| Oracle® Identity Manager Administrative and User Console Guide Release 9.1.0 Part Number E10360-03 |
|
|
View PDF |
| Oracle® Identity Manager Administrative and User Console Guide Release 9.1.0 Part Number E10360-03 |
|
|
View PDF |
The procedure to create a generic technology connector is composed of the following steps:
Selecting the Providers to Be Included in the Generic Technology Connector
Addressing the Prerequisites for Creating the Generic Technology Connector
Using the Administrative and User Console to Create the Generic Technology Connector
As mentioned earlier in this guide, the following providers can be used as the building blocks of the generic technology connectors you create:
Reconciliation Transport Provider
Reconciliation Format Provider
Provisioning Transport Provider
Provisioning Format Provider
Transformation Provider
Validation Provider
See the "Functional Architecture of Generic Technology Connectors" section for the definitions of these providers. Then, based on your knowledge of the data formats and data transport mechanisms supported by the target system, identify the providers that must be included in the generic technology connector that you create. If the target system supports multiple data formats and data transport mechanisms, then you must select a single combination of the transport and format providers discussed in the first chapter. You cannot include, for example, multiple Reconciliation Format Providers in a single generic technology connector.
See Also:
Determining Provider RequirementsIdentify the predefined providers that can be used to meet your provider requirements. See Chapter 20 for information about the predefined providers.
If all your provider requirements are addressed by the predefined providers, then you need not create custom providers. You must create custom providers to address only the requirements that are not addressed by the predefined providers. See Chapter 21 for information about creating custom providers.
You must address the following prerequisites:
If you are creating the generic technology connector on a production server, then enable the cache for the following cache categories:
GenericConnector
GenericConnectorProviders
See "Optimal Cache Configuration for a Production Environment" in Oracle Identity Manager Best Practices Guide for more information.
Testing connectivity between the target system server and the Oracle Identity Manager server
You must take steps to ensure that connectivity can be established between the target system server and the Oracle Identity Manager server. For example, in a LINUX environment, you must enter the fully qualified host name of the Oracle Identity Manager server in the /etc/hosts file on the target system server.
Creating the user account to be used for creating the generic technology connector
All users belonging to the SYSTEM ADMINISTRATORS group of Oracle Identity Manager can create generic technology connectors. Alternatively, members of a group to which you assign the required menu items and permissions can create generic technology connectors.
See Also:
Chapter 10, "Creating and Managing User Groups" for information about creating groups and assigning menu items and permissions to themThe required menu items are as follows:
Create Generic Technology Connector menu item
Manage Generic Technology Connector menu item
The required permissions are as follows:
Form Designer (Allow Insert, Write Access, Delete Access)
Structure Utility.Additional Column (Allow Insert, Write Access, Delete Access)
Meta-Table Hierarchy (Allow Insert, Write Access, Delete Access)
If these permissions are not correctly assigned to the group, then an error is thrown when the user clicks the Create button on the final Administrative and User Console page for creating generic technology connectors.
To navigate to the first Administrative and User Console page for creating a generic technology connector, open the Administrative and User Console, expand Generic Technology Connector, and then click Create.
From this point onward, page-wise instructions are provided in the following sections:
To provide basic information about the generic technology connector that you want to create, use this page as follows
In the Name field, specify a name for the generic technology connector.
The following are guidelines related to selecting a name for the generic technology connector:
The name must not be the same as that of any other connector (predefined connector or generic technology connector) on this Oracle Identity Manager installation.
The name must not be the same as that of any other connector object (such as resource objects, IT resources, and process forms) on this Oracle Identity Manager installation.
Note:
An error message is displayed if you specify a name that is the same as the name of an existing connector. However, an error message is not displayed if you specify a name that is the same as the name of an existing connector object. Therefore, you must ensure that the name you want to specify is not the same as the name of any existing connector object.Bug 5850602: The preceding paragraph explains this bug.
See Chapter 28 for more information about connector objects that are automatically created as part of the generic technology connector creation process.
The name must not contain non-ASCII characters, because Oracle Identity Manager does not support non-ASCII characters in connector names. However, you can include the underscore character (_) in the name.
See Also:
The "Names of Generic Technology Connectors and Connector Objects" section of the "Known Issues" chapter for information about limitations related to the names of generic technology connectors.If you want to use the generic technology connector for reconciliation, select Reconciliation and then perform the following steps:
From the Transport Provider list, select the Reconciliation Transport Provider that you want to use for this connector. This list displays the predefined Reconciliation Transport Providers and the Reconciliation Transport Providers that you create.
From the Format Provider list, select the Reconciliation Format Provider that you want to use for this connector. This list displays the predefined Reconciliation Format Providers and the Reconciliation Format Providers that you create.
Note:
If you select the Shared Drive Reconciliation Transport Provider, then you must also select the CSV Reconciliation Format Provider because all the parameters of this provider are bundled with the parameters of the Shared Drive Reconciliation Transport Provider.If you want to use the connector to perform trusted source reconciliation with the target system, then select Trusted Source Reconciliation.
Note:
If you select the Trusted Source Reconciliation check box, then the Provisioning region of the page is disabled. This is because you cannot provision to a target system that you designate as a trusted source. You can only reconcile data from a trusted source.If you want to use the generic technology connector for provisioning, select Provisioning and then perform the following steps:
Note:
You can select only Reconciliation, only Provisioning, or both Reconciliation and Provisioning.From the Transport Provider list, select the Provisioning Transport Provider that you want to use for this connector. This list displays the predefined Provisioning Transport Providers and the Provisioning Transport Providers that you create.
If you select the Web Services Provisioning Transport Provider and if Secure Sockets Layer (SSL) is enabled for the target Web service, then you must perform the procedure described in the "Configuring SSL Communication Between Oracle Identity Manager and the Target System Web Service" section.
From the Format Provider list, select the Provisioning Format Provider that you want to use for this connector. This list displays the predefined Provisioning Format Providers and the Provisioning Format Providers that you create.
If you select the SPML Provisioning Format Provider, then you must also select the Web Services Provisioning Transport Provider because the parameters of this provider are related to the parameters of the Web Services Provisioning Transport Provider.
Click Continue.
Table 22-1 lists sample entries for the GUI elements on the Step 1: Provide Basic Information page.
Table 22-1 Sample Entries for the Step 1: Provide Basic Information Page
| Label on the Step 1: Provide Basic Information Page | Sample Value or Action | Reference Information |
|---|---|---|
|
Name field |
MyGTC2 |
NA |
|
Reconciliation check box |
Check box selected |
NA |
|
Transport Provider list |
Shared Drive |
|
|
Format Provider list |
CSV |
|
|
Provisioning check box |
Check box selected |
NA |
|
Transport Provider list |
Web Services |
|
|
Format Provider list |
SPML |
Figure 22-1 shows the Step 1: Provide Basic Information page on which the entries described in Table 22-1 have been made.
Figure 22-1 Step 1: Provide Basic Information Page
Use this page to specify values for the parameters of the providers that you select on the Step 1: Provide Basic Information page.
On this page, the provider parameters are divided into two categories:
See Also:
Chapter 20, "Predefined Generic Technology Connector Providers Shipped with Oracle Identity Manager" for detailed information about the run-time parameters of predefined providers that you select on the Step 1: Provide Basic Information pageRun-time parameters are input variables of the providers that you select on the previous page. A run-time parameter represents a value that is not constrained by the design of the provider. For example, the location of the directories containing the data files that you want to reconcile is a run-time parameter.
The parameters listed in this section are either design parameters of providers or reconciliation-specific parameters that are common to all generic technology connectors. A design parameter represents a value or set of values that is defined as part of the provider design.
See Also:
Chapter 20, "Predefined Generic Technology Connector Providers Shipped with Oracle Identity Manager" for detailed information about the design parameters of predefined providers that you select on the Step 1: Provide Basic Information pageFor example:
The format of data files that can be parsed by a Format Provider is a design parameter for that provider. While designing the provider, you define the set of formats the provider can parse. On the Step 2: Specify Parameter Values page, you specify the particular format (from the set of supported formats) that an instance of the Format Provider must parse.
The following are reconciliation-specific design parameters:
Note:
If you do not select the Reconciliation option on the previous page, then these reconciliation-specific design parameters are not displayed on this page.Use this parameter to specify a batch size for the reconciliation run. By using this parameter, you can break into batches the total number of records that the reconciliation engine fetches from the target system during each reconciliation run.
The default value of this parameter is All.
During reconciliation, data from the Reconciliation Format Provider is accepted as input by the Validation Provider. Some of the reconciliation data records may not clear the validation checks. You can use the Stop Reconciliation Threshold parameter to automatically stop reconciliation if the percentage of records that fail the validation checks to the total number of reconciliation records processed exceeds the specified value.
The following example illustrates how this parameter works:
Suppose you specify 20 as the value of the Stop Reconciliation Threshold parameter. This means that you want reconciliation to stop if the percentage of failed records to the total number of records processed becomes equal to or greater than 20. Suppose the second and eighth records fail the validation checks. At this stage, the number of failed records is 2 and the total number of records processed is 8. The percentage of failed records is 25, which is greater than the specified threshold of 20. Therefore, reconciliation is stopped after the eighth record is processed.
Note:
The Stop Reconciliation Threshold parameter is used during reconciliation only if you select Validation Providers on the Step 3: Modify Connector Configuration page.
If reconciliation is stopped because the actual percentage of failed records exceeds the specified percentage, then the records that have already been reconciled into Oracle Identity Manager are not removed.
The default value of this parameter is None. This default value specifies that during a reconciliation run, you want all the target system records to be processed, regardless of the number of records that fail the checks.
Stop Threshold Minimum Records
If you use the Stop Reconciliation Threshold parameter, then there may be a problem if invalid records are encountered right at the beginning of the reconciliation run. For example, suppose you specify 40 as the value of the Stop Reconciliation Threshold parameter. When reconciliation starts, suppose the first record fails the validation checks. At this stage, the percentage of failed records to total records processed is 100. Therefore, reconciliation would stop immediately after the first record is processed.
To avoid such situations, you can use the Stop Threshold Minimum Records parameter in conjunction with the Stop Reconciliation Threshold parameter. The Stop Threshold Minimum Records parameter specifies the number of records that must be processed by the Validation Provider before the Stop Reconciliation Threshold validation is enabled.
The following example illustrates how this parameter works:
Suppose you specify the following values:
Stop Reconciliation Threshold: 20
Stop Threshold Minimum Records: 80
With these values, from the eighty-first record onward, the Stop Reconciliation Threshold validation is enabled. In other words, after the eightieth record is processed, if any record fails the validation check, then the reconciliation engine calculates the percentage of failed records to total records processed.
The default value of this parameter is None.
Note:
The Stop Threshold Minimum Records parameter is used during reconciliation only if you select Validation Providers on the Step 3: Modify Connector Configuration page.
You must specify a value for the Stop Threshold Minimum Records parameter if you specify a value for the Stop Reconciliation Threshold parameter.
Use this parameter to specify whether you want the reconciliation engine to perform incremental or full reconciliation.
Note:
The outcome of both full and incremental reconciliation is the same: target system records that are created or updated after the last reconciliation run are reconciled into Oracle Identity Manager.In incremental reconciliation, only target system records that are newly added or modified after the last reconciliation run are brought to Oracle Identity Manager. Reconciliation events are created for each of these records.
In full reconciliation, all target system records are brought to Oracle Identity Manager. The optimized reconciliation feature identifies and ignores records that have already been reconciled. Reconciliation events are created for the remaining records.
You must select incremental reconciliation if either one of the following conditions is true:
The target system time stamps or uniquely marks (in some way) files or individual data records that it generates, and the Reconciliation Transport Provider can recognize records that have been time stamped or marked by the target system.
For example:
Suppose the target system can time stamp the creation of or modifications to user data records. If you can create a custom Reconciliation Transport Provider that can read this time-stamp information, then only new or modified data records will be transported to Oracle Identity Manager during reconciliation.
The target system provides only data records that are newly added or modified after the last reconciliation run.
If neither of these conditions is true, then you must select full reconciliation.
Reconcile Deletion of Multivalued Attribute Data
Use this parameter to specify whether or not you want to reconcile into Oracle Identity Manager the deletion of multivalued attribute data (child data) on the target system.
The following example explains how this design parameter works:
There is an account for user John Doe on the target system. This user is a member of two user groups, CREATE USERS and REVIEW PERMISSIONS, on the target system. This user account (along with the group membership information) also exists on Oracle Identity Manager.
On the target system, suppose this user is removed from the REVIEW PERMISSIONS group. During the next reconciliation run, the action that will be taken in Oracle Identity Manager depends on whether or not you select the Reconcile Deletion of Multivalued Attribute Data check box:
If you select the check box, then information about this user being a member of the REVIEW PERMISSIONS group on the target system is removed from the Oracle Identity Manager database. All other changes made to this user account on the target system are also reconciled.
If you do not select the check box, then information about this user being a member of the REVIEW PERMISSIONS group on the target system is not removed from the Oracle Identity Manager database. However, all other changes made to this user account on the target system are reconciled.
Use this parameter to specify the format in which date values are stored in the target system.
The format that you specify is used to validate date values fetched during reconciliation and to convert the date values to the format used internally by Oracle Identity Manager.
The Validate Date Format Provider is one of the predefined Validation Providers. During a reconciliation run, the Validate Date Format Provider uses the source date format to validate date values fetched from the target system. Only date values that match the source date format are converted to the date format used by Oracle Identity Manager and then reconciled. This format validation and conversion applies to all date fields (for example, Date of Birth and Hire Date) of the target system.
See Also:
The "Validation Providers" sectionFor information about the date formats that you can specify, see the following page on the Sun Java Web site:
http://java.sun.com/docs/books/tutorial/i18n/format/simpleDateFormat.html
Note:
If you want the source date format to be used in date validation, while performing the procedure described in the "Adding or Editing Fields in Data Sets" section, you must:Map date fields of the Source data sets to date fields of the Reconciliation Staging data sets.
Edit each date field of the Reconciliation Staging data sets and set its data type to the Date data type.
The default value of the Source Date Format parameter is the date format specified as the value of the XL.DefaultDateFormat system property. If you do not specify a value for the Source Date Format parameter, then the default date format is used for date validation during reconciliation.
See Also:
The "Rule Elements, Variables, Data Types, and System Properties" section in Oracle Identity Manager Reference for information about the system properties of Oracle Identity ManagerThe following example illustrates how the Source Date Format parameter is used:
Suppose the following are date values in the target system:
Date 1: 05/04/2007 06:25:44 PM
Date 2: 05/06/2007 07:31:44 PM
Date 3: Thu, Apr 9, '98
Date 4: 07/03/2008 02:15:55 PM
Scenario 1:
While creating the connector, you had entered the following as the value of the Source Date Format parameter:
MM/dd/yyyy hh:mm:ss a
During a reconciliation run, the record containing the Date 3 value is not reconciled because it does not conform to the specified source date format.
Scenario 2:
While creating the connector, you had not entered a value for the Source Date Format parameter. Therefore, during a reconciliation run, all four records are validated against the date format specified as the value of the XL.DefaultDateFormat system property.
The following is a provisioning-specific design parameter:
Note:
If you do not select the Provisioning option on the previous page, then this provisioning-specific design parameter is not displayed.Use this parameter to specify the format in which you want to send date values to the target system during provisioning operations.
During a provisioning operation, date values are converted to the format that you specify as the value of the Target Date Format parameter. This format conversion applies to all date fields (for example, Date of Birth and Hire Date) that are used in the provisioning operation.
For information about the date formats that you can specify, see the following page on the Sun Java Web site:
http://java.sun.com/docs/books/tutorial/i18n/format/simpleDateFormat.html
If you do not specify a date format, then the following date format is used as the default value of this parameter:
yyyy/MM/dd hh:mm:ss z
The following example illustrates how the Target Date Format parameter is used:
During a provisioning operation, any date value that you enter will be in the yyyy/MM/dd hh:mm:ss z format.
Scenario 1:
While creating the connector, you had entered the following as the value of the Target Date Format parameter:
yyyy.MM.dd G 'at' hh:mm:ss z
During a provisioning operation, an Oracle Identity Manager date value (for example, 2007/05/04 06:25:44 IST) will be converted into the target date format (for example, 2007.05.04 AD at 06:25:44 IST) and then sent to the target system.
Scenario 2:
While creating the connector, you had not entered a value for the Target Date Format parameter. During a provisioning operation, date values are sent to the target system in the (default) yyyy/MM/dd hh:mm:ss z format.
After you specify values for the run-time and design parameters, click Continue.
Note:
If any value that you provide on this page is not correct, then an error message is displayed at the top of the page after you click Continue. If this happens, then fix the parameter value and click Continue again.Table 22-2 lists sample entries for the Step 2: Specify Parameter Values page. The GUI elements displayed on this page are based on the entries made on the Step 1: Provide Basic Information page.
Table 22-2 Sample Entries for the Step 2: Specify Parameter Values Page
| Label on the Step 2: Specify Parameter Values Page | Sample Value or Action | Reference Information |
|---|---|---|
|
Run-Time Parameters of the Shared Drive Reconciliation Transport Provider |
||
|
Staging Directory (Parent Identity Data) field |
D:\gctestdata\commaDelimited\parent |
NA |
|
Staging Directory (Multivalued Identity Data) field |
D:\gctestdata\commaDelimited\child |
NA |
|
Archiving Directory field |
D:\gctestdata\commaDelimited\archive |
NA |
|
File Prefix field |
file |
NA |
|
Specified Delimiter field |
, |
NA |
|
Tab Delimiter check box |
Check box not selected |
NA |
|
Fixed Column Width field |
NA |
|
|
Unique Attribute (Parent Data) field |
UserIDTD |
NA |
|
Run-Time Parameter of the Web Services Provisioning Transport Provider |
||
|
Web Service URL field |
http://acme123:8080/spmlws/services/HttpSoap11 |
NA |
|
Run-Time Parameters of the SPML Provisioning Format Provider |
||
|
Target ID field |
target |
NA |
|
User Name (authentication) field |
xelsysadm |
NA |
|
User Password (authentication) field |
NA |
|
|
Design Parameters of the Shared Drive Reconciliation Transport Provider |
||
|
File Encoding field |
Cp1251 |
NA |
|
Design Parameters of the Web Services Provisioning Transport Provider |
||
|
Web Service SOAP Action field |
http://xmlns.oracle.com/OIM/provisioning//processRequest |
NA |
|
Design Parameters of the SPML Provisioning Format Provider |
||
|
WSSE Configured for SPML Web Service? check box |
Check box not selected |
NA |
|
Custom Authentication Credentials Namespace field |
http://xmlns.oracle.com/OIM/provisioning |
NA |
|
Custom Authentication Header Element field |
OIMUser |
NA |
|
Custom Element to Store User Name field |
OIMUserId |
NA |
|
Custom Element to Store Password field |
OIMUserPassword |
NA |
|
SPML Web Service Binding Style (DOCUMENT or RPC) field |
RPC |
NA |
|
SPML Web Service Complex Data Type field |
NA |
|
|
SPML Web Service Operation Name field |
processRequest |
NA |
|
SPML Web Service Target Namespace field |
http://xmlns.oracle.com/OIM/provisioning |
NA |
|
SPML Web Service Soap Message Body Prefix field |
NA |
|
|
ID Attribute for Child Dataset Holding Group Membership Information field |
NA |
|
|
Generic Design Parameters |
This section |
|
|
Target Date Format field |
yyyy-MM-dd hh:mm:ss.fffffffff |
NA |
|
Batch Size field |
All |
NA |
|
Stop Reconciliation Threshold field |
None |
NA |
|
Stop Threshold Minimum Records field |
None |
NA |
|
Source Date Format field |
yyyy/MM/dd hh:mm:ss z |
NA |
|
Reconcile Deletion of Multivalued Attribute Data check box |
Check box selected |
NA |
|
Reconciliation Type list |
Incremental |
NA |
Figure 22-2 shows the first section of the Step 2: Specify Parameter Values page on which the entries listed in Table 2 have been made.
Figure 22-2 First Section of the Step 2: Specify Parameter Values Page
Figure 22-3 shows the second section of the Step 2: Specify Parameter Values page on which the entries listed in Table 2 have been made.
Figure 22-3 Second Section of the Step 2: Specify Parameter Values Page
Figure 22-4 shows the third section of the Step 2: Specify Parameter Values page on which the entries listed in Table 2 have been made.
Figure 22-4 Third Section of the Step 2: Specify Parameter Values Page
Use this page to define data sets and mappings between the fields of the data sets. In other words, you use this page to specify the user data fields that you want to:
Propagate from the target system to Oracle Identity Manager during reconciliation
Propagate from Oracle Identity Manager to the target system during provisioning
In the generic technology connector context, the term metadata refers to the set of identity fields that constitute the user account information on the target system.
First Name, Last Name, Hire Date, and Department ID are examples of user data fields that constitute metadata. The values assigned to these fields constitute the user data on the target system. For example, the identity information of user John Doe on the target system can be composed of the following fields:
First Name: John
Last Name: Doe
Hire Date: 04-December-2007
Department ID: Sales
. . .
After you click the Continue button on the Step 2: Specify Parameter Values page, the metadata displayed on the Step 3: Modify Connector Configuration page depends on the following factors:
Input provided on the Step 1: Provide Basic Information and Step 2: Specify Parameter Values pages
Availability of sample target system data
Note:
In the generic technology connector context, the term metadata detection refers to the process in which sample user data is read from the target system and the corresponding metadata (identity field names) is displayed on the Step 3: Modify Connector Configuration page.Oracle Identity Manager performs the following steps while attempting to detect metadata:
The Reconciliation Transport Provider and Reconciliation Format Provider try to fetch and parse metadata from the target system.
Together, the Shared Drive Reconciliation Transport Provider and CSV Reconciliation Format Provider can detect metadata from the target system. If you want custom providers to perform the same function, then you must ensure that:
The Java code for the Reconciliation Transport Provider contains an implementation of the getMetadata() method of the ReconTransportProvider interface.
The Java code for the Reconciliation Format Provider contains an implementation of the parseMetadata() method of the ReconFormatProvider interface.
If these providers successfully fetch and parse metadata from the target system, then Oracle Identity Manager uses information returned by them to display metadata and the following step is not performed.
If the Reconciliation Transport Provider and Reconciliation Format Provider cannot fetch and parse metadata from the target system, then the Provisioning Transport Provider and Provisioning Format Provider try to perform this function.
The Web Services Provisioning Transport Provider and SPML Provisioning Format Provider cannot detect metadata from the target system. If you want custom providers to be able to detect metadata, then you must ensure that:
The Java code for the Provisioning Transport Provider contains an implementation of the defineMetadata() method of the ProvisioningTransportProvider interface.
The Java code for the Provisioning Format Provider contains an implementation of the parseMetadata() method of the ProvisioningFormatProvider interface.
If the Provisioning Transport Provider and Provisioning Format Provider successfully fetch and parse metadata from the target system, then Oracle Identity Manager uses information returned by these providers to display metadata. If these providers are not successful, then only the default fields defined for any of the provisioning-specific providers that you select are displayed. For example, the ID field of the OIM - Account data set and the objectClass and containerID fields of the Provisioning Staging data set are displayed by default. These data sets and fields are discussed later in this guide.
Figure 22-5 shows the Step 3: Modify Connector Configuration page for the sample entries listed at the end of the "Step 1: Provide Basic Information Page" and "Step 2: Specify Parameter Values Page" sections.
Figure 22-5 Step 3: Modify Connector Configuration Page
The data sets displayed on the Step 3: Modify Connector Configuration page are categorized as follows:
See Also:
The "Functional Architecture of Generic Technology Connectors" sectionThe Source data sets are displayed only if you select the Reconciliation option on the first page, regardless of whether or not you select the Provisioning option.
The Reconciliation Staging data sets are displayed only if you select the Reconciliation option on the Step 1: Provide Basic Information page, regardless of whether or not you select the Provisioning option.
The OIM data sets are always displayed, regardless of the options you select on the Step 1: Provide Basic Information page. However, the OIM - Account data set and its child data sets are not displayed if you select the Trusted Source Reconciliation option on the Step 1: Provide Basic Information page.
The fields displayed in the OIM - User data set are predefined for the OIM User. You can show or minimize the full list of OIM - User data set fields by clicking the arrow icon at the top of the data set. The following fields are displayed in the minimized state of the data set:
User ID
Password
First Name
Last Name
Note:
If you select the Trusted Source Reconciliation option on the Step 1: Provide Basic Information Page, then all the fields of the OIM - User data set are displayed and you cannot use the arrow icon to minimize the display.These fields constitute the minimum set of OIM User fields for which values must be defined. You can designate some or all of the remaining OIM - User data set fields as mandatory OIM User fields for your Oracle Identity Manager installation. You do this by ensuring that these fields always hold values when the OIM User is created.
Note:
Data set and field names that take up more than a certain amount of space are truncated and dots are displayed after the truncated part of the names. For example, the Deprovisioning Date field of the OIM - User data set is displayed as follows:Deprovisioning Da..
To view the full name of a field, you can click the edit icon for that field or the field to which that field is mapped. In the pop-up window, the field name that you want to view is on either the first page or the second page, depending on the data set to which the field belongs.
You can add user-defined fields (UDFs) to the list of predefined OIM User fields by using the Design Console. These UDFs are displayed in the OIM - User data set on the Step 3: Modify Connector Configuration page.
Depending on the options that you select on the Step 1: Provide Basic Information page, some fields are displayed by default on the Step 3: Modify Connector Configuration page:
ID field
The ID field is displayed by default in the OIM - Account data set, regardless of whether or not you select the Reconciliation option or Provisioning option on the Step 1: Provide Basic Information page. When an account is created, this field is used to store the value that uniquely identifies the account in Oracle Identity Manager and in the target system. For a particular user, this unique field is used to direct other operations, such as modify, delete, enable, disable, and child data operations.
Every target system would have a unique field for tracking the creation of and updates made to a user account. While creating a custom Provisioning Transport Provider, you must ensure that the provider retrieves this unique field value from the target system at the end of a Create User operation. This value must then be used to populate the ID field of the OIM - Account data set.
During reconciliation, the value of the ID field must come from the corresponding unique field of the Reconciliation Staging data set. To set this up, you must create a mapping between the two fields. The procedure to create a mapping is discussed later in this section.
Caution:
If you select both the Provisioning and Reconciliation options while creating a generic technology connector and if you do not create a mapping between the ID field and the unique field of the target system, then records that are linked through reconciliation cannot be used for provisioning operations (such as modify, delete, enable, disable, and child data operations). This is because the ID field is not populated in the linked records.The objectClass field is displayed by default in the OIM - Account data set and Provisioning Staging data set only if you select the SPML Provisioning Format Provider on the Step 1: Provide Basic Information page.
The containerID field is displayed by default in the OIM - Account data set and Provisioning Staging data set only if you select the SPML Provisioning Format Provider on the Step 1: Provide Basic Information page.
The Provisioning Staging data sets are displayed only if you select the Provisioning option on the first page, regardless of whether or not you select the Reconciliation option.
The display of data sets on the Step 3: Modify Connector Configuration page depends on the input that you provide on the Step 1: Provide Basic Information page and Step 2: Specify Parameter Values page. The display of fields within the data sets depends on whether or not metadata detection has taken place.
Note:
Metadata detection does not take place if any of the following conditions are true:Sample target system data (including metadata) is not available.
The Transport and Format Providers that you select are not capable of detecting metadata from sample target system data.
This is illustrated by the following example:
Suppose you select only the Reconciliation option on the Step 1: Provide Basic Information page. In addition, metadata detection has not taken place. Under these conditions, the display of data sets and fields on the Step 3: Modify Connector Configuration page can be summarized as follows:
The following data sets are displayed:
Source
Reconciliation Staging
OIM
The fields that constitute the data sets are not displayed.
In addition, if you had selected the Trusted Source Reconciliation option on the Step 1: Provide Basic Information page, then the OIM - Account data set and its child data sets are not displayed.
In Table 22-3, Scenario 1 shows the outcome of this set of input conditions. The rest of the scenarios in this table describe the display of data sets and fields under the combination of input conditions listed in the first row and first column of the table.
Table 22-3 Display of Data Sets and Fields Under Various Input Conditions
| Only Reconciliation Option Selected | Both Reconciliation and Provisioning Options Selected | Only Provisioning Option Selected | |
|---|---|---|---|
|
Metadata detection has not taken place |
Scenario 1 The following data sets are displayed:
The fields that constitute the data sets are not displayed. If you select the Trusted Source Reconciliation option on the Step 1: Provide Basic Information page, then the OIM - Account data set and its child data sets are not displayed. |
Scenario 2 The following data sets are displayed:
The fields that constitute the data sets are not displayed. |
Scenario 3 The following data sets are displayed:
The fields that constitute the data sets are not displayed. |
|
Metadata detection has taken place |
Scenario 4 The following data sets are displayed:
The fields that constitute the data sets are displayed. If you select the Trusted Source Reconciliation option on the Step 1: Provide Basic Information page, then the OIM - Account data set and its child data sets are not displayed. |
Scenario 5 The following data sets are displayed:
The fields that constitute the data sets are displayed. |
Scenario 6 The following data sets are displayed:
The fields that constitute the data sets are displayed. |
See Also:
The "Multilanguage Support" section of the "Known Issues" chapter for information about limitations related to the display of non-ASCII characters on this pageEach flow line displayed on the Step 3: Modify Connector Configuration page represents a mapping (link) between two fields of different data sets. A mapping serves one of the following purposes:
Establishes a data flow path between fields of two data sets, for either provisioning or reconciliation
A mapping of this type forms the basis for validations or transformations to be performed on data.
Creates a basis for comparing (matching) field values of two data sets
The following are examples of matching-only mappings:
Mappings created between fields of the Reconciliation Staging data set and the OIM - User data set form the basis of a reconciliation rule.
A mapping between the unique field of the Reconciliation Staging data set and the ID field of the OIM - Account data set helps identify the key field for reconciliation matching. Along with the ID field, other fields of the OIM - Account data set can be (matching-only) mapped to corresponding fields of the Reconciliation Staging data set to create a composite key field for reconciliation matching.
You can perform the following actions on the Step 3: Modify Connector Configuration page:
Identity fields detected through metadata detection are displayed on the Step 3: Modify Connector Configuration page. You can modify these fields and the mappings between them. If required, you can also add new fields on this page and create mappings between them.
The following is a summary of the actions that you can perform while adding or editing fields on the Step 3: Modify Connector Configuration page:
Note:
These actions are described in detail in the procedure that follows this list. The procedure also describes the conditions that must be fulfilled before you can perform some of these actions.Default attributes (such as the data type and length) are assigned to the fields displayed through metadata detection. You must edit these fields to set the required attributes for them.
Note:
Oracle Identity Manager can recognize date values fetched during reconciliation only if you set the Date data type for fields of the Reconciliation Staging data sets. In addition, if you have specified a value for the Source Date Format parameter on the Step 2: Specify Parameter Values page, then you must map date fields of the Source data sets to the corresponding date fields of the Reconciliation Staging data sets.The Source Date Format parameter is described in the "Step 2: Specify Parameter Values Page" section.
You can create transformation mappings between fields by using a Transformation Provider. While performing this action, you can use the predefined Concatenation Transformation Provider or Translation Transformation Provider, or a custom Transformation Provider that you have created.
You can create matching-only mappings between fields of the Reconciliation Staging data set and OIM data sets. Matching-only mappings that you create between the Reconciliation Staging data set and the OIM - User data set forms the reconciliation rule. Matching-only mappings that you create between the Reconciliation Staging data set and the OIM - Account data set identifies the key field for reconciliation matching.
You can add a child data set to an existing data set.
You can encrypt the value of a field, both in the process form and in the database.
You can designate a field as a lookup field and select an input source for the field. The input source can be a lookup definition or a combination of columns from Oracle Identity Manager database tables.
You can configure user account status reconciliation.
If you want to configure user account status reconciliation, then refer to the "Configuring Account Status Reconciliation" section.
To add or edit a field in a data set:
Note:
The display of the GUI elements and pages described in the following steps depends on the data set in which you are adding or editing a field. For example, the Required and Encrypted check boxes are not displayed if you are adding or editing a field in a Source data set.Depending on whether you want to add or edit a field, click the Add icon for the data set or the edit icon for the field.
On the Step 1: Field Information page, specify values for the following GUI elements:
See Also:
The "Step 3: Modify Connector Configuration Page" section for information about validations applied to the names of fieldsField Name: If you are adding a field, then specify a name for the field. The field name that you specify must contain only ASCII characters, because non-ASCII characters are not allowed.
Mapping Action: Select the type of mapping that you want to create with this field as the destination field of the mapping. You can select one of the following mapping actions:
Select Create Mapping Without Transformation if you only want to create a one-to-one mapping between a source (input) field and the field that you are adding or editing, and you do not want to use a Transformation Provider.
Select the Remove Mapping option if you are editing the field and you want to remove the mapping for which this field is the destination field. The procedure to remove a mapping is covered in detail in the "Removing Mappings Between Fields" section.
The transformation mapping options displayed in the Mapping Action list are based on the predefined Transformation Providers and the custom Transformation Providers that you create. The following menu options correspond to the predefined Transformation Providers:
* Create Mapping With Concatenation
* Create Mapping With Translation
See Also:
The "Transformation Providers" section for information about these predefined Transformation ProvidersApply the following guidelines while selecting a transformation mapping:
You can create transformation mappings only between fields of the following data sets:
- Source and Reconciliation Staging
- OIM and Provisioning Staging
This means that, for example, you cannot create transformation mappings between a field in a Reconciliation Staging data set and a field in an OIM data set.
You cannot create a 1-to-2 mapping with the following source and destination fields:
Source field: Unique field of the Reconciliation Staging data
Destination fields: User ID field of the OIM - User data set and ID field of the OIM - Account data set
This mapping is not supported. Instead, you must create a one-to-one mapping between the unique field of the Reconciliation Staging data and either the User ID field (of the OIM - User data set) or the ID field (of the OIM - Account data set).
Ensure that all the fields of Provisioning Staging data sets are mapped to corresponding fields of OIM - User and OIM - Account data sets.
When you create a mapping that has any field of the OIM - User data set as the source or destination field, the display of the OIM - User data set fields list is frozen in the position it was in (expanded or minimized) when the mapping was created. To unfreeze the display of the OIM - User data set so that you are able to use the arrow icon, you must remove all mappings that have any OIM - User data set field as the source or destination field.
A literal field can be used as one of the input fields of a transformation field. If you select the Literal option, then you must enter a value in the field. You must not leave the field blank after selecting it.
See "Step 3: Modify Connector Configuration Page" for information about limitations related to creating transformation mappings.
Matching Only: Select this check box if the field is to be used as the destination field of a matching-only mapping. As mentioned earlier in this document, you can create the following types of matching-only mappings:
Note:
You must create matching-only mappings for both parent and child data sets.To create the reconciliation rule, you create matching-only mappings between fields of the Reconciliation Staging data set and the OIM - User data set. Each mapping represents a reconciliation rule element. If there are child data sets, then you must ensure that the names of fields of the Reconciliation Staging data set that are input fields for the matching-only mappings are not used in any of the Reconciliation Staging child data sets.
To specify the key field for reconciliation matching, you create a matching-only mapping between the unique field of the Reconciliation Staging data set and the ID field of the OIM - Account data set. Along with the ID field, other fields of the OIM - Account data set can be (matching-only) mapped to corresponding fields of the Reconciliation Staging data set to create a composite key field for reconciliation matching.
Caution:
If the name of a Reconciliation Staging field used in a matching-only mapping were to be reused as the name of a field in a Reconciliation Staging child data set, then matching would not take place during a reconciliation run.This known issue is explained in the "Step 3: Modify Connector Configuration Page" section.
Create End-to-End Mapping: If you are adding a field, then select this check box if you want the same field to be added in all the data sets that are displayed to the right of the data set in which you are adding the field.
Multi-Valued Field: Select this check box if you want to add a child data set. If you select this check box, then the name that you specify in the Field Name field is used as the name of the child data set.
Note:
If you select the Trusted Source Reconciliation check box on the Step 1: Provide Basic Information page, then this check box (in selected or deselected state) is ignored. This is because the reconciliation of multivalued (child) data is not supported in trusted source reconciliation.Data Type: Select the data type of the field.
After metadata detection, the String data type is applied by default to all the fields of the Reconciliation Staging and OIM - Account data sets. Where required, you must use the Data Type list to specify the actual data type of each field.
Length: Specify the character length of the field.
Required: Select this check box if you want to ensure that the field always contains a value.
Encrypted: Select this check box if the value of the field must be stored in encrypted form in the Oracle Identity Manager database.
Password Field: Select this check box if the value of the field must be encrypted on the process form. Values of fields for which this check box is selected are displayed as asterisks (*) on the process forms.
Note:
If you select the Encrypted and Password Field check boxes, then see "Password-Like Fields" for information about guidelines that you must follow.Lookup Field: Select this check box if you want to make the field a lookup field.
Click Continue.
If you select the Lookup Field check box on the Step 1: Field Information page, then the Step 2: Lookup Properties page is displayed. On this page, you can select and specify values for any combination of the lookup properties described in Table 22-4.
Table 22-4 Lookup Properties
| Lookup Property | Value |
|---|---|
|
Column Names |
In the Property Value field, enter the name of the database column containing the values that must be displayed in the lookup window. If required, you can enter multiple database column names separated by commas. Note: If you select the Lookup Column Name property, then you must also select the Column Names property, which is described later in this table. After you enter a value in the Property Value field, click Submit. The following Microsoft SQL query can be used to illustrate how the Column Names and Lookup Column Name properties are used: SELECT USR_FIRST_NAME, USR_LOGIN, USR_LAST_NAME FROM USR Suppose you set the following as the values of the two properties: - Column Names: - Lookup Column Name: When the user selects a particular |
|
Column Captions |
In the Property Value field, enter the name of the column heading that must be displayed in the lookup window. If multiple columns are going to be displayed in the lookup window, then enter multiple column captions separated by commas, for example, Organization Name, Organization Status. After you enter a value in the Property Value field, click Submit. |
|
Column Widths |
In the Property Value field, enter the character width of the column that must be displayed in the lookup window. This must be the same as the maximum length of the underlying field or column from which data values are drawn to populate the lookup field. If the lookup window is going to display multiple columns, then enter multiple column widths separated by commas. After you enter a value in the Property Value field, click Submit. |
|
Lookup Query |
To specify a value for the Lookup Query property:
To correctly display the data returned from a query, you must add a See Also: Oracle Identity Manager Globalization Guide for information about the For example, consider the following Microsoft SQL query: SELECT usr_status FROM usr To view the data returned from the query, you must add the following entry to the lookupfield.header.users.status=User Status If the The syntax for a lookupfield.header.column_code=display value
The By default, the following entries for lookup field column headers are already available in the lookupfield.header.lookup_definition.lookup_code_information .code_key=Value lookupfield.header.lookup_definition.lookup_code_information .decode=Description lookupfield.header.users.manager_login=User ID lookupfield.header.organizations.organization_name=Name lookupfield.header.it_resources.key=Key lookupfield.header.it_resources.name=Instance Name lookupfield.header.users.user_id=User ID lookupfield.header.users.last_name=Last Name lookupfield.header.users.first_name=First Name lookupfield.header.groups.group_name=Group Name lookupfield.header.objects.name=Resource Name lookupfield.header.access_policies.name=Access Policy Name |
|
Lookup Code |
In the Property Value field, enter the lookup definition code name. This code must generate all information pertaining to the lookup field, including lookup values and the text that is displayed with the lookup field when a lookup value is selected. The classification type of the lookup definition code must be of Lookup Type (that is, the Lookup Type option on the Lookup Definition form must be selected). To enter a lookup code, open the Lookup Definition form, query for the required code, and then copy the code into the Property Value field. After you enter a value in the Property Value field, click Submit. Note: The Lookup Code property can be used to replace the combination of the Column Captions, Column Names, Column Widths, Lookup Column Name, and Lookup Query properties. In addition, the information contained in the Lookup Code property supersedes any values set in these five lookup properties. If you want to implement lookup fields reconciliation, then create a scheduled task that populates the lookup code. |
|
Lookup Column Name |
In the Property Value field, enter the name of the database column containing the value that must be stored corresponding to the Column Names value selected by the user in the lookup window. If required, you can enter multiple database column names separated by commas. Note: If you select the Column Names property, then you must also select the Lookup Column Name property. See the "Lookup Column Name" row in this table for more information about how these two properties are used. After you enter a value in the Property Value field, click Submit. |
|
Auto Complete |
If you enter If you do not want to let users filter the display of values in the lookup field, then enter The default value of the Auto Complete property is After you enter a value in the Property Value field, click Submit. |
If you want to edit the value of a property that is displayed in the table on the Step 2: Lookup Properties page, select the edit option for that property and then click Edit. If you want to remove a property that is displayed in the table, select the delete option for that property and then click Delete.
After you specify properties for the lookup field, click Continue.
If you select a transformation option from the Mapping Action list on the Step 1: Field Information page, then the Step 3: Mapping page is displayed. Use this page to define the transformation function that you want to perform on the input data to the field that you are adding. The steps to be performed depend on the Transformation Provider option (Concatenation, Translation, or custom Transformation Provider) that you select on the previous page:
If you select a predefined Transformation Provider (Concatenation or Translation), then see "Transformation Providers" for detailed information about the procedure to specify parameter values for the predefined Transformation Provider. That section also provides detailed information about configuring user account status reconciliation.
You must use the Translation Transformation Provider if you want to configure the reconciliation of user account status information. This procedure is described in the "Translation Transformation Provider" section.
After you specify values for the transformation provider, click Continue.
If required, select a validation check for the field and then click Add. In other words, select the Validation Provider that you want to use.
The validation options displayed in this list are based on the predefined Validation Providers and any custom Validation Providers that you create.
Click Continue, and then click Close.
If you do not want to perform any other action on the Step 3: Modify Connector Configuration page, then click the Close button that is displayed at the top of the page. You must perform the previous step before you click this Close button.
To remove a field from a data set:
Click the Delete icon for that field.
If you do not want to perform any other action on the Step 3: Modify Connector Configuration page, then click the Close button that is displayed at the top of the page.
To remove a mapping:
Click the edit icon for the destination field of the mapping that you want to remove.
Note:
If the destination field itself is the source field for another mapping, then that mapping is not removed.On the Step 1: Field Information page, select Remove Mapping from the Transformation list.
Click Continue.
On the last page, click Close.
If you do not want to perform any other action on the Step 3: Modify Connector Configuration page, then click the Close button that is displayed at the top of the page.
To remove a child data set:
Click the Delete icon for the data set.
If you do not want to perform any other action on the Step 3: Modify Connector Configuration page, then click the Close button that is displayed at the top of the page.
Figure 22-6 shows the Step 3: Specify Connector Configuration page after the MyField field was added to the OIM - Account and Provisioning Staging data sets.
Figure 22-6 Step 3: Modify Connector Configuration Page After Addition of a Field
Use this page to specify form names for the process forms corresponding to the OIM - Account data set and its child data sets.
Note:
If you select the Trusted Source Reconciliation option on the Step 1: Provide Basic Information page, then the OIM - Account data set and its child data sets are not created. Therefore, this page is not displayed if you select the Trusted Source Reconciliation option.The generic technology connector framework automatically creates certain objects after you submit all the information required to create a generic technology connector. Parent and child process forms corresponding to the OIM - Account data sets are examples of objects that are automatically created. Each process form on a particular Oracle Identity Manager installation must have a unique name.
On the Step 4: Verify Connector Form Names page, the generic technology connector framework displays default names for these process forms based on the names of the corresponding data sets. You must verify and, if required, change the names of these forms to ensure that they are unique for this installation of Oracle Identity Manager. While changing the name of a form, you must use only ASCII characters. An error message is displayed if you specify non-unique form names or if any name contains non-ASCII characters.
Note:
You cannot revisit this page, so ensure that the form names that you specify meet all the requirements before you click Continue.After you specify the form names, click Continue.
Instead of clicking Continue, you can click Back to return to the Step 2: Specify Parameter Values page. However, metadata detection does not take place if you make changes on this page and then click the Continue button. This is to ensure that any customization in the data set structure and mappings made during the first pass through this page does not get overwritten. You can manually add or edit fields and mappings on the Step 3: Modify Connector Configuration page.
Figure 22-7 shows the Step 4: Verify Connector Form Names page.
Figure 22-7 Step 4: Verify Connector Form Names Page
Use this page to review information that you have provided up to this point for creating generic technology connectors. The following is a page-wise explanation of the changes that are permitted on the earlier pages:
Step 1: Provide Basic Information page
You can use either the View link or Back button to reopen and view the information provided on the Step 1: Provide Basic Information page. You cannot change the information displayed on this page, because any change in this information would amount to creating a new generic technology connector.
Step 2: Specify Parameter Values page
You can use either the Change link or Back button to reopen this page. You can change parameter values on this page. However, metadata detection does not take place when you submit the changed values. This is to ensure that any customization in the data set structure and mappings made during the first pass through this page does not get overwritten. You can manually add or edit fields and mappings on the Step 3: Modify Connector Configuration page.
Step 3: Modify Connector Configuration page
You can use the Change link to reopen this page and then add or edit fields and mappings.
Step 4: Verify Connector Form Names page
You cannot revisit this page.
After you verify all the information displayed on the Step 5: Verify Connector Information page, click Create.
At this stage, the generic technology connector framework creates all the standard connector objects on the basis of the information that you provide. The list of these objects includes the connector XML file, which is created and imported automatically into Oracle Identity Manager. Except for the form names, the names of the connector objects are in the GTCname_GTC format.
For example, if you specify DB_conn as the name of a generic technology connector that you create, then all (except the forms) the connector objects are named DB_CONN_GTC.
At the end of the process, a message stating that the connector has been successfully created is displayed on the page.
Note:
If the creation process fails, then objects that are created are not automatically deleted. This point is also mentioned in the "Connector Objects" section of the "Known Issues" chapter.See "Errors Encountered at the End of the Connector Creation Process" for a listing of error messages related to the creation process.
Figure 22-8 shows the first section of the Step 5: Verify Connector Information page on which the entries listed at the end of the "Step 1: Provide Basic Information Page" and "Step 2: Specify Parameter Values Page" sections and the changes described at the end of the "Step 3: Modify Connector Configuration Page" section have been made.
Figure 22-8 First Section of the Step 5: Verify Connector Information Page
Figure 22-9 shows the second section of the Step 5: Verify Connector Information page on which the entries listed at the end of the "Step 1: Provide Basic Information Page" and "Step 2: Specify Parameter Values Page" sections and the changes described at the end of the "Step 3: Modify Connector Configuration Page" section have been made.
Figure 22-9 Second Section of the Step 5: Verify Connector Information Page
Note:
If you select only the Provisioning option on the Step 1: Provide Basic Information page, then you can skip this section because you need not configure reconciliation.A reconciliation scheduled task is created automatically when you create the generic technology connector. To configure and run this scheduled task, follow the instructions in the "Modifying Scheduled Tasks" section.
Note:
The name of the scheduled task is in the following format:GTC_Name_GTC
For example, if the name of the generic technology connector is WebConn, then the name of the scheduled task is WebConn_GTC.
Note:
If you select only the Reconciliation option on the Step 1: Provide Basic Information page, then you can skip this section because you need not configure provisioning.A process definition is one of the objects that are automatically created when you create a generic technology connector. The name of the process definition is in the following format:
GTC_name_GTC
For example, if the name of the generic technology connector is WebConn, then the name of the process definition is WebConn_GTC.
The process tasks that constitute this process definition can be divided into two types:
System-defined process tasks
System-defined process tasks are included by default in all newly created process definitions.
Provisioning-specific process tasks
Provisioning-specific process tasks are included in the process definition of a generic technology connector only if you select the Provisioning option on the Step 1: Provide Basic Information page, regardless of whether or not you select the Reconciliation option.
The following are provisioning-specific process tasks:
Create User
Delete User
Enable User
Disable User
Updated Field_Name (this task is created for each field of the OIM - Account data set, except the ID field)
For mappings created between fields of the OIM - User data set and the Provisioning Staging data set, the following process tasks are created:
Change User_data_set_field_name
Edit Provisioning_Staging_field_name
For example, suppose you create a mapping between the Last Name field of the OIM - User data set and the LName field of the Provisioning Staging data set. The following process tasks are automatically created along with the rest of the provisioning-specific process tasks:
Change Last Name
Edit LName
In addition, the following provisioning-specific process tasks are created for each child data set of the OIM - Account data set:
Child Table Child_Form_Name row Inserted
Child Table Child_Form_Name row Updated
Child Table Child_Form_Name row Deleted
All provisioning-specific process tasks have the following default assignments:
Target Type: Group User With Highest Priority
Group: SYSTEM ADMINISTRATORS
User: XELSYSADM
If required, you can modify these default assignments by following the instructions given in the "Modifying Process Tasks" section in Oracle Identity Manager Design Console Guide.
Note:
This is an optional step. Perform the procedure discussed in this section only if you want to enable logging for the generic technology connector.Depending on the application server that you use, see the "Setting Log Levels" section in one of the following guides for information about the procedure that you must follow to enable logging:
Oracle Identity Manager Installation and Configuration Guide for BEA WebLogic Server
Oracle Identity Manager Installation and Configuration Guide for IBM WebSphere Application Server
Oracle Identity Manager Installation and Configuration Guide for JBoss Application Server
Oracle Identity Manager Installation and Configuration Guide for Oracle Application Server
