2 Deploying the Connector

The procedure to deploy the connector can be divided into the following stages:

Note:

Some of the procedures described in this chapter are meant to be performed on the target system. The minimum permissions required to perform the target system procedure are those assigned to members of the Domain Admins group. To perform the target system-specific procedures, you can use the same user account that you create for deploying the Microsoft Active Directory User Management connector.

See the "Deploying the Connector" chapter of Oracle Identity Manager Connector Guide for Microsoft Active Directory User Management for information about creating that user account.

2.1 Preinstallation

Preinstallation information is divided across the following sections:

2.1.1 Preinstallation on Oracle Identity Manager

This section contains the following topics:

2.1.1.1 Files and Directories On the Connector Installation Media

The contents of the connector installation media directory are described in Table 2-1.

Table 2-1 Files and Directories On the Connector Installation Media

File in the Installation Media Directory Description

configuration/Exchange-CI.xml

This XML file contains configuration information that is used during the connector installation process.

Files in the DataSets directory

These XML files specify the information to be submitted by the requester during a request-based provisioning operation.

Note: These files are specific to Oracle Identity Manager versions prior to 11.1.2.

lib/xliExchange.jar

This JAR file contains the class files required for provisioning. During connector installation, this file is copied to the following location:

  • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/JavaTasks

  • For Oracle Identity Manager release 11.1.x: Oracle Identity Manager database

lib/xliExchangeRecon.jar

This JAR file contains the class files required for reconciliation. During connector installation, this file is copied to the following location:

  • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/ScheduleTask

  • For Oracle Identity Manager release 11.1.x: Oracle Identity Manager database

Files in the resources directory

Each of these resource bundles contains language-specific information that is used by the connector. During connector installation, these resource bundles are copied to the following location:

  • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/connectorResources

  • For Oracle Identity Manager release 11.1.x: Oracle Identity Manager database

Note: A resource bundle is a file containing localized versions of the text strings that are displayed on the Administrative and User Console. These text strings include GUI element labels and messages.

script/CreateMailboxExchange2007.vbs

Scripts/CreateExchangeMailbox2010.vbs

This VBScript file is used by the Remote Manager to provision mailboxes in Exchange 2007 and Exchange 2010. This script is called by the Remote Manager.

script/DeleteMailboxExchange2007.vbs

Scripts/DeleteExchangeMailbox2010.vbs

This VBScript file is used by the Remote Manager to delete mailboxes in Exchange 2007 and Exchange 2010. This script is called by the Remote Manager.

xml/MicrosoftExchange-ConnectorConfig.xml

This XML file contains definitions for the connector components. These components include the following:

  • IT resource type

  • Process form

  • Process task and adapters (along with their mappings)

  • Resource object

  • Provisioning process

  • Prepopulate rules

  • Lookup definitions

  • Scheduled tasks

Note: In Oracle Identity Manager release 11.1.x, a scheduled job is an instance of a scheduled task. In this guide, the term scheduled task used in the context of Oracle Identity Manager release 9.1.0.x is the same as the term scheduled job in the context of Oracle Identity Manager release 11.1.x.

See Oracle Fusion Middleware System Administrator's Guide for Oracle Identity Manager for more information about scheduled tasks and scheduled jobs.

2.1.1.2 Determining the Release Number of the Connector

Note:

If you are using Oracle Identity Manager release 9.1.0.x, then the procedure described in this section is optional.

If you are using Oracle Identity Manager release 11.1.1, then skip this section.

You might have a deployment of an earlier release of the connector. While deploying the current release, you might want to know the release number of the earlier release. To determine the release number of the connector that has already been deployed:

  1. In a temporary directory, extract the contents of the following JAR file:

    OIM_HOME/xellerate/JavaTasks/xliExchange.jar

  2. Open the Manifest.mf file in a text editor. The Manifest.mf file is one of the files bundled inside the xliExchange.jar file and the xliExchangeRecon.jar file.

    In the Manifest.mf file, the release number of the connector is displayed as the value of the Version property.

2.1.2 Preinstallation on the Target System

Preinstallation on the target system involves creating a target system user account with appropriate permissions for connector operations. Oracle Identity Manager requires this account to connect to the target system during reconciliation and provisioning operations.

You can use a Microsoft Windows 2003 Server (Domain Controller) administrator account as a target system user account. Alternatively, you can create a user account and assign the minimum required rights to that user account, if Microsoft Active Directory and Microsoft Exchange are not installed on the same system.

The procedure to create a target system user account is provided in the following section.

2.1.2.1 Creating a Target System User Account for Connector Operations

To create the Microsoft Exchange user account for connector operations:

Note:

You need not perform this procedure if Microsoft Active Directory and Microsoft Exchange are installed on the same system.

  1. Create a group, for example OIMEXCConGroup, on Microsoft Active Directory.

  2. Make this group a member of the Account Operators group.

  3. Assign all read permissions for the OIMEXCConGroup group.

    Note:

    You assign read permissions on the Security tab of the dialog box for creating the user account. This tab is displayed only in Advanced Features view. To switch to this view, select Advanced Features from the View menu in the Microsoft Active Directory console.

  4. Assign the OIMEXCConGroup group to be a member of the Exchange View-Only Administrators group. Users in this group have permission to read all Exchange configuration.

  5. Create a user, for example OIMEXCConUser on the target system.

  6. Assign this user to the OIMEXCConGroup group.

  7. Assign this OIMEXCConUser to the Exchange Recipient Administrators group in Microsoft Active Directory as follows:

    1. In the Active Directory User and Computers console, search for the OIMEXCConUser user.

    2. Right-click the OIMEXCConUser user, and then click Properties.

    3. In the Properties dialog box, on the Member Of tab, click Add.

      The Select Groups dialog box is displayed.

    4. In the Enter the object names to select field, enter Exchange Recipient Administrator, and then click Check Names.

    5. Click OK to close the Select Groups dialog box.

    6. Click Apply and then OK to apply the changes and close the properties dialog box.

    Using OIMEXCConUser, you can perform provisioning and reconciliation. You can also enable, disable, and delete a mailbox on Microsoft Exchange.

2.1.2.2 Configuring Microsoft Exchange 2010

Before configuring Microsoft Exchange 2010, the section provides an overview about the different policy levels. They are categorized as follows:

Restricted

You can run the individual cmdlets, but not saved Powershell scripts. This is the default setting.

AllSigned

Scripts can run, but must have a digital signature even if written on the local computer. Prompts you before running scripts from trusted publishers.

RemoteSigned

Scripts written on the local computer do not need a digital signature, but any script downloaded from outside (e-mail, Messenger, Internet) must have a signature to execute.

Unrestricted

Any script can run, but scripts downloaded from outside will run with a warning.

You must set the execution policy to RemoteSigned. To do so perform the following steps:

  1. Open the Exchange management powershell window.

  2. Enter the following command:

    get-executionPolicy

  3. If the policy is not RemoteSigned, then enter the following command to change the policy to RemoteSigned:

    set-executionPolicy RemoteSigned

  4. Close the powershell window.

2.2 Installation

Installation information is divided across the following sections:

2.2.1 Installation on Oracle Identity Manager

Installation on Oracle Identity Manager involves the following procedures:

2.2.1.1 Running the Connector Installer

Note:

In this guide, the term Connector Installer has been used to refer to the Connector Installer feature of the Oracle Identity Manager Administrative and User Console.

