| Oracle® Identity Manager Design Console Guide Release 9.0 B25940-01 |
|
 Previous |
 Next |
| Oracle® Identity Manager Design Console Guide Release 9.0 B25940-01 |
|
Previous |
Next |
This chapter describes the process management in Oracle Identity Manager. It contains the following topics:
The Process Management folder provides System Administrators with the tools necessary to create and manage Oracle Identity Manager processes and e-mail templates. This folder contains the following forms:
This folder contains the following forms:
Email Definition: Through this form, a System Administrator can create templates for e-mail notifications.
Process Definition: This form is used to create and manage approval and provisioning processes. It also allows you to launch the Workflow Definition Renderer that displays your workflow definition in a graphical presentation.
The Email Definition form, as shown in Figure 7-1, is located within the Process Management folder. It is used to create templates (or definitions) for e-mail notifications. These notifications can be set to be sent to the user when:
A task is assigned to the user
The task achieves a particular status
A request is approved (the standard approval process has a status of Completed)
For this example, an e-mail definition has been created. Once the request, which is represented by the Request ID e-mail variable, has been approved, an e-mail notification will be sent from User(SOLO) to the user who created the request (or the requester).
|
Important: Before using the E-mail Definition form, you must specify the address of the e-mail server that Oracle Identity Manager will use to send e-mail notifications to usersFirst, you need to launch the System Configuration form, query for the EMAILSERVER property, and ensure that it is set to the name of the resource asset instance that represents your e-mail server. Next, you must open the IT Resources form and query for the EMAILSERVER IT resource (or whatever name of the resource asset is associated with your mail server. Once this IT resource appears, you have to specify the IP address of the e-mail server, along with the name and password of the user who validates the usage of this server. For more information, refer to "The System Configuration Form", and "The IT Resources Form". |
Now that we have reviewed about e-mail definitions, you will learn about the data fields of the Email Definition form. The following table describes the fields of this form.
| Field Name | Description |
|---|---|
| Name | The name of the e-mail definition. |
| Type | This region contains three radio buttons. These radio buttons are used to specify whether:
If the e-mail definition is to be classified as a provisioning definition, or the e-mail variable is associated with a provisioning process, select the Provisioning Related radio button. When the e-mail definition will be categorized as a request definition, or the e-mail variable is associated with a request, select the Request Related radio button. If the e-mail definition is categorized as a general announcement, then select the General radio button. |
| Object Name | From this lookup field, select the resource object that is associated with the provisioning process to which the e-mail definition is related.
Note: If you leave this lookup field empty, the e-mail definition will be available for use with all resource objects. |
| Process Name | From this lookup field, select a provisioning process that has been assigned to the selected resource object. This is the provisioning process to which the e-mail definition is to be related.
Note: If the Provisioning Related radio button is not selected, both the Object Name and Process Name lookup fields are disabled. |
| Targets | From this combo box, select the source of the variable for the e-mail definition. For example, if the variable you wish to select were Request Name, the source to select would be Request Information.
Note: The items that appear within this combo box reflect the radio button you select from the Type region. |
| Variables | From this combo box, select the variable for the e-mail definition (for example, Request Name). The variables, which appear within this combo box, reflect the items you select from the Targets box.
Note: For more information on e-mail variables and their parameters, refer to "E-Mail Variables". |
| From | Currently, two types of users can be selected from this combo box:
|
| User Login | The ID of the user who appears in the From region of the e-mail notification.
Note: If the User item does not appear in the From combo box, the User Login field is disabled. |
| Subject | The title (or subject) of the e-mail definition. |
| Body | The content (or body) of the e-mail definition. |
Now that we have reviewed e-mail definitions and the data fields of the E-mail Definition form, you are ready to create an e-mail definition.
To create an e-mail definition, perform the following steps:
Open the Email Definition form.
In the Name field, type the name of the e-mail definition.
If the e-mail definition is to be used with a provisioning process, select the Provisioning Related radio button. When the e-mail definition is to be associated with a request, select the Request Related radio button.
|
Important: If the Request Related radio button is selected, ensure that the name of the e-mail server appears in the Value field of the EMAILSERVER property for the System Configuration form. |
Click Save. The remaining data fields of the Email Definition form are now operational.
Double-click the Object Name lookup field. From the Lookup dialog box that appears, select the resource object that is associated with the provisioning process to which this e-mail definition is related.
|
Note: By leaving this lookup field empty, the e-mail definition will be available for use with all resource objects. |
Double-click the Process Name lookup field. From the Lookup dialog box that is displayed, select a provisioning process that has been assigned to the resource object you selected in Step 5. This is the provisioning process to which this e-mail definition is to be related.
|
Note: If the Provisioning Related radio button is not selected, both the Object Name and Process Name lookup fields are disabled. |
Click the From combo box. From the custom menu that is displayed, select the type of the user (Requester, User, or Manager of Provisioned User) who appears in the From region of the e-mail notification.
|
Note: If the Provisioning Related radio button is not selected in Step 3, the Manager of Provisioned User item will not appear in the From combo box. |
Optional. If you selected the User option in the From combo box, double-click the User Login lookup field. From the Lookup dialog box that appears, select the ID of the user who appears in the From region of the e-mail notification.
If you did not select the User item in the From combo box, the User Login field is disabled.
Add information in the Subject field. This field contains the title (or subject) of the e-mail definition.
Add information in the Body text area. This text area contains the content (or body) of the e-mail definition.
When necessary, populate the Subject field and Body text area with e-mail variables.
The following table will help you understand the various radio buttons and combo boxes, which will enable you to customize an e-mail variable for the e-mail definition.
| Name | Description |
|---|---|
| Type | These radio buttons are used to specify whether a variable for the e-mail definition will be related to a provisioning process or a request.
