2 Deploying the Connector

The procedure to deploy the connector is divided across three stages namely preinstallation, installation, postinstallation. upgrading the Oracle Internet Directory Connector, and cloning the Oracle Internet Directory Connector.

The following topics discuss these stages:

2.1 Preinstallation

Preinstallation of the Oracle Internet Directory connector involves creating a target system user account for creating, modifying, and deleting entries related to the managed objects, including accounts, groups, roles (if supported), and organizational units (OU), update passwords for users; installing and configuring the connector server; running the connector server; configuring SSL for the connector; and enabling logging for the connector.

Preinstallation information is divided across the following sections:

2.1.1 Preinstallation on the Target System

The connector uses a target system account to connect to the target system during reconciliation and provisioning operations. Preinstallation involves creating a target system user account for performing the following functions:

  • Create, modify, and delete entries related to the managed objects, including accounts, groups, roles (if supported), and organizational units (ou).

  • Update passwords for users.

  • Use paging controls that have been configured in the IT resource.

Depending on the target system, create the specific target system account for connector operations as follows:

  • Create an admin user account on the ODSEE target system.

  • Create an admin user account on the OUD target system.

  • Create an admin user, admin group, and ACIs on the OID target system.

    To perform this task, you must be an administrator on the OID target system who is familiar with command-line utilities such as ldapsearch and ldapmodify. If you prefer, you can also use Oracle Directory Services Manager to perform these functions.

  • Create an admin user account on the eDirectory target system.

The detailed instructions for performing these preinstallation tasks are available in the product documentation of the target system.

2.1.2 Installing and Configuring the Connector Server

This section contains the following topics:

2.1.2.1 About Installing and Configuring the Connector Server

You can deploy this connector either locally in Oracle Identity Manager or remotely in the Connector Server. A Connector Server enables remote execution of an Identity Connector.

Connector Servers are available in two implementations:

  • As a .Net implementation that is used by Identity Connectors implemented in .Net

  • As a Java implementation that is used by Java-based Identity Connectors

2.1.2.2 Installing and Configuring the Java Connector Server

Use the following steps to install and configure the Java Connector Server:

Note:

Before you deploy the Java Connector Server, ensure that you install JDK or JRE on the same computer where you are installing the Java Connector Server and that your JAVA_HOME or JRE_HOME environment variable points to this installation.

  1. Download the Java Connector Server package from the Oracle Technology Network.
  2. Create a new directory on the computer where you want to install the Connector Server.

    Note:

    In this guide, CONNECTOR_SERVER_HOME represents this directory.

  3. Unzip the Java Connector Server package in the new directory created in Step 1.
  4. Open the ConnectorServer.properties file located in the conf directory. In the ConnectorServer.properties file, set the following properties, as required by your deployment.
    Property Description

    connectorserver.port

    Port on which the Java Connector Server listens for requests.

    Default value: 8759

    connectorserver.bundleDir

    Directory where the connector bundles are deployed.

    Default value: bundles

    connectorserver.libDir

    Directory in which to place dependent libraries.

    Default value: lib

    connectorserver.usessl

    If set to true, the Java Connector Server uses SSL for secure communication.

    Default value: false

    If you specify true, use the following options on the command line when you start the Java Connector Server:

    • -Djavax.net.ssl.keyStore

    • -Djavax.net.ssl.keyStoreType (optional)

    • -Djavax.net.ssl.keyStorePassword

    When you run the preceding options on the command line, you must set values for them. To set values for these options on the command line, you must prefex them with -J.

    Sample value: -J-Djavax.net.ssl.keyStore=mykeystore.jks

    See also Configuring SSL for the Connector.

    connectorserver.ifaddress

    Bind address. To set this property, uncomment it in the file (if necessary). The bind address can be useful if there are more NICs installed on the computer.

    connectorserver.key

    Java Connector Server key.
  5. Set the properties in the ConnectorServer.properties file, as follows:

    • To set the connectorserver.key, run the Java Connector Server with the /setKey option.

      Note:

      For more information, see Running the Connector Server.

    • For all other properties, edit the ConnectorServer.properties file manually.

  6. The conf directory also contains the logging.properties file, which you can edit if required by your deployment.

Note:

Oracle Identity Manager has no built-in support for testing the Connector Server configuration.

2.1.3 Running the Connector Server

This section describes how to run the Connector Server, depending on your operating system:

See Also:

Using the Java Connector Server in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for more information about a Java Connector Server.

2.1.3.1 Running the Connector Server on UNIX and Linux Systems

To run the Connector Server on UNIX and Linux systems, use the connectorserver.sh script, as follows:

  1. Make sure that you have set the properties required by your deployment in the ConnectorServer.properties file, as described in Installing and Configuring the Connector Server.
  2. Navigate to the CONNECTOR_SERVER_HOME/bin directory.
  3. Use the chmod command to set the permissions to make the connectorserver.sh script executable.
  4. Run the connectorserver.sh script. The script supports the following options.
    Option Description

    /run [ -Jjava-option]

    Runs the Connector Server in the console. Optionally, you can specify one or more Java options.

    For example, to run the Connector Server with SSL:

    ./connectorserver.sh /run
-J-Djavax.net.ssl.keyStore=mykeystore.jks
-J-Djavax.net.ssl.keyStorePassword=password

    /start [ -Jjava-option ]

    Runs the Connector Server in the background. Optionally, you can specify one or more Java options.

    /stop

    Stops the Connector Server, waiting up to 5 seconds for the process to end.

    /stop n

    Stops the Connector Server, waiting up to n seconds for the process to end.

    /stop -force

    Stops the Connector Server. Waits up to 5 seconds and then uses the kill -KILL command, if the process is still running.

    /stop n -force

    Stops the Connector Server. Waits up to n seconds and then uses the kill -KILL command, if the process is still running.

    /setKey key

    Sets the Connector Server key. The connectorserver.sh script stores the hashed value of key in the connectorserver.key property in the ConnectorServer.properties file.

2.1.3.2 Running the Connector Server on Microsoft Windows Systems

To run the Connector Server on Microsoft Windows systems, use the ConnectorServer.bat script as follows:

  1. Make sure that you have set the properties required by your deployment in the ConnectorServer.properties file, as described in Installing and Configuring the Connector Server.
  2. Navigate to the CONNECTOR_SERVER_HOME\bin directory and run the ConnectorServer.bat script.

    The ConnectorServer.bat script supports the following options:

    Option Description

    /install [serviceName] ["-J java-option"]

    Installs the Connector Server as a Windows service.

    Optionally, you can specify a service name and Java options. If you do not specify a service name, the default name is ConnectorServerJava.

