Deploying the EBS HRMS Connector

The procedure to deploy the connector can be divided into the following stages:

Preinstallation

Preinstallation involves creating a target system user account for connector operations.

Note:

You must have DBA privileges to run the scripts described in this section and grant the required permissions to the target system user account.

You must have Oracle Database Client installed on the computer on which you perform the procedure described in this section. The Oracle Database Client release must be the same as the database release. In addition, if Oracle Database Client is not installed on the database host computer, then the tnsnames.ora file on the Oracle Database Client host must contain an entry for the SID of the database.

Oracle Identity Manager requires a target system user account to access the target system during connector operations. You provide the credentials of this user account while performing the procedure described in Configuring the IT Resource for the Target System.

To create a target system user account for connector operations:

  1. From the installation media, copy the scripts directory to a temporary directory on either the target system host computer or a computer on which the Oracle Database Client has been installed. If you are installing in the same host computer where the connector directory is present, then skip this step and proceed to the next.
  2. On the computer where you copy the scripts directory, verify that there is a TNS entry in the tnsnames.ora file for the target system database.
  3. Change to the directory containing the scripts directory and depending on the host platform, run either the Run_HRMS_DBScripts.sh or Run_HRMS_DBScripts.bat file. These files are present in the scripts directory of the installation media.
  4. When you run the script, you are prompted for the following information:
    • Enter the ORACLE_HOME

      Set a value for the ORACLE_HOME environment variable. This prompt is displayed only if the ORACLE_HOME environment variable has not been set on the computer on which you are running the script.

    • Enter the System User Name

      Enter the login (user name) of a DBA account with the privileges to create and configure a new target system user.

    • Enter the name of the database

      Enter the connection string or service name given in the tnsnames.ora file to connect to the target system database.

    • Would you like to create new user for connector operations [y/n]

      Enter y or n to specify whether you want to create a new user for connector operations.

      This connects you the SQL*Plus client.

    • Enter password

      Enter the password for the Oracle database login. If you entered n at the earlier prompt to create a new user for connector operations, then the Type and Package are created, and then the connection to the database is disconnected. If you entered y, then the Type and Package are created, and then the connection to the database remains.

    • Enter password

      Enter the password of the dba user.

    • Enter New database Username to be created

      Enter a user name for the target system account that you want to create.

    • Enter the New user password

      Enter a password for the target system account that you want to create.

      This installs all wrappers packages under the APPS schema, creates the new target system account, and then grants all the required privileges on the tables and packages.

    • Connecting with newly created database user

      Enter the connection string or service name that you provided earlier.

      The user account for connector operations is created. The privileges granted to this user account are listed in Privileges Granted to the User Account.

    • Enter the hostname for network acl [Input will be ignored If DB version is earlier than 11g]

      Enter the name of the computer hosting network acl in the following format:

      *.DOMAIN_NAME.com

      This prompt is received only if you entered y at one of the earlier prompts to create a new user for connector operations.

Privileges Granted to the User Account

This section lists the privileges that are granted to the user account created in Preinstallation. The synonyms created for tables are also listed here.

Execute permission granted to the following packages:

APPS.HR_EMPLOYEE_API

APPS.HR_PERSON_API

APPS.HR_PERSON_ADDRESS_API

APPS.HR_PERSON_ADDRESS_BK1

APPS.HR_API

APPS.HR_CONTINGENT_WORKER_API

APPS.HR_ASSIGNMENT_API

Select privilege has been granted to the following tables:

APPS.PER_ALL_ASSIGNMENTS_F

APPS.PER_PEOPLE_F

APPS.PER_PERSON_TYPES

APPS.PER_PERIODS_OF_SERVICE

APPS.PER_PERIODS_OF_PLACEMENT

APPS.PER_ADDRESSES

APPS.PER_PERSON_TYPE_USAGES_F

APPS.PER_ALL_PEOPLE_F

Execute privileges granted to the following wrapper packages created in APPS schema:

