2 Deploying the Connector

The procedure to deploy the connector is divided across three stages namely preinstallation, installation, and postinstallation.

The following topics provide details on these stages:

2.1 Preinstallation

Preinstallation involves creating a target system user account for connector operations.

Preinstallation information is divided across the following sections:

2.1.1 Creating a Target System User Account for Connector Operations

The connector uses a target system account to connect to and perform operations on the target system.

To create this target system account:

  1. Create a technical user account in the target system and assign it a role with  the Spml_Read_Action and Spml_Write_Action actions.
  2. If the target system is configured with JAVA data source by default, then assign the following roles:

    • NWA_SUPERADMIN

    • MY_SPML_FULL_ACCESS_ROLE

    Note:

    If target system Netweaver 7.3 is configured with JAVA data source by default and if JAVA Data source is used for Admin User, then assign the following roles:

    • Administrator

    • Super Administration

    • MY_SPML_FULL_ACCESS_ROLE

  3. If the target system is configured with ABAP data source, then assign the SAP_J2EE_ADMIN group.
  4. If this connector is configured with the ABAP data source and CUA is enabled in the backend ABAP application, then assign a system to the user account created earlier.
  5. If you want to perform connector operations such as Access Request Management and Access Risk Analysis through an SAP Business Objects Access Control system, then assign the following minimum set of roles to a user account in SAP Business Objects Access Control:
    Role Name Description

    SAP_BC_WEBSERVICE_CONSUMER

    Web Service Consumer

    SAP_GRC_NWBC

    Governance, Risk, and Compliance

    SAP_GRAC_ACCESS_APPROVER

    Role for Access Request Approver

    SAP_GRAC_RISK_OWNER

    Risk Maintenance and Risk Analysis

    SAP_GRAC_ROLE_MGMT_ROLE_OWNER

    Role Owner

For detailed information on each of these preinstallation tasks, refer to the SAP documentation.

2.1.2 Installing and Configuring the Connector Server

You can deploy the SAP User Management Engine connector either locally in Oracle Identity Manager or remotely in the Connector Server. A Connector Server is a Microsoft Windows application that enables remote execution of an Identity Connector.

Connector servers are available in two implementations:

  • As a .Net implementation that is used by Identity Connectors implemented in .Net

  • As a Java Connector Server implementation that is used by Java-based Identity Connectors

The SAP User Management Engine connector is implemented in Java, so you can deploy this connector to a Java Connector Server.

Use the following steps to install and configure the Java Connector Server:

Note:

Before you deploy the Java Connector Server, ensure that you install the JDK or JRE on the same computer where you are installing the Java Connector Server and that your JAVA_HOME or JRE_HOME environment variable points to this installation.

  1. Create a new directory on the computer where you want to install the Java Connector Server.

    Note:

    In this guide, CONNECTOR_SERVER_HOME represents this directory.

  2. Unzip the Java Connector Server package in the new directory created in Step 1. You can download the Java Connector Server package from the Oracle Technology Network.
  3. Open the ConnectorServer.properties file located in the conf directory. In the ConnectorServer.properties file, set the following properties, as required by your deployment.
    Property Description

    connectorserver.port

    Port on which the Java Connector Server listens for requests.

    Default is: 8759.

    connectorserver.bundleDir

    Directory where the connector bundles are deployed.

    Default is: bundles.

    connectorserver.libDir

    Directory in which to place dependent libraries.

    Default is: lib.

    connectorserver.usessl

    If set to true, the Java Connector Server uses SSL for secure communication. Default is: false.

    If you specify true, use the following options on the command line when you start the Java Connector Server:

    • -Djavax.net.ssl.keyStore

    • -Djavax.net.ssl.keyStoreType (optional)

    • -Djavax.net.ssl.keyStorePassword

    connectorserver.ifaddress

    Bind address. To set this property, uncomment it in the file (if necessary). The bind address can be useful if there are more NICs installed on the computer.

    connectorserver.key

    Java Connector Server key.
  4. Set the properties in the ConnectorServer.properties file, as follows:

    • To set the connectorserver.key, run the Java Connector Server with the /setKey option.

      Note:

      For more information, see Running the Connector Server.

    • For all other properties, edit the ConnectorServer.properties file manually.

  5. The conf directory also contains the logging.properties file, which you can edit if required by your deployment.

Note:

Oracle Identity Manager has no built-in support for connector servers, so you cannot test your configuration.

2.1.3 Running the Connector Server

When you run the Connector Installer, it automatically copies the connector files to directories in Oracle Identity Manager, imports connector XML files, and compiles adapters used for provisioning.

To run the Java Connector Server, use the ConnectorServer.bat script as follows:

  1. Make sure that you have set the properties required by your deployment in the ConnectorServer.properties file, as described in Installing and Configuring the Connector Server.
  2. Change to the CONNECTOR_SERVER_HOME\bin directory and find the ConnectorServer.bat script.

    The ConnectorServer.bat supports the following options:

    Option Description

    /install [serviceName]

    ["-J java-option"]

    Installs the Java Connector Server as a Windows service.

    Optionally, you can specify a service name and Java options. If you do not specify a service name, the default name is ConnectorServerJava.

    /run ["-J java-option"]

    Runs the Java Connector Server from the console.

    Optionally, you can specify Java options. For example, to run the Java Connector Server with SSL:

    ConnectorServer.bat /run "-J-Djavax.net.ssl.keyStore=mykeystore.jks" "-J-Djavax.net.ssl.keyStorePassword=password"

    /setKey [key]

    Sets the Java Connector Server key. The ConnectorServer.bat script stores the hashed value of the key in the connectorserver.key property in the ConnectorServer.properties file.

    /uninstall [serviceName]

    Uninstalls the Java Connector Server. If you do not specify a service name, the script uninstalls the ConnectorServerJava service.
  3. If you need to stop the Java Connector Server, stop the respective Windows service.

2.2 Installation

You can run the connector code either locally in Oracle Identity Manager or remotely in a Connector Server.

Depending on where you want to run the connector code (bundle), the connector provides the following installation options:

2.2.1 Installing the Connector in Oracle Identity Manager

In this scenario, you install the connector in Oracle Identity Manager using the Connector Installer.

To run the Connector Installer:

  1. Copy the contents of the connector installation media directory into the following directory:

    Note:

    In an Oracle Identity Manager cluster, copy this JAR file to each node of the cluster.

    OIM_HOME/server/ConnectorDefaultDirectory

  2. If you are using Oracle Identity Manager release 11.1.1.x, then perform the following steps:

    1. Log in to the Administrative and User Console.

    2. On the Welcome to Identity Manager Advanced Administration page, in the System Management region, click Manage Connector.

  3. If you are using Oracle Identity Manager release 11.1.2.x, then perform the following steps:

    1. Log in to Oracle Identity System Administration.

    2. In the left pane, under System Management, click Manage Connector.

  4. In the Manage Connector page, click Install.

  5. From the Connector List list, select SAP UME Connector RELEASE_NUMBER.

    Note:

    If you are using SAP BusinessObjects AC system, from the Connector List list, select SAPACUME Connector RELEASE_NUMBER.

    This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory in Step 1.

    If you have copied the installation files into a different directory, then:

    1. In the Alternative Directory field, enter the full path and name of that directory.

    2. To repopulate the list of connectors in the Connector List list, click Refresh.

    3. From the Connector List list, select SAP UME Connector RELEASE_NUMBER.

      Note:

      If you are using SAP BusinessObjects AC system, from the Connector List list, select SAPACUME Connector RELEASE_NUMBER.

  6. Click Load.

  7. To start the installation process, click Continue.

    The following tasks are performed in sequence:

    1. Configuration of connector libraries

    2. Import of the connector XML files (by using the Deployment Manager)

    3. Compilation of adapters

    On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure are displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:

    • Retry the installation by clicking Retry.

    • Cancel the installation and begin again from Step 1.

  8. If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of the steps that you must perform after the installation is displayed. These steps are as follows:

    1. Ensuring that the prerequisites for using the connector are addressed

      Note:

      At this stage, run the Oracle Identity Manager PurgeCache utility to load the server cache with content from the connector resource bundle in order to view the list of prerequisites. See Clearing Content Related to Connector Resource Bundles from the Server Cache for information about running the PurgeCache utility.

      There are no prerequisites for some predefined connectors.

    2. Configuring the IT resource for the connector

      Record the name of the IT resource displayed on this page. The procedure to configure the IT resource is described later in this guide.