Ensure that the Microsoft Active Directory User Management connector is installed before you proceed to install the connector.

To run the Connector Installer:

  1. Copy the contents of the connector installation media directory into the following directory:

    Note:

    In an Oracle Identity Manager cluster, perform this step on each node of the cluster.

    • For Oracle Identity Manager release 9.1.0.x: OIM_HOME/xellerate/ConnectorDefaultDirectory

    • For Oracle Identity Manager release 11.1.x: OIM_HOME/server/ConnectorDefaultDirectory

  2. Log in to the Administrative and User Console by using the user account described in the "Creating the User Account for Installing Connectors" section of the following guide:

    • For Oracle Identity Manager release 9.1.0.x:

      Oracle Identity Manager Administrative and User Console Guide

    • For Oracle Identity Manager release 11.1.x:

      Oracle Fusion Middleware System Administrator's Guide for Oracle Identity Manager

  3. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 9.1.0.x:

      Click Deployment Management, and then click Install Connector.

    • For Oracle Identity Manager release 11.1.1:

      On the Welcome to Identity Manager Advanced Administration page, in the System Management region, click Install Connector.

    • For Oracle Identity Manager release 11.1.2:

      In the left pane, under System Management, click Manage Connector. In the Manage Connector page, click Install.

  4. From the Connector List list, select Exchange RELEASE_NUMBER where RELEASE_NUMBER is 9.x. This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation in Step 1.

    If you have copied the installation files into a different directory, then:

    1. In the Alternative Directory field, enter the full path and name of that directory.

    2. To repopulate the list of connectors in the Connector List list, click Refresh.

    3. From the Connector List list, select Exchange RELEASE_NUMBER where RELEASE_NUMBER is 9.x.

  5. Click Load.

  6. To start the installation process, click Continue.

    The following tasks are performed, in sequence:

    1. Configuration of connector libraries

    2. Import of the connector XML files (by using the Deployment Manager)

    3. Compilation of adapters

    On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure are displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:

    • Retry the installation by clicking Retry.

    • Cancel the installation and begin again from Step 0.

  7. If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of the steps that you must perform after the installation is displayed. These steps are as follows:

    1. Ensuring that the prerequisites for using the connector are addressed

      Note:

      At this stage, run the Oracle Identity Manager PurgeCache utility to load the server cache with content from the connector resource bundle in order to view the list of prerequisites. See Section 2.3.1.2, "Clearing Content Related to Connector Resource Bundles from the Server Cache" for information about running the PurgeCache utility.

      There are no prerequisites for some predefined connectors.

    2. Configuring the IT resource for the connector

      Record the name of the IT resource displayed on this page. The procedure to configure the IT resource is described later in this guide.

    3. Configuring the scheduled tasks

      Record the names of the scheduled tasks displayed on this page. The procedure to configure these scheduled tasks is described later in this guide.

When you run the Connector Installer, it copies the connector files and external code files to destination directories on the Oracle Identity Manager host computer. These files are listed in Table 2-1.

2.2.1.1.1 Copying the ldapbp.jar File

The ldapbp.jar file is used by the connector to enable LDAP-based search of user records on the target system. During the installation of the Microsoft Active Directory User Management connector, this file is copied to the following directory:

Note:

In an Oracle Identity Manager cluster, copy this JAR file into the ThirdParty directory on each node of the cluster.

  • For Oracle Identity Manager release 9.1.0.x:

    OIM_HOME/xellerate/ThirdParty

  • For Oracle Identity Manager release 11.1.x:

    OIM_HOME/server/ThirdParty

See the "Running the Connector Installer" section of Oracle Identity Manager Connector Guide for Microsoft Active Directory User Management for details.

2.2.1.1.2 Installing the Connector in an Oracle Identity Manager Cluster

While installing the connector in an Oracle Identity Manager cluster, you must copy all the JAR files and the contents of the resources directory into their destination directories on each node of the cluster. See Section 2.1.1.1, "Files and Directories On the Connector Installation Media" for information about the files that you must copy and their destination locations on the Oracle Identity Manager host computer.

2.2.1.2 Creating the IT Resource

The IT resource for the target system contains connection information about the target system. Oracle Identity Manager uses this information for reconciliation and provisioning.

For reconciliation and provisioning in Microsoft Exchange 2000 and Microsoft Exchange 2003, Oracle Identity Manager uses the Microsoft Active Directory IT resource. See Oracle Identity Manager Connector Guide for Microsoft Active Directory User Management for instructions to create Microsoft Active Directory IT resources.

For reconciliation in Microsoft Exchange 2007, Oracle Identity Manager uses the Microsoft Active Directory IT resource. For provisioning in Microsoft Exchange 2007, Oracle Identity Manager uses the Microsoft Active Directory IT resource and Microsoft Exchange Server IT resource values.

To create the Microsoft Exchange Server IT resource:

  1. Log in to the Administrative and User Console.

  2. If you are using Oracle Identity Manager release 9.1.0.x, expand Resource Management, and then click Create IT Resource.

  3. If you are using Oracle Identity Manager release 11.1.1, then:

    • On the Welcome to Oracle Identity Manager Self Service page, click Advanced in the upper-right corner.

    • On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Create IT Resource.

  4. If you are using Oracle Identity Manager release 11.1.2, then:

    • Log in to Oracle Identity System Administration.

    • In the left pane, under Configuration, click IT Resource.

  5. On the Step 1: Provide IT Resource Information section, perform the following steps:

    • IT Resource Name: Enter Exchange Server IT Resource.

    • IT Resource Type: Select Exchange Server from the IT Resource Type list.

    • Remote Manager: At this point, do not enter a value in this field.

      Note:

      After you install a Remote Manager for the target system, specify the name of the IT resource for the Remote Manager as the value of the Remote Manager parameter. See Section 2.2.2.1, "Installing the Remote Manager" for information about whether or not you need to install a Remote Manager.

  6. Click Continue. Figure 2-1 shows IT resource values added in the Create IT Resource page.

    Figure 2-1 Step 1: Provide IT Resource Information

    Description of Figure 2-1 follows
    Description of "Figure 2-1 Step 1: Provide IT Resource Information"

  7. On the Step 2: Specify IT Resource Parameter Values section, specify values for the parameters of the IT resource and click Continue. Figure 2-2 shows IT resource parameter values added in the Create IT Resource page.

    Figure 2-2 Step 2: Specify IT Resource Parameter Values

    Description of Figure 2-2 follows
    Description of "Figure 2-2 Step 2: Specify IT Resource Parameter Values"

    Table 2-2 describes the parameters for this IT resource.

    Table 2-2 Parameters of the IT Resource

    Parameter Description

    Remote Script Location

    If you are using Microsoft Exchange 2007 as the target system, then enter the full path of the CreateMailboxExchange2007.vbs script placed in the remote system.

    If you are using Microsoft Exchange 2010 as the target system, then enter the full path of the CreateMailboxExchange2010.vbs script placed in the remote system.

    This remote system is the system where the target system has been installed. The Remote Manager uses VBS script to create mailboxes on the target system.

    Note: This parameter is case-sensitive. Therefore, you must enter the correct case (uppercase and lowercase) of the path to the directory where the script is copied.

