Skip Headers
Oracle® Identity Manager Connector Guide for BMC Remedy User Management
Release 9.0.4

E10422-12
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

1 About the Connector

Oracle Identity Manager automates access rights management, security, and provisioning of IT resources. Oracle Identity Manager connectors are used to integrate Oracle Identity Manager with external, identity-aware applications. This guide discusses the connector that enables you to use BMC Remedy AR System either as a managed (target) resource or as an authoritative (trusted) source of identity data for Oracle Identity Manager.

In the account management (target resource) mode of the connector, information about users created or modified directly on BMC Remedy System can be reconciled into Oracle Identity Manager. This data is used to provision (assign) resources to or update resources already assigned to OIM Users. In addition, you can use Oracle Identity Manager to provision or update resources assigned to OIM Users. These provisioning operations performed on Oracle Identity Manager translate into the creation of or updates to the corresponding target system accounts.

In the identity reconciliation (trusted source) configuration of the connector, users are created or modified only on the target system and information about these users is reconciled into Oracle Identity Manager.

This chapter contains the following sections:

Note:

In this guide, the term Oracle Identity Manager server refers to the computer on which Oracle Identity Manager is installed.

At some places in this guide, BMC Remedy System has been referred to as the target system. It is used interchangeably with BMC Remedy User Management.

The BMC Remedy User Management connector is also referred to as the user management connector.

1.1 Certified Components

Table 1-1 lists the certified components for this connector.

Table 1-1 Certified Components

Item Requirement

Oracle Identity Manager

You can use one of the following releases of Oracle Identity Manager:

  • Oracle Identity Manager release 9.1.0.1 and any later BP in this release track

    Note: In this guide, Oracle Identity Manager release 9.1.0.x has been used to denote Oracle Identity Manager release 9.1.0.1 and future releases in the 9.1.0.x series that the connector supports.

  • Oracle Identity Manager 11g release 1 (11.1.1.3.0) and any later BP in this release track

    Note: In this guide, Oracle Identity Manager release 11.1.1 has been used to denote Oracle Identity Manager 11g release 1 (11.1.1) and future releases in the 11.1.1.x series that the connector supports.

The connector does not support Oracle Identity Manager running on Oracle Application Server. For detailed information about certified components of Oracle Identity Manager, see the certification matrix on Oracle Technology Network at

http://www.oracle.com/technetwork/documentation/oim1014-097544.html

Target systems

BMC Remedy AR System 7.0 and 7.1

Note: The target system does not support SSL communication.

Target system user account

User account that is a member of the APP-Administrator group

You provide the credentials of this user account while defining the IT resource. The procedure is described later in this guide.

If the specified privileges were not assigned to the target system user account, then the following message would be displayed:

You do not have write access.

JDK

The JDK version can be one of the following:

  • For Oracle Identity Manager release 9.1.0.x, use JDK 1.5 or a later release in the 1.5 series.

  • For Oracle Identity Manager release 11.1.1, use JDK 1.6 update 18 or later, or JRockit JDK 1.6 update 17 or later.


1.2 Usage Recommendation

Depending on the Oracle Identity Manager version that you are using, you must deploy and use one of the following connectors:

1.3 Certified Languages

The connector supports the following languages:

See Also:

One of the following guides for information about supported special characters:

  • For Oracle Identity Manager 9.1.0.x:

    Oracle Identity Manager Globalization Guide

  • For Oracle Identity Manager release 11.1.1:

    Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

1.4 Connector Architecture

The architecture of the connector is the blueprint for the functionality of the connector.

Note:

In Oracle Identity Manager release 11.1.1, a scheduled job is an instance of a scheduled task. In this guide, the term scheduled task used in the context of Oracle Identity Manager release 9.1.0.x is the same as the term scheduled job in the context of Oracle Identity Manager release 11.1.1.

See Oracle Fusion Middleware System Administrator's Guide for Oracle Identity Manager for more information about scheduled tasks and scheduled jobs.

The primary function of a connector is to create Users on the target system through Oracle Identity Manager. The BMC Remedy System (target system) can be configured to run in either the identity reconciliation (trusted source) mode or the provisioning (target resource) mode.

In the identity reconciliation mode, BMC Remedy System is used as the trusted source and users are directly created and modified on it. During reconciliation from the trusted source, the user management connector fetches data (using scheduled task) about these target system users into Oracle Identity Manager. This data is used to create or update the corresponding OIM Users.