    3. Configuring the scheduled tasks that are created when you installed the connector

      Record the names of the scheduled tasks displayed on this page. The procedure to configure these scheduled tasks is described later in this guide.

When you run the Connector Installer, it copies the connector files and external code files to destination directories on the Oracle Identity Manager host computer. These files are listed in Table A-1.

2.2.2 Deploying the Connector Bundle in a Connector Server

You can deploy the connector either locally in Oracle Identity Manager or remotely in the Connector Server. A Connector Server is an application that enables remote execution of an Identity Connector, such as the SAP User Management connector.

To deploy the connector bundle remotely in a Connector Server, you must first deploy the connector in Oracle Identity Manager, as described in Installing the Connector in Oracle Identity Manager.

Note:

To install the connector into the Connector Server:

  1. Stop the Connector Server.

    Note:

    You can download the necessary Java Connector Server from the Oracle Technology Network web page.

  2. Copy the SAP UME connector bundle into the CONNECTOR_SERVER_HOME/bundles directory.
  3. Start the Connector Server. See Running the Connector Server for information about starting the Connector Server.

    Note:

    If you are using a Connector Server, the WSDL File must be copied on the system running the Connector Server. Location of the WSDL files is available in the local machine that is running the Connector Server.

    You can download the necessary Java Connector Server from the Oracle Technology Network web page.

2.3 Postinstallation

Postinstallation for the connector involves configuring Oracle Identity Manager, enabling logging to track information about all connector events, and configuring SSL. It also involves performing some optional configurations such as enabling the reset password option, configuring password changes for newly created accounts, setting up lookup definitions for exclusion lists and so on.

Postinstallation steps are divided across the following sections:

2.3.1 Configuring Oracle Identity Manager 11.1.2 or Later

You must create a UI form and an application instance for the resource against which you want to perform reconciliation and provisioning operations. In addition, you must run the entitlement and catalog synchronization jobs.

If you are using Oracle Identity Manager release 11.1.2 or later, you must create additional metadata such as a UI form and an application instance. In addition, you must run entitlement and catalog synchronization jobs. These procedures are described in the following sections:

2.3.1.1 Creating and Activating a Sandbox

You must create and activate a sandbox to begin using the customization and form management features. You can then publish the sandbox to make the customizations available to other users.

See Managing Sandboxes in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for instructions on creating and activating a sandbox.

2.3.1.2 Creating a New UI Form

You can use Form Designer in Oracle Identity System Administration to create and manage application instance forms.

See Managing Forms in Oracle Fusion Middleware Administering Oracle Identity Manager for instructions on creating a new UI form. While creating the UI form, ensure that you select the resource object corresponding to the Concur connector that you want to associate the form with. In addition, select the Generate Entitlement Forms check box.

2.3.1.3 Creating an Application Instance

Create an application instance as follows. For detailed instructions, see Managing Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager.

  1. In the System Administration page, under Configuration in the left pane, click Application Instances.
  2. Under Search Results, click Create.
  3. Enter appropriate values for the fields displayed on the Attributes form and click Save.
  4. In the Form drop-down list, select the newly created form and click Apply.
  5. Publish the application instance for a particular organization.

2.3.1.4 Publishing a Sandbox

Before publishing a sandbox, perform the following procedure as a best practice to validate all sandbox changes made till this stage as it is difficult to revert the changes after a sandbox is published:

  1. In Identity System Administration, deactivate the sandbox.
  2. Log out of Identity System Administration.
  3. Log in to Identity Self Service using the xelsysadm user credentials and then activate the sandbox that you deactivated in Step 1.
  4. In the Catalog, ensure that the Concur application instance form appears with correct fields.
  5. Publish the sandbox. See Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for instructions on publishing a sandbox.

2.3.1.5 Harvesting Entitlements and Sync Catalog

To harvest entitlements and sync catalog:

  1. Run the scheduled jobs for lookup field synchronization listed in Scheduled Job for Lookup Field Synchronization and Scheduled Jobs for SAP BusinessObjects AC Lookup Field Synchronization.
  2. Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about this scheduled job.
  3. Run the Catalog Synchronization Job scheduled job. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about this scheduled job.

2.3.1.6 Updating an Existing Application Instance with a New Form

For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:

  1. Create a sandbox and activate it as described in Creating and Activating a Sandbox.
  2. Create a new UI form for the resource as described in Creating a New UI Form.
  3. Open the existing application instance.
  4. In the Form field, select the new UI form that you created.
  5. Save the application instance.
  6. Publish the sandbox as described in Publishing a Sandbox.

2.3.2 Enabling the Reset Password Option in Oracle Identity Manager 11.1.2.1.0 or Later

You can reset the password for an account after logging in as the user by navigating to My Access, Accounts tab in Oracle Identity Manager release 11.1.2.1.0 or later.

The Reset Password option is enabled for only those accounts that follow the UD_FORMNAME_PASSWORD naming convention for the password field. Otherwise, this option would be disabled as shown in the following sample screenshot:

Description of pwd_reset1.gif follows
Description of the illustration pwd_reset1.gif

To enable the Reset Password option in Oracle Identity Manager release 11.1.2.1.0 or later:

  1. Log in to Oracle Identity System Administration.
  2. In the left pane, under Configuration, click Form Designer.
  3. Enter UD_SAPUME in the Table Name field and click the Query for records button.

    Note:

    If you are using SAP BusinessObjects AC system, then enter the table name as UD_SAPACUME.

  4. Click Create New Version.
  5. In the Create a New Version dialog box, specify the version name in the Label field, save the changes, and then close the dialog box.
  6. From the Current Version list, select the newly created version.
  7. Click the Properties tab.
  8. Select the password field, and click Add Property.
  9. From the Property Name list, select AccountPassword.
  10. In the Property Value field, enter true.
  11. Click Save.

    The password field is tagged with the AccountPassword = true property as shown in the following screenshot:

    Description of pwd_reset2.gif follows
    Description of the illustration pwd_reset2.gif
  12. Click Make Version Active.
  13. Update the application instance with the new form as described in Updating an Existing Application Instance with a New Form.

2.3.3 Configuring Password Changes for Newly Created Accounts

When you log in to SAP by using a newly created account, you are prompted to change your password at first logon. For accounts created through Oracle Identity Manager, password management can be configured by using the changePwdFlag and dummyPassword parameters of the IT resource.

You can apply one of the following approaches:

  • Configure the connector so that users with newly created accounts are prompted to change their passwords at first logon.

    To achieve this, set the changePwdFlag parameter of the IT resource to no. With this setting, the password entered on the process form for a new user account is used to set the password for the new account on the target system. When the user logs in to the target system, the user is prompted to change the password.

  • Configure the connector so that the password set while creating the account on Oracle Identity Manager is set as the new password on the target system. The user is not prompted to change the password at first logon.

    To achieve this, set the changePwdFlag parameter to yes and enter a string in the dummyPassword parameter of the IT resource. With these settings, when you create a user account through Oracle Identity Manager, the user is first created with the dummy password. Immediately after that, the connector changes the password of the user to the one entered on the process form. When the user logs in to the target system, the user is not prompted to change the password.

    Note:

    Security policies of a few target systems allow a user to change the password only once per day. In such a scenario, the target system allows the user to only reset the password and not to change it. The password update task throws an error message, such as Could not update user NEW_PASSWORD_INVALID.

    If the password feature is disabled for users on the target system, then set the changePwdFlag parameter to no.

2.3.4 Changing to the Required Input Locale

Changing to the required input locale (language and country setting) involves installing the required fonts and setting the required input locale.

You may require the assistance of the system administrator to change to the required input locale.

2.3.5 Clearing Content Related to Connector Resource Bundles from the Server Cache

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the Oracle Identity Manager database. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

  1. In a command window, switch to the OIM_HOME/server/bin directory.

    Note:

    You must perform Step 1 before you perform Step 2. An exception is thrown if you run the command described in Step 2 as follows:

    OIM_HOME/server/bin/SCRIPT_FILE_NAME
  2. Enter the following command:

    Note:

    You can use the PurgeCache utility to purge the cache for any content category. Run PurgeCache.bat CATEGORY_NAME on Microsoft Windows or PurgeCache.sh CATEGORY_NAME on UNIX. The CATEGORY_NAME argument represents the name of the content category that must be purged.