APPS.OIM_EMPLOYEE_WRAPPER

APPS.OIM_EMPLOYEE_ADDRESS_WRAPPER

APPS.HZ_PARTIES

APPS.PER_JOBS

APPS.PER_GRADES

APPS.HR_ALL_ORGANIZATION_UNITS

APPS.PER_VALID_GRADES

APPS.FND_LOOKUP_VALUES_VL

Synonyms created or replaced for tables as follows:

synonym PER_PEOPLE_F for APPS.PER_PEOPLE_F

synonym PER_ALL_ASSIGNMENTS_F for APPS.PER_ALL_ASSIGNMENTS_F

synonym PER_PERIODS_OF_SERVICE for APPS.PER_PERIODS_OF_SERVICE

synonym PER_PERIODS_OF_PLACEMENT for APPS.PER_PERIODS_OF_PLACEMENT

synonym HR_EMPLOYEE_API for APPS.HR_EMPLOYEE_API

synonym HR_PERSON_API for APPS.HR_PERSON_API

synonym PER_ADDRESSES for APPS.PER_ADDRESSES

synonym PER_PERSON_TYPE_USAGES_F for APPS.PER_PERSON_TYPE_USAGES_F

synonym PER_ALL_PEOPLE_F for APPS.PER_ALL_PEOPLE_F

synonym PER_JOBS for APPS.PER_JOBS

synonym PER_GRADES for APPS.PER_GRADES

synonym HR_ALL_ORGANIZATION_UNITS for APPS.HR_ALL_ORGANIZATION_UNITS

synonym HR_PERSON_ADDRESS_API for APPS.HR_PERSON_ADDRESS_API

synonym HR_CONTINGENT_WORKER_API for APPS.HR_CONTINGENT_WORKER_API

synonym HR_ASSIGNMENT_API for APPS.HR_ASSIGNMENT_API

synonym HR_PERSON_ADDRESS_BK1 for APPS.HR_PERSON_ADDRESS_BK1

synonym HR_API for APPS.HR_API

synonym HZ_PARTIES for APPS.HZ_PARTIES

synonym PER_PERSON_TYPES for APPS.PER_PERSON_TYPES

synonym PER_VALID_GRADES for APPS.PER_VALID_GRADES

synonym FND_LOOKUP_VALUES_VL for APPS.FND_LOOKUP_VALUES_VL

Synonyms created or replaced for OIM database user as follows:

synonym OIM_EMPLOYEE_WRAPPER for APPS.OIM_EMPLOYEE_WRAPPER

synonym OIM_EMPLOYEE_ADDRESS_WRAPPER for APPS.OIM_EMPLOYEE_ADDRESS_WRAPPER

synonym attributeinfo for APPS.attributeinfo

synonym attributelist for APPS.attributelist

synonym schema_object for APPS.schema_object

synonym schemalist for APPS.schemalist

Installation

Installation information is divided across the following sections:

Understanding the Installation

Depending on where you want to run the connector code (bundle), the connector provides the following installation options:

  • Run the connector code locally in Oracle Identity Manager.

    In this scenario, you deploy the connector in Oracle Identity Manager. Deploying the connector in Oracle Identity Manager involves performing the procedures described in Running the Connector Installer and Configuring the IT Resource for the Target System.

  • Run the connector code remotely in a Connector Server.

    In this scenario, you deploy the connector in Oracle Identity Manager, and then, deploy the connector bundle in a Connector Server. See Using an Identity Connector Server in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for information about installing, configuring, and running the Connector Server, and then installing the connector in a Connector Server.