When the e-mail variable is to be associated with a provisioning process, select the Provisioning Related radio button. If the variable is related to a request, select the Request Related radio button. |
| Targets | From this combo box, select the source of the variable for the e-mail definition. For example, if the variable you wish to select were Request Name, the source to select would be Request Information. |
| Variables | From this combo box, select the variable for the e-mail definition (for example, Request Name). |
|
Note: The items that appear in the custom menu of the Targets combo box reflect the selection of either the Provisioning Related or the Request Related radio button. Similarly, the items, which are displayed in the custom menu of the Variables combo box, correspond to the items that appear in the Targets, Location Types, and Contact Types combo boxes. |
Create an e-mail variable for the Subject field or Body text area.
For this example, the number of the request that has been approved (the Request ID) appears in both the Subject field and the Body text area.
Click Save. The e-mail definition is created. It can be applied through the Assignment tab of the Process Definition form.
A process is the mechanism by which a logical workflow (whether used for approvals or provisioning) is represented within Oracle Identity Manager. Process definitions are comprised of tasks. These process tasks represent the steps that must be completed in order to fulfill the purpose of the process. For example, within an approval process, the tasks are used to represent the individual approvals that must be obtained before a particular action can take place. Within a provisioning process, the tasks are used to actually enable access for a user or organization on the target resource.
The Process Definition form, as shown in Figure 7-2, is located in the Process Management folder. It is used to create and manage the approval and provisioning processes that you associate with your resource objects.
|
Note: The standard approval process, associated with the Request object, can also be managed using this form. |
For this example, the Solaris 8 provisioning process has been created and assigned to the Solaris 8 resource object.
Now that we have reviewed about processes, you will learn about the data fields of the Process Definition form. The following table describes the fields of this form.
| Field Name | Description |
|---|---|
| Name | The name of the process. |
| Type | The classification type of the process definition. Currently, a process definition can be categorized as either an Approval or a Provisioning process. |
| Object Name | The name of the resource object to which the process will be assigned. |
| Map Descriptive Field | By clicking this button, you can select a field that will be used as an identifier of the process definition, once an instance is assigned to a resource object. |
| Render Workflow | Clicking this button will launch a web browser and the Workflow Renderer tool will display the current workflow definition. |
| Default Process | This check box is used to determine whether the current process is to be designated as the default approval or provisioning process for the resource object with which it is associated.
By selecting the check box, the process will be set as the default approval or provisioning process for the resource object to which it is assigned.If you clear the check box, the process will not be the default approval or provisioning process for the resource object with which it is associated and will only be invoked if a process selection rule causes it to be chosen. |
| Auto Save Form | This check box is used to designate whether Oracle Identity Manager should suppress display of the custom form associated with this provisioning process or display it and allow a user to supply it with data each time the process is instantiated.
If you select this check box, it designates that Oracle Identity Manager should automatically save the data in the custom process form without first displaying the form. If you select this checkbox, you must supply either system-defined data or ensure that an adapter is configured to populate the form with the required data (since the user will not be able to access the form).If you clear this check box, it designates that Oracle Identity Manager should display the custom process form and allow users to enter data into its fields. |
| Auto Pre-Populate | This check box designates whether the fields of a custom form that:
Will be populated by Oracle Identity Manager or a user. If the Auto Pre-Populate check box is selected, once the associated custom form appears, the fields that have pre-populate adapters attached to them will be populated by Oracle Identity Manager. When this check box is cleared, these fields must be populated by a user (by clicking the Pre-Populate button on the Toolbar or by a user manually entering the data). Important: This setting does not control the triggering of the pre-populate adapter. It merely determines whether the contents resulting from the execution of the adapter appear within the associated form field(s) because of Oracle Identity Manager or a user. For more information on pre-populate adapters, refer to Oracle Identity Manager Tools Reference Guide. Note: Setting this checkbox is only relevant if you have created a process form (that is to be associated with the process) and pre-populate adapters are used with that form. |
| Table Name | The name of the table, which represents the form that is associated with the process definition. |
Now that we have reviewed processes and the data fields of the Process Definition form, you are ready to create a process definition.
To create a process definition, perform the following steps:
Open the Process Definition form.
In the Name field, type the name of the process definition.
Double-click the Type lookup field. From the Lookup dialog box that is displayed, select the classification type (Approval or Provisioning) of the process definition.
Double-click the Object Name lookup field. From the Lookup dialog box that is displayed, select the resource object that will be associated with the process definition.
Optional. Select the Default Process check box. By doing so, the process will be the default approval or provisioning process for the resource object to which it is assigned.
If you do not want to designate the current process definition as the default approval or provisioning process for the resource object with which it is associated, proceed to Step 6.
Optional. Select the Auto Save Form check box. This denotes that Oracle Identity Manager should suppress display of provisioning process' custom form and automatically save the data in it. This setting is only applicable to provisioning processes.
If you want Oracle Identity Manager to display provisioning process' custom form and solicit users for information, clear this check box.
|
Important: If you select the Auto Save Form check box, make sure that all fields of the associated "custom" process form have adapters associated with them. However, a process form can have default data or object to the process data flow mapping or organization defaults.For more information on adapters and their relationship with fields of custom forms, refer to Oracle Identity Manager Tools Reference Guide. |
If a custom form is to be associated with the process definition, this form contains fields that have pre-populate adapters attached to them, and you want these fields to be populated automatically by Oracle Identity Manager, select the Auto Pre-Populate check box.
If the fields of this form are to be populated manually (by an user clicking the Pre-Populate button on the Toolbar), clear the Auto Pre-Populate check box.
|
Note: If the process definition has no custom form associated with it, or this form's fields have no pre-populate adapters attached to them, clear the Auto Pre-Populate check box. For more information on pre-populate adapters, refer to Oracle Identity Manager Tools Reference Guide. |
Double-click the Table Name lookup field. From the Lookup window that appears, select the table, which represents the form that is associated with the process definition.