    For example, the following commands purge Metadata entries from the server cache:

    PurgeCache.bat MetaData

    PurgeCache.sh MetaData

    On Microsoft Windows: PurgeCache.bat All

    On UNIX: PurgeCache.sh All

    When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

    t3://OIM_HOST_NAME:OIM_PORT_NUMBER

    In this format:

    • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

    • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

2.3.6 Managing Logging

Oracle Identity Manager uses the Oracle Diagnostic Logging (ODL) logging service for recording all types of events pertaining to the connector.

The following topics provide detailed information about logging:

2.3.6.1 Understanding Log Levels

Oracle Identity Manager release 11.1.x uses Oracle Java Diagnostic Logging (OJDL) for logging. OJDL is based on java.util.logger. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

  • SEVERE.intValue()+100

    This level enables logging of information about fatal errors.

  • SEVERE

    This level enables logging of information about errors that might allow Oracle Identity Manager to continue running.

  • WARNING

    This level enables logging of information about potentially harmful situations.

  • INFO

    This level enables logging of messages that highlight the progress of the application.

  • CONFIG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • FINE, FINER, FINEST

    These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These message types are mapped to ODL message type and level combinations as shown in Table 2-1.

Table 2-1 Log Levels and ODL Message Type:Level Combinations

Java Level ODL Message Type:Level

SEVERE.intValue()+100

INCIDENT_ERROR:1

SEVERE

ERROR:1

WARNING

WARNING:1

INFO

NOTIFICATION:1

CONFIG

NOTIFICATION:16

FINE

TRACE:1

FINER

TRACE:16

FINEST

TRACE:32

The configuration file for OJDL is logging.xml, which is located at the following path:

DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml

Here, DOMAIN_HOME and OIM_SEVER are the domain name and server name specified during the installation of Oracle Identity Manager.

2.3.6.2 Enabling Logging

To enable logging in Oracle WebLogic Server:

  1. Edit the logging.xml file as follows:

    1. Add the following blocks in the file:

      <log_handler name='sap-handler' level='[LOG_LEVEL]' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
<property name='logreader:' value='off'/>
     <property name='path' value='[FILE_NAME]'/>
     <property name='format' value='ODL-Text'/>
     <property name='useThreadName' value='true'/>
     <property name='locale' value='en'/>
     <property name='maxFileSize' value='5242880'/>
     <property name='maxLogSize' value='52428800'/>
     <property name='encoding' value='UTF-8'/>
   </log_handler>
      <logger name="ORG.IDENTITYCONNECTORS.SAPUME" level="[LOG_LEVEL]" useParentHandlers="false">
     <handler name="sap-handler"/>
     <handler name="console-handler"/>
   </logger>

      If you are using SAP GRC, then add the following block:

      <logger name="ORG.IDENTITYCONNECTORS.SAPAC" level="[Log_LEVEL]" useParentHandlers="false">
     <handler name="sap-handler"/>
     <handler name="console-handler"/>
</logger>

      If you are using Application Onboarding, then add the following block:

      <logger name='oracle.iam.application' level="[Log_LEVEL]" useParentHandlers='false'>
     <handler name='sap-handler'/>
     <handler name='console-handler'/>
</logger>

    2. Replace both occurrences of [LOG_LEVEL] with the ODL message type and level combination that you require. Table 2-1 lists the supported message type and level combinations.

      Similarly, replace [FILE_NAME] with the full path and name of the log file in which you want log messages to be recorded.

      The following blocks show sample values for [LOG_LEVEL] and [FILE_NAME]:

      <log_handler name='sap-handler' level='NOTIFICATION:1' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
<property name='logreader:' value='off'/>
     <property name='path' value='F:\MyMachine\middleware\user_projects\domains\base_domain1\servers\oim_server1\logs\oim_server1-diagnostic-1.log'/>
     <property name='format' value='ODL-Text'/>
     <property name='useThreadName' value='true'/>
     <property name='locale' value='en'/>
     <property name='maxFileSize' value='5242880'/>
     <property name='maxLogSize' value='52428800'/>
     <property name='encoding' value='UTF-8'/>
   </log_handler>

      <logger name="ORG.IDENTITYCONNECTORS.SAPUME" level="NOTIFICATION:1" useParentHandlers="false">
     <handler name="sap-handler"/>
     <handler name="console-handler"/>
   </logger>

      If you are using SAP GRC, then add the following block:

      <logger name="ORG.IDENTITYCONNECTORS.SAPAC" level="NOTIFICATION:1" useParentHandlers="false">
     <handler name="sap-handler"/>
     <handler name="console-handler"/>
</logger>

      If you are using Application Onboarding, then add the following block:

      <logger name='oracle.iam.application' level="NOTIFICATION:1" useParentHandlers='false'>
     <handler name='sap-handler'/>
     <handler name='console-handler'/>
</logger>
</logger>

      With these sample values, when you use Oracle Identity Manager, all messages generated for this connector that are of a log level equal to or higher than the NOTIFICATION:1 level are recorded in the specified file.

  2. Save and close the file.

  3. Set the following environment variable to redirect the server logs to a file:

    For Microsoft Windows:

    set WLS_REDIRECT_LOG=FILENAME

    For UNIX:

    export WLS_REDIRECT_LOG=FILENAME

    Replace FILENAME with the location and name of the file to which you want to redirect the output.

  4. Restart the application server.

2.3.7 Setting Up the Lookup.SAPUME.UM.RoleDataSource Lookup Definition

The Lookup.SAPUME.UM.RoleDataSource lookup definition is used to hold data source names of the role object class. By default, this lookup definition contains entry for the UME_ROLE_PERSISTENCE role data source, which is common to all SAP configurations. If there are role data sources specific to your environment, then you must update the Lookup.SAPUME.UM.RoleDataSource lookup definition for these data sources.

Note:

If you are using SAP BusinessObjects AC system, then you must update the Lookup.SAPACUME.RoleDatasource.

You must log into SAP User Management Engine as the administrator to view and determine the list of role data sources in your environment.

The name of the role data source is available as part of the Unique ID field. The value of the Unique ID field is in the following format:

ROLE.DATA_SOURCE_NAME.AUTO_GENERATED_VALUE

The following is a simple value of the Unique ID field:

ROLE.PCD_ROLE_PERSISTENCE.YJ1ku1NfcgCd1ZoMDG78ocBzkA=

In this value, PCD_ROLE_PERSISTENCE is the name of the role data source.

After you determine the names of all role data sources available in your environment, add each data source name by creating an entry in the Lookup.SAPUME.UM.RoleDataSource lookup definition as described in the following procedures:

2.3.7.1 Adding Role Data Source Names to the Lookup.SAPUME.UM.RoleDataSource lookup definition in Oracle Identity Manager Release 11.1.1.x

For Oracle Identity Manager release 11.1.1.x:

  1. On the Design Console, expand Administration and then double-click Lookup Definition.
  2. Search for and open the Lookup.SAPUME.UM.RoleDataSource lookup definition.
  3. Click Add.
  4. In the Code and Decode columns, enter the name of the role data source.
  5. Repeat Steps 3 and 4 to create entries for all data source names determined in this section.
  6. Click the Save icon.

2.3.7.2 Adding Role Data Source Names to the Lookup.SAPUME.UM.RoleDataSource lookup definition in Oracle Identity Manager Release 11.1.2.x

For Oracle Identity Manager release 11.1.2.x:

  1. Log in to Oracle Identity System Administration.

    In the left pane, under System Configuration, click Lookups.

  2. Search for and open the Lookup.SAPUME.UM.RoleDataSource lookup definition.
  3. Click Add.
  4. In the Code and Decode columns, enter the name of the role data source.
  5. Repeat Steps 3 and 4 to create entries for all data source names determined in this section.
  6. Click the Save icon.

2.3.8 Setting Up the Lookup.SAPUME.UM.GroupDataSource Lookup Definition

The Lookup.SAPUME.UM.GroupDataSource lookup definition is used to hold data source names of the group object class. By default, this lookup definition contains entry for the PRIVATE_DATASOURCE group data source, which is common to all SAP configurations. If there are group data sources specific to your environment, then you must update the Lookup.SAPUME.UM.GroupDataSource lookup definition for these data sources.