In the account management or provisioning mode, BMC Remedy System is used as a target resource. During reconciliation, the user management connector fetches data (using scheduled tasks) about users created or modified directly on the target system into Oracle Identity Manager. This data is used to add or modify resources allocated to OIM Users. In addition, the connector enables provisioning operations through which user data changes are propagated from Oracle Identity Manager to BMC Remedy System.

Figure 1-1 provides the architecture of the BMC Remedy User Management connector.

Figure 1-1 Architecture of the BMC Remedy User Management Connector

Description of Figure 1-1 follows
Description of "Figure 1-1 Architecture of the BMC Remedy User Management Connector"

Users are created during provisioning in the People form of the BMC Remedy target system. The connector makes use of the Remedy APIs to connect to the Remedy Server, and in turn provision the account.

During reconciliation, scheduled tasks retrieve user records from the People form.

1.5 Features of the Connector

1.5.1 Support for Both Target Resource and Trusted Source Reconciliation

You can use the connector to configure target system as either a target resource or trusted source of Oracle Identity Manager.

See Section 3.3, "Configuring Reconciliation" for more information.

1.5.2 Support for Limited Reconciliation

You can set a reconciliation filter by specifying values for one or more of the following attributes of the scheduled tasks:

  • First Name

  • Last Name

  • Status

  • Notification Method

This filter specifies the subset of newly added and modified target system records that must be reconciled.

See Section 3.3.2, "Limited Reconciliation" for more information.

1.5.3 Support for Batched Reconciliation

You can break down a reconciliation run into batches by specifying the number of records that must be included in each batch.

See Section 3.3.3, "Batched Reconciliation" for more information.

1.5.4 Support for Both Full and Incremental Reconciliation

After you deploy the connector, you can perform full reconciliation to bring all existing user data from the target system to Oracle Identity Manager. After the first full reconciliation run, incremental reconciliation is automatically enabled from the next run of the user reconciliation.

You can perform a full reconciliation run at any time. See Section 3.3.1, "Full Reconciliation" for more information.

1.5.5 Support for Adding New Single-Valued Attributes for Reconciliation and Provisioning

If you want to add to the standard set of single-valued attributes for reconciliation and provisioning, then perform the procedures described in Chapter 4, "Extending the Functionality of the Connector."

1.6 Lookup Definitions Used During Reconciliation and Provisioning

Lookup definitions used during connector operations can be divided into the following categories:

1.6.1 Lookup Definitions Synchronized with the Target System

During a provisioning operation, you use a lookup field on the process form to specify a single value from a set of values. For example, you use the Department lookup field to select a department to which a user must belong to from the list of available departments. When you deploy the connector, lookup definitions corresponding to the lookup fields on the target system are created in Oracle Identity Manager. Lookup field synchronization involves copying additions or changes made to the target system lookup fields into the lookup definitions in Oracle Identity Manager.

The following lookup definitions are populated with values fetched from the target system by the scheduled tasks for lookup field synchronization:

See Also:

Section 3.2, "Scheduled Task for Lookup Field Synchronization" for information about these scheduled tasks

  • Lookup.BMC.Region

  • Lookup.BMC.Site

  • Lookup.BMC.Department

  • Lookup.BMC.Company

  • Lookup.BMC.Organization

  • Lookup.BMC.SiteGroup

  • Lookup.BMC.SiteID

  • Lookup.BMC.SupportCompany

  • Lookup.BMC.SupportOrganization

  • Lookup.BMC.SupportGroup

  • Lookup.BMC.RelationshipRole

  • Lookup.BMC.SupportGroupID

  • Lookup.BMC.PrimaryCentercode

  • Lookup.BMC.PagerSw

1.6.2 Other Lookup Definitions

Table 1-2 describes the other lookup definitions that are created in Oracle Identity Manager when you deploy the connector. These lookup definitions are either prepopulated with values or values must be manually entered in them after the connector is deployed.

Table 1-2 Other Lookup Definitions

Lookup Definition Description of Values Method to Specify Values for the Lookup Definition

Lookup.BMC.UM.Grp.QueryAttribute

This lookup definition holds information about filter attributes for group reconciliation.

This lookup definition is preconfigured. You can add entries in this lookup definition, but you must not modify existing entries.

See Section 3.3.2, "Limited Reconciliation" for more information about adding entries.