Click Save. The process definition is created. In addition, the Map Descriptive Field button is enabled. If you click this button, the Map Descriptive Field dialog box is displayed.
From this window, you can select the field (for example, the Organization Name field) that will be used as an identifier of the process definition when an instance of the process is assigned to a resource object. This field and its value will then appear in the Reconciliation Manger form.
|
Note: If a process has a custom process form attached to it, the fields on that form will also appear within this window and be available for selection. |
By clicking on the Render Workflow button, you can view your workflow definition in a graphical presentation. The Workflow Renderer is a powerful tool in helping you develop your process definition.
Once you launch the Process Definition form, and create a process definition, the tabs of this form become functional.
The Process Definition form contains the following tabs:
Each of these tabs is covered in greater detail in the following sections.
Figure 7-3 displays the Tasks tab of the Process Definition form.
Figure 7-3 The Tasks Tab of the Process Definition Form
This tab is used to:
Create and modify the process tasks that comprise the current process definition
Remove a process task from the process definition (when it is no longer valid)
In this example, the Solaris 8 process definition is comprised of 15 process tasks.
Now that we have reviewed the Tasks tab, you will learn how to add, delete, export, and import process tasks.
To add a process task, perform the following steps:
Click Add. The Creating New Task dialog box is displayed.
In the Task Name field, enter the name of the process task.
From the Toolbar of the Creating New Task window, click Save. Then, click Close. The process task is added to the process definition.
For instructions on how to edit and set process tasks, refer to "Modify Process Tasks".
Figure 7-4 displays the data flow tab of the Process Definition form.
Figure 7-4 Data Flow Tab of the Process Definition Form
This tab is used to define the data flow between:
The fields of the parent resource form (which is attached to the resource object definition) and the fields of the parent process form (which is attached to the provisioning process definition).
The fields of the parent resource form and the fields of the child process form (which belongs to the parent process form).
The fields of the child resource form (which belongs to the parent resource form) and the fields of the child process form.
This tab is relevant only if the parent resource object has a custom resource form attached to it, and the parent process has a custom process form attached to it.
In addition, to map the flow of data between the fields of either a parent resource form and a child process form, or between the fields of a child resource form and a child process form, the custom resource form must have a child resource form assigned to it, and the custom process form must have a child process form assigned to it.
|
Note: For more information on custom process or resource forms, or to learn more about assigning child forms to parent forms, refer to "The Form Designer Form". |
Once you have defined both a resource object form (for the parent resource object) and a process form (for the parent provisioning process) and have assigned child forms to both the parent resource form and the parent process form, you can establish any required mapping between the fields of these forms.
In the example above, two data flows have been defined. For the first data flow, the value of the Home Directory field of the Solaris parent resource form is mapped to the User's Home Directory field of the Solaris parent process form. For the second data flow, the values of the Solaris child resource form are mapped to the appropriate fields of the Solaris child process form.
|
Note: The values of the fields on the process form cannot be mapped back to the resource form fields. Also, the values of the fields on the child resource form cannot be mapped to those fields that belong to the parent process form. |
Now that we have reviewed the Data Flow tab, you will learn how to map the following:
A data field on a parent resource form to a data field on a parent process form
A data field on a parent resource form to a data field on a child process form
A data field on a child resource form to a data field on a child process form
Similarly, you will learn how to break the mapping between two data fields.
To map the data field of a Parent Resource form to a data field of a Process form, perform the following steps:
Click Add Field Map. The Define Data Flow dialog box is displayed.
From the Data Source combo box, select the desired data field of the parent resource form.
From the Data Sink combo box, highlight the target data field of the parent or child process form.
From the window's Toolbar, click Save. Then, click Close. The selected data field of the parent resource form is now mapped to the target data field of either the parent or child process form, depending on the selection you made in Step 3 of this procedure.
To map the data field of a Child Resource form to a data field of a Child Process form, perform the following steps:
Click Add Table Map. The Add Data Flow Table Mapping dialog box is displayed.
From the Resource Object Child Table combo box, select the desired table names of the child resource form.
From the Process Child Table combo box, highlight the target table names of the child process form.
From the window's Toolbar, click Save. Then, click Close. The selected table names of the child resource form is now mapped to the target table names of the child process form.
Click Add Field Map. The Define Data Flow dialog box is displayed.
From the Table Mapping combo box, select the desired table name of the child resource form.
From the Data Source combo box, select the desired data field of the child process form.
From the Data Sink combo box, select the target data field of the child process form.
Reconciliation Field Mappings tab, as shown in Figure 7-5, is used to define the relationship between the data elements in the target system/trusted source and the fields within Oracle Identity Manager with which they are to be linked.
Figure 7-5 The Reconciliation Field Mappings tab of the Process Definition Form
Only those fields that have been defined on the Reconciliation Fields tab of the associated resource will be available for mapping assignments. These mappings are used to determine which fields in Oracle Identity Manager are to be populated with the information provided (using reconciliation events) from the target system. In addition, for target resources (not trusted sources), this tab is also used to indicate which fields are key fields. Key fields are the fields for which the values on the process form and the reconciliation event must be the same for a match to be generated on the Processes Matched Tree tab of the Reconciliation Manager form. For each mapping, the following information is displayed:
Name of the field (as defined on the Reconciliation Fields tab of the associated resource) on the target system/trusted source that is to be reconciled with data in Oracle Identity Manager.
Data type associated with the field (as defined on the Reconciliation Fields tab of the associated resource). Possible values are Multi-Valued, String, Number, Date, IT resource.
(For trusted sources) The name of the field on the users form (for user discovery) or the Oracle Identity Manager Organizations form (for organization discovery) to which the data in the trusted source field is to be mapped.
|
Note: If you will be performing both user and organization discovery with a trusted source, organization discovery must be conducted first. |
(For target resources) The name of the field on the resource's custom (provisioning) process form to which the data in the target resources field is to be mapped.