Note:

  • If you are using SAP BusinessObjects AC system, then you must update the Lookup.SAPACUME.GroupDatasource lookup definition

  • SAP User Management Engine does not allow adding a group from the built-in groups adapter data source. Therefore, this data source must not be added in this lookup definition. If SAP User Management Engine is configured with SAP ABAP-based system as data source, such as R3_ROLE_DS, then check whether User Management Engine allows adding a group that assigns ABAP roles to a user. You can check if this is allowed from the Identity Management page of SAP User Management Engine. If adding the group is allowed, then add the data source, R3_ROLE_DS, to the Lookup.SAPUME.UM.GroupDataSource lookup definition

You must log into SAP User Management Engine as the administrator to view and determine the list of group data sources in your environment.

The name of the group data source is available as part of the Unique ID field.

The value of the Unique ID field is in the following format:

GRUP.DATA_SOURCE_NAME.AUTO_GENERATED_VALUE

The following is a sample value of the Unique ID field:

GRUP.PRIVATE_DATASOURCE.un:Guests

In this value, PRIVATE_DATASOURCE is the name of the group data source.

After you determine the names of all group data sources available in your environment, add each data source name by creating an entry in the Lookup.SAPUME.UM.GroupDataSource lookup definition as described in the following procedures:

2.3.8.1 Adding Group Data Source Names to the Lookup.SAPUME.UM.GroupDataSource lookup definition in Oracle Identity Manager Release 11.1.1.x

For Oracle Identity Manager release 11.1.1.x:

  1. On the Design Console, expand Administration and then double-click Lookup Definition.
  2. Search for and open the Lookup.SAPUME.UM.GroupDataSource lookup definition.
  3. Click Add.
  4. In the Code and Decode columns, enter the name of the group data source.
  5. Repeat Steps 3 and 4 to create entries for all data source names determined in this section.
  6. Click the Save icon.

2.3.8.2 Adding Group Data Source Names to the Lookup.SAPUME.UM.GroupDataSource lookup definition in Oracle Identity Manager Release 11.1.1.x

For Oracle Identity Manager release 11.1.2.x:

  1. Log in to Oracle Identity System Administration.

    In the left pane, under System Configuration, click Lookups.

  2. Search for and open the Lookup.SAPUME.UM.GroupDatasource lookup definition.
  3. Click Add.
  4. In the Code and Decode columns, enter the name of the role data source.
  5. Repeat Steps 3 and 4 to create entries for all data source names determined in this section.
  6. Click the Save icon.

2.3.9 Setting Up the Lookup Definitions for Exclusion Lists

In the Lookup.SAPUME.UM.ProvExclusionList and Lookup.SAPUME.UM.ReconExclusionList lookup definitions, enter the user IDs of target system accounts for which you do not want to perform provisioning and reconciliation operations, respectively. See Lookup Definitions for Exclusion Lists for information about the format of the entries in these lookups.

Note:

The Lookup.SAPUME.UM.ProvExclusionList and Lookup.SAPUME.UM.ReconExclusionList lookup definitions are optional and do not exist by default.

You must add these lookups to the Lookup.SAPUME.UM.Configuration lookup definition to enable exclusions during provisioning and reconciliation operations. See Lookup.SAPUME.UM.Configuration for more information.

To add entries in the lookup for exclusions during provisioning operations:

Note:

To specify user IDs to be excluded during reconciliation operations, add entries in the Lookup.SAPUME.UM.ReconExclusionList lookup.

  1. On the Design Console, expand Administration and then double-click Lookup Definition.
  2. Search for and open the Lookup.SAPUME.UM.ProvExclusionList lookup definition.
  3. Click Add.
  4. In the Code Key and Decode columns, enter the first user ID to exclude.

    Note:

    The Code Key represents the resource object field name on which the exclusion list is applied during provisioning operations.

  5. Repeat Steps 3 and 4 for the remaining user IDs to exclude.

    For example, if you do not want to provision users with user IDs User001, User002, and User088 then you must populate the lookup definition with the following values:

    Code Key Decode

    Logon Name

    User001

    Logon Name

    User002

    Logon Name

    User088

    You can also perform pattern matching to exclude user accounts. You can specify regular expressions supported by the representation in the java.util.regex.Pattern class.

    See Also:

    For information about the supported patterns, visit http://download.oracle.com/javase/6/docs/api/java/util/regex/Pattern.html

    For example, if you do not want to provision users matching any of the user IDs User001, User002, and User088, then you must populate the lookup definition with the following values:

    Code Key Decode

    Logon Name[PATTERN]

    User001|User002|User088

    If you do not want to provision users whose user IDs start with 00012, then you must populate the lookup definition with the following values:

    Code Key Decode

    Logon Name[PATTERN]

    00012*
  6. Click the save icon.

2.3.10 Configuring Oracle Identity Manager for Request-Based Provisioning

In request-based provisioning, an end user creates a request for a resource by using the Administrative and User Console. Administrators or other users can also create requests for a particular user. Requests for a particular resource on the resource can be viewed and approved by approvers designated in Oracle Identity Manager.

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 11.1.1.x.

The direct provisioning feature of the connector is automatically disabled when you enable request-based provisioning. Therefore, do not enable request-based provisioning if you want to use the direct provisioning.

To configure request-based provisioning, perform the following procedures:

2.3.10.1 Importing Request Datasets Using Deployment Manager

The request datasets (predefined or generated) can be imported by using the Deployment Manager (DM). The predefined request datasets are stored in the xml/SAPUME-Datasets.xml file on the installation media.

To import a request dataset definition by using the Deployment Manager:

  1. Log in to the Administrative and User Console.
  2. On the Welcome page, click Advanced in the upper-right corner of the page.
  3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the System Management region, click Import Deployment Manager File. A dialog box for opening files is displayed.
  4. Locate and open the SAPUME-Datasets.xml file, which is located in the xml directory of the installation media.

    Details of this XML file are shown on the File Preview page.

  5. Click Add File. The Substitutions page is displayed.
  6. Click Next. The Confirmation page is displayed.
  7. Click Import.
  8. In the message that is displayed, click Import to confirm that you want to import the XML file and then click OK.

The request datasets are imported into MDS.

2.3.10.2 Enabling the Auto Save Form Feature

To enable the Auto Save Form feature:

  1. Log in to the Design Console.
  2. Expand Process Management, and then double-click Process Definition.
  3. Search for and open the SAPUME process process definition.
  4. Select the Auto Save Form check box.
  5. Click the Save icon.

2.3.10.3 Running the PurgeCache Utility

Run the PurgeCache utility to clear content belonging to the Metadata category from the server cache. See Clearing Content Related to Connector Resource Bundles from the Server Cache for instructions.

The procedure to configure request-based provisioning ends with this step.

2.3.11 Configuring SSL to Secure Communication Between the Target System and Oracle Identity Manager

You configure SSL to secure data communication between Oracle Identity Manager and the target system.

To configure SSL between the target system and Oracle Identity Manager:

  1. Generate the certificate on the target system.

    See the target system documentation for detailed instructions.

  2. To import the certificate on Oracle Identity Manager:

    1. Copy the target system certificate to the Oracle Identity Manager host computer.

    2. In a command window, change to the directory where you copy the certificate file and then enter a command similar to the following:

      keytool -import -alias ALIAS -file CER_FILE -keystore MY_CACERTS -storepass PASSWORD

      In this command:

      ALIAS is the alias for the certificate (for example, the server name).

      CER_FILE is the full path and name of the certificate (.cer) file.

      Table 2-2 shows the location of the certificate store of the supported application server.

      The following is a sample command:

      keytool -import -alias ibm1-cert140 -file C:\syaug24\Middleware\ibm1-cert.cer -keystore C:\syaug24\Middleware\jrockit_160_24_D1.1.2-4\jre\lib\security\cacerts -storepass changeit

      Table 2-2 Certificate Store Locations

      Application Server Certificate Store Location

      Oracle WebLogic Server

      • If you are using Oracle jrockit_R27.3.1-jdk, then copy the certificate into the following directory:

        JROCKIT_HOME/jre/lib/security/cacerts

      • If you are using the default Oracle WebLogic Server JDK, then copy the certificate into the following directory:

        WEBLOGIC_HOME/java/jre/lib/security/cacerts

    3. To confirm whether or not the certificate has been imported successfully, enter a command similar to the following:

      keytool -list -alias ALIAS -keystore MY_CACERTS -storepass PASSWORD

      For example:

      keytool -list -alias MyAlias -keystore C:\mydir\java\jre\lib\security\cacerts -storepass changeit

2.3.12 Configuring the IT Resource for the Target System

An IT resource contains connection information about the target system. Oracle Identity Manager uses this information during reconciliation and provisioning.

