| Oracle® Identity Manager Design Console Guide Release 9.0 Part Number B32143-01 |
|
|
View PDF |
| Oracle® Identity Manager Design Console Guide Release 9.0 Part Number B32143-01 |
|
|
View PDF |
This chapter describes the process management in Oracle Identity Manager. It contains the following topics:
The Process Management folder provides System Administrators with tools for creating and managing Oracle Identity Manager processes and e-mail templates.
This folder contains the following forms:
Email Definition: This form enables a System Administrator to create templates for e-mail notifications.
Process Definition: This form is used to create and manage approval and provisioning processes. It also allows you to launch the Workflow Definition Renderer that displays your workflow definition in a graphical presentation.
The Email Definition form, as shown in Figure 7-1, is located in the Process Management folder. You use this form to create templates for e-mail notifications. These notifications can be set to be sent to the user when:
A task is assigned to the user
The task achieves a particular status
A request is approved (the standard approval process has a status of Completed)
You apply Email definitions through the Assignment tab of the Process Definition form.
In Figure 7-1, an email definition has been created. After the request represented by the Request ID email variable is approved, an email notification is sent from user SOLO to the user who created the request or to the requester.
Before using the Email Definition form, you must specify the address of the email server that Oracle Identity Manager will use to send e-mail notifications to users.
To specify the email server:
Launch the System Configuration form.
Query for the EMAILSERVER property, and ensure that it is set to the name of the resource asset instance that represents your e-mail server.
Open the IT Resources form and query for the EMAILSERVER IT resource or another name for the resource asset that is associated with your mail server.
Once this IT resource appears, specify the IP address of the e-mail server and the name and password of the user who validates the usage of this server.
The following table describes the fields of the Email Definition form.
| Field Name | Description |
|---|---|
| Name | The name of the email definition. |
| Type | This region contains three radio buttons for the following:
To classify the email definition as a provisioning definition, or to associate the email variable with a provisioning process, select the Provisioning Related radio button. To categorize the email definition as a request definition, or to associate the email variable with a request, select the Request Related radio button. To categorize the email definition as a general announcement, select the General radio button. |
| Object Name | From this lookup field, select the resource object that is associated with the provisioning process to which the email definition is related.
Note: Leave this lookup field empty to make the email definition available for use with all resource objects. |
| Process Name | From this lookup field, select a provisioning process that has been assigned to the selected resource object. This is the provisioning process to which the email definition is to be related.
Note: If the Provisioning Related radio button is not selected, both the Object Name and Process Name lookup fields are disabled. |
| Language | From this lookup field, select the language that is associated with the e-mail definition. |
| Region | From this lookup field, select the region that is associated with the language in the e-mail definition. |
| Targets | Select the source of the variable for the email definition. For example, if the variable you wish to select were Request Name, the source to select would be Request Information.
Note: The items that appear in this box reflect the radio button you select from the Type region. |
| Variables | From this box, select the variable for the email definition (for example, Request Name). The variables, which appear in this box, reflect the items you select from the Targets box.
Note: For more information on e-mail variables and their parameters, refer to "EMail Variables". |
| From | Currently, two types of users can be selected from this box:
|
| User Login | The ID of the user in the From region of the email notification.
Note: If the User item does not appear in the From box, the User Login field is disabled. |
| Subject | The title of the email definition. |
| Body | The content of the email definition. |
The following procedure describes creating an email definition.
To create an email definition:
Open the Email Definition form.
In the Name field, type the name of the mail definition.
If the email definition is to be used with a provisioning process, select the Provisioning Related radio button. When the email definition is to be associated with a request, select the Request Related radio button.
|
Important: If the Request Related radio button is selected, ensure that the name of the e-mail server appears in the Value field of the EMAILSERVER property on the System Configuration form. |
Double-click the Language lookup field and select a language to associate with this e-mail definition.
Double-click the Region lookup field and select a region to associate with the e-mail definition language.
|
Note: E-mail notification is based on the locale that was specified when you first installed Oracle Identity Manager. |
Click Save.
The remaining data fields of the Email Definition form are now operational.
To associate this email definition with a particular resource object, from the Lookup dialog box, double-click the Object Name lookup field and select the resource object that is associated with the provisioning process to which this e-mail definition is related.
Leave this lookup field empty to make the email definition available for use with all resource objects.
Double-click the Process Name lookup field.
From the Lookup dialog box, select a provisioning process that is assigned to the resource object you selected in Step 7. This is the provisioning process to which this e-mail definition is to be related.
|
Note: If the Provisioning Related radio button is not selected, both the Object Name and Process Name lookup fields are disabled. |
Click the From box.
From the custom menu that is displayed, select the type of the user (Requester, User, or Manager of Provisioned User) who appears in the From region of the e-mail notification.
|
Note: If the Provisioning Related radio button is not selected in Step 3, the Manager of Provisioned User item will not appear in the From box. |
Optional. If you selected the User option in the From box, double-click the User Login lookup field.
From the Lookup dialog box, select the ID of the user who appears in the From region of the email notification.
If you did not select the User item in the From box, the User Login field is disabled.
Add information in the Subject field.
This field contains the title of the email definition.
Add information in the Body text area.
This text area contains the contents of the email definition.
When necessary, populate the Subject field and Body text area with email variables.
The following table describes the email variables that you can customize for the email definition.
| Name | Description |
|---|---|
| Type | These radio buttons specify if a variable for the email definition will be related to a provisioning process or a request.
