test

Oracle Waveset 8.1.1 Business Administrator's Guide

Chapter 4 Configuring Business Administration Objects

This chapter provides information and procedures for using the Administrator Interface to set up and maintain Waveset objects. For more information about Waveset objects, see Waveset Objects of the Overview chapter.

Note –

For information about configuring Waveset for a Service Provider implementation, see Chapter 17, Service Provider Administration

This chapter is organized in the following topics:

Configuring Waveset Policies

Read this section for information about configuring user policies.

This section contains the following topics:

What are Policies?

Waveset policies set limitations for Waveset users by establishing constraints for Waveset accountID, login, and password characteristics.

Note –

Waveset also provides Audit policies that are specifically designed to audit user compliance. Audit policies are discussed in Chapter 13, Identity Auditing: Basic Concepts

Policies are categorized as the following types:

    You create and edit Waveset user policies from the Policies page. To open this page, follow these steps:

  1. Log in to the Administrator interface.

  2. Click the Security tab, then click the Policies subtab.

    The Policies page opens as shown in the following figure.

    Figure showing an Waveset policy.

Must Not Contain Attributes in Policies

You can change the allowed set of “must not contain” attributes in the UserUIConfig configuration object.

Attributes are listed in UserUIConfig as follows:

What is a Dictionary Policy?

A dictionary policy enables Waveset to check passwords against a word database to ensure that they are protected from a simple dictionary attack. By using this policy with other policy settings to enforce the length and makeup of passwords, Waveset makes it difficult to use a dictionary to guess passwords that are generated or changed in the system.

The dictionary policy extends the password exclusion list that you can set up with the policy. (This list is implemented by the Must Not Contain Words option on the Administrator Interface password Edit Policy page.)

ProcedureTo Configure a Dictionary Policy

To set up a dictionary policy, you must:

  1. Open the Policies page as described in Configuring Waveset Policies.

  2. Click Configure Dictionary to display the Dictionary Configuration page.

  3. Select and enter database information.

    Database information includes:

    • Database Type. Select the database type (Oracle, DB2, SQLServer, or MySQL) that you will use to store the dictionary.

    • Host. Enter the name of the host where the database is running.

    • User. Enter the user name to use when connecting to the database.

    • Password. Enter the password to use when connecting to the database.

    • Port. Enter the port on which the database is listening.

    • Connection URL. Enter the URL to use when connecting. These template variables are available:

      • %h - host

      • %p - port

      • %d - database name

      Driver Class. Enter the JDBC driver class to use while interacting with the database.

    • Database Name. Enter the name of the database where the dictionary will be loaded.

    • Dictionary Filename. Enter the name of the file to use when loading the dictionary.

  4. Click Test to test the database connection.

  5. If the connection test is successful, click Load Words to load the dictionary. The load task may take a few minutes to complete.

  6. Click Test to ensure that the dictionary was loaded correctly.

ProcedureTo Implement a Dictionary Policy

Use the following steps to implement a dictionary policy:

  1. Open the Policies page as described in Configuring Waveset Policies.

  2. Click the Password Policy link to edit the password policy.

  3. On the Edit Policy page, select the Check passwords against dictionary words option.

  4. Click Save to save your changes.

    Once implemented, all changed and generated passwords will be checked against the dictionary.

Customizing Email Templates

Waveset uses email templates to deliver information and requests for action to users and approvers. The system includes templates for:

ProcedureTo Customize an Email Template

You can customize email templates to provide specific directions to the recipient, telling him how to accomplish a task or how to see results. For example, you might want to customize the Account Creation Approval template to direct an approver to an account approval page by adding the following message:

Please go to http://host.example.com:8080/idm/approval/approval.jsp to approve account creation for $(fullname).

Use the following procedure to customize an email template using the Account Creation Approval template as an example:

  1. In the Administrator interface, click the Configure tab, then click the Email Templates subtab.

    The Email Templates page opens.

  2. Click to select the Account Creation Approval template.

    Figure illustrating the Edit Email Template tab

  3. Enter details for the template.

    You can enter the following information:

    • In the SMTP Host field, enter the SMTP server name so that email notification can be sent.

    • In the From field, customize the originating email address.

    • In the To and Cc fields, enter one or more email addresses or Waveset accounts that will be the recipients of the email notification.

    • In the Bcc field, enter one or more email addresses or Waveset accounts that will receive blind copies of the email notification.

    • In the Email Body field, customize the content to provide a pointer to your Waveset location.

  4. Click Save.

    You can also modify email templates by using the Identity Manager Integrated Development Environment (Identity Manager IDE). For information about the Identity Manager IDE, go to the following website: https://identitymanageride.dev.java.net/.

    Note –

    You must register and log in to this site.