Running the Connector Installer

To run the Connector Installer:

  1. Copy the contents of the connector installation media directory into the following directory:

    OIM_HOME/server/ConnectorDefaultDirectory

  2. Log in to Oracle Identity System Administration.

  3. In the left pane, under System Management, click Manage Connector.

  4. In the Manage Connector page, click Install.

  5. The Connector List list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory in Step 1.

    You can select one of the following options:

    • For the HRMS Trusted connector:

      Oracle EBS Employee Reconciliation RELEASE_NUMBER

    • For the HRMS Target connector:

      Oracle EBS HRMS RELEASE_NUMBER

    If you have copied the installation files into a different directory, then:

    1. In the Alternative Directory field, enter the full path and name of that directory.

    2. To repopulate the list of connectors in the Connector List list, click Refresh.

    3. From the Connector List list, select the connector that you want to install.

  6. Click Load.

  7. To start the installation process, click Continue.

    The following tasks are performed, in sequence:

    1. Configuration of connector libraries

    2. Import of the connector XML files (by using the Deployment Manager)

    3. Compilation of adapters

    On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure is displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:

    • Retry the installation by clicking Retry.

    • Cancel the installation and begin again from Step 1.

  8. If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of steps that you must perform after the installation is displayed. These steps are as follows:

    1. Ensuring that the prerequisites for using the connector are addressed

      Note:

      At this stage, run the Oracle Identity Manager PurgeCache utility to load the server cache with content from the connector resource bundle in order to view the list of prerequisites. See Clearing Content Related to Connector Resource Bundles from the Server Cache for information about running the PurgeCache utility.

      There are no prerequisites for some predefined connectors.

    2. Configuring the IT resource for the connector

      The procedure to configure the IT resource is described later in this guide.

    3. Configuring the scheduled jobs

      The procedure to configure these scheduled jobs is described later in this guide.

Configuring the IT Resource for the Target System

An IT resource contains connection information about the target system. Oracle Identity Manager uses this information during reconciliation and provisioning. Depending on the connector you have installed, one of the following the IT resources for the target system are created during connector installation:

  • Oracle EBS HRMS

  • Oracle EBS HRMS Trusted

Depending on the connector that you are using, you must specify values for the parameters of these IT resources as follows:

  1. Log in to Oracle Identity System Administration.
  2. In the left pane, under Configuration, click IT Resource.
  3. In the IT Resource Name field on the Manage IT Resource page, enter the IT resource name that you want to configure (for example, Oracle EBS HRMS) and then click Search. Alternatively, from the IT Resource Type menu, select the name of the IT resource, and then click Search.
  4. Click the edit icon for the IT resource.
  5. From the list at the top of the page, select Details and Parameters.
  6. Specify values for the parameters of the IT resource. The list of IT resource parameters for each connector is listed later in this section.
  7. To save the values, click Update.

Table 2-1 describes each parameter of the Oracle EBS HRMS and Oracle EBS HRMS Trusted IT resources.

Table 2-1 Parameters of the Oracle EBS HRMS and Oracle EBS HRMS Trusted IT Resources

Parameter Description

batchSize

Enter the number of records that must be included in each batch fetched from the target system during reconciliation.

Default value: 1000

Configuration Lookup

This parameter holds the name of the configuration lookup definition. Depending on the connector that you are using, the value is one of the following:

  • For HRMS Target connector: Lookup.EBSHRMS.Configuration

  • For HRMS trusted connector: Lookup.EBSHRMS.Configuration.Trusted

You must not change the value of this parameter. However, if you create a copy of this lookup definition, then you can enter the name of the newly created lookup definition as the value of the Configuration Lookup Name parameter.

Connector Server Name

Enter the name of the connector server IT resource.

database

Enter the name of the target system database.

deletePerson

Specifies whether the employee record must be completely deleted from the target system. There is no hard delete of employee records in the target system. In other words, when you delete an employee record, the employee record is just set to terminated, but the record is not completely deleted from the target system.

If you set the value of this parameter to true, the employee record is completely deleted from the target system.

If you set the value of this parameter to false, the employee record is not deleted from the target system, but its status is just set to "terminated".

This parameter is present only in the Oracle EBS HRMS IT resource.

host

Enter the host name or IP address of the computer hosting the target system.

includeFutureHires

Specifies whether the connector must detect and reconcile records with future-dated Start Date values.