Indicator (only for target resources) designating whether the field is a key field within the reconciliation for this target resource. For provisioning processes to be matched to reconciliation event data, the value of the key fields in their process forms must be the same as those in the reconciliation event.
This procedure is used to map the fields on the target resource/trusted source (as defined on the Reconciliation Fields tab of the associated resource definition) to the applicable fields in Oracle Identity Manager. These mapping are used to determine what fields within Oracle Identity Manager are to be updated with the information in a reconciliation event when you click the Create User or Create Organization button, the Link button (on the Matched Users or Matched Organizations tab) or the Establish Link button (on the Processes Matched Tree tab) of the Reconciliation Manager form.
Once you have accessed the provisioning process definition for the associated resource and selected the Reconciliation Field Mappings tab, use one of the two procedures below.
|
Note: For user discovery on a trusted source, the resource on which you will define the fields to be mapped is User and the provisioning process on which you will define the field mappings is User. In addition, the Oracle Identity Manager fields (i.e., user attributes) to which you will map your trusted source fields will be derived from the Users form.For organization discovery on a trusted source, the resource on which you will define the fields to be mapped is Oracle Identity Manager Organization and the provisioning process on which you will define the field mappings is Oracle Identity Manager Organization. In addition, the Oracle Identity Manager fields (i.e., organization attributes) to which you will map your trusted source fields will be derived from the Organizations form. |
Map a Single Value Field
To map a single value field, perform the following steps:
Click Add Field Map. The Add Reconciliation Field Mappings dialog box is displayed.
Select the field on the target system that you wish to map from the menu in the Field Name field. Oracle Identity Manager will automatically supply the field type based on what was entered for this field on the associated Resource Object form.
For trusted sources:
Select a value from the User Attribute menu and click OK. Skip to Step 4.
For target resources:
Double-click Process Data Field. Select the correct mapping from the Lookup dialog box and click OK.
If you are defining mapping for a trusted source, skip this step. Set the Key Field for Reconciliation Matching checkbox (for target resources only). If this checkbox is selected, Oracle Identity Manager will evaluate whether the value of this field on the provisioning process' form matches the value of that field within the reconciliation event (all matched processes appears on the Processes Matched Tree tab of the Reconciliation Manager form). If this checkbox is cleared, Oracle Identity Manager will not require the value of this field to match on the process form and reconciliation event for process matching.
|
Note: In order for a field to be set as a key field, it must be set as required on the Object Reconciliation tab of the applicable resource. |
Click Save. The mapping for the selected field(s) will be applied the next time a reconciliation event is received from the target resource or trusted source.
Map a Multi-Value Field (for target resources only)
To map a multi-value field, perform the following steps:
Click Add Table Map. The Add Reconciliation Table Mappings dialog box is displayed.
Select the multi-value field on the target system that you wish to map from the menu in the Field Name field. Oracle Identity Manager will automatically supply the field type based on what was entered for this field on the associated Resource Object form.
Select the child table you defined on the target resource's process form from the Table Name menu (only child tables appears).
Double-click Process Data Field. Select the correct mapping from the Lookup dialog box and click OK.
Save and close the Add Reconciliation Table Mappings dialog box.
Right-click the multi-value field you just mapped and select Define a property field map from the menu that appears.
Select the component (child) field you wish to map. Oracle Identity Manager will automatically supply the field type based on what was entered for this field on the associated Resource Object form.
Double-click the Process Data Field field. Select the correct mapping from the Lookup dialog box and click OK.
Set the Key Field for Reconciliation Matching checkbox. If this checkbox is selected, Oracle Identity Manager will evaluate whether the value of this field on the provisioning process' child form matches the value of that field within the reconciliation event (all matched processes appears on the Processes Matched Tree tab of the Reconciliation Manager form). If this checkbox is cleared, Oracle Identity Manager will not require the value of this field to match on the process form and reconciliation event for process matching. You should ensure that at least one component (child) field of each multi-value field is set as a key field. This will enhance the quality of the matches generated on the Process Matched Tree tab.
|
Note: In order for a field to be set as a key field, it must be set as required on the Object Reconciliation tab of the applicable resource. |
Repeat Steps 6-9 for each component (child) field defined on the multi-value field.
Click Save. The mapping for the selected field(s) will be applied the next time a reconciliation event is received from the target resource.
This procedure is used to delete a mapping that has been established between a field on the target system/trusted source (as defined on the Reconciliation Fields tab of the associated resource definition) and a field in Oracle Identity Manager. Once you have accessed the provisioning process definition for the associated resource and selected the Reconciliation Field Mappings tab:
Select the field mapping you wish to delete.
Click Delete Map. The mapping for the selected field will be deleted.
This tab is used to select the user groups that can view, modify, and delete the current process definition.
In addition, the Write and Delete check boxes are visual indicators of the privileges that a user group has with the process definition. When the Write check box is selected, the corresponding user group can read and modify the current process definition. If this check box is cleared, the user group cannot read or edit the process definition.
Similarly, when the Delete check box is selected, the associated user group can delete the current process definition. If this check box is cleared, the user group cannot delete the process definition.
For this example, the SYSTEM ADMINISTRATORS user group can view, modify, and delete the Solaris 8 process definition.
Now that we have reviewed the Administrators tab, you will learn how to assign a user group to a process definition, and remove a user group from a process definition.
Click Assign. The Groups window is displayed.
Select the unassigned group, and assign it to the process definition.
Click OK. The user group appears in the Administrators tab.
If you want this user group to be able to view and/or modify the current process definition, double-click the corresponding Write check box. Otherwise, proceed to Step 5.
If you want this user group to be able to delete the current process definition, double-click the associated Delete check box. Otherwise, proceed to Step 6.
Click Save. The user group is assigned to the process definition.
Once you create a process task for your process definition, you may need to modify it. To do so, double-click its row header. The Editing Task window appears, containing additional information about the process task.