To associate the email variable with a provisioning process, select the Provisioning Related radio button. To relate the variable to a request, select the Request Related radio button. |
| Targets | From this box, select the source of the variable for the email definition. For example if you want to use the Request Name variable, the source to select would be Request Information. |
| Variables | From this box, select the variable for the email definition, for example, Request Name. |
|
Note: The items that appear in the custom menu of the Targets box reflect the selection of either the Provisioning Related or the Request Related radio button. Similarly, the items that are displayed in the custom menu of the Variables box correspond to the items that appear in the Targets, Location Types, and Contact Types boxes. |
Create an email variable for the Subject field or Body text area.
For this example, the number of the request that has been approved (the Request ID) appears in both the Subject field and the Body text area.
Click Save.
The email definition is created.
A process is the mechanism for representing a logical workflow for approvals or provisioning in Oracle Identity Manager. Process definitions consist of tasks. Process tasks represent the steps that you must complete to fulfill the purpose of a process. For example, in an approval process, the tasks can represent individual approvals that are required for an action can take place. In a provisioning process, tasks are used to enable a user or organization to access the target resource.
The Process Definition form shown in Figure 7-2 is located in the Process Management folder. You use this form to create and manage the approval and provisioning processes that you associate with your resource objects.
|
Note: You can also use this form to manage the standard approval process associated with the Request object. |
In Figure 7-2, the Solaris 8 provisioning process is created and assigned to the Solaris 8 resource object.
The following table describes the fields of the Process Definition form.
| Field Name | Description |
|---|---|
| Name | The name of the process. |
| Type | The classification type of the process definition. A process definition can be categorized as an Approval or a Provisioning process. |
| Object Name | The name of the resource object to which the process will be assigned. |
| Map Descriptive Field | Click this button to select a field that will be used as an identifier of the process definition after an instance is assigned to a resource object. |
| Render Workflow | Click this button to launch a web browser and display the current workflow definition using the Workflow Renderer tool. |
| Default Process | This check box determines if the current process is the default approval or provisioning process for the resource object with which it is associated.
Select the check box to set the process as the default approval or provisioning process for the resource object to which it is assigned. If you clear the check box, the process will not be the default. It will only be invoked if a process selection rule causes it to be chosen. |
| Auto Save Form | This check box designates whether Oracle Identity Manager should suppress display of the custom form associated with this provisioning process or display it and allow a user to supply it with data each time the process is instantiated.
Select this check box to automatically save the data in the custom process form without displaying the form. If you select this checkbox, you must supply either system-defined data or ensure that an adapter is configured to populate the form with the required data since the user will not be able to access the form. Clear this check box to display the custom process form and allow users to enter data into its fields. |
| Auto Pre-Populate | This check box designates whether the fields of a custom form are populated by Oracle Identity Manager or a user. Two types of forms are affected:
If the Auto Pre-Populate check box is selected, once the associated custom form appears, the fields that have pre-populate adapters attached to them will be populated by Oracle Identity Manager. When this check box is cleared, a user must populate these fields by clicking the Pre-Populate button on the toolbar or by manually entering the data. Important: This setting does not control the triggering of the pre-populate adapter. It only determines if the contents resulting from the execution of the adapter appear in the associated form field(s) because of Oracle Identity Manager or a user. For more information on pre-populate adapters, see the Oracle Identity Manager Tools Reference Guide. Note: This checkbox is only relevant if you have created a process form that is to be associated with the process and pre-populate adapters are used with that form. |
| Table Name | The name of the table that represents the form that is associated with the process definition. |
The following procedure describes how to create a process definition.
To create a process definition:
Open the Process Definition form.
In the Name field, type the name of the process definition.
Double-click the Type lookup field.
From the Lookup dialog box that is displayed, select the classification type (Approval or Provisioning) of the process definition.
Double-click the Object Name lookup field.
From the Lookup dialog box that is displayed, select the resource object that will be associated with the process definition.
Optional. Select the Default Process check box to make this the default approval or provisioning process for the resource object to which it is assigned.
If you do not want the current process definition to be the default, proceed to Step 6.
Optional. Select the Auto Save Form check box to suppress the display of the provisioning process' custom form and automatically save the data in it.
This setting is only applicable to provisioning processes.
To display provisioning process' custom form and solicit users for information, clear this check box.
|
Important: If you select the Auto Save Form check box, make sure that all fields of the associated "custom" process form have adapters associated with them. However, a process form can have default data or object to the process data flow mapping or organization defaults.For more information on adapters and their relationship with fields of custom forms, see the Oracle Identity Manager Tools Reference Guide. |
If a custom form is to be associated with the process definition, this form contains fields that have pre-populate adapters attached to them, and you want these fields to be populated automatically by Oracle Identity Manager, select the Auto Pre-Populate check box.
If the fields of this form are to be populated manually (by an user clicking the Pre-Populate button on the Toolbar), clear the Auto Pre-Populate check box.
|
Note: If the process definition has no custom form associated with it, or this form's fields have no pre-populate adapters attached to them, clear the Auto Pre-Populate check box. For more information on pre-populate adapters, see the Oracle Identity Manager Tools Reference Guide. |
Double-click the Table Name lookup field.
From the Lookup window that appears, select the table that represents the form associated with the process definition.
Click Save.
The process definition is created and the Map Descriptive Field button is enabled. If you click this button, the Map Descriptive Field dialog box appears.
From this window, you can select the field (for example, the Organization Name field) that will be used as an identifier of the process definition when an instance of the process is assigned to a resource object. This field and its value will then appear in the Reconciliation Manger form.
|
Note: If a process has a custom process form attached to it, the fields on that form will also appear in this window and be available for selection. |
click the Render Workflow button to view your workflow definition in a graphical presentation.
The Workflow Renderer is a powerful tool in helping you develop your process definition.
After you launch the Process Definition form and create a process definition, the tabs of this form become functional.
The Process Definition form contains the following tabs:
Each of these tabs is described in the following sections.