    /run ["-J java-option"]

    Runs the Connector Server from the console. Optionally, you can specify Java options. For example, to run the Connector Server with SSL:

    ConnectorServer.bat /run
"-J-Djavax.net.ssl.keyStore=mykeystore.jks"
"-J-Djavax.net.ssl.keyStorePassword=password"

    /setKey [key]

    Sets the Connector Server key. The ConnectorServer.bat script stores the hashed value of the key in the connectorserver.key property in the ConnectorServer.properties file.

    /uninstall [serviceName]

    Uninstalls the Connector Server. If you do not specify a service name, the script uninstalls the ConnectorServerJava service.
  3. To stop the Connector Server, stop the respective Windows service.

2.1.4 Configuring SSL for the Connector

This section describes how to configure SSL for the connector, including:

Caution:

Configuring SSL is an optional procedure; however, it is recommended that you configure SSL. If you do not configure SSL, passwords can be transmitted over the network in clear text. For example, this problem can occur when you are creating a user or modifying a user's password.

2.1.4.1 Configuring SSL on the Target System

To configure SSL on the target system:

  1. On the target system, ensure that SSL is enabled and a port is specified for the Directory Server to accept connections from LDAPS clients.

    For more information, refer to the documentation for your specific target system .

  2. Generate a self-signed certificate.
  3. Export the public key for the certificate you generated in the previous step.

    For example, on an OUD target system:

    keytool -exportcert -alias server-cert -file config/server-cert.txt -rfc 
-keystore config/keystore -storetype JKS

    Or, on an ODSEE target system:

    odsee-instance/bin/dsadm export-cert -o /tmp/odsee.cert . defaultCert

    Or, on an eDirectory target system, you can export the trust certificate from the JDK key store on which eDirectory is installed:

    keytool -J-ns -import -alias ALIAS_NAME -file FULL_PATH\trustedrootcert.der -keystore sys:java\lib\security\cacerts

    Choose and confirm the PKCS#12 file password.

  4. Import the server certificate into the JRE of the target system.

    For example, on an OUD target system:

    keytool -importcert -alias server-cert -file config/server-cert.txt  
-keystore config/truststore -storetype JKS

2.1.4.2 Configuring the Connector Server for SSL

To configure the Connector Server for SSL:

  1. Create a certificate store and add the certificate generated on the target system to the store. For example, on a Windows system: 
    C:\>certutil -f -addstore sslstore C:\target.cert

    This command creates a new certificate store named sslstore and adds the certificate in target.cert to this store.

    Note:

    Ensure that the certificate store with the name used in the preceding command does not already exist. That is, the certificate store used in the ConnectorServer.properties file must have only one certificate. If more than one certificate exists in the certificate store, the Connector Server will not start.

    To view the number of certificates in the certificate store, use the certutil command. For example, on Windows:

    C:\>certutil -viewstore sslstore
  2. In the ConnectorServer.properties file, set the following values: 
    <add key="connectorserver.usessl" value="true" />
<add key="connectorserver.certificatestorename" value="sslstore" />

    In this example, sslstore is the name of the certificate store.

  3. Restart the Connector Server.

    On a Windows system, use the ConnectorServer.bat script. For example:

    ConnectorServer.bat /run
"-J-Djavax.net.ssl.keyStore=sslstore
"-J-Djavax.net.ssl.keyStorePassword=password"

    On a UNIX or Linux system, use the ConnectorServer.sh script. For example:

    ./connectorserver.sh /run
-J-Djavax.net.ssl.keyStore=sslstore
-J-Djavax.net.ssl.keyStorePassword=password
  4. Set the UseSSL IT Resource parameter for the Connector Server to true, as described in Creating the IT Resource for the Connector Server.

2.1.4.3 Configuring Oracle Identity Manager for SSL

To configure Oracle Identity Manager for SSL:

  1. Import the target system certificate into the JDK (or JRE) used by Oracle Identity Manager. For example: 
    keytool -import -keystore my_cacerts -file cert_file_name -storepass password

    In this command:

    • my_cacerts is the full path and name of the certificate store (the default is cacerts).

    • cert_file_name is the full path and name of the certificate file.

    • password is the password of the keystore.

    For example:

    keytool -import -keystore /home/OIM/java/jdk/lib/security/cacerts 
-file /home/target.cert -storepass kspassword
  2. Import the target system certificate into the Oracle WebLogic Server keystore. For example: 
    keytool -import -keystore WEBLOGIC_HOME/server/lib/DemoTrust.jks 
-file cert_file_name -storepass password

    In this command:

    • cert_file_name is the full path and name of the certificate file.

    • password is the password of the keystore.

    For example:

    keytool -import -keystore WEBLOGIC_HOME/server/lib/DemoTrust.jks
-file /home/target.cert -storepass DemoTrustKeyStorePassPhrase

2.1.5 Enabling Logging for the Connector

This section describes the following topics:

2.1.5.1 Enabling Logging on Oracle Identity Manager

2.1.5.1.1 About Enabling Logging on Oracle Identity Manager

When you enable logging, Oracle Identity Manager automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations. Oracle Identity Manager uses Oracle Java Diagnostic Logging (OJDL) for logging. OJDL is based on java.util.logger.

To specify the type of event for which you want logging to take place, set the log level to one of the following:

  • SEVERE.intValue()+100

    This level enables logging of information about fatal errors.

  • SEVERE

    This level enables logging of information about errors that might prevent Oracle Identity Manager from running.

  • WARNING

    This level enables logging of information about potentially harmful situations.

  • INFO

    This level enables logging of messages that highlight the progress of the application.

  • CONFIG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • FINE, FINER, FINEST

    These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These message types are mapped to ODL message type and level combinations as shown in Table 2-1.

Table 2-1 Log Levels and ODL Message Type: Level Combinations

Java Level ODL Message Type:Level

SEVERE.intValue()+100

INCIDENT_ERROR:1

SEVERE

ERROR:1

WARNING

WARNING:1

INFO

NOTIFICATION:1

CONFIG

NOTIFICATION:16

FINE

TRACE:1

FINER

TRACE:16

FINEST

TRACE:32

The configuration file for OJDL is logging.xml, which is located at the following path:

DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml

Here, DOMAIN_HOME and OIM_SEVER are the domain name and server name specified during the installation of Oracle Identity Manager.