Lookup.BMC.UM.QueryAttribute

This lookup definition holds information about filter attributes for user reconciliation.

This lookup definition is preconfigured. You can add entries in this lookup definition, but you must not modify existing entries.

See Section 3.3.2, "Limited Reconciliation" for more information about adding entries.

Lookup.BMC.RelationshipRole

This lookup definition holds information about the relationship roles that you can select for a target system account that you create through Oracle Identity Manager.

The following is the format of the Code Key and Decode values in this lookup definition:

  • Code Key: Relationship role name on the target system

  • Decode: Corresponding relationship role name to be displayed in the Relationship Role lookup field of the OIM User form

This lookup definition is preconfigured. You can add or modify entries in this lookup definition if you add or modify entries in the Relationship Role lookup field on the target system

See one of the following guides for more information about modifying entries in a lookup definition:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

Combo.BMC.ClientType

This lookup definition holds information about client types that you can select for a target system account that you create through Oracle Identity Manager

The following is the format of the Code Key and Decode values in this lookup definition:

  • Code Key: Type of client on the target system

  • Decode: Corresponding client type to be displayed in the Client Type field of the OIM User form

This lookup definition is preconfigured. You can add or modify entries in this lookup definition if you add or modify entries in the Client Type field on the target system

See one of the following guides for more information about modifying entries in a lookup definition:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

Combo.BMC.ProfileStatus

This lookup definition holds information about profile statuses that you can select for a target system account that you create through Oracle Identity Manager.

The following is the format of the Code Key and Decode values in this lookup definition:

  • Code Key: Profile status name on the target system

  • Decode: Corresponding profile status name to be displayed in the Profile Status field of the OIM User form

This lookup definition is preconfigured. You can add or modify entries in this lookup definition if you add or modify entries in the Profile Status field on the target system

See one of the following guides for more information about modifying entries in a lookup definition:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

Combo.BMC.ClientSensitivity

This lookup definition holds information about the sensitivity that you can select for a target system account that you create through Oracle Identity Manager.

The following is the format of the Code Key and Decode values in this lookup definition:

  • Code Key: Client sensitivity value on the target system

  • Decode: Corresponding client sensitivity value to be displayed in the Sensitivity field of the OIM User form

This lookup definition is preconfigured. You can add or modify entries in this lookup definition if you add or modify entries in the Client Sensitivity field on the target system

See one of the following guides for more information about modifying entries in a lookup definition:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

Combo.BMC.VIP

You use this lookup definition to specify whether the user is a V.I.P.

This lookup definition is preconfigured. You must not modify the entries in this lookup definition.

Combo.BMC.ARLicenseType

This lookup definition holds information about license types that you can select for a target system account that you create through Oracle Identity Manager.

The following is the format of the Code Key and Decode values in this lookup definition:

  • Code Key: License type value on the target system

  • Decode: Corresponding license type value to be displayed in the ARLicenseType field of the OIM User form

This lookup definition is preconfigured. You can add or modify entries in this lookup definition if you add or modify entries in the License Type field on the target system

See one of the following guides for more information about modifying entries in a lookup definition:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

Combo.BMC.SupportStaff

You use this lookup definition to specify whether the user is a support staff member.

This lookup definition is preconfigured. You must not modify the entries in this lookup definition.

Combo.BMC.Notify

This lookup definition holds information about the notification mechanism that you can select for a target system account that you create through Oracle Identity Manager.

The following is the format of the Code Key and Decode values in this lookup definition:

  • Code Key: Notification mechanism value on the target system

  • Decode: Corresponding notification mechanism value to be displayed in the Notification Method field of the OIM User form

This lookup definition is preconfigured. You can add or modify entries in this lookup definition if you add or modify entries in the Notification Method field on the target system

See one of the following guides for more information about modifying entries in a lookup definition:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

Combo.BMC.HourlyRate

This lookup definition holds information about the hourly rate currency you can select for a target system account that you create through Oracle Identity Manager.

