Contents

Title and Copyright Information

Preface

• Audience
• Documentation Accessibility
• Related Documents
• Conventions

What's New in This Guide

• New Features in Release 12c (12.2.1.2)
• New Features in Release 12c (12.2.1.1)
  • New IDS Tuning Configuration Parameters
• New Features in Release 12c (12.2.1)
  • New IDS Configuration Parameters
  • Support to Reclaim Connection Back into the Connection Pool
• New Features in Release 12c (12.1.3)
  • Logical NOT Operator in Search Filters
  • Pass-Through Support for Entity Attributes

1 Introduction to Identity Governance Framework

• 1.1 Overview of the Identity Governance Framework
  • 1.1.1 Benefits of Identity Governance Framework to Organizations
  • 1.1.2 Benefits of Identity Governance Framework to Developers
• 1.2 Understanding Identity Governance Framework APIs
• 1.3 System Requirements and Certification for Identity Governance Framework

2 Using the Identity Directory API

• 2.1 Overview of the Identity Directory API
  • 2.1.1 Understanding Identity Directory API
  • 2.1.2 Identity Directory Service Architecture
• 2.2 Identity Directory API Configuration
  • 2.2.1 Logical Entity Configuration for an Identity Directory Service
    • 2.2.1.1 Properties of a Logical Entity Configuration
    • 2.2.1.2 Attributes of a Logical Entity Configuration
    • 2.2.1.3 Properties of a Logical Entity Definition
    • 2.2.1.4 Properties of a Logical Entity Relationship
  • 2.2.2 Physical Identity Store Configuration for an Identity Directory Service
  • 2.2.3 Operational Configuration for an Identity Directory Service
• 2.3 Design Recommendations for Identity Directory API
  • 2.3.1 Minimizing Use of defaultFetch Attributes
  • 2.3.2 Initializing the Identity Directory Once
• 2.4 Examples of Using the Identity Directory API
  • 2.4.1 Initializing and Obtaining Identity Directory Handle
  • 2.4.2 Initializing and Obtaining Identity Directory Handle from JPS Context
  • 2.4.3 Initializing and Obtaining In-Memory Identity Directory Handle
  • 2.4.4 Adding a User
  • 2.4.5 Obtaining a User for Given Principal
  • 2.4.6 Modifying a User
  • 2.4.7 Obtaining a User for Given ID Value
  • 2.4.8 Searching Users Using Complex Search Filter
  • 2.4.9 Changing User Password
  • 2.4.10 Resetting User Password
  • 2.4.11 Authenticating a User
  • 2.4.12 Deleting a User
  • 2.4.13 Creating a Group
  • 2.4.14 Searching Groups
  • 2.4.15 Obtaining Management Chain
  • 2.4.16 Obtaining Reportees of a User
  • 2.4.17 Adding a Member to a Group
  • 2.4.18 Deleting a Member From a Group
  • 2.4.19 Obtaining All The Groups For Which User is a Member
  • 2.4.20 Using Logical NOT Operator in a Search Filter

3 Using the ArisID API

• 3.1 About the ArisID API
• 3.2 Configuring the ArisID API
  • 3.2.1 Examining CARML Files
  • 3.2.2 Configuring the Identity Repository
  • 3.2.3 Configuring the Mapping File
• 3.3 Design Recommendations for the ArisID API
  • 3.3.1 About Unique Identifier Configuration
  • 3.3.2 About Unique Key Attribute Specification
  • 3.3.3 About Multiple Language Support
  • 3.3.4 Handling Large Results
  • 3.3.5 Securing the Application
    • 3.3.5.1 Applying Domain Level Credentials
    • 3.3.5.2 Applying Application Level Credentials
  • 3.3.6 Configuring the Timeout Interval
  • 3.3.7 Specifying Wildcard Characters in Search Filters
• 3.4 Generating ArisID Beans
• 3.5 Examples of Using IDX User and Role Beans
  • 3.5.1 Searching Users Using IDX User and Role Beans: SearchUsers.jsp
  • 3.5.2 Searching Users Using IDX User and Role Beans: SearchUsers.html
• 3.6 Understanding OpenLDAP Considerations

4 Migrating to Identity Directory API

• 4.1 Overview of Migrating to Identity Directory API
• 4.2 Migrating the Application to Identity Directory API
  • 4.2.1 Initializing API
  • 4.2.2 Getting UserManager and GroupManager Handle
  • 4.2.3 Searching Filter
  • 4.2.4 Performing CRUD Operations
    • 4.2.4.1 APIs to Find a User
    • 4.2.4.2 APIs to Search a User
    • 4.2.4.3 APIs to Create a User
    • 4.2.4.4 APIs to Delete a User
    • 4.2.4.5 APIs to Authenticate a User
    • 4.2.4.6 APIs to Modify Users and Manage Related Entities
• 4.3 Understanding the Comparison Between User and Role API With IDS API
  • 4.3.1 Comparison of User-Related APIs With Identity Directory APIs
  • 4.3.2 Comparison of Role-Related APIs With Identity Directory APIs
• 4.4 Moving From a Test to a Production Environment
  • 4.4.1 Overview of Moving Between Environments
  • 4.4.2 Modifying Identity Directory Service/libOVD Move Plan
    • 4.4.2.1 Locating Identity Directory Service/libOVD configGroup Elements
    • 4.4.2.2 Properties to Customize for Identity Directory Service/libOVD Move Plan
• 4.5 Tuning Configuration Parameters for IDS
  • 4.5.1 Configuration Parameters for IDS
  • 4.5.2 WLST Commands to Set Tuning Parameters Using File-Based Configuration
  • 4.5.3 WLST Commands to Set Tuning Parameters Using In-Memory Configuration
  • 4.5.4 Handling Firewall and Load Balancer Timeout Errors
• 4.6 Allowing Pass-through Attributes in IDS