HTML and Links in Email Templates

You can insert HTML-formatted content into an email template to display in the body of an email message. Content can include text, graphics, and Web links to information. To enable HTML-formatted content, select the HTML Enabled option.

Allowable Variables in the Email Body

You can also include references to variables in the email template body, in the form $(Name); for example: Your password $(password) has been recovered.

Allowable variables for each template are defined in the following table.

.

Table 4–1 Email Template Variables

Template  

Allowable Variables  

Password Reset 

$(password)– newly generated password

Update Approval 

$(fullname)– user’s full name

$(role)– user’s role

Update Notification 

$(fullname)– user’s full name

$(role)– user’s role

Report 

$(report)– generated report

$(id)– encoded ID of the task instance

$(timestamp)– time when email was sent

Request Resource 

$(fullname)– user’s full name

$(resource)– resource type

Risk Analysis 

$(report)– risk analysis report

Temporary Password Reset 

$(password)– newly generated password

$(expiry)– password expiration date

Configuring Audit Groups and Audit Events

Setting up audit configuration groups allows you to record and report on system events you select. Setting up audit groups also enables you to run AuditLog reports later.

ProcedureTo Open the Audit Configuration Page

You use the Audit Configuration page to set up audit groups. To open the Audit Configuration page, follow these steps:

  1. Open the Administrator interface.

  2. Click the Configure tab, then click the Audit subtab.

    The Audit Configuration page opens.

ProcedureTo Configure Audit Groups

Configuring audit groups and events requires the Configure Audit administrative capability.

  1. Open the Audit Configuration page as described in the previous section.

    The Audit Configuration page shows the list of audit groups, each of which may contain one or more events. For each group, you can record successful events, failed events, or both.

  2. Click an audit group in the list to display the Edit Audit Configuration Group page. This page lets you select the types of audit events to be recorded as part of an audit configuration group in the system audit log.

  3. Check that the Enable auditing check box is selected. Clear the check box to disable the auditing system.

    Note –

    For more information about audit groups, see Audit Configuration inChapter 10, Audit Logging.

ProcedureTo Add Events to the Audit Configuration Group

Use the following steps to add an event to the group:

  1. Click New.

    Waveset adds an event at the bottom of the page.

  2. Select an object type from the list in the Object Type column, and then move one or more items in the Actions column from the Available area to the Selected area for the new object type.

  3. Click OK to add the event to the group.

ProcedureTo Edit Events in the Audit Configuration Group

You can edit events in the group by adding or deleting actions for an object type, as follows:

  1. Move items in the Actions column from the Available to the Selected area for that object type.

  2. Click OK.

Remedy Integration

You can integrate Waveset with a Remedy server, enabling it to send Remedy tickets according to a specified template.

Set up Remedy integration in two areas of the Administrator interface:

Creation of Remedy tickets is configured through Waveset workflow. Depending on your preferences, a call can be made at an appropriate time that uses the defined template to open a Remedy ticket. For more information about configuring workflows, see Chapter 1, Workflow, in Oracle Waveset 8.1.1 Deployment Reference.

Configuring the End-User Interface

Administrators can configure certain aspects of the end-user interface by modifying a form in the Administrator interface.

ProcedureTo Set Options for Displaying Information in the End-User Interface

  1. In the Administrator interface, click Configure in the main menu.

  2. Click User Interface in the secondary menu.

    The User Interface page opens.

  3. Complete and save the End User Dashboard portion of the form. Click Help if you need help with the form.

    For information on completing the Anonymous Enrollment portion of the form, see Anonymous Enrollment.

ProcedureTo Enable Process Diagrams in the End-User Interface

Process diagrams depict the workflow that Waveset follows when end-users launch a request or update their profile. When enabled, process diagrams display on the results page after the end-user submits a form.

Process diagrams must be enabled in the Administrator interface before they can be enabled in the end-user interface. See Enabling Process Diagrams for Use in Waveset for more information.

  1. Open the User Interface configuration page by following the steps in Configuring the End-User Interface

  2. Select the Enable End-User Process Diagrams option, which is located in the Result Pages section of the form.

    If the Enable End-User Process Diagrams option is not available, then you must first enable process diagrams in the Administrator interface. See Enabling Process Diagrams for Use in Waveset.

  3. Click Save.

Registering Waveset

Administrators are encouraged to register their installation of Waveset.

You must have an Oracle Online Account and password to register. If you do not have an Oracle Online Account, you can register for one by completing the form at this address:

https://reg.sun.com/register

Waveset can be registered from the console or by using the Administrator interface.

Registering from the console allows you to also create a local service tag, which can be used with Sun Service Tag software to track your inventory of Oracle systems, software, and services. The service tags client package should be installed before you create a local service tag. This package can be downloaded by clicking the Download Service Tags button at the following address:

http://inventory.sun.com/inventory

To register Waveset, you must log on with an administrator account that allows you to configure Waveset objects. This account must have the Product Registration capability. For information about capabilities, see Assigning Capabilities to Users.