The SAPUME IT Resource is automatically created when you run the Connector Installer. You must specify values for the parameters of the IT resource.

Note:

If you are using SAP BusinessObjects AC system, then the SAP AC UME IT resource is automatically created when you run the Connector Installer.

Note:

If you are using SAP BusinessObjects AC system, then the SAP AC UME IT resource is automatically created when you run the Connector Installer.

The ALL USERS group has INSERT, UPDATE, and DELETE permissions on the default IT resource. This is to ensure that end users can select the IT resource during request-based provisioning. If you create another IT resource, then you must assign INSERT, UPDATE, and DELETE permissions for the ALL USERS group on the IT resource.

To specify values for the parameters of the IT resource:

  1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 11.1.1.x:

      Log in to the Administrative and User Console.

    • For Oracle Identity Manager release 11.1.2.x:

      Log in to Oracle Identity System Administration.

  2. If you are using Oracle Identity Manager release 11.1.1.x, then:

    1. On the Welcome page, click Advanced in the upper-right corner of the page.

    2. On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Manage IT Resource.

  3. If you are using Oracle Identity Manager release 11.1.2.x, then, in the left pane under Configuration, click IT Resource.

  4. In the IT Resource Name field on the Manage IT Resource page, enter SAPUME IT Resource and then click Search.

  5. Click the edit icon for the IT resource.

  6. From the list at the top of the page, select Details and Parameters.

  7. Specify values for the parameters of the IT resource. Table 2-3 describes the parameters of the SAP UME IT resource and Table 2-4 describes the parameters of the SAP AC UME IT resource.

    Note:

    Entries in this table are sorted in alphabetical order of parameter names.

    Table 2-3 Parameters of the SAP UME IT Resource

    Parameter Description

    Configuration Lookup

    This parameter holds the name of the lookup definition containing configuration information.

    Value: Lookup.SAPUME.Configuration

    ConnectorServerName

    Name of the IT resource of the type "Connector Server." You create an IT resource for the Connector Server in Configuring the IT Resource for the Connector Server.

    Note: Enter a value for this parameter only if you have deployed the SAP User Management Engine connector in the Connector Server.

    changePwdFlag

    See Configuring Password Changes for Newly Created Accounts for information about the value to be specified for this parameter.

    Default value: no

    dummyPassword

    Enter the dummy password that you want the connector to use during a Create User provisioning operation. The connector first sets the password as this value and then changes it to the password specified on the process form. See Configuring Password Changes for Newly Created Accounts for more information about this parameter.

    enableDate

    Enter the date that must be set (in the YYYY-MM-DD format) if a user must be enabled.

    Sample value: 9999-12-31

    logonNameInitialSubstring

    Enter a set of characters to support full reconciliation for the English language. For other languages, enter all characters of that language.

    Sample value: abcdefghijklmnopqrstuvwxyz1234567890

    logSPMLRequest

    Enter yes to specify that the SPML requests being sent to the target system be written to the log file. Otherwise, enter no.

    pwdHandlingSupport

    If SAP User Management Engine is configured with an LDAP-based data source in writable mode, then SSL configuration between SAP User Management Engine and the LDAP-based data source is mandatory for password management. In such a scenario, if SSL is not configured between SAP User Management Engine and the LDAP-based data source and password need not be maintained from SAP User Management Engine, then set the value of this parameter no. Otherwise, set the value of this parameter to yes.

    Default value: yes

    TopologyName

    Enter the name of the topology of the computer hosting the target system

    umePassword

    Enter the password of the target system user account that you create for connector operations

    umeUrl

    • If you perform the procedure described in Configuring SSL to Secure Communication Between the Target System and Oracle Identity Manager, then enter the URL for the SPML service in the following format:

      https://HOSTNAME:SSL_PORT/spml/spmlservice

    • If you do not configure SSL between the target system and Oracle Identity Manager, then enter the URL for the SPML service in the following format:

      http://HOSTNAME:PORT/spml/spmlservice

      Sample value: http://myhost:50000/spml/spmlservice

    umeUserId

    Enter the user ID of the target system user account that you create for connector operations

    Table 2-4 Parameters of the SAP AC UME IT Resource

    Parameter Description

    changePwdFlag

    See Configuring Password Changes for Newly Created Accounts for information about the value to be specified for this parameter.

    Default value: no

    Configuration Lookup

    This parameter holds the name of the lookup definition containing configuration information.

    Value: Lookup.SAPAC10UME.Configuration

    ConnectorServerName

    Name of the IT resource of the type "Connector Server." You create an IT resource for the Connector Server in Configuring the IT Resource for the Connector Server.

    Note: Enter a value for this parameter only if you have deployed the SAP User Management Engine connector in the Connector Server.

    dummyPassword

    Enter the dummy password that you want the connector to use during a Create User provisioning operation. The connector first sets the password as this value and then changes it to the password specified on the process form. See Configuring Password Changes for Newly Created Accounts for more information about this parameter.

    enableDate

    Enter the date that must be set (in the YYYY-MM-DD format) if a user must be enabled.

    Sample value: 9999-12-31

    grcLanguage

    This parameter defines the language of grc.

    Value: en

    grcPassword

    This parameter is used to authenticate the user access.

    grcUsername

    This parameter holds the GrcUsername for accessing the grc system.

    logonNameInitialSubstring

    Enter a set of characters to support full reconciliation for the English language. For other languages, enter all characters of that language.

    Sample value: abcdefghijklmnopqrstuvwxyz1234567890

    logSPMLRequest

    Enter yes to specify that the SPML requests being sent to the target system be written to the log file. Otherwise, enter no.

    pwdHandlingSupport

    If SAP User Management Engine is configured with an LDAP-based data source in writable mode, then SSL configuration between SAP User Management Engine and the LDAP-based data source is mandatory for password management. In such a scenario, if SSL is not configured between SAP User Management Engine and the LDAP-based data source and password need not be maintained from SAP User Management Engine, then set the value of this parameter no. Otherwise, set the value of this parameter to yes.

    Default value: yes

    umePassword

    Enter the password of the target system user account that you create for connector operations

    umeUrl

    • If you perform the procedure described in Configuring SSL to Secure Communication Between the Target System and Oracle Identity Manager, then enter the URL for the SPML service in the following format:

      https://HOSTNAME:SSL_PORT/spml/spmlservice

    • If you do not configure SSL between the target system and Oracle Identity Manager, then enter the URL for the SPML service in the following format:

      http://HOSTNAME:PORT/spml/spmlservice

      Sample value: http://myhost:50000/spml/spmlservice

    umeUserId

    Enter the user ID of the target system user account that you create for connector operations

  8. To save the values, click Update.

2.3.13 Configuring the IT Resource for the Connector Server

An IT resource contains connection information about the target system. Oracle Identity Manager uses this information during reconciliation and provisioning.

Perform the procedure described in this section only if you have installed the connector bundle in a Connector Server, as described in Deploying the Connector Bundle in a Connector Server. You must create a separate IT resource for the Connector Server.

To create the IT resource for the Connector Server:

  1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 11.1.1.x:

      Log in to the Administrative and User Console.

    • For Oracle Identity Manager release 11.1.2.x:

      Log in to Oracle Identity System Administration.

  2. If you are using Oracle Identity Manager release 11.1.1.x, then:

    1. On the Welcome page, click Advanced in the upper-right corner of the page.

    2. On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Create IT Resource.

  3. If you are using Oracle Identity Manager release 11.1.2.x, then:

    1. In the left pane under Configuration, click IT Resource.

      Note:

      If you are using Oracle Identity Manager release 11.1.2.3.x or later, then in the left pane, under Provisioning Configuration, click IT Resource.

    2. In the Manage IT Resource page, click Create IT Resource.

  4. Note: On the Step 1: Provide IT Resource Information page, perform the following steps:

    • IT Resource Name: Enter a name for the IT resource.

    • IT Resource Type: Select Connector Server from the IT Resource Type list.

    • Remote Manager: Do not enter a value in this field.

  5. Click Continue. Figure 2-1 shows the IT resource values added on the Create IT Resource page.

    Figure 2-1 Step 1: Provide IT Resource Information

    Description of Figure 2-1 follows
    Description of "Figure 2-1 Step 1: Provide IT Resource Information"

  6. On the Step 2: Specify IT Resource Parameter Values page, specify values for the parameters of the IT resource and then click Continue. Figure 2-2 shows the Step 2: Specify IT Resource Parameter Values page.

