debug("reqId :: " + reqId);
try {
tcSignatureMessage moSignature = tcCryptoUtil.sign("xelsysadm","PrivateKey");
tcUtilityFactory utilityFactory = new tcUtilityFactory(env, moSignature);
tcRequestOperationsIntf requestIntf = (tcRequestOperationsIntf)utilityFactory.getUtility("Thor.API.Operations.tcRequestOperationsIntf");
requestMap.put("Requests.Request ID", reqId);
tcResultSet requestResultSet = requestIntf.getRequestTargets(Long.parseLong(reqId));
requestResultSet.goToRow(0);
String targetUser = requestResultSet.getStringValue("Users.User ID");
logger.debug("targetUser :: " + targetUser);
userMap.put("Users.User ID", targetUser);
tcUserOperationsIntf userOperationsIntf = (tcUserOperationsIntf)utilityFactory.getUtility("Thor.API.Operations.tcUserOperationsIntf");
tcResultSet findUserSet = userOperationsIntf.findAllUsers(userMap);
findUserSet.goToRow(0);
managerKey = findUserSet.getLongValue("Users.Manager Key");
logger.debug("managerKey :: " + managerKey);
tcResultSet requestAssignedToUser = requestIntf.getApprovalTasksAssignedToUser(managerKey, requestMap);
countRequestAssignedToUser = requestAssignedToUser.getRowCount();
logger.debug("countRequestAssignedToUser :: " + countRequestAssignedToUser);
if(countRequestAssignedToUser == 1 ){
response = "SUCCESS";
} else {
response = "FAILURE";
}
} catch (Exception e) {
logger.error("Exceprion in modifyRequest :: ", e);
}
logger.debug("response :: " + response);
return response;
}
}

List of Auditing Reports in OIM

2009-07-23T21:16:00.000-07:00

Overview of Operational Reports :

The following sections describe the default operational reports in Oracle Identity Manager. These reports can be used by Oracle Identity Manager Administrators and auditors for operational and compliance purposes.

Table lists the operational reports available in the Administrative and User Console.

List of Operational Reports

Name	Description
Entitlements Summary	Lists the number of users for each status type within each resource.
Policy List	Displays a snapshot of all policies defined within the system.
Delegated Administrators By Organization	Lists all the delegated administrator user groups for organizations.
Attestation Requests by Reviewer	Lists attestation requests by reviewer.
Approval Status By Approver	Provides a summary of all approval tasks.
User Resource Access	Lists the access rights to resources for selected users.
Resource Access List	Lists all users who have access to a selected resource.
Policy Detail	Lists complete details about specific policies defined within the system.
Group Membership Profile	Lists the number of users in different numbers of groups.
OIM Password Expiration	Lists users whose Oracle Identity Manager passwords are about to expire.
Group Membership	Provides a snapshot of users in each group.
Resource Password Expiration	Lists users whose resource passwords are about to expire (as determined by Oracle Identity Manager).
Organization Structure	Lists the hierarchical organization structure and user memberships.
Requests Initiated	Lists all requests initiated in a specified time interval.
Requests Details By Status	Returns details of all requests with a specified status.
Attestation Process List	Provides a snapshot of all defined attestation processes.
Attestation Requests by Process	Lists attestation requests by process.
Attestation Request Detail	Lists complete details of selected attestation requests.
Financially Significant Resources	Lists complete details of financially significant resources.
Delegated Administrators & Permissions By Organization	Lists all administrator user groups and permissions for organizations.
Delegated Administrators & Permissions By Resource	Lists all administrator user groups and permissions for resources.
Delegated Administrators By Resource	Lists all administrator and authorizer user groups for resources.

Overview of Historical Reports :

The following sections describe the historical data reports in Oracle Identity Manager. These reports can be used by administrators and auditors for compliance and auditing purposes.

Table lists the historical reports that are available in the Administrative and User Console.

Table List of Historical Reports

Name	Description
User Resource Access History	Returns the history of a user's resource access.
Resource Access List History	Returns a history of all users who have had access to a selected resource.
User Profile History	Returns the history of a user's profile.
User Membership History	Returns the history of a user's memberships in a user group.
Group Membership History	Returns the history of a group's memberships.
Resource Activity	Returns the history of all provisioning and approval activities for a resource.
Task Assignment History	Returns the history of all task assignment based on the tasks.
Password Reset Success Failure	Returns the password change metrics for Oracle Identity Manager users.
Account Activity In Resource	Lists all account activities in each resource.
Rogue Accounts By Resource	Lists all the rogue accounts in each resource. Note: This report is available only if the exception reporting feature is enabled. For more information.
Fine Grained Entitlement Exceptions By Resource	Lists all fine-grained entitlement exceptions associated with a resource. Note: This report is available only if the exception reporting feature is enabled. For more information, see Chapter 5, "Oracle Identity Manager Reporting
Users Created	Lists all users created in a specified time interval.
Users Deleted	Lists all users deleted in a specified time interval.
Users Disabled	Lists all users disabled in a specified time interval.
Users Unlocked	Lists all users (accounts) unlocked in a specified time interval.

Script for starting OIM/JBoss as a windows service

2009-06-25T23:55:00.000-07:00

You can use this in conjunction with JavaService.exe to launch OIM's JBoss as a service (http://forge.objectweb.org/projects/javaservice/).You need to update this with your proper environment settings.