2.1.5.1.2 Enabling Logging on Oracle WebLogic Server

To enable logging on Oracle WebLogic Server:

  1. Edit the logging.xml file as follows:

    1. Add the following blocks in the file:

      <log_handler name='OIMCP.LDAP' level='[LOG_LEVEL]' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
<property name='logreader:' value='off'/>
     <property name='path' value='[FILE_NAME]'/>
     <property name='format' value='ODL-Text'/>
     <property name='useThreadName' value='true'/>
     <property name='locale' value='en'/>
     <property name='maxFileSize' value='5242880'/>
     <property name='maxLogSize' value='52428800'/>
     <property name='encoding' value='UTF-8'/>
   </log_handler>

      <logger name="ORG.IDENTITYCONNECTORS.LDAP" level="[LOG_LEVEL]" useParentHandlers="false">
     <handler name="OIMCP.LDAP"/>
     <handler name="console-handler"/>
   </logger>

    2. Replace both occurrences of [LOG_LEVEL] with the ODL message type and level combination that you require. Table 2-1 lists the supported message type and level combinations.

      Similarly, replace [FILE_NAME] with the full path and name of the log file in which you want log messages to be recorded.

      The following blocks show sample values for [LOG_LEVEL] and [FILE_NAME]:

      <log_handler name='OIMCP.LDAP' level='NOTIFICATION:1' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
<property name='logreader:' value='off'/>
     <property name='path' value='F:\MyMachine\middleware\user_projects\domains\base_domain1\servers\oim_server1\logs\oim_server1-diagnostic-1.log'/>
     <property name='format' value='ODL-Text'/>
     <property name='useThreadName' value='true'/>
     <property name='locale' value='en'/>
     <property name='maxFileSize' value='5242880'/>
     <property name='maxLogSize' value='52428800'/>
     <property name='encoding' value='UTF-8'/>
   </log_handler>

      <logger name="ORG.IDENTITYCONNECTORS.LDAP" level="NOTIFICATION:1" useParentHandlers="false">
     <handler name="OIMCP.LDAP"/>
     <handler name="console-handler"/>
   </logger>

      With these sample values, when you use Oracle Identity Manager, all messages generated for this connector that are of a log level equal to or higher than the NOTIFICATION:1 level are recorded in the specified file.

  2. Save and close the file.

  3. Set the following environment variable to redirect the server logs to a file:

    For Microsoft Windows:

    set WLS_REDIRECT_LOG=FILENAME

    For UNIX:

    export WLS_REDIRECT_LOG=FILENAME

    Replace FILENAME with the location and name of the file to which you want to redirect the output.

  4. Restart the application server.

2.1.5.2 Enabling Logging on the Connector Server

2.1.5.2.1 About Enabling Logging on the Connector Server

When you enable logging, the connector server stores in a log file information about events that occur during the course of provisioning and reconciliation operations for different statuses. By default, the connector server logs are set at INFO level and you can change this level to any one of the following:

  • Error

    This level enables logging of information about errors that might allow connector server to continue running.

  • WARNING

    This level enables logging of information about potentially harmful situations.

  • INFO

    This level enables logging of messages that highlight the progress of the operation.

  • FINE, FINER, FINEST

    These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

2.1.5.2.2 Enabling Logging for the Connector Server

To enable the logging information for the Connector Server:

  1. Navigate to the CONNECTOR_SERVER_HOME/Conf directory.
  2. Open the logging.properties file in a text editor.
  3. Edit the following entry by replacing INFO with the required level of logging: 
    .level=INFO
  4. Save and close the file.
  5. Restart the connector server.

2.2 Installation

You must install the Oracle Internet Directory connector in Oracle Identity Manager and if required, place the connector code bundle in the Connector Server.

Depending on where you want to run the connector code (bundle), the connector provides the following installation options:

2.2.1 Installing the Connector in Oracle Identity Manager

Installation on Oracle Identity Manager consists of the following procedures:

2.2.1.1 Running the Connector Installer

To run the Connector Installer:

  1. Copy the contents of the connector installation media directory into the following directory:

    OIM_HOME/server/ConnectorDefaultDirectory

  2. If you are using Oracle Identity Manager release 11.1.1.x, then:

    1. Log in to the Administrative and User Console by using the user account described in Creating the User Account for Installing Connectors in Oracle Fusion Middleware Administering Oracle Identity Manager.

    2. On the Welcome to Identity Manager Advanced Administration page, in the System Management region, click Manage Connector.

  3. If you are using Oracle Identity Manager release 11.1.2.x or later, then:

    1. Log in to Oracle Identity System Administration.

    2. In the left pane, under System Management, click Manage Connector.

  4. In the Connector Management page, click Install.

  5. From the Connector List list, select OID/LDAP/EDIR Connector RELEASE_NUMBER.

    This list displays the names and release numbers of connectors whose installation files you copied into the default connector installation directory in Step 1. Select the connector for your specific target system.

    If you have copied the installation files into a different directory, then:

    1. In the Alternative Directory field, enter the full path and name of that directory.

    2. To repopulate the list of connectors in the Connector List list, click Refresh.

    3. From the Connector List list, select ODSEE/OUD/LDAPV3 Connector RELEASE_NUMBER.

  6. Click Load.

  7. To start the installation process, click Continue.

    The following tasks are performed, in sequence:

    1. Configuration of Connector Libraries

    2. Import of the Connector XML Files (Using Deployment Manager)

    3. Compilation of Adapter Definitions

    On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure is displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:

    • Retry the installation by clicking Retry.

    • Cancel the installation and begin again from Step 1.

  8. If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of steps that you must perform after the installation is displayed. These steps are as follows:

    1. Ensuring that the prerequisites for using the connector are addressed

      Note:

      At this stage, run the Oracle Identity Manager PurgeCache utility to load the server cache with content from the connector resource bundle in order to view the list of prerequisites. See Clearing Content Related to Connector Resource Bundles from the Server Cache for information about running the PurgeCache utility.

      There are no prerequisites for some predefined connectors.

    2. Configuring the IT resource for the connector

      The procedure to configure the IT resource is described later in this guide.

    3. Configuring the scheduled jobs

      The procedure to configure these scheduled jobs is described later in this guide.

When you run the Connector Installer, it copies the connector files to destination directories on the Oracle Identity Manager host computer. These files are listed in Files and Directories on the OID Connector Installation Media.

2.2.1.2 Configuring the IT Resource for the Target System

Note:

If you have configured your target system as a trusted source, then create an IT resource of type OID. For example, OID Trusted. The parameters of this IT resource are the same as the parameters of the IT resources described in Table 2-2 of this section. See Creating IT Resources in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about creating an IT resource.

The IT resource for the target system is created during connector installation. This IT resource contains connection information about the target system. Oracle Identity Manager uses this information during reconciliation and provisioning.