If you set the value of this parameter to true, all employee records with future-dated start Date values are reconciled.

If you set the value of this parameter to false, employee records with future-dated Start Date values are not reconciled.

Default value: true

This parameter is present only in the Oracle EBS HRMS Trusted IT resource.

jdbcUrlTemplate

Enter the JDBC URL template of the target system database.

Default value: jdbc:oracle:thin:@%h:%p:%d

port

Enter the number of the port at which the target system database is listening.

user

Enter the user ID of the database user account that Oracle Identity Manager uses to connect to the target system.

password

Enter the password of the database user account that Oracle Identity Manager uses to connect to the target system.

Postinstallation

Postinstallation steps are divided across the following sections:

Configuring Secure Communication Between the Target System and Oracle Identity Manager

To secure communication between Oracle Database and Oracle Identity Manager, you can perform either one or both of the following procedures:

Note:

To perform the procedures described in this section, you must have the permissions required to modify the TNS listener configuration file.

Configuring Data Encryption and Integrity in Oracle Database

See Data Encryption in Oracle Database Advanced Security Administrator's Guide for information about configuring data encryption and integrity.

Configuring SSL Communication in Oracle Database

To enable SSL communication between Oracle Database and Oracle Identity Manager:

  1. See Secure Socket Layer in Oracle Database Advanced Security Administrator's Guide for information about enabling SSL communication between Oracle Database and Oracle Identity Manager.
  2. Export the certificate on the Oracle Database host computer.
  3. Copy the certificate to Oracle Identity Manager.
  4. Import the certificate into the JVM certificate store of the application server on which Oracle Identity Manager is running.

    To import the certificate into the certificate store, run the following command:

    keytool -import -file FILE_LOCATION -keystore TRUSTSTORE_LOCATION -storepass TRUSTSTORE_PASSWORD -trustcacerts -alias ALIAS
    

    In this command:

    • Replace FILE_LOCATION with the full path and name of the certificate file.

    • Replace ALIAS with an alias for the certificate.

    • Replace TRUSTSTORE_PASSWORD with a password for the certificate store.

    • Replace TRUSTSTORE_LOCATION with one of the certificate store paths given in Table 2-2. This table shows the location of the certificate store for each of the supported application servers.

    Note:

    In an Oracle Identity Manager cluster, you must import the file into the certificate store on each node of the cluster.

    Table 2-2 Certificate Store Locations

    Application Server Certificate Store Location

    Oracle WebLogic Server

    • If you are using Oracle jrockit_R27.3.1-jdk, then copy the certificate into the following directory:

      JROCKIT_HOME/jre/lib/security

    • If you are using the default Oracle WebLogic Server JDK, then copy the certificate into the following directory:

      WEBLOGIC_HOME/java/jre/lib/security/cacerts

    IBM WebSphere Application Server

    • For a nonclustered configuration of any supported IBM WebSphere Application Server release, import the certificate into the following certificate store:

      WEBSPHERE_HOME/java/jre/lib/security/cacerts

    • For IBM WebSphere Application Server 6.1.x, in addition to the cacerts certificate store, you must import the certificate into the following certificate store:

      WEBSPHERE_HOME/Web_Sphere/profiles/SERVER_NAME/config/cells/CELL_NAME/nodes/NODE_NAME/trust.p12

      For example:

      C:/Web_Sphere/profiles/AppSrv01/config/cells/tcs055071Node01Cell/nodes/tcs055071Node0/trust.p12

    • For IBM WebSphere Application Server 5.1.x, in addition to the cacerts certificate store, you must import the certificate into the following certificate store:

      WEBSPHERE_HOME/etc/DummyServerTrustFile.jks

    JBoss Application Server

    JAVA_HOME/jre/lib/security/cacerts

    Oracle Application Server

    ORACLE_HOME/jdk/jre/lib/security/cacerts

Configuring Oracle Identity Manager

Note:

Perform the procedure described in this section only if you are using the HRMS Target connector.