The following is the format of the Code Key and Decode values in this lookup definition:

  • Code Key: Currency value on the target system

  • Decode: Corresponding currency value to be displayed in the Hourly Rate field of the OIM User form

This lookup definition is preconfigured. You can add or modify entries in this lookup definition if you add or modify entries in the Hourly Rate field on the target system

See one of the following guides for more information about modifying entries in a lookup definition:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager


1.7 Connector Objects Used During Target Resource Reconciliation and Provisioning

The following sections provide information about connector objects used during target resource reconciliation and provisioning:

See Also:

One of the following guides for conceptual information about reconciliation:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Connector Concepts

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware User's Guide for Oracle Identity Manager

1.7.1 User Attributes for Target Resource Reconciliation and Provisioning

Table 1-5 provides information about user attribute mappings for target resource reconciliation and provisioning.

Table 1-3 User Attributes for Target Resource Reconciliation and Provisioning

Process Form Field Target System Attribute Description

User ID

CTM:People.Person ID

User's unique ID

Password

CTM:People.Password

Password

FirstName

CTM:People.First Name

First name of the user

LastName

CTM:People.Last Name

Last name of the user

ClientType

CTM:People.Client Type

Type of user

ProfileStatus

CTM:People.Profile Status

Status of the user profile

ClientSensitivity

CTM:Client Sensitivity

Client sensitivity

VIP

CTM:People.VIP

Specifies whether the user is a very important person

Company+

CTM:People Organization.Company

User's company name

Organization

CTM:People Organization.Organization

Organization to which the user belongs

Department

CTM:People Organization.Department

Department of the user

Site+

SIT:Site Alias Company LookUp.Site

Site to which the user belongs

Region

CTM:Region.Region

Region to which the user belongs

The values displayed in this list are specific to the value selected in the Site+ list.

SiteGroup

SIT:Site Group:Site Group

Site group to which the user belongs

The values displayed in this list are specific to the value selected in the Region list.

SupportStaff

CTM:People.Support Staff

Specifies whether the user is a support staff

NotificationMethod

CTM:People.Notification Method

Notification method

EmailAddress

CTM:People.Email Address

E-mail address of the user

PrimaryCenterCode

CTM:People.Cost Center Code

Cost center code

HourlyRate

CTM:People.Hourly Rate

Hourly rate

ARLicenseType

CTM:People.License Type

License type

Business Phone

CTM:People.Business

Business phone number

SiteID

CTM:Site ID

Unique site ID


1.7.2 Support Group Attributes for Target Resource Reconciliation and Provisioning

Table 1-4 provides information about support group attribute mappings for target resource reconciliation and provisioning.

Table 1-4 Support Group Attributes for Target Resource Reconciliation and Provisioning

Process Form Field Target System Support Group Attribute Description

Support Group Company

CTM:Support Group.Company

Support group company name

Support Group Organization

CTM:Support Group.Organization

Support group organization name

Support Group

CTM:Support Group

Support group name

Support Group Relationship Role

CTM:Support Group. Relationship Role

Support group relationship role name

Support Group ID

Group Id

Support group ID


1.7.3 Reconciliation Rule for Target Resource Reconciliation

See Also:

For generic information about reconciliation matching and action rules, see one of the following guides:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Connector Concepts

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware User's Guide for Oracle Identity Manager

The following is the process-matching rule:

Rule name: BMC User Recon

Rule element: User Login Equals Users.LoginName

In this rule:

  • User Login is the User ID attribute on the OIM User form.

  • Users.LoginName is the Login ID attribute of the target system.

After you deploy the connector, you can view the reconciliation rule for target resource reconciliation by performing the following steps:

Note:

Perform the following procedure only after the connector is deployed.

  1. Log in to the Oracle Identity Manager Design Console.

  2. Expand Development Tools.

  3. Double-click Reconciliation Rules.

  4. Search for BMC User Recon. Figure 1-2 shows the reconciliation rule for target resource reconciliation.

    Figure 1-2 Reconciliation Rule for Target Resource Reconciliation

    Description of Figure 1-2 follows
    Description of "Figure 1-2 Reconciliation Rule for Target Resource Reconciliation"

1.7.4 Reconciliation Action Rules for Target Resource Reconciliation

Table 1-5 lists the action rules for target resource reconciliation.

Table 1-5 Action Rules for Target Resource Reconciliation

Rule Condition Action

No Matches Found

Assign to Administrator With Least Load

One Entity Match Found

Establish Link

One Process Match Found

Establish Link


Note:

No action is performed for rule conditions that are not predefined for this connector. You can define your own action rule for such rule conditions. For information about modifying or creating reconciliation action rules, see one of the following guides:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

After you deploy the connector, you can view the reconciliation action rules for target resource reconciliation by performing the following steps:

  1. Log in to the Oracle Identity Manager Design Console.

  2. Expand Resource Management.

  3. Double-click Resource Objects.

  4. Search for and open the BMCRO resource object.

  5. Click the Object Reconciliation tab, and then click the Reconciliation Action Rules tab. The Reconciliation Action Rules tab displays the action rules defined for this connector. Figure 1-3 shows the reconciliation action rule for target resource reconciliation.