You must specify values for the parameters of the target system IT resource as follows:

  1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 11.1.1.x:

      Log in to the Administrative and User Console

    • For Oracle Identity Manager release 11.1.2.x or later:

      Log in to Oracle Identity System Administration

  2. If you are using Oracle Identity Manager release 11.1.1.x, then:

    1. On the Welcome page, click Advanced in the upper-right corner of the page.

    2. On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Manage IT Resource.

  3. If you are using Oracle Identity Manager release 11.1.2.x or later, then:

    1. Create and activate a sandbox. For detailed instructions on creating and activating a sandbox, see Managing Sandboxes of Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

    2. In the left pane, under Configuration, click IT Resource.

  4. In the IT Resource Name field on the Manage IT Resource page, enter DSEE Server, OID Server, or eDirectory Server and click Search.

    Alternatively, from the IT Resource Type list, you can select LDAP, OID Server, or eDirectory Server and then click Search. Figure 2-1 shows the Manage IT Resource page.

    Figure 2-1 Manage IT Resource Page

    Description of Figure 2-1 follows
    Description of "Figure 2-1 Manage IT Resource Page"

  5. Click the edit icon corresponding to the DSEE Server or OID Server IT resource.

  6. From the list at the top of the page, select Details and Parameters.

  7. Specify values for the parameters of the IT resource. Figure 2-2 shows the Edit IT Resource Details and Parameters page.

    Figure 2-2 Edit IT Resource Details and Parameters Page for the Target System IT Resource

    Description of Figure 2-2 follows
    Description of "Figure 2-2 Edit IT Resource Details and Parameters Page for the Target System IT Resource"

    Table 2-2 describes each parameter of the IT resource.

    Table 2-2 Parameters of the IT Resource for the Target System

    Parameter Description

    host

    Enter the host name or IP address of the target system.

    Sample values:

    myhost

    172.20.55.120

    port

    Enter the port number to connect to the target system.

    Sample value: 1389

    ssl

    Specifies whether communication with the target system must be secured using SSL.

    Default value: true

    Note: You can set the value to true, when SSL is enabled between Oracle Identity Manager and the Connector Server or between Oracle Identity Manager and the target system.To configure SSL between Oracle Identity Manager and the Connector Server, see the "connectorserver.usessl" property in Step 4 of Installing and Configuring the Connector Server.

    See also Configuring SSL for the Connector.

    principal

    Enter the bind DN for performing operations on the target system. For example:

    For ODSEE or OUD: cn=Directory Manager

    For OID: cn=orcladmin

    For eDirectory: cn=Admin,dc=idc

    Note. For eDirectory, the bind DN should be the complete DN name.

    credentials

    Enter the bind password associated with the bind DN.

    failover

    Enter the complete URL of LDAP backup server or servers that the connector must switch to if the primary LDAP server fails or becomes unavailable.

    The URL is a fully qualified host name or an IP address in the following format:

    ldap://host:port

    The following example shows an IP address for one backup LDAP server: ldap://172.20.55.191:389

    If you specify more than one URL, each URL must be enclosed in double quotes (") and separated by a comma (,). For example:

    "ldap://172.20.55.191:389","ldap://172.20.55.171:387"

    baseContexts

    Enter the base contexts for operations on the target system.

    Sample value: "dc=example,dc=com"

    Note: In a multilevel base context, each base context must be specified within double quotes (") and separated by a comma (,).

    For example, "dc=example,dc=com","dc=mydc,dc=com"

    Configuration Lookup

    Enter the name of the lookup definition that stores configuration information used during reconciliation and provisioning.

    If you have configured your target system as a target resource, then enter one of the following values:

    • For ODSEE: Lookup.LDAP.Configuration

    • For OUD: Lookup.LDAP.OUD.Configuration

    • For OID: Lookup.OID.Configuration

    • For eDirectory: Lookup.EDIR.Configuration

    If you have configured your target system as a trusted source, then enter one of the following values:

    • For ODSEE: Lookup.LDAP.Configuration.Trusted

    • For OUD: Lookup.LDAP.OUD.Configuration.Trusted

    • For OID: Lookup.OID.Configuration.Trusted

    • For eDirectory: Lookup.EDIR.Configuration.Trusted

    Connector Server Name

    Name of the IT resource of the type "Connector Server." You create an IT resource for the Connector Server in Creating the IT Resource for the Connector Server.

    Note: Enter a value for this parameter only if you have deployed this connector in the Connector Server.

  8. To save the values, click Update.

2.2.2 Installing the Connector in the Connector Server

To deploy the connector bundle remotely in a Connector Server, you must first deploy the connector in Oracle Identity Manager, as described in Installing the Connector in Oracle Identity Manager.

Note:

You can download the Connector Server from the Oracle Technology Network web page. If you need to set up the Connector Server, see Installing and Configuring the Connector Server.

To install the connector in the Connector Server:

  1. Stop the Connector Server.
  2. Copy the connector bundle to the Connector_Server_Home/bundles directory.
  3. Restart the Connector Server.
  4. Create an IT resource of type "Connector Server" and point it to the Connector Server.
  5. Update the "Connector Server" field name in the connector IT resource with the Connector Server IT resource name.
  6. Stop the Connector Server.

    Note:

    You can download the necessary Connector Server from the Oracle Technology Network web page.

  7. From the installation media, copy the bundle/org.identityconnectors.ldap-1.0.6380.jar file to the CONNECTOR_SERVER_HOME/bundles directory.
  8. Start the Connector Server for the connector bundle to be picked up by the Connector Server.

2.3 Postinstallation

Postinstallation steps are divided across the following sections:

2.3.1 Postinstallation on Oracle Identity Manager

Configuring Oracle Identity Manager involves performing the following procedures:

2.3.1.1 Configuring Oracle Identity Manager 11.1.2 or Later

Note:

You need not perform the procedures described in this section if you have configured your target system as a trusted source.

If you are using Oracle Identity Manager release 11.1.2 or later, you must create additional metadata such as a UI form and an application instance. In addition, you must run entitlement and catalog synchronization jobs. These procedures are described in the following sections:

2.3.1.1.1 Creating and Activating a Sandbox

Create and activate a sandbox as follows. For detailed instructions, see Managing Sandboxes of Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

  1. Log in to Oracle Identity System Administration.
  2. In the upper right corner of the page, click the Sandboxes link.

    The Manage Sandboxes page is displayed.

  3. On the toolbar, click Create Sandbox.
  4. In the Create Sandbox dialog box, enter values for the following fields:

    • Sandbox Name: Enter a name for the sandbox.

    • Sandbox Description: Enter a description of the sandbox.