    Figure 2-2 Step 2: Specify IT Resource Parameter Values

    Description of Figure 2-2 follows
    Description of "Figure 2-2 Step 2: Specify IT Resource Parameter Values"

    Table 2-5 provides information about the parameters of the IT resource.

    Table 2-5 Parameters of the IT Resource for the Connector Server

    Parameter Description

    Host

    Enter the host name or IP address of the computer hosting the connector server.

    Sample value: RManager

    Key

    Enter the key for the Java connector server.

    Port

    Enter the number of the port at which the connector server is listening.

    Default value: 8759

    Timeout

    Enter an integer value which specifies the number of milliseconds after which the connection between the connector server and Oracle Identity Manager times out.

    Sample value: 300

    UseSSL

    Enter true to specify that you will configure SSL between Oracle Identity Manager and the Connector Server. Otherwise, enter false.

    Default value: false

    Note: If you configure the connector to communicate with the Connector Server using SSL, including setting the connectorserver.usessl property to true and importing the target system certificate into the Connector Server JDK keystore, an attempt to access the target system or run the Connector Server returns an error.

  7. On the Step 3: Set Access Permission to IT Resource page, the SYSTEM ADMINISTRATORS group is displayed by default in the list of groups that have Read, Write, and Delete permissions on the IT resource that you are creating.

    Note:

    This step is optional.

    If you want to assign groups to the IT resource and set access permissions for the groups, then:

    1. Click Assign Group.

    2. For the groups that you want to assign to the IT resource, select Assign and the access permissions that you want to set. For example, if you want to assign the ALL USERS group and set the Read and Write permissions to this group, then you must select the respective check boxes in the row, as well as the Assign check box, for this group.

    3. Click Assign.

  8. On the Step 3: Set Access Permission to IT Resource page, if you want to modify the access permissions of groups assigned to the IT resource, then:

    Note:

    • This step is optional.

    • You cannot modify the access permissions of the SYSTEM ADMINISTRATORS group. You can modify the access permissions of only other groups that you assign to the IT resource.

    1. Click Update Permissions.

    2. Depending on whether you want to set or remove specific access permissions for groups displayed on this page, select or deselect the corresponding check boxes.

    3. Click Update.

  9. On the Step 3: Set Access Permission to IT Resource page, if you want to unassign a group from the IT resource, then:

    Note:

    • This step is optional.

    • You cannot unassign the SYSTEM ADMINISTRATORS group. You can unassign only other groups that you assign to the IT resource.

    1. Select the Unassign check box for the group that you want to unassign.

    2. Click Unassign.

  10. Click Continue. Figure 2-3 shows the Step 3: Set Access Permission to IT Resource page.

    Figure 2-3 Step 3: Set Access Permission to IT Resource

    Description of Figure 2-3 follows
    Description of "Figure 2-3 Step 3: Set Access Permission to IT Resource"

  11. On the Step 4: Verify IT Resource Details page, review the information that you provided on the first, second, and third pages. If you want to make changes in the data entered on any page, click Back to revisit the page and then make the required changes.

  12. To proceed with the creation of the IT resource, click Continue. Figure 2-4 shows Step 4: Verify IT Resource Details page.

    Figure 2-4 Step 4: Verify IT Resource Details

    Description of Figure 2-4 follows
    Description of "Figure 2-4 Step 4: Verify IT Resource Details"

  13. The Step 5: IT Resource Connection Result page displays the results of a connectivity test that is run using the IT resource information. If the test is successful, then click Continue. If the test fails, then you can perform one of the following steps:

  14. Click Finish. Figure 2-6 shows the IT Resource Created Page.

    Figure 2-6 Step 6: IT Resource Created

    Description of Figure 2-6 follows
    Description of "Figure 2-6 Step 6: IT Resource Created"

2.3.14 Configuring the Access Request Management Feature of the Connector

Oracle Identity Manager can be configured as the medium for sending provisioning requests to SAP BusinessObjects AC Access Request Management. A request from Oracle Identity Manager is sent to Access Request Management, which forwards the provisioning data contained within the request to the target system (SAP R/3 or SAP CUA). The outcome is the creation of or modification to the user's account on the target system.

Note:

Before you configure the Access Request Management feature, it is recommended that you read the guidelines described in Guidelines on Using a Deployment Configuration.

The following sections provide information about configuring the Access Request Management feature:

2.3.14.1 Specifying Values for the GRC UME-ITRes IT Resource

The GRC UME-ITRes IT resource holds information that is used during communication with SAP BusinessObjects AC Access Request Management. To set values for the parameters of this IT resource:

  1. Depending on the Oracle Identity Manager release you are using, perform one of the following steps:

    • For Oracle Identity Manager release 11.1.1.x:

      Log in to the Administrative and User Console.

    • For Oracle Identity Manager release 11.1.2.x:

      Log in to Identity System Administration.

  2. If you are using Oracle Identity Manager release 11.1.1.x, then:

    1. On the Welcome page, click Advanced in the upper-right corner of the page.

    2. On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Manage IT Resource.

  3. If you are using Oracle Identity Manager release 11.1.2.x, then, in the left pane under Configuration, click IT Resource.

  4. In the IT Resource Name field on the Manage IT Resource page, enter GRC UME-ITRes and then click Search.

  5. Click the edit icon for the IT resource.

  6. From the list at the top of the page, select Details and Parameters.

  7. Specify values for the parameters of the IT resource.

    Table 2-6 lists the parameters of the GRC UME-ITRes IT resource.

    Table 2-6 Parameters of the GRC UME-ITRes IT Resource

    Parameter Description

    Configuration Lookup

    Enter the name of the configuration lookup definition.

    Value for Lookup

    Lookup.SAPUME.Configuration

    Connector Server Name

    Name of the IT resource of the type "Connector Server."

    language

    Enter the two-letter code for the language set on the target system.

    Sample value: EN

    password

    Enter the password of the account created on Access Request Management system.

    port

    Enter the number of the port at which Access Request Management system is listening.

    Sample value: 8090

    server

    Enter the IP address of the host computer on which Access Request Management system is listening.

    Sample value: 10.231.231.231

    username

    Enter the user name of an account created on Access Request Management system. This account is used to call Access Request Management system APIs that are used during request validation.

    Sample value: jdoe

  8. To save the values, click Update.

2.3.14.2 Configuring Request Types and Workflows on SAP BusinessObjects AC Access Request Management

You must create and configure request types and workflows on SAP BusinessObjects AC Access Request Management for provisioning operations.

  1. Create a request type in SAP BusinessObjects AC Access Request Management.

    In SAP BusinessObjects AC Access Request Management, a request type defines the action that is performed when a request is processed. Oracle Identity Manager is a requester. It works with request types defined in SAP BusinessObjects AC Access Request Management. The Lookup.SAPUME.AC10.Configuration lookup definition maps request types to provisioning operations submitted through Oracle Identity Manager.

  2. Create an access request workflow using the MSMP (Multi Step Multi process) Workflow engine.

2.3.15 Configuring SoD (Segregation of Duties)

SoD is a process that ensures that an individual is given access to only one module of a business process and will not be able to access other modules to reduce risk of fraud and error.

This section discusses the following procedures:

Note:

The ALL USERS group has INSERT, UPDATE, and DELETE permissions on the UD_SAPUME and UD_UME_ROLE process forms. During SoD validation of an entitlement request, data first moves from a dummy object form to a dummy process form. From there, data is sent to the SoD engine for validation. If the request clears the SoD validation, then data is moved from the dummy process form to the actual process form. Because the data is moved to the actual process forms through APIs, the ALL USERS group must have INSERT, UPDATE, and DELETE permissions on the three process forms.

2.3.15.1 Configuring SAP GRC to Act As the SoD Engine

To configure the SAP GRC to act as the SoD engine, see Using Segregation of Duties (SoD) in Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for 11g Release 1 (11.1.2).

2.3.15.2 Specifying Values for the GRC UME-ITRes IT Resource

The GRC UME-ITRes IT resource holds information that is used by the connector during SoD operations. This IT resource is the same as the one used by the Access Request Management feature for both Oracle Identity Manager.

To set values for the parameters of this IT resource, see Specifying Values for the GRC UME-ITRes IT Resource.