@echo off

SETLOCAL

set JAVA_HOME=C:\j2sdk1.4.2_14
set JBOSS_HOME=C:\jboss-4.0.3SP1
set OIM_HOME=c:\oracle\xellerate
set NAME=OIMService
set JVMOPTIONS=-DXL.HomeDir=C:\oracle\xellerate -Djava.awt.headless=true

SET javaservice=%OIM_HOME%\bin\JavaService.exe
SET logdir=%OIM_HOME%\logs
SET jbossjar=%JBOSS_HOME%\bin\run.jar
SET toolsjar=%JAVA_HOME%\lib\tools.jar
SET jvmdll=%JAVA_HOME%\jre\bin\server\jvm.dll
SET svcmode=-auto
SET description=Oracle Identity Manager
SET dependsopt=

"%javaservice%" -install %NAME% "%jvmdll%" -Djava.class.path="%jbossjar%;%toolsjar%" %JVMOPTIONS% -Xms128M -Xmx512M -start org.jboss.Main -stop org.jboss.Main -method systemExit -out "%logdir%\service_out.log" -err "%logdir%\service_err.log" -current "%JBOSS_HOME%\bin" %dependopt% %svcmode% -overwrite -startup 6 -description "%description%"

ENDLOCAL

@pause

Delete related to OIM Users

2009-06-18T21:07:00.000-07:00

OIM do not allow for the deletion of users for reporting and auditing reasons. In
addition, the data model is very complex and the USR entries are involved in
almost every table in some fashion which makes it very dangerous to simply
remove the users from USR table resulting in unintended consequences and
negating the validity of any development or testing.

However, we can mark the users as deleted and then reuse the user IDs. Or, we can change the userid for the users you no longer need to indicate that they are no longer valid if we do not want to enable userid reuse.

If some one want to create a clean database ,he would create a new database, install OIM against it, and then migrate the connectors and integrations to the new OIM server using the Deployment Manager.

STEPS

In the manage users screen of the Administrative Console we can delete a full page of users
by:
- clicking on the "Delete" checkbox in the top row of the table to select the delete option for all of the users in the page
- and then clicking on the "Delete" button at the bottom of the page.

By default the page will only display 10 users at a time but the number of rows displayed can be changed to
as high as 50 rows by changing the "global.displayrecordNum.value" in the
xlDefaultAdmin.properties file.
To reuse UserIDs:
- Open the Design Console
- Goto the Administration - System Configuration form
- Search for the Keyword "XL.UserIDReuse" and set the value to TRUE

This will allow you to reuse the UserIDs of deleted users.

Customization Related to Redirect in OIM

2009-06-18T20:54:00.000-07:00

If you want to redirect from OIM to any other page like say www.google.com

For eg. If users click save button and you want to redirect to google.com

Changes in OIM :

Go to Jboss/server/default/deploy/Xelleratefull.ear/xlWebapp.war and in struts-config.xml file and edit on whatever conditions you want to redirect

e.g Here on success, user should see www.xxx.com then for that
These are in < and />
forward name="success" path="https://www.xxx.com" redirect="true"

and it will redirect.

Include a Link Below in OIM on left panel

2009-06-18T20:52:00.000-07:00

Menu link is retrieved from the database through the menu items created from design console
example:
(Form Information screen):
Class Name: My Menu.Menu 1
Description: My Menu Menu 1
Type: menuitem
- On the UI, the menus are grouped and the names globalized from the corresponding entries in xlWebAdmin.properties file
menuGroup.My-Menu=My Menu
menuItem.My-Menu.Menu-1=Menu 1

- /pages will have a new jsp page added with a 'tiles:insert' definition code for the entry
example: (/pages/SamplePage.jsp)
<%@ taglib uri="/WEB-INF/tld/struts-tiles.tld" prefix="tiles" %>
- tiles-defs.xml will have an entry with the definition name, referring to the definition code defined in the /pages jsp code
- The 'title' can have a code with a corresponding entry in the xlWebAdmin.properties file. This will be the title shown on the web page title bar
- The 'body' will refer to a jsp page to be created in the /tiles folder
example:
In tiles-defs.xml:

In xlWebAdmin.properties:
samplepage.title.showpage=Sample Page Title - A new jsp to be added to /tiles folder with the name used in the tiles-defs.xml entry
example: /tiles/SamplePageTiles.jsp
- struts-config.xml file will have two entries:
- one for form bean in the section, that will have the bean properties required to store data for the logic in the new functionality to be added.
example:

type="com.thortech.xl.webclient.actions.SampleForm" /> - one for the action class in the section, that is used for performing all the java logic before forwarding to a jsp page with the display contents.
example:
type="com.thortech.xl.webclient.actions.SampleAction"
validate="false"
input="/pages/SamplePage.jsp"
scope="session"
path="/sample"
parameter="method">

- In the xlDefaultAdmin.properties file put an entry that will be used to forward to the corresponding method in the java class:
- menuItem.My-Menu.Menu-1.link=sample.do?methodCode

- In the xlWebAdmin.properties file put the entry with the value as the one defined after '?' in previous step:
- sample.message.selection.method1=methodCode
- In the custom action class have the struts documented standard method getKeyMethodMap() with the following content:
Map methodMap = super.getKeyMethodMap(); methodMap.put("sample.message.selection.method1", "method1");
- Define the method with the name as 'method1()' and put the logic and the forward in that.