  5. Click Save and Close.
  6. Click OK on the confirmation message that is displayed.

    The sandbox is created and displayed in the Available Sandboxes section of the Manage Sandboxes page.

  7. From the table showing the available sandboxes in the Manage Sandboxes page, select the newly created sandbox that you want to activate.
  8. On the toolbar, click Activate Sandbox.

    The sandbox is activated.

2.3.1.1.2 Creating a New UI Form

Create a new UI form as follows. For detailed instructions, see Managing Forms in Oracle Fusion Middleware Administering Oracle Identity Manager.

  1. In the left pane, under Configuration, click Form Designer. The Form Designer page is displayed.
  2. From the Actions menu, select Create. Alternatively, click Create on the toolbar. The Create Form page is displayed.
  3. On the Create Form page, enter values for the following UI fields:

    • Resource Type: Select the resource object that you want to associate the form with. For example, AD User.

    • Form Name: Enter a name for the form.

  4. Click Create.

    A message is displayed stating that the form is created.

2.3.1.1.3 Creating an Application Instance

Create an application instance as follows. For detailed instructions, see Managing Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager.

  1. In the left pane of Identity System Administration, under Configuration, click Application Instances. The Application Instances page is displayed.
  2. From the Actions menu, select Create. Alternatively, click Create on the toolbar. The Create Application Instance page is displayed.
  3. Specify values for the following fields:

    • Name: The name of the application instance.

    • Display Name: The display name of the application instance.

    • Description: A description of the application instance.

    • Resource Object: The resource object name. Click the search icon next to this field to search for and select AD User.

    • IT Resource Instance: The IT resource instance name. Click the search icon next to this field to search for and select Active Directory.

    • Form: Select the form name (created in Creating a New UI Form). If the newly created form is not visible, then click the Refresh icon adjacent to the Form field.

  4. Click Save. The application instance is created.
  5. Publish the application instance to an organization to make the application instance available for requesting and subsequent provisioning to users. See Managing Organizations Associated With Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager for detailed instructions.
2.3.1.1.4 Publishing a Sandbox

To publish the sandbox that you created in Creating and Activating a Sandbox:

  1. Close all the open tabs and pages.
  2. In the upper right corner of the page, click the Sandboxes link.

    The Manage Sandboxes page is displayed.

  3. From the table showing the available sandboxes in the Manage Sandboxes page, select the sandbox that you created in Creating and Activating a Sandbox.
  4. On the toolbar, click Publish Sandbox. A message is displayed asking for confirmation.
  5. Click Yes to confirm. The sandbox is published and the customizations it contained are merged with the main line.
2.3.1.1.5 Harvesting Entitlements and Sync Catalog

To harvest entitlements and sync catalog:

  1. Run the scheduled jobs for lookup field synchronization listed in Scheduled Jobs for Lookup Field Synchronization.
  2. Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about this scheduled job.
  3. Run the Catalog Synchronization Job scheduled job. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about this scheduled job.

2.3.1.2 Localizing Field Labels in UI Forms

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 11.1.2.x or later and you want to localize UI form field labels.

To localize field label that is added to the UI forms:

  1. Log in to Oracle Enterprise Manager.

  2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.

  3. In the right pane, from the Application Deployment list, select MDS Configuration.

  4. On the MDS Configuration page, click Export and save the archive to the local computer.

  5. Extract the contents of the archive, and open one of the following files in a text editor:

    • For Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle_en.xlf

    • For releases prior to Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle.xlf

  6. Edit the BizEditorBundle.xlf file in the following manner:

    1. Search for the following text:

      <file source-language="en"  
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

    2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE"
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja"
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

    3. Search for the application instance code. This procedure shows a sample edit for Oracle Internet Directory application instance. The original code is:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_OID_USR_FNAME__c_description']}">
<source>Username</source>
</target>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.adform.entity.oidformEO.UD_OID_USR_FNAME__c_LABEL">
<source>Username</source>
</target>
</trans-unit>

    4. Open the resource file from the connector package, for example OID_ja.properties, and get the value of the attribute from the file, for example, global.udf.UD_OID_USR_FNAME=\u540D.

    5. Replace the original code shown in Step 6.b with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_OID_USR_FNAME__c_description']}">
<source>Username</source>
<target>\u30E6\u30FC\u30B6\u30FC\u540D</target>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.OracleDBForm.entity.OracleDBForm.UD_OID_USR_FNAME__c_LABEL">
<source>Username</source>
<target>\u30E6\u30FC\u30B6\u30FC\u540D</target>
</trans-unit>

    6. Repeat Steps 6.a through 6.d for all attributes of the process form.

    7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing.

      Sample file name: BizEditorBundle_ja.xlf.

  7. Repackage the ZIP file and import it into MDS.

    See Also:

    Deploying and Undeploying Customizations in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager, for more information about exporting and importing metadata files

  8. Log out of and log in to Oracle Identity Manager.

2.3.1.3 Clearing Content Related to Connector Resource Bundles from the Server Cache

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the Oracle Identity Manager database. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

  1. In a command window, switch to the OIM_HOME/server/bin directory.
  2. Enter one of the following commands:

    Note:

    You can use the PurgeCache utility to purge the cache for any content category. Run PurgeCache.bat CATEGORY_NAME on Microsoft Windows or PurgeCache.sh CATEGORY_NAME on UNIX. The CATEGORY_NAME argument represents the name of the content category that must be purged.

    For example, the following commands purge Metadata entries from the server cache:

    PurgeCache.bat MetaData

    PurgeCache.sh MetaData

    On Microsoft Windows: PurgeCache.bat All

    On UNIX: PurgeCache.sh All

    When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

    t3://OIM_HOST_NAME:OIM_PORT_NUMBER

    In this format:

    • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

    • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

2.3.1.4 Setting up the Lookup Definition for Connection Pooling

This section contains the following properties:

2.3.1.4.1 Connection Pooling Properties

By default, this connector uses the ICF connection pooling. Table 2-3 lists the connection pooling properties, their description, and default values set in ICF.

Table 2-3 Connection Pooling Properties

Property Description

Pool Max Idle

Maximum number of idle objects in a pool.

Default value: 10

Pool Max Size

Maximum number of connections that the pool can create.

Default value: 10

Pool Max Wait

Maximum time, in milliseconds, the pool must wait for a free object to make itself available to be consumed for an operation.

Default value: 150000

Pool Min Evict Idle Time

Minimum time, in milliseconds, the connector must wait before evicting an idle object.

Default value: 120000

Pool Min Idle

Minimum number of idle objects in a pool.

Default value: 1
2.3.1.4.2 Modifying the Connection Pooling Properties

Note:

This section describes an optional procedure. Perform this procedure only if you want to modify the default connection pooling properties.

If you want to modify the connection pooling properties to use values that suit requirements in your environment, then:

  1. Log in to the Design Console.
  2. Expand Administration, and then double-click Lookup Definition.
  3. Search for and open one of the following lookup definitions:

    For the trusted source mode:

    • For ODSEE: Lookup.LDAP.Configuration.Trusted

    • For OUD: Lookup.LDAP.OUD.Configuration.Trusted

    • For OID: Lookup.OID.Configuration.Trusted

    • For eDirectory: Lookup.EDIR.Configuration.Trusted

    For target resource mode:

    • For ODSEE: Lookup.LDAP.Configuration

    • For OUD: Lookup.LDAP.OUD.Configuration

    • For OID: Lookup.OID.Configuration

    • For eDirectory: Lookup.EDIR.Configuration

  4. On the Lookup Code Information tab, click Add.

    A new row is added.

  5. In the Code Key column of the new row, enter Pool Max Idle.
  6. In the Decode column of the new row, enter a value corresponding to the Pool Max Idle property.
  7. Repeat Steps 4 through 6 for adding each of the connection pooling properties listed in Table 2-3.
  8. Click the Save icon.

2.3.1.5 Setting Up the OID Configuration Lookup Definition for LDAP Operation Timeouts

When an LDAP request is made by a client to a server and the server does not respond, the client waits forever for the server to respond until the TCP connection times out. On the client-side, you encounter read timed out exceptions while performing lookup field synchronization such as OID Connector Group Lookup Reconciliation. To avoid encountering such an issue, you must configure read and connect timeouts for your JNDI/LDAP service provider. To do so:

  1. Log in to the Design Console.
  2. Expand Administration, and then double-click Lookup Definition.
  3. Search for and open the Lookup.OID.Configuration lookup definition.
  4. On the Lookup Code Information tab, click Add.

    A new row is added.

  5. In the Code Key column of the new row, enter readTimeout.
  6. In the Decode column of the new row, enter a value corresponding to the readTimeout property. This property represents an integer value that specifies the number of milliseconds after which the LDAP provider must abort attempts to read an LDAP operation.
  7. On the Lookup Code Information tab, click Add.

    A new row is added.

  8. In the Code Key column of the new row, enter connectTimeout.
  9. In the Decode column of the new row, enter a value corresponding to the connectTimeout property. This property represents an integer value that specifies the number of milliseconds after which the connection between the LDAP server and client times out.
  10. Click the Save icon.

2.3.1.6 Configuring Oracle Identity Manager for Request-Based Provisioning

See About Request-Based Provisioning for information about request-based provisioning.

To configure request-based provisioning, perform the following procedures:

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 11.1.1.x.

2.3.1.6.1 About Request-Based Provisioning

In request-based provisioning, an end user creates a request for a resource by using the Administrative and User Console. Administrators or other users can also create requests for a particular user. Requests for a particular resource on the resource can be viewed and approved by approvers designated in Oracle Identity Manager.

The following are features of request-based provisioning:

  • A user can be provisioned only one resource (account) on the target system.

    Note:

    Direct provisioning allows the provisioning of multiple LDAP server accounts on the target system.

  • Direct provisioning cannot be used if you enable request-based provisioning.

2.3.1.6.2 Copying Predefined Request Datasets

A request dataset is an XML file that specifies the information to be submitted by the requester during a provisioning operation. Predefined request datasets are shipped with this connector. These request datasets specify information about the default set of attributes for which the requester must submit information during a request-based provisioning operation. The following files contain predefined request datasets available in the xml directory on the installation media:

  • For ODSEE or OUD target systems: ODSEE-OUD-LDAPV3-Datasets.xml

  • For an OID target system: OID-Datasets.xml

  • For an eDirectory target system: eDirectory-Datasets.xml

Copy this file from the installation media to any directory on the Oracle Identity Manager host computer. It is recommended that you create a directory structure as follows:

/custom/connector/RESOURCE_NAME

For example:

E:\MyDatasets\custom\connector\LDAP

Note:

Until you complete the procedure to configure request-based provisioning, ensure that there are no other files or directories inside the parent directory in which you create the directory structure. In the preceding example, ensure that there are no other files or directories inside the E:\MyDatasets directory.

The directory structure to which you copy the dataset files is the MDS location into which these files are imported after you run the Oracle Identity Manager MDS Import utility. The procedure to import dataset files is described in the next section.

Depending on your requirement, you can modify the file names of the request datasets. In addition, you can modify the information in the request datasets.

2.3.1.6.3 Importing Request Datasets

The request datasets (predefined or generated) can be imported by using the Deployment Manager (DM). The predefined request dataset is stored in the xml directory on the installation media.

To import a request dataset definition by using the Deployment Manager:

  1. Log in to Oracle Identity Manager Administrative and User Console.
  2. On the Welcome page, click Advanced in the upper-right corner of the page.
  3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the System Management region, click Import Deployment Manager File. A dialog box for opening files is displayed.
  4. Depending on the target system that you are using, locate and open one of the following files, which are located in the xml directory of the installation media.

    • For ODSEE or OUD target systems: ODSEE-OUD-LDAPV3-Datasets.xml

    • For an OID target system: OID-Datasets.xml

    • For an eDirectory target system: eDirectory-Datasets.xml

    Details of this XML file are shown on the File Preview page.

  5. Click Add File. The Substitutions page is displayed.
  6. Click Next. The Confirmation page is displayed.
  7. Click Import.
  8. In the message that is displayed, click Import to confirm that you want to import the XML file and then click OK.

The request datasets are imported into MDS.

2.3.1.6.4 Enabling the Auto Save Form Feature

To enable the Auto Save Form feature:

  1. Log in to the Design Console.
  2. Expand Process Management, and then double-click Process Definition.
  3. Search for and open the LDAP User process definition.
  4. Select the Auto Save Form check box.
  5. Click the Save icon.
2.3.1.6.5 Running the PurgeCache Utility

Run the PurgeCache utility to clear content belonging to the Metadata category from the server cache. See Clearing Content Related to Connector Resource Bundles from the Server Cache for instructions.

The procedure to configure request-based provisioning ends with this step.