The Editing Task window contains the following tabs:
Each of these tabs is covered in greater detail in the following sections.
Figure 7-6 displays the General tab of the Editing Task dialog box.
Figure 7-6 The General Tab of the Editing Task Dialog Box
This tab is used to set high-level information for the task you want to modify. For this example, the Create User task is used to create a user within the Solaris environment.
Now that we have reviewed top-level information pertaining to process tasks, you will learn about the data fields of the General tab. The following table describes the fields of this tab.
| Field Name | Description |
|---|---|
| Task Name | The name of the process task. |
| Task Description | Explanatory information about the process task. |
| Duration | The expected completion time of the current process task (in days, hours, and minutes). |
| Conditional | This check box is used to determine whether a condition needs to be met for the current process task to be added to the process.
If you select this check box, the process task cannot be added to the process unless a condition has been met. By clearing this check box, a condition does not have to be met for the process task to be added to the process. |
| Required for Completion | This check box is used to determine if the current process task needs to be completed for the process to be completed.
If you select this check box, the process cannot be completed if the process task does not have a status of Completed. By clearing this check box, the status of the process task does not affect the completion status of the process. |
| Constant Duration | N/A |
| Task Effect | From this combo box, select the process action you want the task to be associated with (for example, disable, enable). A process is able to enable or disable a user's access to a resource. When the disable action is chosen, all tasks associated with the disable action will be inserted.
Note: If you do not want the process task to be associated with a particular process action, select NONE from the combo box. |
| Disable Manual Insert | This check box is used to determine whether an user can manually add the current process task to the process.
If you select this check box, the process task cannot be added to the process manually. By clearing this check box, an user can add the process task to the process. |
| Allow Cancellation while Pending | This check box is used to determine whether the process task can be cancelled if its status is Pending.
If you select this check box, the process task can be cancelled if it has a Pending status. By clearing this check box, the process task cannot be cancelled if its status is Pending. |
| Allow Multiple Instances | This check box is used to determine whether the process task can be inserted into the current process more than once.
If you select this check box, multiple instances of the process task can be added to the process. By clearing this check box, the process task can be added to the current process only once. |
| Retry Period in Minutes | If a process task is Rejected, the length of time before Oracle Identity Manager will insert a new instance of that task with a status of Pending.
Figure 7-6, 30 appears in the Retry Period in Minutes text box. If the Create User process task is rejected, in 30 minutes, then Oracle Identity Manager will add a new instance of this task, and assign it a status of Pending. |
| Retry Count | How many times Oracle Identity Manager will retry a rejected task. Figure 7-6, 5 is displayed in the Retry Count text box. If the Create User process task is rejected, Oracle Identity Manager will add a new instance of this task, and assign it a status of Pending. However, once this process task is rejected for the fifth time, Oracle Identity Manager will no longer insert a new instance of the Create User process task. |
| Child Table/ Trigger Type | These combo boxes are used to specify the action that Oracle Identity Manager needs to perform within the child table of the custom form that is associated with the current process (as indicated by the Table Name field of the Process Definition form).
From the Child Table combo box, select the child table of the custom form, upon which Oracle Identity Manager will perform an action. Then, from the Trigger Type combo box, specify the action that Oracle Identity Manager will perform within this child table. These actions include:
Note: If the custom process form does not have any child tables associated with it, the Child Table combo box will be empty. In addition, the Trigger Type combo box will be disabled. |
Now that we have reviewed process tasks and the data fields of the General tab, you are ready to modify high-level information pertaining to a process task.
Double-click the row header of the task you want to modify. The Editing Task dialog box is displayed.
Click the General tab.
In the Description field, enter explanatory information about the process task.
Optional. In the Duration area, enter the expected completion time of the process task (in days, hours, and minutes).
If you want a condition to be met for the process task to be added to the Process Instance, select the Conditional check box. Otherwise, proceed to Step 6.
|
Important: If you select the Conditional check box, make sure you specify the condition that needs to be met for the task to be added to the process. |
When you want the completion status of the process to be dependent on the completion status of the process task, select the Required for Completion check box. By doing so, the process cannot be completed if the process task does not have a status of Completed.
If you do not want the status of the process task to affect the completion status of the process, proceed to Step 7.
When you want to prevent an user from manually adding the process task into a currently running instance of the process, select the Disable Manual Insert check box. Otherwise, proceed to Step 8.
If you want an user to be able to cancel the process task if its status is Pending, select the Allow Cancellation while Pending check box. Otherwise, proceed to Step 9.
When you want to allow this task to be inserted multiple times within a single process instance, select the Allow Multiple Instances check box. Otherwise, proceed to Step 10.
Click the Task Effect combo box. From the custom menu that appears, select one of the following menu items:
Enable Process or Access to Application. If a resource is reactivated using the enable function, all tasks with this effect will be inserted will be inserted into the process. If you select this option, be sure the Allow Multiple Instances check box is selected.
Disable Process or Access to Application. If a resource is de-activated using the disable function, all tasks with this effect will be inserted into the process. If you select this option, be sure the Allow Multiple Instances check box is selected.
No Effect. This is the default process action associated with all tasks. If this option is selected, the task will only be inserted during normal provisioning (unless it is conditional).
Optional. If the process task is Rejected, you may want Oracle Identity Manager to insert a new instance of this process task (with a status of Pending). In order for this to occur, a value must be entered in the Retry Period in Minutes field. This designates the length of time (in minutes) that Oracle Identity Manager will wait before adding this process task instance.
In the Retry Count text box, enter the number of time Oracle Identity Manager will retry a rejected task. For example, suppose 3 appear in the Retry Count text box for the process task. If it is rejected, Oracle Identity Manager will add a new instance of this task, and assign it a status of Pending. However, once this process task is rejected for the fourth time, Oracle Identity Manager will no longer insert a new instance of the process task.
|
Note: If either the Retry Period or Retry Count is selected, you must specify parameters for the other option since they are both related. |
From the Child Table combo box, select the child table of the custom form, upon which Oracle Identity Manager will perform an action.