You use this tab to:
Create and modify the process tasks that comprise the current process definition
Remove a process task from the process definition (when it is no longer valid)
Figure 7-3 displays the Tasks tab of the Process Definition form.
Figure 7-3 The Tasks Tab of the Process Definition Form
For example, the Solaris 8 process definition can consist of 15 process tasks.
Process tasks represent the steps that you must complete in a process. The following procedure describes how to add a process task.
To add a process task:
Click Add.
The Creating New Task dialog box appears.
In the Task Name field, enter the name of the process task.
From the Toolbar of the Creating New Task window, click Save. Then, click Close.
The process task is added to the process definition.
For instructions on how to edit and set process tasks, refer to "Modifying Process Tasks".
You use this tab to define the data flow between the following items:
The fields of a parent resource form that is attached to a resource object definition and the fields of a parent process form that is attached to a provisioning process definition
The fields of a parent resource form and the fields of a child of the parent process form.
The fields of a child resource form and the fields of a child process form
This tab is relevant only if parent resource and process objects have custom resource forms attached to them.
Figure 7-4 displays the data flow tab of the Process Definition form.
Figure 7-4 Data Flow Tab of the Process Definition Form
To map the flow of data between the fields of a parent resource form and a child process form, or between the fields of a child resource form and a child process form, you must assign a child resource form to the custom resource form, and assign a child process form to the custom process form.
|
See also: For more information on custom process or resource forms and assigning child forms to parent forms, see "The Form Designer Form". |
After you define a resource object form for the parent resource object and a process form for the parent provisioning process and assign child forms to each form, you can establish mappings between the form fields, with two restrictions. Field values on the process form cannot be mapped back to resource form fields, and field values on a child resource form cannot be mapped to fields in the parent process form.
Figure 7-4, shows two data flows:
For the first data flow, the value of the Home Directory field of the Solaris parent resource form is mapped to the User's Home Directory field of the Solaris parent process form.
For the second data flow, the values of the Solaris child resource form are mapped to the appropriate fields of the Solaris child process form.
The following sections describe how to map the following:
A parent resource form field to a parent process form field
A parent resource form field to a child process form field
A child resource form field to a child process form field
The following also describes how to break the mapping between two data fields.
The following procedure describes how to map the data field of a parent resource form to a data field of a process form.
To map the data field of a Parent Resource form to a data field of a Process form:
Click Add Field Map.
The Define Data Flow dialog box appears.
From the Data Source box, select the desired data field of the parent resource form.
From the Data Sink box, highlight the target data field of the parent or child process form.
From the window's Toolbar, click Save, then click Close.
The selected data field of the parent resource form is now mapped to the target data field of either the parent or child process form, depending on the selection you made in Step 3 of this procedure.
The following procedure describes how to map the data in a field on a child resource form to a field in a child process form
To map a data field from a child resource form to a child process form:
Click Add Table Map.
The Add Data Flow Table Mapping dialog box appears.
From the Resource Object Child Table box, select the table names of the child resource form.
From the Process Child Table box, highlight the target table names of the child process form.
From the window's Toolbar, click Save, then, click Close.
The selected table names of the child resource form is now mapped to the target table names of the child process form.
Click Add Field Map.
The Define Data Flow dialog box appears.
From the Table Mapping box, select the desired table name of the child resource form.
From the Data Source box, select a data field of the child process form.
From the Data Sink box, select the target data field of the child process form.
The following procedure describes how to break a mapping.
To break a mapping:
Highlight the data fields, which contain a mapping you want to sever.
Click Delete Map.
The selected data field of the resource object form is no longer mapped to the highlighted data field of the process form.
You use the Reconciliation Field Mappings tab shown in Figure 7-5 to define a relationship between data elements in a target system or trusted source and fields in Oracle Identity Manager.
Figure 7-5 The Reconciliation Field Mappings tab of the Process Definition Form
Only fields that you define in the Reconciliation Fields tab of the associated resource are available for mapping. Using a reconciliation event, these mappings determine what fields in Oracle Identity Manager to populate with information from the target system. For target resources (not trusted sources), you can use this tab to indicate what fields are key fields. Key fields determine what values on the process form and the reconciliation event must be the same to generate a match on the Processes Matched Tree tab of the Reconciliation Manager form.
For each mapping, the following information appears:
Name of the field, as defined on the Reconciliation Fields tab of the associated resource, on the target system or trusted source that is to be reconciled with data in Oracle Identity Manager.
Data type associated with the field, as defined on the Reconciliation Fields tab of the associated resource.
Possible values are Multi-Valued, String, Number, Date, and IT resource.
For trusted sources: For user discovery, mapping of the data in the trusted source field to the name of a field on the users form, or for organization discovery, mapping of the data in the trusted source field to the name of a field on the Oracle Identity Manager Organizations form.
If you are performing user and organization discovery with a trusted source, organization discovery must be conducted first.
For target resources: The name of the field on the resource's custom (provisioning) process form to which the data in the target resources field is to be mapped.
For target resources: Indicator designating if the field is a key field in the reconciliation for this target resource.
For provisioning processes to match a reconciliation event data, the key field values in their process forms must be the same as those in the reconciliation event.
You can map the fields on a target resource or trusted source, as defined on the Reconciliation Fields tab of the associated resource definition, to applicable fields in Oracle Identity Manager. These mapping determine what fields in Oracle Identity Manager are updated in a reconciliation event. These mappings occur when you click one of the following on the Reconciliation Manager form:
The Create User or Create Organization button
The Link button on the Matched Users or Matched Organizations tab
The Establish Link button on the Processes Matched Tree tab
For user discovery on a trusted source, you define the fields to be mapped from the User resource to fields in the User provisioning process. The fields (that is, the user attributes) to which you will map your trusted source fields are derived from the Users form.For organization discovery on a trusted source, you define fields to be mapped from the Oracle Identity Manager Organization resource to fields in the Oracle Identity Manager Organization provisioning process. The fields (that is, the organization attributes) to which you will map your trusted source fields are derived from the Organizations form.
After you have accessed the provisioning process definition for the associated resource and selected the Reconciliation Field Mappings tab, use one of the two procedures below.
Mapping a Single Value Field
The following procedure describes how to map a single value.
To map a single value field:
Click Add Field Map.
The Add Reconciliation Field Mappings dialog box appears.
Select the field on the target system that you wish to map from the menu in the Field Name field.
Oracle Identity Manager will automatically supply the field type based on what was entered for this field on the associated Resource Object form.
For trusted sources:
Select a value from the User Attribute menu and click OK. Skip to Step 4.
For target resources:
Double-click Process Data Field. Select the correct mapping from the Lookup dialog box and click OK.
If you are defining mapping for a trusted source, skip this step.
Set the Key Field for Reconciliation Matching checkbox for target resources only. If this checkbox is selected, Oracle Identity Manager evaluates if the value of this field on the provisioning process form matches the value of the field in the reconciliation event. All matched processes appears on the Processes Matched Tree tab of the Reconciliation Manager form. If this checkbox is cleared, Oracle Identity Manager does not require the value of this field to match the process form and reconciliation event for process matching.
|
Note: To set a field as a key field, it must be set as required on the Object Reconciliation tab of the applicable resource. |
Click Save.
The mapping for the selected field or fields is applied the next time a reconciliation event is received from the target resource or trusted source.
Mapping a Multi-Value Field (for target resources only)
To map a multi-value field, perform the following steps:
Click Add Table Map.
The Add Reconciliation Table Mappings dialog box appears.
Select the multi-value field on the target system that you wish to map from the menu in the Field Name field.
Oracle Identity Manager will automatically supply the field type based on what was entered for this field on the associated Resource Object form.
Select the child table you defined on the target resource's process form from the Table Name menu (only child tables appears).
Double-click Process Data Field and select the correct mapping from the Lookup dialog box and click OK.
Save and close the Add Reconciliation Table Mappings dialog box.
Right-click the multi-value field you just mapped and select Define a property field map from the menu that appears.
Select the component (child) field you wish to map.
Oracle Identity Manager will automatically supply the field type based on what was entered for this field on the associated Resource Object form.
Double-click the Process Data Field field.
Select the correct mapping from the Lookup dialog box and click OK.
Set the Key Field for Reconciliation Matching checkbox.
If this checkbox is selected, Oracle Identity Manager compares the field value on the provisioning process child form with the field value in the reconciliation event. All matching processes appear on the Processes Matched Tree tab of the Reconciliation Manager form. If you clear this checkbox, the value of this field does not have to match on the process form and reconciliation event for process matching. Ensure that at least one component (child) field of each multi-valued field is set as a key field. This enhances the quality of the matches generated on the Process Matched Tree tab.
|
Note: Key fields must be set as required on the Object Reconciliation tab of the applicable resource. |
Repeat Steps 6-9 for each component (child) field defined on the multi-value field.
Click Save.
The mapping for the selected field(s) will be applied the next time a reconciliation event is received from the target resource.
This procedure is used to delete a mapping that has been established between a field in Oracle Identity Manager and a field on the target system or trusted source as defined on the Reconciliation Fields tab of the associated resource definition.
To delete a mapping:
Access the provisioning process definition for the associated resource.
Select the Reconciliation Field Mappings tab.
Select the field mapping you wish to delete.
Click Delete Map.
The mapping for the selected field is deleted.
You use this tab to select the user groups that can view, modify, and delete the current process definition.
On this tab, when the Write check box is selected, the corresponding user group can read and modify the current process definition. When the Delete check box is selected, the associated user group can delete the current process definition.
For example, a SYSTEM ADMINISTRATORS user group can be configured to view, modify, and delete the Solaris 8 process definition.
The following procedure describes how to assign user group privileges.
To assign a user group:
Click Assign.
The Groups window appears.
Select the unassigned group, and assign it to the process definition.
Click OK.
The user group appears in the Administrators tab.
To enable this user group to view, or modify, or view and modify the current process definition, double-click the corresponding Write check box.
Otherwise, proceed to Step 5.
To enable this user group to delete the current process definition, double-click the associated Delete check box.
Otherwise, proceed to Step 6.
Click Save.
The user group is assigned to the process definition.
To modify a process task for a process definition, double-click its row header. The Editing Task window appears, containing additional information about the process task.
The Editing Task window contains the following tabs:
You use this tab to set high-level information for the task that you want to modify. For this example, the Create User task is used to create a user in the Solaris environment.
Figure 7-6 displays the General tab of the Editing Task dialog box.
Figure 7-6 The General Tab of the Editing Task Dialog Box
The following table describes the fields of the General tab.
| Field Name | Description |
|---|---|
| Task Name | The name of the process task. |
| Task Description | Explanatory information about the process task. |
| Duration | The expected completion time of the current process task in days, hours, and minutes. |
| Conditional | This check box determines if a condition must met to add the current process task to the process.
Select this check box to prevent the process task from being added to the process unless a condition has been met. Clear this check box to not require the condition to be met for the process task to be added to the process. |
| Required for Completion | This check box determines if the current process task must be completed for the process to be completed.
Select this check box to require the process task to have a status of Completed before the process can be completed. Clear this check box to ensure that the status of the process task does not affect the completion status of the process. |
| Constant Duration | N/A |
| Task Effect | From this box, select the process action you want to associate with the task, for example, disable, enable. A process can enable or disable a user's access to a resource. When the disable action is chosen, all tasks associated with the disable action are inserted.
Note: If you do not want the process task to be associated with a particular process action, select NONE from the box. |
| Disable Manual Insert | This check box determines if a user can manually add the current process task to the process.
Select this check box to prevent the process task from being added to the process manually. Clear this check box to enable a user to add the process task to the process. |
| Allow Cancellation while Pending | This check box determines if the process task can be cancelled if its status is Pending.
Select this check box to allow the process task to be cancelled if it has a Pending status. Clearing this check box to prevent the process task from being cancelled if its status is Pending. |
| Allow Multiple Instances | This check box determines if the process task can be inserted into the current process more than once.
Select this check box to enable multiple instances of the process task to be added to the process. Clear this check box to enable the process task to be added to the current process only once. |
| Retry Period in Minutes | If a process task is Rejected, this field determines the interval before Oracle Identity Manager inserts a new instance of that task with a status of Pending.
In Figure 7-6, 30 appears in the Retry Period in Minutes text box. If the Create User process task is rejected, in 30 minutes Oracle Identity Manager adds a new instance of this task and assigns it a status of Pending. |
| Retry Count | How many times Oracle Identity Manager retries a rejected task. In Figure 7-6, 5 is displayed in the Retry Count text box. If the Create User process task is rejected, Oracle Identity Manager adds a new instance of this task, and assign it a status of Pending. When this process task is rejected for the fifth time, Oracle Identity Manager no longer inserts a new instance of it. |
| Child Table/ Trigger Type | These boxes specify the action that Oracle Identity Manager performs in the child table of a custom form that is associated with the current process, as indicated by the Table Name field of the Process Definition form.
From the Child Table box, select the child table of the custom form where Oracle Identity Manager will perform an action. From the Trigger Type box, specify the action that Oracle Identity Manager is to perform in the child table. These actions include:
Note: If the custom process form does not have any child tables associated with it, the Child Table box will be empty. In addition, the Trigger Type box will be disabled. |
The following procedure describes how to modify a process task's general information.
To modify the general information for a process task:
Double-click the row header of the task you want to modify.
The Editing Task dialog box appears.
Click the General tab.
In the Description field, enter explanatory information about the process task.
Optional. In the Duration area, enter the expected completion time of the process task (in days, hours, and minutes).
If you want a condition to be met for the process task to be added to the Process Instance, select the Conditional check box.
Otherwise, proceed to Step 6.
|
Important: If you select the Conditional check box, you must specify the condition to be met for the task to be added to the process. |
When you want the completion status of the process to depend on the completion status of the process task, select the Required for Completion check box.
By doing so, the process cannot be completed if the process task does not have a status of Completed.
If you do not want the status of the process task to affect the completion status of the process, proceed to Step 7.
To prevent a user from manually adding the process task into a currently running instance of the process, select the Disable Manual Insert check box.
Otherwise, proceed to Step 8.
To enable a user to cancel the process task if its status is Pending, select the Allow Cancellation while Pending check box.
Otherwise, proceed to Step 9.
To allow this task to be inserted multiple times in a single process instance, select the Allow Multiple Instances check box.
Otherwise, proceed to Step 10.
Click the Task Effect box.
From the custom menu that appears, select one of the following:
Enable Process or Access to Application. If a resource is reactivated using the enable function, all tasks with this effect are inserted into the process. If you select this option, you must also check the Allow Multiple Instances check box.
Disable Process or Access to Application. If a resource is deactivated using the disable function, all tasks with this effect are inserted into the process. If you select this option, you must also check the Allow Multiple Instances check box.
No Effect. This is the default process action associated with all tasks. If this option is selected, the task is only inserted during normal provisioning unless it is conditional.
Optional. If the process task is Rejected, you may want Oracle Identity Manager to insert a new instance of this process task (with a status of Pending).
For this to occur, enter a value in the Retry Period in Minutes field. This designates the time in minutes that Oracle Identity Manager waits before adding this process task instance.
In the Retry Count text box, enter the number of times Oracle Identity Manager will retry a rejected task. For example, suppose 3 appears in the Retry Count text box. If the task is rejected, Oracle Identity Manager adds a new instance of this task, and assigns it a status of Pending. After this process task is rejected for the fourth time, Oracle Identity Manager no longer inserts a new instance of the process task.
|
Note: If either Retry Period or Retry Count is selected, you must specify parameters for the other option since they are both related. |
From the Child Table box, select the child table of the custom form where Oracle Identity Manager will perform an action.
From the Trigger Type box, specify the action that Oracle Identity Manager will perform in the child table. These actions include the following:
Insert. Add a new value to the designated column of the child table.
Update. Modify an existing value from the corresponding column of the child table.
Delete. Remove a value from the designated column of the child table.
|
Note: If the custom process form does not have any child tables associated with it, the Child Table box will be empty. In addition, the Trigger Type box will be disabled. |
Click Save.
The modifications to the process task's top-level information reflects the changes you made in the General tab.
Through the Integration tab, you can:
Automate a process task by attaching an event handler or task adapter to it.
Map the variables of the task adapter, so Oracle Identity Manager can pass the appropriate information when the adapter is triggered. This occurs when the process task's status is Pending.
Break the link between the adapter/event handler and the process task, once the adapter or event handler is no longer applicable with the process task.
For example, suppose that the adpSOLARISCREATEUSER adapter is attached to the Create User process task. This adapter has nine adapter variables, all of which are mapped correctly as indicated by the Y that precedes each variable name.
|
Note: Event handlers are preceded with tc (Thor class), such as tcCheckAppInstalled. These are event handlers that Oracle provides. Customer-created event handlers cannot have a tc prefix in their name. Adapters are preceded with adp, for example, adpSOLARISCREATEUSER. |
|
See also: For more information on adapters and event handlers, refer to "The Adapter Factory Form" and "The Event Handler Manager Form". |
The following procedure describes how to assign an adapter or event handler to a process task.
|
Important: If you assign an adapter to the process task, the adapter will not work until you map the adapter variables correctly. See "Mapping Adapter Variables" for details. |
To assign an adapter or event handler to a process task:
Double-click the row header of the process task to which you want to assign an event handler or adapter.
The Editing Task window appears.
Click the Integration tab.
Click Add.
The Handler Selection dialog box appears, as shown in Figure 7-7.
To assign an event handler to the process task, select the System radio button.
To add an adapter to the process task, select the Adapter radio button. A list of event handlers or adapters, which you can assign to the process task, appears in the Handler Name region.
Figure 7-7 The Handler Selection Dialog Box
Select the event handler or adapter that you want to assign to the process task.
From the Handler Selection window's Toolbar, click Save.
A confirmation dialog box appears.
Click OK.
The event handler or adapter is assigned to the process task.
The following procedure describes how to map adapter variables.
|
Tip: For more information on which items to select in this procedure, see the Oracle Identity Manager Tools Reference Guide. |
|
Caution: To trigger a task associated with a change to a parent form field, the name of the task must be <field> Updated, where <field> is the name of the parent form field. If the task is not named according to this convention, it is not triggered during a field update. |
To map an adapter variable:
Select the adapter variable that you want to map.
Click Map.
The Data Mapping for Variable window appears.
Complete the Map To, Qualifier, IT Asset Type, IT Asset Property, Literal Value, and Old Value fields.
From the Data Mapping for Variable window's Toolbar, click Save.
Click Close.
The mapping status for the adapter variable changes from N to Y. This indicates that the adapter variable has been mapped.
The following procedure describes removing an adapter or event handler from a process task.
To remove an adapter or event handler from a process task:
Click Remove.
A confirmation dialog box appears.
Click OK.
The event handler or adapter is removed from the process task.
You use the Task Dependency tab to determine the logical flow of process tasks in a process. Through this tab, you can:
Assign preceding tasks to a process task.
These tasks must have a status of Completed before Oracle Identity Manager or a user can trigger the current process task.
Assign dependent tasks to a process task.
Oracle Identity Manager or a user can trigger these tasks only after the current process task has a status of Completed.
Break the link between a preceding task and the current task so that the preceding task's completion status no longer has any bearing on the current task being triggered.
Break the link between the current task and a dependent task so that the current task's completion status no longer has any bearing on triggering the dependent tasks.
For example, the Create User process task does not have any preceding tasks. Oracle Identity Manager triggers this task whenever the task is inserted into a process (for example, when an associated resource is requested). The Create User process task has seven dependent tasks. Prior to completion of this process task, each dependent task will have a status of Waiting. Once this task achieves a status of Completed, each of these process tasks are assigned a status of Pending, and Oracle Identity Manager can trigger them.
The following procedure describes assigning a preceding task to a process task.
To assign a preceding task to a process task:
Double-click the row header of the process task to which you want to assign a preceding task.
The Editing Task window appears.
Click the Task Dependency tab.
From the Preceding Tasks region, click Assign.
The Assignment window appears.
From this window, select the preceding task, and assign it to the process task.
Click OK.
The preceding task is assigned to the process task.
The following procedure describes removing a preceding task from a process task.
To remove a preceding task from a process task:
Highlight the preceding task that you want to delete.
From the Preceding Tasks region, click Delete.
The preceding task is removed from the process task.
The following procedure describes assigning a dependent task to a process task.
To assign a dependent task to a process task:
Double-click the row header of the process task to which you want to assign a dependent task.
The Editing Task window appears.
Click the Task Dependency tab.
From the Dependent Tasks region, click Assign.
The Assignment window appears.
From this window, select the dependent task, and assign it to the process task.
Click OK. The dependent task is assigned to the process task.
The following procedure describes removing a dependent task from a process task.
To remove a dependent task from a process task:
Highlight the dependent task that you want to delete.
From the Dependent Tasks region, click Delete.
The dependent task is removed from the process task.
You use the Responses tab to do the following:
Define the response codes that can be received in conjunction with the execution of a particular process tasks. You can use response codes to represent specific conditions on the target system.
Define the conditional tasks that are launched if a response code is received during execution of this process task. These tasks are called generated tasks.
Remove a response from a process task.
Remove a generated task from a process task.
For example, when a Create User process task is Completed, the SUCCESS response is activated. This response displays a dialog box with the message "The user was created successfully." In addition, Oracle Identity Manager triggers the Enable User process task.
|
Note: By default, the UNKNOWN response is defined for each process task that is rejected. This way, even when the System Administrator does not add any responses to a process task, if this task is rejected, the user will be notified, using an error message in a dialog box. |
The following procedure describes how to add a response to a process task.
To add a response to a process task:
Double-click the row header of the process task to which you want to add a response.
The Editing Task window appears.
Click the Responses tab.
In the Responses region, click Add.
A blank row appears in the Responses region.
Add information into the Response field.
This field contains the response code value. This field is case-sensitive.
Add information into the Description field. This field contains explanatory information about the response.
If the process task triggers the response, this information appears in the task information dialog box.
Double-click the Status lookup field.
From the Lookup window that appears, select a task status level. If the response code is received, it will cause the task to be set to this status.
Click Save.
The response you added would now reflect the settings you have entered.
The following procedure describes how to remove a response from a process task.
To remove a response from a process task:
Highlight the response that you want to delete.
From the Responses region, click Delete.
The response is removed from the process task.
The following procedure describes how to assign a generated task to a process task.
To assign a generated task to a process task:
Double-click the row header of the process task to which you want to assign a generated task.
The Editing Task window appears.
Click the Responses tab.