2.3.2 Creating the IT Resource for the Connector Server

To create the IT resource for the Connector Server:

  1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 11.1.1.x:

      Log in to the Administrative and User Console

    • For Oracle Identity Manager release 11.1.2.x or later:

      Log in to Oracle Identity System Administration

  2. If you are using Oracle Identity Manager release 11.1.1.x, then:

    1. On the Welcome page, click Advanced in the upper-right corner of the page.

    2. On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Create IT Resource.

  3. If you are using Oracle Identity Manager release 11.1.2.x or later, then:

    1. Create and activate a sandbox. For detailed instructions on creating and activating a sandbox, see Managing Sandboxes of Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

    2. In the left pane, under Configuration, click IT Resource.

      The Manage IT Resource page is displayed.

    3. Click Create IT Resource.

  4. On the Step 1: Provide IT Resource Information page, perform the following steps:

    • IT Resource Name: Enter a name for the IT resource.

    • IT Resource Type: Select Connector Server from the IT Resource Type list.

    • Remote Manager: Do not enter a value in this field.

  5. Click Continue. Figure 2-3 shows the IT resource values added on the Create IT Resource page.

    Figure 2-3 Step 1: Provide IT Resource Information

    Description of Figure 2-3 follows
    Description of "Figure 2-3 Step 1: Provide IT Resource Information"

  6. On the Step 2: Specify IT Resource Parameter Values page, specify values for the parameters of the IT resource and then click Continue. Figure 2-4 shows the Step 2: Specify IT Resource Parameter Values page.

    Figure 2-4 Step 2: Specify IT Resource Parameter Values

    Description of Figure 2-4 follows
    Description of "Figure 2-4 Step 2: Specify IT Resource Parameter Values"

    Figure 2-5 provides information about the parameters of the IT resource.

    Note:

    See Step 8 of Installing and Configuring the Connector Server for the values to be specified for the parameters of the IT resource.

    Table 2-4 Parameters of the IT Resource for the Connector Server

    Parameter Description

    Host

    Enter the host name or IP address of the computer hosting the connector server.

    Sample value: myhost.com

    Key

    Enter the key for the connector server.

    Port

    Enter the number of the port at which the connector server is listening.

    Default value: 8759

    Timeout

    Enter an integer value which specifies the number of milliseconds after which the connection between the connector server and Oracle Identity Manager times out.

    Sample value: 0

    A value of 0 means that the connection never times out.

    UseSSL

    Enter true to specify that you will configure SSL between Oracle Identity Manager and the Connector Server. Otherwise, enter false.

    Default value: false

    Note: It is recommended that you configure SSL to secure communication with the Connector Server.

    See also Configuring SSL for the Connector.

  7. On the Step 3: Set Access Permission to IT Resource page, the SYSTEM ADMINISTRATORS group is displayed by default in the list of groups that have Read, Write, and Delete permissions on the IT resource that you are creating.

    Note:

    This step is optional.

    If you want to assign groups to the IT resource and set access permissions for the groups, then:

    1. Click Assign Group.

    2. For the groups that you want to assign to the IT resource, select Assign and the access permissions that you want to set. For example, if you want to assign the ALL USERS group and set the Read and Write permissions to this group, then you must select the respective check boxes in the row, as well as the Assign check box, for this group.

    3. Click Assign.

  8. On the Step 3: Set Access Permission to IT Resource page, if you want to modify the access permissions of groups assigned to the IT resource, then:

    Note:

    • This step is optional.

    • You cannot modify the access permissions of the SYSTEM ADMINISTRATORS group. You can modify the access permissions of only other groups that you assign to the IT resource.

    1. Click Update Permissions.

    2. Depending on whether you want to set or remove specific access permissions for groups displayed on this page, select or deselect the corresponding check boxes.

    3. Click Update.

  9. On the Step 3: Set Access Permission to IT Resource page, if you want to unassign a group from the IT resource, then:

    Note:

    • This step is optional.

    • You cannot unassign the SYSTEM ADMINISTRATORS group. You can unassign only other groups that you assign to the IT resource.

    1. Select the Unassign check box for the group that you want to unassign.

    2. Click Unassign.

  10. Click Continue. Figure 2-5 shows the Step 3: Set Access Permission to IT Resource page.

    Figure 2-5 Step 3: Set Access Permission to IT Resource

    Description of Figure 2-5 follows
    Description of "Figure 2-5 Step 3: Set Access Permission to IT Resource"

  11. On the Step 4: Verify IT Resource Details page, review the information that you provided on the first, second, and third pages. If you want to make changes in the data entered on any page, click Back to revisit the page and then make the required changes.

  12. To proceed with the creation of the IT resource, click Continue. Figure 2-6 shows Step 4: Verify IT Resource Details page.

    Figure 2-6 Step 4: Verify IT Resource Details

    Description of Figure 2-6 follows
    Description of "Figure 2-6 Step 4: Verify IT Resource Details"

  13. The Step 5: IT Resource Connection Result page displays the results of a connectivity test that is run using the IT resource information. If the test is successful, then click Continue. If the test fails, then you can perform one of the following steps:

  14. Click Finish. Figure 2-8 shows the IT Resource Created Page.

    Figure 2-8 Step 6: IT Resource Created

    Description of Figure 2-8 follows
    Description of "Figure 2-8 Step 6: IT Resource Created"

2.4 Uninstalling the Connector

If you want to uninstall the connector for any reason, see Uninstalling Connectors in Oracle Fusion Middleware Administering Oracle Identity Manager.

2.5 Upgrading the Connector

Upgrading to the OID connector release 11.1.1.5.0 is supported for Oracle Internet Directory connector version number 9.0.4.14, and Sun Java System Directory connector version 9.0.4.15. The following sections describe the upgrade process:

Note:

Preupgrade considerations are:

  • Before you perform the upgrade procedure, it is strongly recommended that you create a backup of the Oracle Identity Manager database. Refer to the database documentation for information about creating a backup.

  • As a best practice, first perform the upgrade procedure in a test environment.

2.5.1 Preupgrade Steps

Perform the following preupgrade steps:

  1. Perform a reconciliation run to fetch all latest updates to Oracle Identity Manager.
  2. Define the source connector (an earlier release of the connector that must be upgraded) in Oracle Identity Manager. You define the source connector to update the Deployment Manager XML file with all customization changes made to the connector.
  3. If required, create the connector XML file for a clone of the source connector.
  4. Disable all the scheduled tasks.

2.5.2 Upgrade Steps

Depending on the environment in which you are upgrading the connector, perform one of the following steps:

  • Development Environment

    Perform the upgrade procedure by using the wizard mode.

  • Staging or Production Environment

    Perform the upgrade procedure by using the silent mode. In the silent mode, use the silent.xml file that is exported from the development environment.

See Managing Connector Lifecycle of Oracle Fusion Middleware Administering Oracle Identity Manager for detailed information about the wizard and silent modes.