Then, from the Trigger Type combo box, specify the action that Oracle Identity Manager will perform within this child table. These actions include:
Insert. Adding a new value to the designated column of the child table.
Update. Modifying an existing value from the corresponding column of the child table.
Delete. Removing a value from the designated column of the child table.
|
Note: If the custom process form does not have any child tables associated with it, the Child Table combo box will be empty. In addition, the Trigger Type combo box will be disabled. |
Click Save. The modifications to the process task's top-level information reflects the changes you made in the General tab.
Through the Integration tab, you can:
Automate a process task by attaching an event handler or task adapter to it.
Map the variables of the task adapter, so Oracle Identity Manager can pass the appropriate information when the adapter is triggered. This occurs when the process task's status is Pending.
Break the link between the adapter/event handler and the process task, once the adapter or event handler is no longer applicable with the process task.
In this example, the adpSOLARISCREATEUSER adapter is attached to the Create User process task. This adapter has nine adapter variables, all of which are mapped correctly (as indicated by the Y, which precedes each variable name).
|
Tip: event handlers are preceded with tc (Thor class), such as tcCheckAppInstalled. These are event handlers that Oracle provides. Customer created event handlers cannot have tc preceded in their name. Adapters are preceded with adp (for example, adpSOLARISCREATEUSER). |
|
Note: For more information on adapters and event handlers, refer to "The Adapter Factory Form" and "The Event Handler Manager Form". |
Now that we have reviewed the Integration tab, you will learn how to assign an adapter or an event handler to a process task, map the variables of an adapter, and remove an adapter or event handler from a process task.
Double-click the row header of the process task to which you want to assign an event handler or adapter. The Editing Task window appears.
Click the Integration tab.
Click Add. The Handler Selection dialog box is displayed, as shown in Figure 7-7.
To assign an event handler to the process task, select the System radio button. To add an adapter to the process task, select the Adapter radio button. A list of event handlers or adapters, which you can assign to the process task, appears in the Handler Name region.
Figure 7-7 The Handler Selection Dialog Box
Select the event handler or adapter that you want to assign to the process task.
From the Handler Selection window's Toolbar, click Save. A confirmation dialog box appears.
Click OK. The event handler or adapter is assigned to the process task.
|
Important: If you have assigned an adapter to the process task, the adapter will not work until you map the adapter variables correctly. To learn how to map adapter variables, refer to "Map Adapter Variables". |
Select the adapter variable that you want to map.
Click Map. The Data Mapping for Variable window appears.
Complete the Map To, Qualifier, IT Asset Type, IT Asset Property, Literal Value, and Old Value fields.
|
Note: For more information on which items to select, refer to the Oracle Identity Manager Tools Reference Guide.Caution: In order to trigger a task associated with a change to a parent form field, the name of the task must be <field> Updated, where <field> is the name of the parent form field. If the task is not named according to this convention, then it will not be triggered during field update. |
From the Data Mapping for Variable window's Toolbar, click Save.
Then, click Close. The mapping status for the adapter variable changes from N to Y. This indicates that the adapter variable has been mapped.
The Task Dependency tab is used to determine the logical flow of process tasks within a process. Through this tab, you can:
Assign preceding tasks to a process task. These tasks must have a status of Completed before Oracle Identity Manager or an user can trigger the current process task.
Assign dependent tasks to a process task. Oracle Identity Manager or an user can trigger these tasks only after the current process task has a status of Completed.
Break the link between a preceding task and the current task (when the preceding task's completion status no longer has any bearing on the current task being triggered).
Break the link between the current task and a dependent task (when the current task's completion status no longer has any bearing on triggering the dependent tasks).
For this example, the Create User process task does not have any preceding tasks. As a result, Oracle Identity Manager will trigger this task whenever task is added inserted into the process (for example, when the associated resource is requested).
In addition, the Create User process task has seven dependent tasks. Once this task achieves a status of Completed, each of these process tasks will be assigned a status of Pending (before that, each dependent task will have a status of Waiting). As a result, Oracle Identity Manager will then be able to trigger them.
Now that we have reviewed task dependencies, you will learn how to assign preceding and dependent tasks to a process task. In addition, you will learn how to remove preceding and dependent tasks from a process task.
Double-click the row header of the process task to which you want to assign a preceding task. The Editing Task window appears.
Click the Task Dependency tab.
From the Preceding Tasks region, click Assign. The Assignment window appears.
From this window, select the preceding task, and assign it to the process task.
Click OK. The preceding task is assigned to the process task.
1. Highlight the preceding task that you want to delete.
2. From the Preceding Tasks region, click Delete. The preceding task is removed from the process task.
Double-click the row header of the process task to which you want to assign a dependent task. The Editing Task window appears.
Click the Task Dependency tab.
From the Dependent Tasks region, click Assign. The Assignment window appears.
From this window, select the dependent task, and assign it to the process task.
Click OK. The dependent task is assigned to the process task.
The Responses tab is used to:
Define the response codes that can be received in conjunction with the execution of a particular process tasks. The responses codes can be used to represent specific conditions on the target system.
Define the conditional tasks that will be launched, if a particular response code is received in conjunction with the execution of this process task. These tasks are called generated tasks.
Remove a response from a process task, when it is no longer valid.
Remove a generated task from a process task, when it is no longer valid.
For this example, when the Create User process task is Completed, the SUCCESS response is activated. As a result, a dialog box appears, displaying the "The user was created successfully." message. In addition, Oracle Identity Manager will trigger the Enable User process task.
Now that we have reviewed responses and generated tasks, you will learn how to assign a response and a generated task to the current process task. In addition, you will learn how to remove a response and a generated task from the current process task.
|
Note: By default, the UNKNOWN response is defined for each process task that is rejected. This way, even when the System Administrator does not add any responses to a process task, if this task is rejected, the user will be notified, using an error message in a dialog box. |
Double-click the row header of the process task to which you want to add a response. The Editing Task window appears.
Click the Responses tab.
Within the Responses region, click Add. A blank row appears within the Responses region.
Add information into the Response field. This field contains the response code value. This field is case-sensitive.
Add information into the Description field. This field contains explanatory information about the response. If the process task triggers the response, this information appears in the task information dialog box.
Double-click the Status lookup field. From the Lookup window that appears, select a task status level. If the response code is received, it will cause the task to be set to this status.
Click Save. The response you added would now reflect the settings you have entered.
Highlight the response that you want to delete.
From the Responses region, click Delete. The response is removed from the process task.
Double-click the row header of the process task to which you want to assign a generated task. The Editing Task window appears.
Click the Responses tab.
Select the response code for which you wish to assign generated tasks (i.e., the tasks to be generated).
From the Tasks to Generate region, click Assign. The Assignment window appears.
From this window, select the generated task and assign it to the process task response.
Click OK. The generated task is assigned to the process task.
The Undo/Recovery tab is used to:
Define process tasks that will be triggered when the current process task is Cancelled. These process tasks are known as undo tasks.
Remove an undo task from a process task, when it is no longer valid.
Define process tasks that will be triggered when the current process task is Rejected. These tasks are called recovery tasks.
Remove a recovery task from a process task, when it is no longer valid.
For this example, if the Create User process task is Cancelled, the Delete User undo task will be triggered. Similarly, if the Create User task is Rejected, Oracle Identity Manager will trigger the Enable User recovery task.
|
Note: As stated previously, when the current process task is Rejected, Oracle Identity Manager will trigger any recovery tasks that have been assigned to the process task. By selecting the Complete on Recovery check box, Oracle Identity Manager will change the status of the current process task from Rejected to Unsuccessfully Completed upon completion of all recovery tasks that are generated. This way, Oracle Identity Manager can trigger other, dependent process tasks. |
Now that we have reviewed about undo and recovery tasks, you will learn how to assign an undo and recovery task to the current process task. In addition, you will learn how to remove an undo and recovery task from the current process task.
Double-click the row header of the process task to which you want to assign an undo task. The Editing Task window appears.
Click the Undo/Recovery tab.
Within the Undo Tasks region, click Assign. The Assignment window appears.
From this window, select the undo task, and assign it to the process task.
Click OK. The undo task is assigned to the process task.
Highlight the undo task that you want to delete.
From the Undo Tasks region, click Delete. The undo task is removed from the process task.
Double-click the row header of the process task to which you want to assign a recovery task. The Editing Task window appears.
Click the Undo/Recovery tab.
From the Recovery Tasks region, click Assign. The Assignment window appears.
From this window, select the recovery task, and assign it to the process task.
Click OK. The recovery task is assigned to the process task.
Optional. If you want the status of the current process task to change from Rejected to Unsuccessfully Completed upon completion of all recovery tasks that are generated (so Oracle Identity Manager can trigger other, dependent process tasks) select the Complete on Recovery check box. Otherwise, leave this check box empty.
This tab is used to designate the e-mail notification to be generated when the current process task achieves a particular status. For each status a task can achieve, a separate e-mail notification can be generated. If an e-mail notification is no longer valid, you can remove it from the Notification tab.
For this example, when the Create User process task achieves a status of Completed, Oracle Identity Manager will send the Process Task Completed e-mail notification to the user who will be provisioned with the resource once the task is completed. In addition, if the Create User process task is rejected, the Process Task Rejected e-mail notification will be sent to this user and the user's manager.
|
Note: Oracle Identity Manager can only send an e-mail notification to a user if you have first created a template for the e-mail message, using the E-mail Definition form. For more information on creating e-mail notifications, refer to "The Email Definition Form". |
Now that we have reviewed about e-mail notifications, you will learn how to assign e-mail notifications to a process task, and remove e-mail notifications from a process task.
Double-click the row header of the process task to which you want to assign an e-mail notification. The Editing Task dialog box is displayed.
Click the Notification tab.
Click Assign. The Assignment dialog box is displayed.
From this window, select the e-mail template definition to use, and assign it to the process task.
Click OK. The name of the e-mail notification appears in the Notification tab.
Double-click the Status lookup field. From the Lookup window that appears, select a completion status level. When the process task achieves this status level, Oracle Identity Manager will send the associated e-mail notification.
Select the check boxes, which represent the users who will receive the e-mail notification. Currently, an e-mail notification can be sent to the following users:
Assignee. This user is responsible for completing the associated process task.
Requester. This user requested the process that contains the corresponding process task.
User. This user will be provisioned with the resource once the associated process task is Completed.
User's Manager. This user is the supervisor of the user, who will be provisioned with the resource once the corresponding process task is Completed.
Click Save. The e-mail notification is assigned to the process task.
A resource object contains data that is used to provision resources to users and applications. This data includes approval and provisioning processes.
In addition, a resource object is provided with pre-defined provisioning statuses, which represent the various statuses of the resource object throughout its lifecycle as it is being provisioned to the target user or organization. By accessing the Currently Provisioned tab of the Resource Objects form, you can see the provisioning status of that resource object at any time. These values are also displayed in the Object Process Console tab on the Users and Organizations forms.
|
Note: Provisioning statuses are defined in the Status Definition tab of the Resource Objects form. |
The provisioning status of a resource object is determined by the status of its associated approval and provisioning processes, as well as the tasks that comprise these processes. For this reason, you must provide a link between the status of a process task and the provisioning status of the resource object to which it is assigned.
The Task to Object Status Mapping tab is used to create this link. Also, when this connection is no longer relevant, or you wish to associate a process task status with a different provisioning status for the resource object, you must sever the link that currently exists.
For this example, there are five mappings between process task statuses and provisioning statuses of a resource object. When the Create User process task achieves a status of Completed, the associated resource object will be assigned a provisioning status of Provisioned. However, if this task is cancelled, the provisioning status for the resource object will be Revoked. None indicates that the achievement of this status by the process task has no impact on the provisioning status of the resource object.
Now that we have reviewed the relationship between process task statuses and provisioning statuses, you will learn how to map a process task status to a provisioning status, and unmap a process task status from a provisioning status.
Double-click the row header of the process task, which has a status that you want to map to the provisioning status of a resource object. The Editing Task window appears.
Click the Task to Object Status Mapping tab.
Highlight the desired process task status.
Double-click the Object Status lookup field. From the Lookup window that appears, select the provisioning status of the resource object to which you want to map the process task status.
Click OK. The provisioning status you selected appears within the Task to Object Status Mapping tab.
Click Save. The process task status is mapped to the provisioning status.
Highlight the desired process task status.
Double-click the Object Status lookup field. From the Lookup window that appears, select None. None indicates that the achievement of this status by the process task has no impact on the provisioning status of the resource object.
Click OK. The provisioning status of None appears within the Task to Object Status Mapping tab.
Click Save. The process task status is no longer mapped to the provisioning status of the resource object.
Assignment Tab of the Editing Task Window
This tab is used to specify assignment rules for the current process task. These rules will determine how the process task will be assigned.
|
Note: For the most part, task assignment rules are associated with tasks of approval processes, since these tasks are usually completed manually. On the other hand, tasks belonging to provisioning processes are usually automated. As a result, they do not need task assignment rules. |
For this example, when the Create User process task is inserted in the process, the Solaris Process Tasks - User rule will be evaluated (since it has a priority value of 1). If that rule's criteria are satisfied, the task will be assigned to the user named RLAVA (and the task will be marked to escalate in 600,000 milliseconds, or 10 minutes).
If the criteria of the Solaris Process Tasks - User rule are not satisfied, Oracle Identity Manager will evaluate the criteria of the Solaris Process Tasks - Group rule. If that rule's criteria are satisfied, the task will be assigned to the SYSTEM ADMINISTRATORS user group (and the task will be marked to escalate in 10 minutes).
|
Note: Only rules with a classification type of Task Assignment can be assigned to a process task. For more information on specifying the classification type of a rule, refer to "The Rule Designer Form". In addition, Oracle Identity Manager comes pre-defined with a Default rule. This rule always evaluates to true. As a result, it can be used as a safeguard mechanism to ensure that at least one pre-defined task assignment takes place if all the other rules fail. |
Now that we have reviewed rules and their relationship to process tasks, you will learn about the data fields of the Assignment tab. The following table describes the fields of this tab.
| Field Name | Description |
|---|---|
| Rule | The name of the Task Assignment rule to evaluate. |
| Target Type | The classification type of the user or user group that is responsible for completing the current process task. Currently, the process task can be assigned to:
Note: Object Authorizer and Object Administrator user groups are defined in the Object Authorizers and Administrators tabs, respectively, of the Resource Objects form. |
| Adapter | This is the name of the adapter. Double click this field to get a lookup form for all existing adapters. |
| Adapter Status | This is the status of the adapter. |
| Group | The user group to which the current process task is assigned. |
| User | The user to which the current process task is assigned. |
| Email Name;Send Email | By selecting an e-mail notification from the Email Name Lookup field, and selecting the Send Email check box, Oracle Identity Manager will send the e-mail notification to a user or user group once the current process task is assigned. |
| Escalation Time | The amount of time (in milliseconds) that the user or user group, which is associated with the rule that Oracle Identity Manager triggers, has to complete the process task. If this process task is not completed within the allotted time, Oracle Identity Manager will then re-assign it to another user or user group. The escalation rule adheres to the order defined by the target type parameter. |
| Priority | The priority number of the rule that is associated with the current process task. This number indicates the order in which Oracle Identity Manager will evaluate the rule. |
Now that we have reviewed task assignment rules and the data fields of the Assignment tab, you are ready to add a task assignment rule to a process task. In addition, when the rule is no longer valid, you will learn how to remove it from the process task.
Double-click the row header of the task to which you want to add a rule. The Editing Task window appears.
Click the Assignment tab.
Click Add. A blank row appears within the Assignment tab.
Double-click the Rule lookup field. From the Lookup window that appears, select the rule that you wish to add to the process task. Then, click OK.
Double-click the Target Type lookup field. From the Lookup window that appears, select the classification type of the user or user group (User, Group, Group User with Highest Priority, Group User with Least Load, Request Target User's Manager, Object Authorizer User with Highest Priority, Object Authorizer User with Least Load, Object Administrator, Object Administrator User with Least Load) that is responsible for completing the process task. Then, click OK.
Double-click the Group lookup field. From the Lookup window that appears, select the user group that is responsible for completing the process task. This setting is only necessary if you selected Group, Group User with Highest Priority or Group User with Least Load in the Target Type field. Then, click OK.
OR
Double-click the User lookup field. From the Lookup window that appears, select the user who is responsible for completing the process task. This setting is only necessary if you selected User in the Target Type field. Then, click OK.
Double-click the Email Name field. From the Lookup window that appears, select the e-mail notification that will be sent to the corresponding user or user group once the task is assigned. Click OK. Then, select the Send Email check box.
If you do not want Oracle Identity Manager to send an email notification when the task is assigned, proceed to Step 8.
In the Escalation Time field, enter the time (in milliseconds) that the selected user or user group has to complete the process task.
When you do not want to associate a time limit with the rule you are adding to the process task, leave the Escalation Time field empty, and proceed to Step 10.
In the Priority field, enter the priority number of the rule that you are adding to the process task.
Click Save. The rule is added to the process task.