    Sample value: RM_HOME/RemoteScripts/CreateMailboxExchange2007.vbs

    Report Log Location

    Enter the full path of the directory including the name of the log file where you want the log file to be generated. The log file stores the outcome of each run of the CreateMailboxExchange2007.vbs, CreateMailboxExchange2010.vbs, DeleteMailboxExchange2007.vbs, or DeleteMailboxExchange2010.vbs scripts.

    You must create the directory if it does not already exist.

    Note: This parameter is case-sensitive. Therefore, you must enter the correct case (uppercase and lowercase) of the path to the directory where the log files are to be generated.

    Sample value: RM_HOME/Log/Report.log

    Report.log is the name of the log file generated. You can change this file name.

    Delete Remote Script Location

    If you are using Microsoft Exchange 2007 as the target system, then enter the full path of the DeleteMailboxExchange2007.vbs script placed in the remote system.

    If you are using Microsoft Exchange 2010 as the target system, then enter the full path of the DeleteMailboxExchange2010.vbs script placed in the remote system.

    This remote system is the system where the target system has been installed. The Remote Manager uses VBS script to delete mailboxes on the target system.

    Note: This parameter is case-sensitive. Therefore, you must enter the correct case (uppercase and lowercase) of the path to the directory where the script is copied.

    Sample value: RM_HOME/RemoteScripts/DeleteMailboxExchange2007.vbs

  8. The Step 3: Set Access Permission to IT Resource page is displayed. On this page, the SYSTEM ADMINISTRATORS group is displayed by default in the list of groups that have Read, Write, and Delete permissions on the IT resource that you are creating.

    Note:

    This step is optional.

    If you want to assign groups to the IT resource and set access permissions for the groups, then:

    a. Click Assign Group.

    b. For the groups that you want to assign to the IT resource, select Assign and the access permissions that you want to set. For example, if you want to assign the ALL USERS group and set the Read and Write permissions to this group, then you must select the respective check boxes in the row, as well as the Assign check box, for this group.

    c. Click Assign.

  9. On the Step 3: Set Access Permission to IT Resource page, if you want to modify the access permissions of groups assigned to the IT resource, then:

    Note:

    • This step is optional.

    • You cannot modify the access permissions of the SYSTEM ADMINISTRATORS group. You can modify the access permissions of only other groups that you assign to the IT resource.

    a. Click Update Permissions.

    b. Depending on whether you want to set or remove specific access permissions for groups displayed on this page, select or deselect the corresponding check boxes.

    c. Click Update.

  10. On the Step 3: Set Access Permission to IT Resource page, if you want to unassign a group from the IT resource, then:

    Note:

    • This step is optional.

    • You cannot unassign the SYSTEM ADMINISTRATORS group. You can unassign only other groups that you assign to the IT resource.

    a. Select the Unassign check box for the group that you want to unassign.

    b. Click Unassign.

  11. Click Continue.

  12. On the Step 4: Verify IT Resource Details page, review the information that you provided on the first, second, and third pages. If you want to make changes in the data entered on any page, click Back to revisit the page and then make the required changes.

  13. To proceed with the creation of the IT resource, click Continue. Figure 2-3 shows the IT resource details that you created in the Create IT Resource page.

    Figure 2-3 Step 4: Verify IT Resource Details

    Description of Figure 2-3 follows
    Description of "Figure 2-3 Step 4: Verify IT Resource Details"

  14. The Step 5: IT Resource Connection Result page displays the results of a connectivity test that is run using the IT resource information. If the test is successful, then click Create. If the test fails, then you can perform one of the following steps:

    • Click Back to revisit the previous pages and then make corrections in the IT resource creation information.

    • Click Cancel to stop the procedure, and then begin from the first step onward.

    • Proceed with the creation process by clicking Continue. You can fix the problem later, and then rerun the connectivity test by using the Diagnostic Dashboard. Figure 2-4 shows the IT resource connection result in the Create IT Resource page.

      Figure 2-4 Step 5: IT Resource Connection Result Page

      Description of Figure 2-4 follows
      Description of "Figure 2-4 Step 5: IT Resource Connection Result Page"

  15. The Step 6: IT Resource Created page displays the details of the IT resource that you created. Click Finish. Figure 2-5 shows the IT resource created in the Create IT Resource page.

    Figure 2-5 IT Resource Created Page of Oracle Identity Manager

    Description of Figure 2-5 follows
    Description of "Figure 2-5 IT Resource Created Page of Oracle Identity Manager"

2.2.2 Installation on the Target System

This section discusses the following topics:

Note:

The procedure to configure the Remote Manager is described in Section 2.3.3, "Configuring the Remote Manager".

2.2.2.1 Installing the Remote Manager

The Remote Manager enables mailbox provisioning operations on Microsoft Exchange 2007.

Note:

The Remote Manager can be installed on any domain member on which Microsoft Exchange Management Tools is installed.

You must install the Remote Manager for Microsoft Exchange 2007 if you have not installed the Remote Manager for Microsoft Active Directory. See Oracle Identity Manager Connector Guide for Microsoft Active Directory User Management for information about this Remote Manager.

A single Remote Manager can be used with multiple Microsoft Exchange installations (on multiple host computers) that are configured for a single Microsoft Active Directory installation. The Remote Manager can be installed on any Microsoft Exchange host on which Exchange Management tools are installed.

Note:

  • See the "Deploying the Connector" chapter of Oracle Identity Manager Connector Guide for Microsoft Active Directory User Management for information about installing and configuring the Remote Manager for Microsoft Active Directory.

  • In this guide, the directory in which you install the Remote Manager is referred to as RM_HOME.

Prerequisites

The following are the prerequisites for installing the Remote Manager:

  • For Oracle Identity Manager release 9.1.0.x

    If Microsoft Exchange 2007 is running on 64-bit Microsoft Windows Server, then you must install the 64-bit version of JDK 1.5 or later before you install the Remote Manager.

  • For Oracle Identity Manager release 11.1.x

    If Microsoft Exchange 2007 is running on 64-bit Microsoft Windows Server, then before you install the Remote Manager, you must install Oracle WebLogic Application Server on the Remote Manager host computer. While installing the application server, do not select the JDK bundled with the application server. Instead, select an installed instance of a 64-bit version of JDK.

Note:

During the mailbox provisioning operations on Microsoft Exchange 2007 and Microsoft Exchange 2010, the Remote Manager may throw the following types of errors:

Get-ItemProperty: Cannot find path

To prevent such errors, you must ensure that the Remote Manager uses an installed instance of a 64-bit version of JDK.

To deploy the Remote Manager:

  1. The Remote Manager installation files are shipped along with the Oracle Identity Manager installation files. You can install the Remote Manager on any computer that is a part of the domain.

    If you are using Oracle Identity Manager release 11.1.x, then see the Oracle Fusion Middleware System Administrator's Guide for Oracle Identity Manager guide for instructions of installing the Remote Manager.