    Figure 1-3 Reconciliation Action Rules for Target Resource Reconciliation

    Description of Figure 1-3 follows
    Description of "Figure 1-3 Reconciliation Action Rules for Target Resource Reconciliation"

1.7.5 Provisioning Functions

Table 1-6 lists the provisioning functions that are supported by the connector. The Adapter column gives the name of the adapter that is used when the function is performed.

Table 1-6 Provisioning Functions

Function Adapter

Create User

BMCCreateUser

Delete User

BMCDeleteUser

Update User

BMCUpdateUser

Update User Password

BMCUpdateUserPassword

Delete Support Group

BMCDeleteSupportGroup

Update Support Group

BMCupdateSupportGroup


1.8 Connector Objects Used During Trusted Source Reconciliation

The following sections provide information about connector objects used during trusted source reconciliation:

1.8.1 User Attributes for Trusted Source Reconciliation

Table 1-7 lists user attributes for trusted source reconciliation.

Table 1-7 User Attributes for Trusted Source Reconciliation

OIM User Form Field Target System Attribute Description

User ID

CTM:People.Person ID

User's unique ID

First Name

First Name

First Name

Last Name

Last Name

Last name

Employee Type

NA

Default value: Consultant

User Type

NA

Default value: End-User Administrator

Organization

NA

Default value: Xellerate Users


1.8.2 Reconciliation Rule for Trusted Source Reconciliation

See Also:

For generic information about reconciliation matching and action rules, see one of the following guides:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Connector Concepts

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware User's Guide for Oracle Identity Manager

The following is the process matching rule:

Rule name: BMCUserTrustedRecon

Rule element: User Login Equals Users.PersonID

In this rule element:

  • User Login is the User ID field on the OIM User form.

  • Users.PersonID is the CTM:People.Person ID field of BMC Remedy AR System.

After you deploy the connector, you can view the reconciliation rule for target resource reconciliation by performing the following steps:

Note:

Perform the following procedure only after the connector is deployed.

  1. Log in to the Oracle Identity Manager Design Console.

  2. Expand Development Tools.

  3. Double-click Reconciliation Rules.

  4. Search for BMCUserTrustedRecon. Figure 1-4 shows the reconciliation rule for trusted source reconciliation.

    Figure 1-4 Reconciliation Rule for Trusted Source Reconciliation

    Description of Figure 1-4 follows
    Description of "Figure 1-4 Reconciliation Rule for Trusted Source Reconciliation"

1.8.3 Reconciliation Action Rules for Trusted Source Reconciliation

Table 1-8 lists the action rules for target resource reconciliation.

Table 1-8 Action Rules for Target Source Reconciliation

Rule Condition Action

No Matches Found

Create User

One Entity Match Found

Establish Link

One Process Match Found

Establish Link


Note:

No action is performed for rule conditions that are not predefined for this connector. You can define your own action rule for such rule conditions. For information about modifying or creating reconciliation action rules, see one of the following guides:

  • For Oracle Identity Manager release 9.1.0.x: Oracle Identity Manager Design Console Guide

  • For Oracle Identity Manager release 11.1.1: Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager

After you deploy the connector, you can view the reconciliation action rules for target resource reconciliation by performing the following steps:

  1. Log in to the Oracle Identity Manager Design Console.

  2. Expand Resource Management.

  3. Double-click Resource Objects.

  4. Search for and open the Xellerate User resource object.

  5. Click the Object Reconciliation tab, and then click the Reconciliation Action Rules tab. The Reconciliation Action Rules tab displays the action rules defined for this connector. Figure 1-5 shows the reconciliation action rules for trusted source reconciliation.

    Figure 1-5 Reconciliation Action Rules for Trusted Source Reconciliation

    Description of Figure 1-5 follows
    Description of "Figure 1-5 Reconciliation Action Rules for Trusted Source Reconciliation"

1.9 Roadmap for Deploying and Using the Connector

The following is the organization of information in the rest of this guide: