7 Enabling Offline Provisioning

In online provisioning, multiple provisioning operations that constitute a provisioning request are performed in sequence. For example, if you create a request to allocate (provision) five resources to an OIM User, then the system:

• Treats the provisioning of one resource to one user as a provisioning operation

• Processes provisioning operations in sequence, one after the other

The provisioning request is treated as a single transaction. This approach could cause performance issues under certain conditions. In addition, there is a higher probability of transaction timeout and, therefore, the entire transaction being rolled back.

In offline provisioning, provisioning operations within a request are converted into JMS messages. One JMS message is submitted for each resource provisioned to each user. For example, if you create a request to provision 5 resources to 5 OIM Users, then 25 JMS messages are generated. Processing of each JMS message is treated as a single transaction, and it is asynchronous and independent of other JMS messages. Processing of the other messages continues even if one transaction times out. This approach offers better performance and a lower probability of transaction timeout.

This section discusses the following topics:

• Features of Offline Processing

• Enabling and Disabling Offline Provisioning

• Configuring the Remove Failed Off-line Messages Scheduled Task

7.1 Features of Offline Processing

The following are features of offline provisioning:

• The offline provisioning approach is applied only during Provision (Create Target System Account) Resource, Enable Resource, Disable Resource, and Revoke Resource operations. The offline provisioning approach is not applied in a provisioning operation that involves modification of an allocated (provisioned) resource.

• Offline provisioning is not applied during organization provisioning.

• You enable offline provisioning at the resource object level. The procedure is described later in this chapter.

• JMS messages generated during offline provisioning are processed in parallel. Each message is processed independently and asynchronously of other messages. This approach provides better performance over the online provisioning approach in which provisioning operations generated during a particular provisioning request are processed in sequence.

• The response to a provisioning operation is displayed almost immediately after the provisioning data is submitted. This response is not dependent on the processing of each request in the operation.

  When you view resource details of an OIM User, the "Provisioning in Queue" status is displayed if the request for a particular resource has not yet been processed.

• The final status of the resource instance is the same as the status for online provisioning. For example, if a message for a resource is accepted, then the Provisioned status is displayed. The same status is displayed for online provisioning.

• Within an offline provisioning request, processing of each message is treated as an independent transaction. Rejection or failure of a single message does not affect processing of the remaining messages in the provisioning request.

• During offline provisioning, details of a failed message (along with an explanation) are not displayed on the console. This behavior is different from that of online provisioning in which details of a failed operation are displayed on the console. In offline provisioning, details of failed messages are stored in the OPS table. You can view these details by running the Off-line Resource Provisioning Messages report. See "Reports Related to Offline Provisioning" for information about this report.

• When you disable or delete an OIM User, all the resources provisioned to the user must be disabled or revoked, respectively. This is the expected outcome in both online and offline provisioning. The outcome is the same if the request succeeds, regardless of the type of provisioning. However, the outcome is different if an exception is encountered during the operation.

  Online provisioning treats a Disable or Delete OIM User operation as one transaction. If even a single resource cannot be successfully disabled or revoked on the target system, then the entire transaction is rolled back.

  Note:

  A rollback in Oracle Identity Manager does not affect the status of the resource on the target systems. For example, suppose an OIM User is assigned Resource A, Resource B, and Resource C. If this OIM User is deleted, then the system first tries to delete the resources from the respective target systems. Suppose Resources A and B are deleted but problems are encountered on attempting to delete Resource C. In this case, the entire transaction is rolled back and the status of Resources A, B, and C on Oracle Identity Manager is set to whatever it was at the start of the transaction. However, the actual status of Resources A and B on their target systems is that they have been deleted.

  In offline provisioning, the following JMS messages are generated in response to a Disable or Delete OIM User operation:

  • JMS message to disable or delete the OIM User

  • JMS messages to disable or revoke each resource assigned to the OIM User

  If the OIM User is successfully disabled or deleted, then a message (statement) to this effect is displayed on the console. The display of this message (statement) is independent of the success or failure of the JMS messages generated to disable or revoke each resource. If the JMS message for a particular resource fails, then that resource becomes a rogue account in Oracle Identity Manager. You can identify these rogue accounts by running the Off-line Resource Provisioning Messages report. For each of the remaining resources, the status of the resource (Disabled or Revoked) in Oracle Identity Manager is the same as the status of the resource (Disabled or Deleted) on the target system.

7.2 Enabling and Disabling Offline Provisioning

As mentioned earlier, you enable offline provisioning at the resource object level.

To enable offline provisioning:

1. Log in to the Design Console.

2. Expand Resource Management, and double-click Resource Objects.

3. Search for and open the resource object for which you want to enable offline provisioning.

4. On the Resource Object form, select Off-line Provisioning.

5. Click the Save icon.

   Note:

   For Enable, Disable, and Revoke Resource operations, offline provisioning is enabled when you select the Off-line Provisioning check box. Perform the remaining steps of this procedure if you also want to enable offline provisioning for Provision Resource operations.

6. Expand Process Management, and double-click Process Definitions.

7. Search for and open the process definition corresponding to the resource object that you modified earlier.

8. Select the Auto Save Form check box.

9. Click the Save icon.

To disable offline provisioning:

1. Log in to the Design Console.

2. Expand Resource Management, and double-click Resource Objects.

3. Search for and open the resource object for which you want to enable offline provisioning.

4. On the Resource Object form, deselect the Off-line Provisioning check box.

5. Click the Save icon.

7.3 Reports Related to Offline Provisioning

The Off-line Resource Provisioning Messages report returns the list of messages that are generated during offline provisioning and rejected by the target system.

7.4 Configuring the Remove Failed Off-line Messages Scheduled Task

Configure the Remove Failed Off-line Messages scheduled task to schedule deletion of failed requests from the OPS table. While configuring this scheduled task, set a value for the Remove Failed Messages Older Than (days) attribute.

See Oracle Identity Manager Design Console Guide for information about working with scheduled tasks.