    If you are using Oracle Identity Manager release 9.1.0.x, then depending on the application server that you use, perform the procedure to install the Remote Manager by following the instructions given in one of the following guides:

    • Oracle Identity Manager Installation and Configuration Guide for Oracle WebLogic Server

    • Oracle Identity Manager Installation and Configuration Guide for IBM WebSphere Application Server

    • Oracle Identity Manager Installation and Configuration Guide for JBoss Application Server

    • Oracle Identity Manager Installation and Configuration Guide for Oracle Application Server

  2. If you are using Oracle Identity Manager release 9.1.0.x, then copy the following JAR files into the RM_HOME\xlremote\JavaTasks directory:

    • OIM_HOME/xellerate/lib/xlVO.jar

    • OIM_HOME/xellerate/lib/xlScheduler.jar

    • OIM_HOME/xellerate/lib/xlAPI.jar

    • OIM_HOME/xellerate/JavaTasks/xliActiveDirectory.jar

    • OIM_HOME/xellerate/ScheduleTask/xliADRecon.jar

    • OIM_HOME/xellerate/JavaTasks/xliExchange.jar

    • OIM_HOME/xellerate/ScheduleTask/xliExchangeRecon.jar

  3. If you are using Oracle Identity Manager release 11.1.x, then copy the following JAR files into the RM_HOME\xlremote\JavaTasks directory:

    • OIM_HOME/server/lib/xlVO.jar

    • OIM_HOME/server/lib/xlScheduler.jar

    • OIM_HOME/server/lib/xlAPI.jar

    • OIM_HOME/server/lib/xlUtils.jar

    • OIM_HOME/server/lib/xlRemoteManager.jar

    • INSTALL_MEDIA/lib/xliActiveDirectory.jar

      Note:

      In this guide, the connector installation media is referred to as INSTALL_MEDIA.

    • INSTALL_MEDIA/lib/xliADRecon.jar

    • INSTALL_MEDIA/lib/xliExchange.jar

    • INSTALL_MEDIA/lib/xliExchangeRecon.jar

  4. Do one of the following based on the Microsoft Exchange version:

    • Copy the CreateMailboxExchange2007.vbs file from the INSTALL_MEDIA/scripts directory to the RM_HOME/scripts directory:

    • Copy the CreateExchangeMailbox2010.vbs file from the INSTALL_MEDIA/scripts directory to the RM_HOME/scripts directory:

    Note:

    Ensure that the RM_HOME directory is secured using Microsoft Windows best practices. Only the target system user account for Oracle Identity Manager must have permissions to access the RM_HOME directory.

  5. To enable logging in the Remote Manager, create a log directory and file inside the RM_HOME directory. For example:

    RM_HOME/Log/Report.log

  6. Specify the name of the Remote Manager as the value of the Remote Manager IT resource parameter. This parameter is described in Section 2.2.1.2, "Creating the IT Resource".

    See one of the following guides for information about modifying the value of an IT resource parameter:

    • For Oracle Identity Manager release 9.1.0.x:

      Oracle Identity Manager Administrative and User Console Guide

    • For Oracle Identity Manager release 11.1.x:

      Oracle Fusion Middleware System Administrator's Guide for Oracle Identity Manager

2.2.2.2 Enabling Client-Side Authentication for the Remote Manager

To enable client-side authentication for the Remote Manager:

Note:

If you have already enabled client-side authentication for the Remote Manager in Microsoft Active Directory, then you need not perform the procedure described in this section.

  1. Open one of the following files in a text editor:

    • For Oracle Identity Manager release 9.1.0.x:

      RM_HOME/xlremote/config/xlconfig.xml

    • For Oracle Identity Manager release 11.1.x:

      OIM_HOME/remote_manager/config/xlconfig.xml

  2. Set the ClientAuth property to true as follows:

    <ClientAuth>true</ClientAuth>

  3. If you are using Oracle Identity Manager release 9.1.0.x, then ensure that the RMIOverSSL property is set to true as follows:

    <RMIOverSSL>true</RMIOverSSL>

  4. Save and close the file.

  5. If you are using Oracle Identity Manager release 9.1.0.x, then perform Steps 2 through 4 in the OIM_HOME/config/xlconfig.xml file.

2.3 Postinstallation

Postinstallation information is divided across the following sections:

2.3.1 Postinstallation on Oracle Identity Manager

Postinstallation on Oracle Identity Manager consists of the following procedures:

Note:

In an Oracle Identity Manager cluster, you must perform these procedures on each node of the cluster.

2.3.1.1 Configuring Oracle Identity Manager 11.1.2 or Later

If you are using Oracle Identity Manager release 11.1.2 or later, you must create additional metadata such as a UI form and an application instance. In addition, you must run entitlement and catalog synchronization jobs. These procedures are described in the following sections:

2.3.1.1.1 Tagging Form Fields

You must add properties to certain form fields. To do so:

  1. Log in to Oracle Identity Manager Design Console.

  2. Open Exchange parent form (UD_MSEXCHG).

  3. Create a new form version.

  4. In the Properties tab, add the following properties:

    For the Exchange IT Resource field, add ITResource = true property.

    For the Log On Name field, add AccountName = true property.

    For the Object GUID field, add AccountId = true property.

  5. Click Make Version Active.

2.3.1.1.2 Creating and Activating a Sandbox

Create and activate a sandbox as follows. For detailed instructions, see the "Managing Sandboxes" section in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

  1. On the upper navigation bar, click Sandboxes. The Manage Sandboxes page is displayed.

  2. On the toolbar, click Create Sandbox. The Create Sandbox dialog box is displayed.

  3. In the Sandbox Name field, enter a name for the sandbox. This is a mandatory field.

  4. In the Sandbox Description field, enter a description of the sandbox. This is an optional field.

  5. Click Save and Close. A message is displayed with the sandbox name and creation label.

  6. Click OK. The sandbox is displayed in the Available Sandboxes section of the Manage Sandboxes page.

  7. Select the sandbox that you created.

  8. From the table showing the available sandboxes in the Manage Sandboxes page, select the newly created sandbox that you want to activate.

  9. On the toolbar, click Activate Sandbox.

    The sandbox is activated.

2.3.1.1.3 Creating a New UI Form

Create a new UI form as follows. For detailed instructions, see the "Managing Forms" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

  1. In the left pane, under Configuration, click Form Designer.

  2. Under Search Results, click Create.

  3. Select the resource type for which you want to create the form, for example, Exchange IT resource.

  4. Enter a form name and click Create.

2.3.1.1.4 Creating an Application Instance

Create an application instance as follows. For detailed instructions, see the "Managing Application Instances" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.

  1. In the System Administration page, under Configuration in the left pane, click Application Instances.

  2. Under Search Results, click Create.

  3. Enter appropriate values for the fields displayed on the Attributes form and click Save.

  4. In the Form drop-down list, select the newly created form and click Apply.

  5. Publish the application instance for a particular organization.

2.3.1.1.5 Publishing a Sandbox

To publish the sandbox that you created in Section 2.3.1.1.2, "Creating and Activating a Sandbox":

  1. Close all the open tabs and pages.

  2. From the table showing the available sandboxes in the Manage Sandboxes page, select the sandbox that you created in Section 2.3.1.1.2, "Creating and Activating a Sandbox."

  3. On the toolbar, click Publish Sandbox. A message is displayed asking for confirmation.

  4. Click Yes to confirm. The sandbox is published and the customizations it contained are merged with the main line.

2.3.1.1.6 Syncing Catalog

To sync catalog:

  1. Run the scheduled jobs for lookup field synchronization listed in Section 3.3, "Scheduled Task for Lookup Field Synchronization."