2.3.15.3 Specifying a Value for the TopologyName IT Resource Parameter

The TopologyName IT resource parameter holds the name of the combination of the following elements that you want to use for SoD validation:

  • Oracle Identity Manager installation

  • SAP BusinessObjects AC installation

  • SAP ERP installation

By default, the GRC-ITRes IT resource is registered. However, you must manually register the GRC UME-ITRes IT resource and enter the new topology name as the value of the TopologyName IT resource parameter.

To register the GRC UME-ITRes IT resource:

  1. Run the following command and add instance names for SAP and GRC.

    On Microsoft Windows: OIM_HOME\server\bin>registration.bat

    On a UNIX-based computer: OIM_HOME/server/bin/./registration.sh

    After running this command, enter options as shown in the following sample output:

    Do you want to proceed with registration? (y/n) y
Register System Instance for type OIM ?(y/n) n
Register System Instance for type EBS ?(y/n) n
Register System Instance for type PSFT ?(y/n) n
Register System Instance for type OAACG ?(y/n) n
Register System Instance for type SAP ?(y/n) y
Provide instance name sap1
Register System Instance for type GRC ?(y/n) y
Provide instance name grc1
GRC ITResource Instance Name: GRC UME-ITRes
Register System Instance for type OIM SDS ?(y/n) n
Register System Instance for type OIA ?(y/n) n
  2. Run the following command and find the registration IDs for the above instance names:

    OIM_HOME\server\bin>registration printRegistrationIDs

  3. Import the metadata/iam-features-sil/db/SILConfig.xml file from MDS and add the <Topology> element with IDs found in Step 2.

    Here is a sample element:

    <Topology>
    <name>sodgrcume</name>
    <IdmId>1</IdmId>
    <SodId>24</SodId>
    <SDSId>23</SDSId>
</Topology>
  4. Export the metadata/iam-features-sil/db/SILConfig.xml file to MDS and restart the server.

See Configuring the IT Resource for the Target System for information about specifying values for parameters of the IT resource.

2.3.15.4 Disabling and Enabling SoD

This section describes the procedure to disable and enable SoD on Oracle Identity Manager.

2.3.15.4.1 Disabling SoD on Oracle Identity Manager

To disable SoD:

  1. If you are using Oracle Identity Manager release 11.1.1.x, then perform the following steps:

    1. Log in to the Administrative and User Console.

    2. On the Welcome page, click Advanced in the upper-right corner of the page.

    3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the System Management tab, click System Configuration.

  2. If you are using Oracle Identity Manager release 11.1.2.x, then perform the following steps:

    1. Log in to Identity System Administration.

    2. In the left pane, under System Management, click System Configuration.

  3. In the Search System Configuration box, enter XL.SoDCheckRequired and then click Search.

    A list that matches your search criteria is displayed in the search results table.

  4. Click the XL.SoDCheckRequired property name.

    System properties for SoD are displayed on the right pane.

  5. In the Value box, enter FALSE to disable SoD.

  6. Click Save.

  7. Restart Oracle Identity Manager.

2.3.15.4.2 Enabling SoD on Oracle Identity Manager

To enable SoD:

  1. If you are using Oracle Identity Manager release 11.1.1.x, then perform the following steps:

    1. Log in to the Administrative and User Console.

    2. On the Welcome page, click Advanced in the upper-right corner of the page.

    3. On the Welcome to Oracle Identity Manager Advanced Administration page, in the System Management tab, click System Configuration.

  2. If you are using Oracle Identity Manager release 11.1.2.x, then perform the following steps:

    1. Log in to Identity System Administration.

    2. In the left pane, under System Management, click System Configuration.

  3. In the Search System Configuration box, enter XL.SoDCheckRequired and then click Search.

    A list that matches your search criteria is displayed in the search results table.

  4. Click the XL.SoDCheckRequired property name.

    System properties for SoD are displayed on the right pane.

  5. In the Value box, enter TRUE to enable SoD.

  6. Click Save.

  7. Restart Oracle Identity Manager.

2.3.16 Downloading WSDL files from SAP BusinessObjects AC

You need to download the WSDL files from SAP BusinessObjects AC before configuring the web services in SAP BusinessObjects AC. WSDL is required for connector to connect SAP web services.

Since the connector supports only basic authentication, select the User ID/Password check box for the following web services supported from OIM:

WSDL Description

GRAC_AUDIT_LOGS_WS

Audit log web service

GRAC_LOOKUP_WS

Look Up Service

GRAC_REQUEST_STATUS_WS

Request status web service

GRAC _RISK_ANALYSIS_WOUT_NO_WS

Risk analysis without request number

GRAC_SELECT_APPL_WS

Select Application web service

GRAC_USER_ACCESS_WS

User Access Request Service

GRAC_SEARCH_ROLES_WS

Search role web service

When you download the WSDL file, ensure to save it with the same name as mentioned in the SOA Management page. In addition, ensure that the folder containing WSDL files have read permission.

2.3.17 Localizing Field Labels in UI Forms

You can localize UI form field labels by using the resource bundle corresponding to the language you want to use. The resource bundles are available in the connector installation media.

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 11.1.2.x or later and you want to localize UI form field labels.

To localize field label that you add to in UI forms:

  1. Log in to Oracle Enterprise Manager.

  2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.

  3. In the right pane, from the Application Deployment list, select MDS Configuration.

  4. On the MDS Configuration page, click Export and save the archive to the local computer.

  5. Extract the contents of the archive, and open one of the following files in a text editor:

    • For Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle_en.xlf

    • For releases prior to Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle.xlf

  6. Edit the BizEditorBundle.xlf file in the following manner:

    1. Search for the following text:

      <file source-language="en"  
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

    2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE"
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja"
original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
datatype="x-oracle-adf">

    3. Search for the application instance code. This procedure shows a sample edit for SAP User Management Engine application instance. The original code is:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_SAPUME_DEPARTMENT__c_description']}">
<source>Department</source>
</target>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.SAPUMEFORM.entity.SAPUMEFORMEO.UD_SAPUME_DEPARTMENT__c_LABEL">
<source>Department</source>
</target>
</trans-unit>

    4. Open the resource file from the connector package, for example SAPUME_ja.properties, and get the value of the attribute from the file, for example, global.udf.UD_SAPUME_DEPARTMENT=\u90E8\u9580.

    5. Replace the original code shown in Step 6.b with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_SAPUME_DEPARTMENT__c_description']}">
<source>Department</source>
<target>\u90E8\u9580</target>
</trans-unit>
<trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.SAPUMEFORM.entity.SAPUMEFORMEO.UD_SAPUME_DEPARTMENT__c_LABEL">
<source>Department</source>
<target>\u90E8\u9580</target>
</trans-unit>

    6. Repeat Steps 6.a through 6.d for all attributes of the process form.

    7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing.

      Sample file name: BizEditorBundle_ja.xlf.

  7. Repackage the ZIP file and import it into MDS.

    See Also:

    Deploying and Undeploying Customizations in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager, for more information about exporting and importing metadata files

  8. Log out of and log in to Oracle Identity Manager.

2.3.18 Synchronizing the SAPUME Process Form and SAP AC UME Process Form with Target System Field Lengths

Ensure that the field length of attribute values in the target system must be the same as the field length of values in the SAPUME process form and SAP AC UME Process Form fields.

2.4 Upgrading the Connector

You can upgrade the SAP User Management Engine connector while in production, and with no downtime. Your customizations will remain intact and the upgrade will be transparent to your users. All form field names are preserved from the legacy connector.

To upgrade the SAP User Management Engine connector, perform the procedures described in the following sections:

Note:

  • Before you perform the upgrade procedure, it is strongly recommended that you create a backup of the Oracle Identity Manager database. Refer to the database documentation for information about creating a backup.

  • As a best practice, first perform the upgrade procedure in a test environment.

2.4.1 Prerequisites for Upgrading the Connector

Before you perform an upgrade operation or any of the upgrade procedures, you must perform the following actions:

  • Perform a reconciliation run to fetch all latest updates to Oracle Identity Manager.

  • Define the source connector (an earlier release of the connector that must be upgraded) in Oracle Identity Manager. You define the source connector to update the Deployment Manager XML file with all customization changes made to the connector.

  • Run the Oracle Identity Manager Delete JARs utility to delete the old connector bundle to the Oracle Identity Manager database.

    See Also:

    Delete JAR Utility of Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for detailed information about the Delete JARs utility

2.4.2 Upgrading the Connector

Depending on the environment in which you are upgrading the connector, perform one of the following steps:

  • Staging Environment

    Perform the upgrade procedure by using the wizard mode.