Note –

Java on your Waveset application servers must be properly configured for SSL for the product registration feature to work. All Jar files referenced in your java.security file (or equivalent) need to be present.

The rest of this section provides information and instructions to help you register Waveset. This information is organized into the following topics:

Registering Waveset from the Console

You use the register command to register Waveset from the console. This section contains information about this command, including:

register Command Usage

register -local
register -remote [-u <userid> [-p <password>]] [-prompt] -userSOA <userid> 
-passSOA <password> [-proxy <proxyHost> [-port <proxyPortNumber>]] 
register [-help | -?]

register Command Options

The following table describes the options you can use with the register command.

Table 4–2 Command Options

Option  

Description  

-local

Create a service tag on this host. 

-remote

Register this installation of Waveset over the network directly with Oracle. 

-u <userid>

The Waveset user ID of the Waveset administrator who is authorized to do the registration. 

-p <password>

The Waveset password of the Waveset administrator who is authorized to do the registration. 

-prompt

Interactively prompt for the password if missing. 

-userSOA <userid>

The user ID of the Oracle Online Account that will be used for registration. Required if registering with the -remote option.

-passSOA <password>

The password of the Oracle Online Account that will be used for registration. Required if registering with the -remote option.

-proxy <proxyHost>

The network proxy to use for access to the Oracle online registration service. Required if registering with the -remote option and your network is configured to use a proxy to reach external Internet addresses.

-port <proxyPortNumber>

The port on the network proxy to use for access to the Oracle online registration service. Required if registering with the -remote option and your network is configured to use a proxy to reach external Internet addresses.

-help | -?

Print help for this command to the console. 

ProcedureTo Register Waveset from the Console

To register Waveset from the Console, you must create a local service tag or register with Oracle over the Internet. Use the following instructions:

  1. Start the Waveset console (command-line) interface.

    • From a Windows command line, type

      %WSHOME%\bin\lh

    • From a UNIX command line, type

      $WSHOME/bin/lh

  2. Use the register command to register Waveset.

    Use the following syntax:

    • To create a local service tag,

      register -local

    • To register Waveset over the Internet, use the following command:

      register -remote -u <userid> -p <password> -userSOA <soaUserid> -passSOA <soaPassword> -proxy <proxyHost> -port <proxyPortNumber>

      where:

      • userid is the Waveset userID of the Waveset administrator who is authorized to do the registration.

      • password is the Waveset password of the Waveset administrator who is authorized to do the registration.

      • soaUserid is the user ID of the Oracle Online Account that will be used for registration.

      • soaPassword is the password of the Oracle Online Account that will be used for registration.

      • proxyHost is the network proxy to use for access to the Oracle online registration service. Only required if your network is configured to use a proxy to reach external Internet addresses.

      • proxyPortNumber is the port on the network proxy to use for access to the Oracle online registration service. Only required if your network is configured to use a proxy to reach external Internet addresses.

ProcedureTo Register Waveset from the Administrator Interface

If you do not need to create a local service tag, register Waveset from the Administrator interface.

  1. In the Administrator interface, click Configure.

  2. In the secondary menu, click Product Registration.

    The Product Registration page opens.

  3. Complete the form and click Register Now. Click the i-Helps for information about individual form fields.

    Note –

    • If your application server is not configured to allow outgoing SSL connections, you might see the following error message:


      Failed to register on Sun Connection server 
due to invalid Sun Online Account user/password.

      To resolve this issue, add the appropriate trusted root certificates to your application server’s keystore. Consult your application server’s documentation for details.

    • If old versions of xml-apis.jar and xercesImpl.jar are present in your application server’s classpath, you might see the following error message:


      java.lang.NoSuchMethodError:org.w3c.dom.Node.getTextContent()Ljava/lang/String;

      To resolve this problem, modify the classpath so that only the most recent versions of xml-apis.jar and xercesImpl.jar are present.

Editing Waveset Configuration Objects

In the course of administering Waveset, you will occasionally be called upon to edit the Waveset system configuration object (also referred to as the System Configuration File), or other similar objects.

  1. Open the Waveset Debug Page by typing the following URL into your browser.

    http://<AppServerHost>:<Port>/idm/debug/session.jsp

    The System Settings page opens.

    Note –

    You must have the Debug capability to view /idm/debug/ pages.

  2. Find the List Objects button, then select Configuration from the adjacent Type drop-down list.

  3. Click the List Objects button.

    The List Objects of type: Configuration page opens.

  4. In the list of objects, find the object you need, then click edit.

    For example, to edit the system configuration object, find System Configuration, then click edit.

  5. Edit the object as directed and click Save.

  6. If directed to do so, restart your server (or servers).