2.5.3 Postupgrade Steps

Perform the postupgrade procedure documented in Managing Connector Lifecycle of Oracle Fusion Middleware Administering Oracle Identity Manager.

To prevent errors during a child and parent table update, perform the following steps after you upgrade the connector:

Note:

Perform Steps 1 through 7 of the following procedure if you are using the ODSEE target system.

If you are using the OID, Novell eDirectory, or OUD target systems, then skip Steps 1 through 7, and perform Step 8.

  1. Log in to Oracle Identity Manager Design Console.

  2. Open Process Management and then Process Definition.

  3. Find the LDAP User process.

  4. Open the Remove User From Group task.

  5. Go to the Integration tab.

  6. Update the childTableName variable value from UD_LDAP_GRP to UD_IPNT_GRP.

  7. Update the childTableName variable in a similar manner for these tasks and values:

    • Add Role to User: UD_LDAP_ROL to UD_IPNT_ROL

    • Remove Role From User: UD_LDAP_ROL to UD_IPNT_ROL

    • Add User to Group: UD_LDAP_GRP to UD_IPNT_GRP

    • Update User Role: UD_LDAP_ROL to UD_IPNT_ROL

    • Update User Group: UD_LDAP_GRP to UD_IPNT_GRP

  8. If you are using Oracle Identity Manager release 11.1.2.x or later, then all changes made to the Form Designer of the Design Console must be done in a new UI form as follows:

    1. Log in to Oracle Identity System Administration.

    2. Create and active a sandbox. See Creating and Activating a Sandbox for more information.

    3. Create a new UI form to view the upgraded fields. See Creating a New UI Form for more information about creating a UI form.

    4. Associate the newly created UI form with the application instance of your target system. To do so, open the existing application instance for your resource, from the Form field, select the form (created in Step 5.c), and then save the application instance.

    5. Publish the sandbox. See Publishing a Sandbox for more information.

2.5.4 Running the Form Version Control (FVC) Utility to Migrate eDirectory Forms

To manage data changes on eDirectory forms after an upgrade operation, run the Form Version Control (FVC) utility. The FVC utility requires a properties file to define the data conversion actions that you want the utility to perform.

Note:

The following procedure applies to an eDirectory target system, but you can also run the FVC utility for other target systems.

Before you run the FVC utility, set the following entries in the properties file:

  • For User forms:

    ResourceObject;eDirectory User 
FormName;UD_EDIR_USR 
FromVersion;From-Version
ToVersion;To-Version
ParentParent;UD_EDIR_USR_GUID;UD_EDIR_USR_REFID

  • For Group forms:

    ResourceObject;eDirectory Group 
FormName;UD_EDIR_GR
FromVersion;From-Version
ToVersion;To-Version
ParentParent;UD_EDIR_GR_GUID;UD_EDIR_GR_REFID

  • For Role forms:

    ResourceObject;eDirectory Role 
FormName;UD_EDIR_RL
FromVersion;From-Version
ToVersion;To-Version
ParentParent;UD_EDIR_RL_GUID;UD_EDIR_RL_REFID

  • For Organisation Unit (OU) forms:

    ResourceObject;eDir Organisation Unit 
FormName;UD_EDIR_OU
FromVersion;From-Version
ToVersion;To-Version
ParentParent;UD_EDIR_OU_GUID;UD_EDIR_OU_REFID

2.6 Postcloning Steps

This section contains the following topics:

2.6.1 About Postcloning Steps

You can clone the OID connector by setting new names for some of the objects that comprise the connector. The outcome of the process is a new connector XML file. Most of the connector objects, such as Resource Object, Process Definition, Process Form, IT Resource Type Definition, IT Resource Instances, Lookup Definitions, Adapters, Reconciliation Rules and so on in the new connector XML file have new names.

Note:

Managing Connector Lifecycle in Oracle Fusion Middleware Administering Oracle Identity Manager for detailed information about cloning connectors.

After a copy of the connector is created by setting new names for connector objects, some objects might contain the details of the old connector objects. Therefore, you must modify the following Oracle Identity Manager objects to replace the base connector artifacts or attribute references with the corresponding cloned artifacts or attributes:

  • IT Resource

    The cloned connector has its own set of IT resources. You must configure both the cloned connector IT resources and Connector Server IT resources, and provide the reference of the cloned Connector Server IT Resource in the cloned connector IT resource. Ensure you use the configuration lookup definition of the cloned connector.

  • Scheduled Task

    The values of the Resource Object Name and IT Resource scheduled task attributes in the cloned connector refer to the values of the base connector. Therefore, these values (values of the Resource Object Name and IT resource scheduled task attributes that refer to the base connector) must be replaced with the new cloned connector artifacts.

  • Lookup Definition

    No change is required to be made in any of the cloned lookup definitions. All cloned lookup definitions contain proper lookup entries.

  • Process Tasks

    After cloning, you notice that all event handlers attached to the process tasks are the cloned ones. Therefore, no changes are required for process tasks in parent forms. This is because the adapter mappings for all process tasks related to parent forms are updated with cloned artifacts.

  • Localization Properties

    You must update the resource bundle of a user locale with new names of the process form attributes for proper translations after cloning the connector. You can modify the properties file of your locale in the resources directory of the connector bundle.

  • POSIX Accounts, Groups, and Roles

    If you have cloned the connector and added a group or role to an account, perform the steps in Postcloning Configuration for User Accounts.

2.6.2 Postcloning Configuration for User Accounts

This configuration change is related to a child form. When you add a group or role to an account, perform the following steps:

  1. Log in to Oracle Identity Manager Design Console.
  2. Go to the cloned LDAP User Process, OID User Process, eDirectory User, or OUD User Process definition.
  3. Open the Add User To Group Process task and navigate to the Integration tab.
  4. In the Event Handler/Adapter section, click Remove.
  5. Add the same adapter again and do the mappings. Table 2-5 shows sample mappings for OID.

    Note: Open the childTableName mapping and change the Literal Value to the new value (the cloned value).

  6. Repeat these steps for the Remove User From Group and Update User Group tasks.

    Similar steps can be repeated for Add Role, Delete Role, and Update Role, in the case of ODSEE and eDirectory targets, which support roles.

Table 2-5 Mappings for OID Event Handler/Adapter

Variable Name Data Type Map To Qualifer Literal Value

processInstanceKey

Long

Process Data

Process Instance

NA

Adapter return value

Object

Response Code

NA

NA

objectType

String

Literal

String

User

itResourceName

String

Literal

String

UD_OID_USR_SERVER

childTableName

String

Literal

String

UD_OID_GRP1