  • Production Environment

    Perform the upgrade procedure by using the silent mode.

See Also:

Managing Connector Lifecycle of Oracle Fusion Middleware Administering Oracle Identity Manager for detailed information about the wizard and silent modes

2.4.3 Performing the Postupgrade Steps

Perform the procedure described in this section to complete the steps that are required to post-upgrade.

  1. Run the Oracle Identity Manager Upload JARs utility to post the new connector bundle to the Oracle Identity Manager database.

    See Also:

    Upload JAR Utility of Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for detailed information about the Upload JARs utility

  2. Re-configure the IT resource of the connector.
  3. Upgrading the connector will generate duplicate entries in Lookups, you must manually delete these duplicate entries. Perform the Postupgrade procedure documented in Managing Connector Lifecycle of Oracle Fusion Middleware Administering Oracle Identity Manager.
  4. Perform the postupgrade steps. Depending on the version of the connector that you are using, perform one of the procedures described in the following sections:

2.4.3.1 Performing the Postupgrade Steps for Releases 9.x, 11.1.1.5.0, and 11.1.1.6.0 of the SAP User Management Engine Connector

Run the Form Version Control (FVC) utility to manage data changes on a form after an upgrade operation.

To do so, in a text editor, open the fvc.properties file located in the OIM_DC_HOME directory.

If you are using the connector release 9x, include the following entries:

ResourceObject;SAPUME Resource Object
FormName;UD_SAPEP
FromVersion;V_9.0.4.12
ToVersion;v_11.1.1.8.0
Parent;UD_SAPEP_IS_LOCK;false

If you are using the connector release 11.1.1.x, include the following entries:

ResourceObject;SAPUME Resource Object
FormName;UD_SAPUME
FromVersion;V_11.1.1.5.0
ToVersion;v_11.1.1.8.0
Parent;UD_SAPUME_IS_LOCK;false

2.4.3.2 Perform the Postupgrade Steps for Release 11.1.1.8.0 or later of the SAP User Management Engine Connector

2.4.3.2.1 Postupgrade Steps While Upgrading the Basic User Management Engine configuration from Release 11.1.1.8.0 to Release 11.1.1.9.0

Run the Form Version Control (FVC) utility to manage data changes on a form after an upgrade operation. To do so, in a text editor, open the fvc.properties file located in the OIM_DC_HOME directory.

If you are using the connector release 11.1.1.8.0, include the following entries:

ResourceObject;SAPUME Resource Object
FormName;UD_SAPUME
FromVersion;V_11.1.1.8.0
ToVersion;v_11.1.1.9.0

Note:

While upgrading the connector, the following information will display. You must manually delete the following adapters and Event handlers:

  • The "sapume ac remove child" and "sapume ac add child" Adapters.

  • The "adpSAPUMEACREMOVECHIL" and "adpSAPUMEACADDCHILD" event handlers.

2.4.3.2.2 Postupgrade Steps While Upgrading the SoD validation of SAP BusinessObjects AC Access Risk Analysis from Release 11.1.1.8.0 to Release 11.1.1.9.0

Perform the procedure described in this section to complete the postupgrade steps for the SoD validation of SAP BusinessObjects AC Access Risk Analysis.

  1. Re-configure the GRC UME-ITRes IT resource.
  2. You must manually update the decode values of the following entries in the "Lookup.SAPUME.Configuration" lookup definition:

    • SODSystemKey

    • wsdlFilePath

    • entitlementRiskAnalysisAccessURL

  3. Run the Form Version Control (FVC) utility to manage data changes on a form after an upgrade operation. To do so, in a text editor, open the fvc.properties file located in the OIM_DC_HOME directory. If you are using the connector release 11.1.1.8.0, include the following entries: 
    ResourceObject;SAPUME Resource Object
FormName;UD_SAPUME
FromVersion;V_11.1.1.8.0
ToVersion;v_11.1.1.9.0
  4. Create a new version of the process form, and run the "Resubmit Uninitiated Provisioning SODChecks" scheduler.

    Note:

    While upgrading the connector, the following information will display. You must manually delete the following adapters and Event handlers:

    • The "sapume ac remove child" and "sapume ac add child" Adapters.

    • The "adpSAPUMEACREMOVECHIL" and "adpSAPUMEACADDCHILD" event handlers.

2.4.3.2.3 Postupgrade Steps While Upgrading the SAP BusinessObjects AC Access Request Management from Release 11.1.1.8.0 to Release 11.1.1.9.0

Perform the procedure described in this section to complete the postupgrade steps for the SAP BusinessObjects AC Access Request Management.

  1. Re-configure the SAPUME IT Resource IT resource with GRC credentials.

  2. You must manually update the decode values for the following entries in the "Lookup.SAPAC10UME.Configuration" lookup definition:

    • roleLookupAccessURL

    • otherLookupAccessURL

    • auditLogsAccessURL

    • appLookupAccessURL

    • wsdlFilePath

    • userAccessAccessURL

    • requestStatusAccessURL

    • Note: Upgrading the connector will generate duplicate entries in Lookups, you must manually delete these duplicate entries.

    • Perform the postupgrade procedure documented in the Managing Connector Lifecycle of Oracle Fusion Middleware Administering Oracle Identity Manager.

  3. Run the Form Version Control (FVC) utility to manage data changes on a form after an upgrade operation. To do so:

    In a text editor, open the fvc.properties file located in the OIM_DC_HOME directory. If you are using the connector release 11.1.1.8.0, include the following entries:

    ResourceObject;SAP AC UME Resource Object
FormName;UD_SAPUME
FromVersion;v_11.1.1.8.0
ToVersion;v_11.1.1.9.0

    Run the FVC utility. This utility is copied into the following directory when you install the design console:

    For Microsoft Windows:

    OIM_DC_HOME/fvcutil.bat

    For UNIX:

    OIM_DC_HOME/fvcutil.sh

    When you run this utility, you are prompted to enter the login credentials of the Oracle Identity Manager administrator, and the logger level and log file location.

    See Also:

    Using the Form Version Control Utility of Oracle Fusion Middleware Administering Oracle Identity Manager for detailed information about the FVC utility

  4. Run the PostUpgradeScript_SAPUME.sql script as follows:

    1. Connect to the Oracle Identity Manager database by using the OIM DB User credentials.

    2. Run the PostUpgradeScript_SAPUME.sql. This script is located in the Upgrade directory on the installation media.

      Note:

      Change the task name of the bulk adapter after upgrade.Example: Replace UD_SAPACUME Updated with UD_SAPUME Updated.

  5. Create a new version of the process form.

    If you are using Oracle Identity Manager release 11.1.2.x, then all changes made to the Form Designer of the Design Console must be done in a new UI form as follows:

    1. Log in to Oracle Identity System Administration.

    2. Create and activate a sandbox. See Creating and Activating a Sandbox for more information.

    3. Create a new UI form to view the upgraded fields. See Creating a New UI Form for more information about creating a UI form.

    4. Associate the newly created UI form with the application instance of your target system. To do so, open the existing application instance for your resource, from the Form field, select the form (created in the preceding step), and then save the application instance.

    5. Publish the sandbox. See Publishing a Sandbox for more information.

  6. Run all the following scheduled jobs that are used for SAP BusinessObjects AC lookup field synchronization:

    Note:

    You can specify values for the attributes of these scheduled jobs. Table 3-2 describes the attributes of these scheduled jobs. Configuring Scheduled Jobs describes the procedure to configure scheduled jobs.

    • SAP AC UME Role Lookup Reconciliation

    • SAP AC UME Group Lookup Reconciliation

    • SAP AC UME BusinessProcess Lookup Reconciliation

    • SAP AC UME FunctionalArea Lookup Reconciliation

    • SAP AC UME ItemProvAction Lookup Reconciliation

    • SAP AC UME Priority Lookup Reconciliation

    • SAP AC UME ReqInitSystem Lookup Reconciliation

    • SAP AC UME RequestType Lookup Reconciliation

  7. Perform full reconciliation.

    This operation updates the Unique Id resource object field and the lock status of the users. The lock status will be updated as per the value specified in the fvc.properties file in Step 5a.

    See Full Reconciliation for more information about this step.

  8. After upgrading the connector, you can perform delete reconciliation.

    See Reconciliation Scheduled Jobs for more information about delete reconciliation.

  9. If you are using Connector Server, Deploy the Connector Bundle in a Connector Server. See Deploying the Connector Bundle in a Connector Server for more information.