Select the response code for which you wish to assign generated tasks (i.e., the tasks to be generated).
From the Tasks to Generate region, click Assign.
The Assignment window appears.
From this window, select the generated task and assign it to the process task response.
Click OK.
The generated task is assigned to the process task.
The following procedure describes how to remove a generated task from a process task.
To remove a generated task from a process task:
Select the desired response code.
Highlight the generated task that you want to delete.
From the Tasks to Generate region, click Delete.
The generated task is removed from the process task.
You use the Undo/Recovery tab for the following:
To define process tasks that are triggered when the current process task is cancelled. These process tasks are known as undo tasks.
To remove an undo task from a process task, when it is no longer valid.
To define process tasks that are triggered when the current process task is rejected. These tasks are called recovery tasks.
To remove a recovery task from a process task.
For example, if the Create User process task is Cancelled, the Delete User undo task is triggered. Similarly, if the Create User task is Rejected, Oracle Identity Manager triggers the Enable User recovery task.
|
Note: When the current process task is rejected, Oracle Identity Manager triggers any recovery tasks that are assigned to the process task. If you select the Complete on Recovery check box, Oracle Identity Manager changes the status of the current process task from Rejected to Unsuccessfully Completed upon completion of all recovery tasks that are generated. This enables Oracle Identity Manager to trigger other dependent process tasks. |
The following sections describe how to assign an undo and recovery task to the current process task, and how to remove an undo and recovery task from the current process task.
The following procedure describes how to assign an undo task to a process task.
To assign an undo task to a process task:
Double-click the row header of the process task to which you want to assign an undo task.
The Editing Task window appears.
Click the Undo/Recovery tab.
In the Undo Tasks region, click Assign.
The Assignment window appears.
From this window, select the undo task, and assign it to the process task.
Click OK. The undo task is assigned to the process task.
The following procedure describes how to remove an undo task from a process task.
To remove an undo task from a process task:
Highlight the undo task that you want to delete.
From the Undo Tasks region, click Delete.
The undo task is removed from the process task.
The following procedure describes how to assign a recovery task to a process task.
To assign a recovery task to a process task:
Double-click the row header of the process task to which you want to assign a recovery task.
The Editing Task window appears.
Click the Undo/Recovery tab.
From the Recovery Tasks region, click Assign.
The Assignment window appears.
From this window, select the recovery task, and assign it to the process task.
Click OK.
The recovery task is assigned to the process task.
Optional. If you want the status of the current process task to change from Rejected to Unsuccessfully Completed upon completion of all recovery tasks that are generated (so Oracle Identity Manager can trigger other, dependent process tasks) select the Complete on Recovery check box.
Otherwise, leave this check box empty.
The following procedure describes how to remove an recovery task from a process task.
To remove an recovery task from a process task:
Highlight the recovery task that you want to delete.
From the Recovery Tasks region, click Delete.
The recovery task is removed from the process task.
You use this tab to designate the email notification to be generated when the current process task achieves a particular status. A separate email notification can be generated for each status a task can achieve. If an email notification is no longer valid, you can remove it from the Notification tab.
For example, when the Create User process task achieves a status of Completed, Oracle Identity Manager sends the Process Task Completed email notification to the user who is to be provisioned with the resource. If the Create User process task is rejected, the Process Task Completed email notification is sent to the user and the user's manager.
|
Note: Oracle Identity Manager can only send an email notification to a user if you first create a template for the email message using the Email Definition form. See "The Email Definition Form" for details. |
The following sections describe how to assign email notifications to a process task and remove email notifications from a process task.
The following procedure describes how to assign an email notification to a process task.
To assign an email notification to a process task:
Double-click the row header of the process task to which you want to assign an e-mail notification.
The Editing Task dialog box appears.
Click the Notification tab.
Click Assign.
The Assignment dialog box appears.
From this window, select the e-mail template definition to use, and assign it to the process task.
Click OK.
The name of the e-mail notification appears in the Notification tab.
Double-click the Status lookup field.
From the Lookup window that appears, select a completion status level. When the process task achieves this status level, Oracle Identity Manager will send the associated -mail notification.
Select the check boxes that represent the users who will receive the email notification.
Currently, an email notification can be sent to the following users:
Assignee. This user is responsible for completing the associated process task.
Requester. This user requested the process that contains the corresponding process task.
User. This user will be provisioned with the resource once the associated process task is Completed.
User's Manager. This user is the supervisor of the user, who will be provisioned with the resource once the corresponding process task is Completed.
Click Save.
The email notification is assigned to the process task.
The following procedure describes how to remove an email notification from a process task.
To remove an email notification from a process task:
Highlight the e-mail notification that you want to delete.
Click Delete.
The e-mail notification is removed from the process task.
A resource object contains data that is used to provision resources to users and applications. This data includes approval and provisioning processes.
In addition, a resource object is provided with pre-defined provisioning statuses, which represent the various statuses of the resource object throughout its lifecycle as it is being provisioned to the target user or organization. By accessing the Currently Provisioned tab of the Resource Objects form, you can see the provisioning status of that resource object at any time. These values are also displayed in the Object Process Console tab on the Users and Organizations forms.
|
Note: Provisioning statuses are defined in the Status Definition tab of the Resource Objects form. |
The provisioning status of a resource object is determined by the status of its associated approval and provisioning processes, as well as the tasks that comprise these processes. For this reason, you must provide a link between the status of a process task and the provisioning status of the resource object to which it is assigned.
The Task to Object Status Mapping tab is used to create this link. Also, when this connection is no longer relevant, or you wish to associate a process task status with a different provisioning status for the resource object, you must sever the link that currently exists.
For this example, there are five mappings between process task statuses and provisioning statuses of a resource object. When the Create User process task achieves a status of Completed, the associated resource object will be assigned a provisioning status of Provisioned. However, if this task is cancelled, the provisioning status for the resource object will be Revoked. None indicates that the achievement of this status by the process task has no impact on the provisioning status of the resource object.
The following sections describe how to map a process task status to a provisioning status and unmap a process task status from a provisioning status.
The following procedure describes how to map an process task status to a provisioning status.
To map an process task status to a provisioning status:
Double-click the row header of the process task, which has a status that you want to map to the provisioning status of a resource object.
The Editing Task window appears.
Click the Task to Object Status Mapping tab.
Highlight the desired process task status.
Double-click the Object Status lookup field.
From the Lookup window that appears, select the provisioning status of the resource object to which you want to map the process task status.
Click OK.
The provisioning status you selected appears in the Task to Object Status Mapping tab.
Click Save.
The process task status is mapped to the provisioning status.
The following procedure describes how to unmap an process task status from a provisioning status.
To unmap an process task status from a provisioning status:
Highlight the desired process task status.
Double-click the Object Status lookup field.
From the Lookup window that appears, select None. None indicates that the achievement of this status by the process task has no impact on the provisioning status of the resource object.
Click OK.
The provisioning status of None appears in the Task to Object Status Mapping tab.
Click Save.
The process task status is no longer mapped to the provisioning status of the resource object.
This tab is used to specify assignment rules for the current process task. These rules will determine how the process task will be assigned.
|
Note: For the most part, task assignment rules are associated with tasks of approval processes, since these tasks are usually completed manually. On the other hand, tasks belonging to provisioning processes are usually automated. As a result, they do not need task assignment rules. |
For example, if the Create User process task is inserted in the process, the Solaris Process Tasks - User rule will be evaluated since it has a priority value of 1. If that rule's criteria are satisfied, the task is assigned to the user named RLAVA and the task is marked to escalate in 600,000 milliseconds, or 10 minutes.
If the criteria of the Solaris Process Tasks - User rule are not satisfied, Oracle Identity Manager evaluates the criteria of the Solaris Process Tasks - Group rule. If that rule's criteria are satisfied, the task is assigned to the SYSTEM ADMINISTRATORS user group and the task is marked to escalate in 10 minutes.
|
Note: Only rules with a classification type of Task Assignment can be assigned to a process task. For more information on specifying the classification type of a rule, refer to "The Rule Designer Form". In addition, Oracle Identity Manager comes pre-defined with a Default rule. This rule always evaluates to true. As a result, it can be used as a safeguard mechanism to ensure that at least one pre-defined task assignment takes place if all the other rules fail. |
Now that we have reviewed rules and their relationship to process tasks, you will learn about the data fields of the Assignment tab. The following table describes the fields of this tab.
| Field Name | Description |
|---|---|
| Rule | The name of the Task Assignment rule to evaluate. |
| Target Type | The classification type of the user or user group that is responsible for completing the current process task. Currently, the process task can be assigned to:
Note: Object Authorizer and Object Administrator user groups are defined in the Object Authorizers and Administrators tabs, respectively, of the Resource Objects form. |
| Adapter | This is the name of the adapter. Double click this field to get a lookup form for all existing adapters. |
| Adapter Status | This is the status of the adapter. |
| Group | The user group to which the current process task is assigned. |
| User | The user to which the current process task is assigned. |
| Email Unmentioned Email | By selecting an e-mail notification from the Email Name Lookup field, and selecting the Send Email check box, Oracle Identity Manager will send the e-mail notification to a user or user group once the current process task is assigned. |
| Escalation Time | The amount of time (in milliseconds) that the user or user group, which is associated with the rule that Oracle Identity Manager triggers, has to complete the process task. If this process task is not completed in the allotted time, Oracle Identity Manager will then re-assign it to another user or user group. The escalation rule adheres to the order defined by the target type parameter. |
| Priority | The priority number of the rule that is associated with the current process task. This number indicates the order in which Oracle Identity Manager will evaluate the rule. |
The following sections describe adding a task assignment rule to a process task and how to remove it from the process task.
The following procedure describes how to add a rule to a process task.
To add a rule to a process task:
Double-click the row header of the task to which you want to add a rule.
The Editing Task window appears.
Click the Assignment tab.
Click Add.
A blank row appears in the Assignment tab.
Double-click the Rule lookup field.
From the Lookup window that appears, select the rule that you wish to add to the process task. Then, click OK.
Double-click the Target Type lookup field.
From the Lookup window that appears, select the classification type of the user or user group (User, Group, Group User with Highest Priority, Group User with Least Load, Request Target User's Manager, Object Authorizer User with Highest Priority, Object Authorizer User with Least Load, Object Administrator, Object Administrator User with Least Load) that is responsible for completing the process task. Then, click OK.
Double-click the Group lookup field.
From the Lookup window that appears, select the user group that is responsible for completing the process task. This setting is only necessary if you selected Group, Group User with Highest Priority or Group User with Least Load in the Target Type field. Then, click OK.
OR
Double-click the User lookup field. From the Lookup window that appears, select the user who is responsible for completing the process task. This setting is only necessary if you selected User in the Target Type field. Then, click OK.
Double-click the Email Name field.
From the Lookup window that appears, select the e-mail notification that will be sent to the corresponding user or user group once the task is assigned. Click OK. Then, select the Send Email check box.
If you do not want Oracle Identity Manager to send an email notification when the task is assigned, proceed to Step 8.
In the Escalation Time field, enter the time (in milliseconds) that the selected user or user group has to complete the process task.
When you do not want to associate a time limit with the rule you are adding to the process task, leave the Escalation Time field empty, and proceed to Step 10.
In the Priority field, enter the priority number of the rule that you are adding to the process task.
Click Save.
The rule is added to the process task.