  2. Run the Catalog Synchronization Job scheduled job. See the "Predefined Scheduled Tasks" section in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information about this scheduled job.

2.3.1.1.7 Updating an Existing Application Instance with a New Form

For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:

  1. Create a sandbox and activate it as described in Section 2.3.1.1.2, "Creating and Activating a Sandbox."

  2. Create a new UI form for the resource as described in Section 2.3.1.1.3, "Creating a New UI Form."

  3. Open the existing application instance.

  4. In the Form field, select the new UI form that you created.

  5. Save the application instance.

  6. Publish the sandbox as described in Section 2.3.1.1.5, "Publishing a Sandbox."

    Note:

    If you are using Oracle Identity Manager 11g Release 2 (11.1.2.0.4) or later, then you must perform the steps mentioned in MetaLink note 1535369.1 to ensure provisioning operations work as expected.

2.3.1.2 Clearing Content Related to Connector Resource Bundles from the Server Cache

Note:

In an Oracle Identity Manager cluster, you must perform this step on each node of the cluster. Then, restart each node.

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the OIM_HOME/xellerate/connectorResources directory for Oracle Identity Manager release 9.1.0.x and Oracle Identity Manager database for Oracle Identity Manager release 11.1.x. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

  1. In a command window, perform one of the following steps:

    • If you are using Oracle Identity Manager release 9.1.0.x, then switch to the OIM_HOME/xellerate/bin directory.

    • If you are using Oracle Identity Manager release 11.1.x, then switch to the OIM_HOME/server/bin directory.

    Note:

    You must perform Step 1 before you perform Step 2. An exception is thrown if you run the command described in Step 2 as follows:

    For Oracle Identity Manager release 9.1.0.x:

    OIM_HOME/xellerate/bin/SCRIPT_FILE_NAME

    For Oracle Identity Manager release 11.1.x:

    OIM_HOME/server/bin/SCRIPT_FILE_NAME

  2. Enter one of the following commands:

    Note:

    You can use the PurgeCache utility to purge the cache for any content category. Run PurgeCache.bat CATEGORY_NAME on Microsoft Windows or PurgeCache.sh CATEGORY_NAME on UNIX. The CATEGORY_NAME argument represents the name of the content category that must be purged.

    For example, the following commands purge Metadata entries from the server cache:

    PurgeCache.bat MetaData

    PurgeCache.sh MetaData

    • For Oracle Identity Manager release 9.1.0.x:

      On Microsoft Windows: PurgeCache.bat ConnectorResourceBundle

      On UNIX: PurgeCache.sh ConnectorResourceBundle

      Note:

      You can ignore the exception that is thrown when you perform Step 2. This exception is different from the one mentioned in Step 1.

      In this command, ConnectorResourceBundle is one of the content categories that you can delete from the server cache. See the following file for information about the other content categories:

      OIM_HOME/xellerate/config/xlconfig.xml

    • For Oracle Identity Manager release 11.1.x:

      On Microsoft Windows: PurgeCache.bat All

      On UNIX: PurgeCache.sh All

      When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

      t3://OIM_HOST_NAME:OIM_PORT_NUMBER

      In this format:

      • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

      • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

    See Oracle Fusion Middleware System Administrator's Guide for Oracle Identity Manager for more information about the PurgeCache utility.

2.3.1.3 Enabling Logging

Depending on the Oracle Identity Manager release you are using, perform instructions in one of the following sections:

2.3.1.3.1 Enabling Logging on Oracle Identity Manager Release 9.1.0.x

Note:

In an Oracle Identity Manager cluster, perform this procedure on each node of the cluster. Then, restart each node.

When you enable logging, Oracle Identity Manager automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

  • ALL

    This level enables logging for all events.

  • DEBUG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • INFO

    This level enables logging of messages that highlight the progress of the application at a coarse-grained level.

  • WARN

    This level enables logging of information about potentially harmful situations.

  • ERROR

    This level enables logging of information about error events that might allow the application to continue running.

  • FATAL

    This level enables logging of information about very severe error events that could cause the application to stop functioning.

  • OFF

    This level disables logging for all events.

The file in which you set the log level and the log file path depend on the application server that you use:

  • IBM WebSphere Application Server

    To enable logging:

    1. Add the following lines in the OIM_HOME/xellerate/config/log.properties file:

      log4j.logger.XELLERATE=LOG_LEVEL
log4j.logger.OIMCP.MEXC=LOG_LEVEL

    2. In these lines, replace LOG_LEVEL with the log level that you want to set.

      For example:

      log4j.logger.XELLERATE=INFO
log4j.logger.OIMCP.MEXC=INFO

    After you enable logging, log information is written to the following file:

    WEBSHERE_HOME/AppServer/logs/SERVER_NAME/SystemOut.log

  • JBoss Application Server

    To enable logging:

    1. In the JBOSS_HOME/server/default/conf/log4j.xml file, locate or add the following lines:

      <category name="XELLERATE">
   <priority value="LOG_LEVEL"/>
</category>

      <category name="OIMCP.MEXC">
   <priority value="LOG_LEVEL"/>
</category>

    2. In the second XML code line of each set, replace LOG_LEVEL with the log level that you want to set. For example:

      <category name="XELLERATE">
   <priority value="INFO"/>
</category>

      <category name="OIMCP.MEXC">
   <priority value="INFO"/>
</category>

    After you enable logging, log information is written to the following file:

    JBOSS_HOME/server/default/log/server.log

  • Oracle Application Server

    To enable logging:

    1. Add the following lines in the OIM_HOME/xellerate/config/log.properties file:

      log4j.logger.XELLERATE=LOG_LEVEL
log4j.logger.OIMCP.MEXC=LOG_LEVEL

    2. In these lines, replace LOG_LEVEL with the log level that you want to set.

      For example:

      log4j.logger.XELLERATE=INFO
log4j.logger.OIMCP.MEXC=INFO

    After you enable logging, log information is written to the following file:

    ORACLE_HOME/opmn/logs/default_group~home~default_group~1.log

  • Oracle WebLogic Server

    To enable logging:

    1. Add the following lines in the OIM_HOME/xellerate/config/log.properties file:

      log4j.logger.XELLERATE=LOG_LEVEL
log4j.logger.OIMCP.MEXC=LOG_LEVEL

    2. In these lines, replace LOG_LEVEL with the log level that you want to set.

      For example:

      log4j.logger.XELLERATE=INFO
log4j.logger.OIMCP.MEXC=INFO

    After you enable logging, log information is displayed on the server console.

2.3.1.3.2 Enabling Logging on Oracle Identity Manager Release 11.1.x

Note:

In an Oracle Identity Manager cluster, perform this procedure on each node of the cluster. Then, restart each node.

Oracle Identity Manager release 11.1.1 uses Oracle Java Diagnostic Logging (OJDL) for logging. OJDL is based on java.util.logger. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

  • SEVERE.intValue()+100

    This level enables logging of information about fatal errors.

  • SEVERE

    This level enables logging of information about errors that might allow Oracle Identity Manager to continue running.

  • WARNING

    This level enables logging of information about potentially harmful situations.

  • INFO

    This level enables logging of messages that highlight the progress of the application.

