Showing posts with label OIM 11g. Show all posts
Showing posts with label OIM 11g. Show all posts

Wednesday, January 11, 2012

OIM 11.1.1.5 User Manager API bug causes double provisioning

I wrote a Post Process Event Handler code, which provide value to a User's attribute during user creation. The event-handler code was using UserManagerment (oracle.iam.identity.usermgmt.api.UserManager) API.

public class GuidGenerationPostProcEventHandler implements oracle.iam.platform.kernel.spi.PostProcessHandler {
:
public EventResult execute(long processId, long eventId, Orchestration orchestration) { 
HashMap params = orchestration.getParameters();
String uid = this.getParamaterValue(params, Constants.USERID); 
oracle.iam.identity.usermgmt.vo.User user = new User(uid);
user.setAttribute("Micam Unique Id", generateUniqueId()); // generateUniqueId is a private method and returns some value 
try {
   usrMgrService = Platform.getService(UserManager.class);    
   usrMgrService.modify(Constants.USERID, uid, user);
catch (...) 
:
:
}
return ( new EventResult() );
    :
    :

The above said code worked as expected. It generated the value and populated the user attributes called "Micam Unique Id".  But, this code did some damage to my auto-provisioning set up to OID. I saw two auto-provisionings are initiated during user creation event instead of one. I could not figure out the cause. so I posted the query to oracle forum ( https://forums.oracle.com/forums/thread.jspa?threadID=2329154 ) and found the following answer from some of our smart users. 

There is a known issue in UserManagement APIs in OIM 11.1.15. Using the UsrMngmt APIs to update a User within an Orchestration will cause another user update orchestration to be initiated. The user update is also causing role membership rules to be evaluated, which in turn is triggering second provisioning. So solution is to use Entity Management (oracle.iam.platform.entitymgr.EntityManager) APIs instead . The new code snippet is given here, which works fine so far. 

public class GuidGenerationPostProcEventHandler implements oracle.iam.platform.kernel.spi.PostProcessHandler {
    :    
 public EventResult execute(long processId, long eventId, Orchestration orchestration) {        
        HashMap mapAttrs = new HashMap() ;
    mapAttrs.put("Micam Unique Id", generateUniqueId()); // generateUniqueId is a private method and returns some value 
    try {
   String userKey;     
   if (!orchestration.getOperation().equals("CREATE")) 
userKey = orchestration.getTarget().getEntityId();
   else {
    OrchestrationEngine orchEngine = Platform.getService(OrchestrationEngine.class);            
    userKey = (String) orchEngine.getActionResult(processID);
            }        
            
            entMgrService = Platform.getService(EntityManager.class);        
            entMgrService.modifyEntity(orchestration.getTarget().getType(), userKey, mapAttrs);                        
    }
    catch (..) {
    :      
    return ( new EventResult() );
     :
     :

As of writing this blog, there is no UserMgmt & EntityMgmt API documentations available from Oracle. So good luck.

Monday, January 9, 2012

Quick OIM TIP : Finding out OIM Version and Patch Information

(1) Execute the following query against OIM schema.
select XSD_VALUE from XSD where XSD_CODE='XL_BUILD_NUMBER';

 (2) .../Oracle/Middleware/Oracle_IDM1/OPatch/opatch lsinventory -details

Friday, January 6, 2012

OIM 11g: exporting User.xml using MDS utilities

Here are the steps to export OIM's  User.xml from metadata using weblogic MDS utilities.

$ cd /opt/Oracle/Middleware/Oracle_OIM/server/bin
Aassuming you have installed OIM at /opt/Oracle/Middleware/Oracle_OIM. The default directory could be /opt/Oracle/Middleware/Oracle_IDM2 for 11.1.1.5 installation

$ vi weblogic.properties.  Set the value similar to the example below.

wls_servername=oim_server1
application_name=OIMMetadata
metadata_from_loc=@From_location
metadata_to_loc=/opt/export
metadata_files=/file/User.xml

- The above said example assumes that your oim server name is oim_server1.
- The exported file will land in directory mentioned in metadata_to_loc
- Export operation ignores the value mentioned in metadata_from_loc proerty field.
- Rest of the property fields should be hard-coded as shown in the example.

$ ./weblogicExportMetadata.sh
User Name   = weblogic
Password     = Your Password
Server URL = t3://weblogic-admin-server:7001

While running this, you may see some warning about the SSL port and admin port. Just ignore it. If the above runs successfully, your exported User.xml will be in /opt/export/file directory.