  • CONFIG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • FINE, FINER, FINEST

    These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These log levels are mapped to ODL message type and level combinations as shown in Table 2-3.

Table 2-3 Log Levels and ODL Message Type:Level Combinations

Log Level ODL Message Type:Level

SEVERE.intValue()+100

INCIDENT_ERROR:1

SEVERE

ERROR:1

WARNING

WARNING:1

INFO

NOTIFICATION:1

CONFIG

NOTIFICATION:16

FINE

TRACE:1

FINER

TRACE:16

FINEST

TRACE:32

The configuration file for OJDL is logging.xml, which is located at the following path:

DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml

Here, DOMAIN_HOME and OIM_SERVER are the domain name and server name specified during the installation of Oracle Identity Manager.

To enable logging in Oracle WebLogic Server:

  1. Edit the logging.xml file as follows:

    1. Add the following blocks in the file:

      <log_handler name='ad-exc-handler' level='[LOG_LEVEL]' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
<property name='logreader:' value='off'/>
     <property name='path' value='[FILE_NAME]'/>
     <property name='format' value='ODL-Text'/>
     <property name='useThreadName' value='true'/>
     <property name='locale' value='en'/>
     <property name='maxFileSize' value='5242880'/>
     <property name='maxLogSize' value='52428800'/>
     <property name='encoding' value='UTF-8'/>
   </log_handler>

      <logger name="OIMCP.MEXC" level="[LOG_LEVEL]" useParentHandlers="false">
     <handler name="ad-exc-handler"/>
     <handler name="console-handler"/>
   </logger>

    2. Replace both occurrences of [LOG_LEVEL] with the ODL message type and level combination that you require. Table 2-3 lists the supported message type and level combinations.

      Similarly, replace [FILE_NAME] with the full path and name of the log file in which you want log messages to be recorded.

      The following blocks show sample values for [LOG_LEVEL] and [FILE_NAME] :

      <log_handler name='ad-exc-handler' level='NOTIFICATION:1' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
<property name='logreader:' value='off'/>
     <property name='path' value='F:\MyMachine\middleware\user_projects\domains\base_domain1\servers\oim_server1\logs\oim_server1-diagnostic-1.log'/>
     <property name='format' value='ODL-Text'/>
     <property name='useThreadName' value='true'/>
     <property name='locale' value='en'/>
     <property name='maxFileSize' value='5242880'/>
     <property name='maxLogSize' value='52428800'/>
     <property name='encoding' value='UTF-8'/>
   </log_handler>
 
<logger name="OIMCP.MEXC" level="NOTIFICATION:1" useParentHandlers="false">
     <handler name="ad-exc-handler"/>
     <handler name="console-handler"/>
   </logger>

    With these sample values, when you use Oracle Identity Manager, all messages generated for this connector that are of a log level equal to or higher than the NOTIFICATION:1 level are recorded in the specified file.

  2. Save and close the file.

  3. Set the following environment variable to redirect the server logs to a file:

    For Microsoft Windows:

    set WLS_REDIRECT_LOG=FILENAME

    For UNIX:

    export WLS_REDIRECT_LOG=FILENAME

    Replace FILENAME with the location and name of the file to which you want to redirect the output.

  4. Restart the application server.

2.3.1.4 Linking the Exchange Resource Object with the AD User Resource Object

To link the Exchange resource object with the AD User resource object:

  1. On the Design Console, expand Resource Management and then double-click Resource Objects.

  2. Search for and open the AD User resource object.

  3. On the Status Definition sub tab of the Resource Object tab, ensure that the Disabled and Revoked check boxes are selected.

  4. To save the changes to the AD User resource object, click the Save icon.

  5. Search for and open the Exchange resource object.

  6. On the Depends On sub tab of the Resource Object tab, click Assign.

  7. In the Assigned Objects Dialog box, move the AD User resource object from Unassigned Objects to Assigned Objects.

  8. Click OK.

  9. To save the changes to the Exchange resource object, click the Save icon.

2.3.1.5 Modifying Dependent Lookup Query Properties for Lookup Fields on Microsoft SQL Server

Note:

Perform the procedure described in this section only if your Oracle Identity Manager installation is running on Microsoft SQL Server.

In an Oracle Identity Manager cluster, perform this procedure on each node of the cluster. Then, restart each node.

In this connector, the child forms of a resource implement the dependent lookup feature of Oracle Identity Manager. By default, the queries for synchronization of lookup field values from the target system are based on Oracle Database SQL. If your Oracle Identity Manager installation is running on Microsoft SQL Server, then you must modify the lookup queries for synchronization of lookup definitions as follows:

  1. On the Design Console, expand Development Tools and double-click Form Designer.

  2. Perform the following procedure for the UD_MSEXCHG form:

    1. Search for and open the form.

    2. Click Create New Version.

    3. Enter a version for the form, click the Save icon, and then close the dialog box.

    4. On the Additional Columns subtab of the Properties tab, search for the row containing the ITResourceLookupField field type. The following screenshot shows the row that holds information about the process form field for the IT resource lookup definition:

      Process form field for the IT resource lookup definition

    5. Note down the value in the Name column for the row containing the ITResourceLookupField field type.

    6. On the Child Tables subtab of the Properties tab, double-click Lookup Query in the list of components.

    7. From the Edit Property dialog box, copy the contents of the Property Value field for the Lookup Query property name into a text file. The contents of the Property Value field are the SQL query for Oracle Database.

      The following is a sample Oracle Database query for parent forms:

      select lkv_encoded,lkv_decoded from lkv lkv,lku lku where lkv.lku_key=lku.lku_key and lku_type_string_key='Lookup.ExchangeReconciliation.MailStore' and substr(lkv_encoded,1,length(concat((select svr_key from svr where svr_name='$Form data.UD_MSEXCHG_ADSERVER$'),'~')))=concat((select svr_key from svr where svr_name='$Form data.UD_SAP_ITRESOURCE$'),'~')

      The following screenshot shows the Edit Property dialog box:

      Screenshot shows the Edit Property dialog box

    8. Note down the value of the lku_type_string_key column from the Oracle Database query. In the sample Oracle Database query, the value of the lku_type_string_key column is Lookup.ExchangeReconciliation.MailStore.

    9. Delete the contents of the Property Value field.

    10. Copy the following query into the Property Value field:

      select lkv_encoded,lkv_decoded from lkv lkv,lku lku where lkv.lku_key=lku.lku_key and lku_type_string_key='LOOKUP_DEFINITION_NAME' and CHARINDEX( (select CONVERT(varchar,svr_key)  from svr where svr_name='$Form data.IT_RESOURCE_COLUMN_NAME$') + '~' ,lkv_encoded)>0

      In this query:

      Replace LOOKUP_DEFINITION_NAME with the lookup definition name that you copy in Step h.

      Replace IT_RESOURCE_COLUMN_NAME with the name of the value that you note down in Step e.

    11. In the Edit Property dialog box, click the Save icon and then close the dialog box.

    12. Click the Save icon to save changes to the process form.

    13. From the Current Version list, select the version that you modified.

    14. Click Make Version Active.

    15. Click the Save icon.

2.3.1.6 Configuring Oracle Identity Manager for Request-Based Provisioning

Note:

Perform the procedure described in this section only if both the conditions are true:

  • You are using Oracle Identity Manager release 11.1.1.

    The procedure is not applicable to Oracle Identity Manager release 11.1.2.

  • You want to perform request-based provisioning operations.

In request-based provisioning, an end user creates a request for a resource by using the Administrative and User Console. Administrators or other users can also create requests for a particular user. Requests for a particular resource on the resource can be viewed and approved by approvers designated in Oracle Identity Manager.

The following are features of request-based provisioning:

  • A user can be provisioned only one resource (account) on the target system.

    Note:

    Direct provisioning allows the provisioning of multiple Microsoft Exchange accounts on the target system.

  • Direct provisioning cannot be used if you enable request-based provisioning.

To configure request-based provisioning, perform the following procedures:

2.3.1.6.1 Copying Predefined Request Datasets

A request dataset is an XML file that specifies the information to be submitted by the requester during a provisioning operation. Predefined request datasets are shipped with this connector. These request datasets specify information about the default set of attributes for which the requester must submit information during a request-based provisioning operation. The following is the list of predefined request datasets available in the DataSets directory on the installation media:

ProvisionResourceExchange.xml

Copy this file from the installation media to any directory on the Oracle Identity Manager host computer. It is recommended that you create a directory structure as follows:

/custom/connector/RESOURCE_NAME

For example:

E:\MyDatasets\custom\connector\Exchng

Note:

Until you complete the procedure to configure request-based provisioning, ensure that there are no other files or directories inside the parent directory in which you create the directory structure. In the preceding example, ensure that there are no other files or directories inside the E:\MyDatasets directory.

The directory structure to which you copy the dataset files is the MDS location into which these files are imported after you run the Oracle Identity Manager MDS Import utility. The procedure to import dataset files is described in the next section.

Depending on your requirement, you can modify the file names of the request datasets. In addition, you can modify the information in the request datasets. See Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for information on modifying request datasets.

2.3.1.6.2 Importing Request Datasets into MDS

All request datasets must be imported into the metadata store (MDS), which can be done by using the Oracle Identity Manager MDS Import utility.

To import a request dataset definition into MDS:

  1. Ensure that you have set the environment for running the MDS Import utility. See Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for detailed information about setting up the environment for MDS utilities.

    Note:

    While setting up the properties in the weblogic.properties file, ensure that the value of the metadata_from_loc property is the parent directory of the /custom/connector/RESOURCE_NAME directory. For example, while performing the procedure in Section 2.3.1.6.1, "Copying Predefined Request Datasets," if you copy the files to the E:\MyDatasets\custom\connector\Exchng directory, then set the value of the metada_from_loc property to E:\MyDatasets.

  2. In a command window, change to the OIM_HOME\server\bin directory.

  3. Run one of the following commands:

    • On Microsoft Windows

      weblogicImportMetadata.bat

    • On UNIX

      weblogicImportMetadata.sh

  4. When prompted, enter the following values:

    • Please enter your username [weblogic]

      Enter the username used to log in to WebLogic server

      Sample value: WL_User

    • Please enter your password [weblogic]

      Enter the password used to log in to WebLogic server

    • Please enter your server URL [t3://localhost:7001]

      Enter the URL of the application server in the following format:

      t3://HOST_NAME_IP_ADDRESS:PORT

      In this format, replace:

      • HOST_NAME_IP_ADDRESS with the host name or IP address of the computer on which Oracle Identity Manager is installed.

      • PORT with the port on which Oracle Identity Manager is listening.

    The request dataset is imported into MDS at the following location:

    /custom/connector/RESOURCE_NAME

2.3.1.6.3 Enabling the Auto Save Form Feature

To enable the Auto Save Form feature:

  1. Log in to the Design Console.

  2. Expand Process Management, and then double-click Process Definition.

  3. Search for and open the Exchange process definition.

  4. Select the Auto Save Form check box.

  5. Click the Save icon.

2.3.1.6.4 Running the PurgeCache Utility

Run the PurgeCache utility to clear content belonging to the Metadata category from the server cache. See Section 2.3.1.2, "Clearing Content Related to Connector Resource Bundles from the Server Cache" for instructions.

The procedure to configure request-based provisioning ends with this step.

2.3.2 Postinstallation on the Target System

Postinstallation on the target system involves the following procedure:

2.3.2.1 Configuring SSL

You need not configure SSL for Microsoft Exchange if it is already configured on the Microsoft Active Directory target system to which your Microsoft Exchange is linked.

2.3.3 Configuring the Remote Manager

Note:

Perform this procedure only if you have installed the Remote Manager for Microsoft Exchange 2007. The procedure to install the Remote Manager is described in Section 2.2.2.1, "Installing the Remote Manager."

If you have installed multiple Microsoft Exchange 2007 Remote Managers, then you must perform this procedure for each Remote Manager.

For reconciliation in Microsoft Exchange 2007, Oracle Identity Manager uses the Microsoft Active Directory IT resource. For provisioning in Microsoft Exchange 2007, Oracle Identity Manager uses the Microsoft Active Directory IT resource, Exchange IT resource, and the Remote Manager IT resource values. For information about the Exchange IT resource parameters, see Section 2.2.1.2, "Creating the IT Resource."

This section discusses the following topics:

2.3.3.1 Creating the IT Resource for the Remote Manager

To create the IT resource for the Remote Manager:

  1. Log in to the Administrative and User Console.

  2. If you are using Oracle Identity Manager release 9.1.0.x, expand Resource Management, and then click Create IT Resource.

  3. If you are using Oracle Identity Manager release 11.1.1, then:

    • On the Welcome to Oracle Identity Manager Self Service page, click Advanced in the upper-right corner.

    • On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Create IT Resource.

  4. If you are using Oracle Identity Manager release 11.1.2, then:

    • Log in to Oracle Identity System Administration.

    • In the left pane, under Configuration, click IT Resource.

  5. On the Step 1: Provide IT Resource Information page, enter the following information:

    • IT Resource Name: Enter Exchange Remote Manager IT Resource.

    • IT Resource Type: Select Remote Manager from the IT Resource Type list.

    • Remote Manager: Do not enter a value in this field.

  6. Click Continue.

  7. On the Step 2: Specify IT Resource Parameter Values page, specify values for the parameters of the IT resource and then click Continue. Table 2-4 describes the parameters for this IT resource.

    Table 2-4 Parameters of the IT Resource for the Remote Manager

    Parameter Description

    service name

    Enter a name for the remote manager.

    Sample value: RManager

    url

    Enter the IP address of the target system host computer and the port number at which the Remote Manager is listening.

    Sample value: rmi://10.0.0.1:12346

  8. Click Continue.

  9. On the Step 4: Verify IT Resource Details page, review the information that you provided on the first, second, and third pages. If you want to make changes in the data entered on any page, click Back to revisit the page and then make the required changes.

  10. To proceed with the creation of the IT resource, click Continue.

  11. The Step 5: IT Resource Connection Result page displays the results of a connectivity test that is run using the IT resource information. If the test is successful, then click Create. If the test fails, then you can perform one of the following steps:

    • Click Back to revisit the previous pages and then make corrections in the IT resource creation information.

    • Click Cancel to stop the procedure, and then begin from the first step onward.

    • Proceed with the creation process by clicking Continue. You can fix the problem later, and then rerun the connectivity test by using the Diagnostic Dashboard.

  12. The Step 6: IT Resource Created page displays the details of the IT resource that you created. Click Finish.

2.3.3.2 Configuring Oracle Identity Manager Release 9.1.0.x to Trust the Remote Manager

To configure Oracle Identity Manager to trust the Remote Manager you have installed:

  1. From the computer hosting the Remote Manager, copy the RM_HOME/xlremote/config/xlserver.cert file to a temporary directory on the Oracle Identity Manager host computer.

    Note:

    The server certificate in the OIM_HOME directory is also named xlserver.cert. Ensure that you do not overwrite that certificate.

  2. To import the certificate by using the keytool utility, run the following command:

    JAVA_HOME/jre/bin/keytool -import -alias ALIAS -file RM_CERT_LOCATION/xlserver.cert -keystore OIM_HOME/xellerate/config/.xlkeystore -storepass PASSWORD

    In the preceding command, replace:

    • JAVA_HOME with the location of the Java directory for your application server.

    • ALIAS with an alias for the certificate in the store.

    • RM_CERT_LOCATION with the full path of the temporary directory where you copied the certificate.

    • PASSWORD with the password of the keystore.

  3. Copy the OIM_HOME/xellerate/config/xlserver.cert file to a temporary directory on the Remote Manager host computer.

  4. To import the certificate by using the keytool utility on the Remote Manager host computer, run the following command:

    JAVA_HOME/jre/bin/keytool -import -alias ALIAS -file OIM_CERT_LOCATION/xlserver.cert -keystore RM_HOME/xlremote/config/.xlkeystore -storepass PASSWORD

    In the preceding command, replace:

    • JAVA_HOME with the location of the Java directory for your application server.

    • ALIAS with an alias for the certificate in the store.

    • OIM_CERT_LOCATION with the full path of the temporary directory where you copied the certificate.

    • PASSWORD with the password of the keystore.

      Note:

      It is recommended that you follow security best practices and change the default passwords used for the Remote Manager keystore. To change the Remote Manager keystore password, follow the instructions given in Oracle Identity Manager Installation and Configuration Guide for your application server.

2.3.3.3 Configuring Oracle Identity Manager Release 11.1.x to Trust the Remote Manager

To configure Oracle Identity Manager to trust the Remote Manager:

  1. On the computer hosting Oracle Identity Manager, export the certificate by running the following command:

    keytool -export -keystore KEYSTORE_FILE -storepass KEYSTORE_PASSWORD -alias ALIAS -file CERT_FILE_NAME

    In this command:

    • KEYSTORE_FILE is the complete path and name of the keystore.

    • KEYSTORE_PASSWORD is the password of the keystore.

    • ALIAS is the alias of the certificate to be exported.

    • CERT_FILE_NAME is the file name containing the exported certificate

    The following is a sample command:

    keytool -export -keystore D:\March11g\Middleware\user_projects\domains\MARCHWIN\config\fmwconfig\default-keystore.jks -storepass MyPa55word -alias xell -file oim.cer

  2. Copy the exported certificate to any directory on the target system.

  3. To import the certificate, run the following command:

    keytool -import -keystore KEYSTORE_FILE -storepass KEYSTORE_PASSWORD -alias ALIAS -file CERT_FILE_NAME

    In this command:

    • KEYSTORE_FILE is the complete path and name of the keystore.

    • KEYSTORE_PASSWORD is the password of the keystore.

    • ALIAS is the alias of the certificate to be imported.

    • CERT_FILE_NAME is the file name containing the imported certificate

    The following is a sample command:

    keytool -import -keystore C:\Oracle\Middleware1\Oracle_IDM1\remote_manager\config\default-keystore.jks -storepass MyPa55word -alias oimserver -file C:\Oracle\Middleware1\OIMCert\oim.cer

  4. Copy the OIM_HOME/config/xlserver.cert file from the Remote Manager host computer to a temporary directory on the Oracle Identity Manager host computer.

  5. To import the certificate, run the following command:

    keytool -import -keystore KEYSTORE_FILE -storepass KEYSTORE_PASSWORD -alias ALIAS -file CERT_FILE_NAME

    In this command:

    • KEYSTORE_FILE is the complete path and name of the keystore.

    • KEYSTORE_PASSWORD is the password of the keystore.

    • ALIAS is the alias of the certificate to be imported.

    • CERT_FILE_NAME is the file name containing the imported certificate

    The following is a sample command

    keytool -import -keystore D:\March11g\Middleware\user_projects\domains\MARCHWIN\config\fmwconfig\default_keystore.jks -storepass Welcome1 -alias rmcert -file D:\March11g\Middleware\RMCert146\xlserver.cert

2.3.3.4 Verifying That the Remote Manager Is Running

To ensure that the Remote Manager is running:

  1. Use the following script to start the Remote Manager:

    For Oracle Identity Manager release 9.1.0.x:

    RM_HOME/xlremote/remotemanager.bat

    For Oracle Identity Manager release 11.1.x:

    OIM_HOME/remote_manager/remotemanager.bat

  2. Log in to the Design Console.

  3. Expand Administration, and double-click Remote Manager.

  4. Search for and open the Remote Manager that you have created.

  5. Click the Refresh icon. The screen displays details of the Remote Manager that you have configured. The running check box should be selected for the Remote Manager. This implies that the status of the Remote Manager is active.

2.3.4 Localizing Field Labels in UI Forms

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 11.1.2 or later and you want to localize UI form field labels.

To localize field label that you add to in UI forms:

  1. Log in to Oracle Enterprise Manager.

  2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.

  3. In the right pane, from the Application Deployment list, select MDS Configuration.

  4. On the MDS Configuration page, click Export and save the archive to the local computer.

  5. Extract the contents of the archive, and open one of the following files in a text editor:

    • For Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle_en.xlf

    • For releases prior to Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle.xlf

  6. Edit the BizEditorBundle.xlf file in the following manner:

    1. Search for the following text:

      <file source-language="en"  
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

    2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE"
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja"
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

    3. Search for the application instance code. This procedure shows a sample edit for Exchange application instance. The original code is:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_MSEXCHG_DISPLAYNAME__c_description']}">
<source>Display Name</source>
<target/>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.EFORM.entity.EFORMEO.UD_MSEXCHG_DISPLAYNAME__c_LABEL">
<source>Display Name</source>
<target/>
</trans-unit>

    4. Open the resource file from the connector package, for example Exchange_ja.properties, and get the value of the attribute from the file, for example, global.udf.UD_MSEXCHG_DISPLAYNAME=\u8868\u793A\u540D.

    5. Replace the original code shown in Step 6.c with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_MSEXCHG_DISPLAYNAME__c_description']}">
<source>Display Name</source>
<target>\u8868\u793A\u540D</target>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.EFORM.entity.EFORMEO.UD_MSEXCHG_DISPLAYNAME__c_LABEL">
<source>Display Name</source>
<target>\u8868\u793A\u540D</target>
</trans-unit>

    6. Repeat Steps 6.a through 6.d for all attributes of the process form.

    7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing.

      Sample file name: BizEditorBundle_ja.xlf.

  7. Repackage the ZIP file and import it into MDS.

    See Also:

    The "Deploying and Undeploying Customizations" chapter in the Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager, for more information about exporting and importing metadata files

  8. Log out of and log in to Oracle Identity Manager.