You must create additional metadata such as a UI form and an application instance. In addition, you must run catalog synchronization job. These procedures are described in the following sections:

Creating and Activating a Sandbox

See Managing Sandboxes in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for instructions on creating and activating a sandbox.

Creating a New UI Form

See Managing Forms in Oracle Fusion Middleware Administering Oracle Identity Manager. for instructions on creating a new UI form. While creating the UI form, ensure that you select the resource object corresponding to the EBS HRMS Target connector that you want to associate the form with.

Note:

  • While creating a new UI form, the form type should be Parent Form + Child Tables (Master/Detail).

  • Ensure that you select the Generate Entitlement Forms check box.

Associating the Form with the Application Instance

By default, an application instance named Oracle EBS HRMS Application Instance is automatically created after you install the connector. You must associate this application instance with the form created in Creating a New UI Form.

See Managing Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager for instructions on modifying an application instance.

After updating the application instance, you must publish it to an organization to make the application instance available for requesting and subsequent provisioning to users. However, as a best practice, perform the following procedure before publishing the application instance:

  1. In the System Administration console, deactivate the sandbox.
  2. Log out of the System Administration console.
  3. Log in to the Self Service console and activate the sandbox that you deactivated in Step 1.
  4. In the Catalog, check for the Application Instance UI (form fields) and ensure that it appears correctly.
  5. Publish the application instance only if everything appears correctly. Otherwise, fix the issues and then publish the application instance.

See Managing Organizations Associated With Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager for instructions on publishing an application instance to an organization.

Publishing a Sandbox

Before you publish a sandbox, perform the following procedure as a best practice to validate all sandbox changes made till this stage as it is hard to revert changes once a sandbox is published:

  1. In the System Administration console, deactivate the sandbox.
  2. Log out of the System Administration console.
  3. Log in to the Self Service console using the xelsysadm user credentials and then activate the sandbox that you deactivated in Step 1.
  4. In the Catalog, ensure that the EBS HRMS application instance form appears with correct fields.
  5. Publish the sandbox. See Publishing a Sandbox in Developing and Customizing Applications for Oracle Identity Manager for instructions on publishing a sandbox.

Syncing the Catalog

To sync the catalog:

  1. Run the scheduled jobs for lookup field synchronization listed in Scheduled Job for Lookup Field Synchronization.
  2. Run the Catalog Synchronization Job scheduled job. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about this scheduled job.

Updating an Existing Application Instance with a New Form

For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:

  1. Create a sandbox and activate it as described in Creating and Activating a Sandbox.
  2. Create a new UI form for the resource as described in Creating a New UI Form.
  3. Open the existing application instance.
  4. In the Form field, select the new UI form that you created.
  5. Save the application instance.
  6. Publish the sandbox as described in Publishing a Sandbox.

Setting Up the Lookup Definition for Connection Pooling

By default, this connector uses the ICF connection pooling. Table 2-3 lists the connection pooling properties, their description, and default values set in ICF:

Table 2-3 Connection Pooling Properties

Property Description

Pool Max Idle

Maximum number of idle objects in a pool.

Default value: 10

Pool Max Size

Maximum number of connections that the pool can create.

Default value: 10

Pool Max Wait

Maximum time, in milliseconds, the pool must wait for a free object to make itself available to be consumed for an operation.

Default value: 150000

Pool Min Evict Idle Time

Minimum time, in milliseconds, the connector must wait before evicting an idle object.

Default value: 120000

Pool Min Idle

Minimum number of idle objects in a pool.

Default value: 1

If you want to modify the connection pooling properties to use values that suit requirements in your environment, then:

  1. Log in to the Design Console.
  2. Expand Administration, and then double-click Lookup Definition.
  3. Search for and open one of the following lookup definitions:

    For the HRMS Trusted connector: Lookup.EBSHRMS.Configuration.Trusted

    For the HRMS Target connector: Lookup.EBSHRMS.Configuration

  4. On the Lookup Code Information tab, click Add.

    A new row is added.

  5. In the Code Key column of the new row, enter Pool Max Idle.
  6. In the Decode column of the new row, enter a value corresponding to the Pool Max Idle property.
  7. Repeat Steps 4 through 6 for adding each of the connection pooling properties listed in Table 2-3.
  8. Click the Save icon.

Clearing Content Related to Connector Resource Bundles from the Server Cache

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the Oracle Identity Manager database. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

  1. In a command window, switch to the OIM_HOME/server/bin directory.
  2. Enter one of the following commands:
    • On Microsoft Windows: PurgeCache.bat All

    • On UNIX: PurgeCache.sh All

    When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

    t3://OIM_HOST_NAME:OIM_PORT_NUMBER
    

    In this format:

    • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

    • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

    You can use the PurgeCache utility to purge the cache for any content category.

Managing Logging

Managing logging is discussed in the following sections:

Understanding Log Levels

Oracle Identity Manager uses Oracle Java Diagnostic Logging (OJDL) for logging. OJDL is based on java.util.logger. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

  • SEVERE.intValue()+100

    This level enables logging of information about fatal errors.

  • SEVERE

    This level enables logging of information about errors that might allow Oracle Identity Manager to continue running.

  • WARNING

    This level enables logging of information about potentially harmful situations.

  • INFO

    This level enables logging of messages that highlight the progress of the application.

  • CONFIG

    This level enables logging of information about fine-grained events that are useful for debugging.

  • FINE, FINER, FINEST

    These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These log levels are mapped to ODL message type and level combinations as shown in Table 2-4.

Table 2-4 Log Levels and ODL Message Type:Level Combinations

Log Level ODL Message Type:Level

SEVERE.intValue()+100

INCIDENT_ERROR:1

SEVERE

ERROR:1

WARNING

WARNING:1

INFO

NOTIFICATION:1

CONFIG

NOTIFICATION:16

FINE

TRACE:1

FINER

TRACE:16

FINEST

TRACE:32

The configuration file for OJDL is logging.xml, which is located at the following path:

DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml

Here, DOMAIN_HOME and OIM_SERVER are the domain name and server name specified during the installation of Oracle Identity Manager.

Enabling logging

To enable logging in Oracle WebLogic Server:

  1. Edit the logging.xml file as follows:

    1. Add the following blocks in the file:

      <log_handler name='ebs-handler' level='[LOG_LEVEL]' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
      <property name='logreader:' value='off'/>
           <property name='path' value='[FILE_NAME]'/>
           <property name='format' value='ODL-Text'/>
           <property name='useThreadName' value='true'/>
           <property name='locale' value='en'/>
           <property name='maxFileSize' value='5242880'/>
           <property name='maxLogSize' value='52428800'/>
           <property name='encoding' value='UTF-8'/>
         </log_handler>
      </log_handlers>
      
      <logger name='ORG.IDENTITYCONNECTORS.EBS' level='[LOG_LEVEL]' useParentHandlers='false'>
           <handler name='ebs-handler'/>
           <handler name='console-handler'/>
         </logger>
      
    2. Replace both occurrences of [LOG_LEVEL] with the ODL message type and level combination that you require. Table 2-4 lists the supported message type and level combinations.

      Similarly, replace [FILE_NAME] with the full path and name of the log file in which you want log messages to be recorded.

      The following blocks show sample values for [LOG_LEVEL] and [FILE_NAME] :

      <log_handler name='ebs-handler' level='TRACE:32' class='oracle.core.ojdl.logging.ODLHandlerFactory'>     <property name='logreader:' value='off'/>
           <property name='path' value='/scratch/acme1/user1/oim_Jun25.log'/>
           <property name='format' value='ODL-Text'/>
           <property name='useThreadName' value='true'/>
           <property name='locale' value='en'/>
           <property name='maxFileSize' value='5242880'/>
           <property name='maxLogSize' value='52428800'/>
           <property name='encoding' value='UTF-8'/>
         </log_handler>
      </log_handlers>
      
      <loggers>
         <logger name='ORG.IDENTITYCONNECTORS.EBS' level='TRACE:32' useParentHandlers='false'>
           <handler name='ebs-handler'/>
           <handler name='console-handler'/>
         </logger>
      

    With these sample values, when you use Oracle Identity Manager, all messages generated for this connector that are of a log level equal to or higher than the TRACE:32 level are recorded in the specified file.

  2. Save and close the file.

  3. Set the following environment variable to redirect the server logs to a file:

    For Microsoft Windows:

    set WLS_REDIRECT_LOG=FILENAME
    

    For UNIX:

    export WLS_REDIRECT_LOG=FILENAME
    

    Replace FILENAME with the location and name of the file to which you want to redirect the output.

  4. Restart the application server.

Determining Values for the JDBC URL and Connection Properties Parameters

This section discusses the JDBC URL and Connection Properties parameters. You apply the information in this section while performing the procedure described in Configuring the IT Resource for the Target System.

The values that you specify for the JDBC URL and Connection Properties parameters depend on the security measures that you have implemented:

Supported JDBC URL Formats

The following are the supported JDBC URL formats:

  • Multiple database instances support one service (Oracle RAC)

    JDBC URL format:

    jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=HOST1_NAME.DOMAIN)(PORT=PORT1_NUMBER))(ADDRESS=(PROTOCOL=TCP)(HOST=HOST2_NAME.DOMAIN)(PORT=PORT2_NUMBER))(ADDRESS=(PROTOCOL=TCP)(HOST=HOST3_NAME.DOMAIN)(PORT=PORT3_NUMBER)) . . . (ADDRESS=(PROTOCOL=TCP)(HOST=HOSTn_NAME.DOMAIN)(PORT=PORTn_NUMBER))(CONNECT_DATA=(SERVICE_NAME=ORACLE_DATABASE_SERVICE_NAME)))

    Sample value:

    jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST= host1.example.com)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST= host2.example.com)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST= host3.example.com)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST= host4.example.com)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME= srvce1)))

  • One database instance supports one service

    JDBC URL format:

    jdbc:oracle:thin:@HOST_NAME.DOMAIN:PORT_NUMBER:ORACLE_DATABASE_SERVICE_NAME

    Sample value:

    jdbc:oracle:thin:@host1.example:1521:srvce1

  • One database instance supports multiple services (for Oracle Database 10g and later)

    JDBC URL format:

    jdbc:oracle:thin:@//HOST_NAME.DOMAIN:PORT_NUMBER/ORACLE_DATABASE_SERVICE_NAME

    Sample value:

    jdbc:oracle:thin:@host1.example.com:1521/srvce1

Only SSL Communication Is Configured

After you configure SSL communication, the database URL is recorded in the tnsnames.ora file. See Local Naming Parameters in the tnsnames.ora File in Oracle Database Net Services Reference for detailed information about the tnsnames.ora file.

The following are sample formats of the contents of the tnsnames.ora file. In these formats, DESCRIPTION contains the connection descriptor, ADDRESS contains the protocol address, and CONNECT_DATA contains the database service identification information.

Sample Format 1:

NET_SERVICE_NAME=
 (DESCRIPTION=
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (CONNECT_DATA= 
     (SERVICE_NAME=SERVICE_NAME)))

Sample Format 2:

NET_SERVICE_NAME= 
 (DESCRIPTION_LIST=
  (DESCRIPTION= 
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (CONNECT_DATA= 
     (SERVICE_NAME=SERVICE_NAME)))
  (DESCRIPTION= 
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (CONNECT_DATA= 
     (SERVICE_NAME=SERVICE_NAME))))

Sample Format 3:

NET_SERVICE_NAME= 
 (DESCRIPTION= 
  (ADDRESS_LIST= 
   (LOAD_BALANCE=on)
   (FAILOVER=off)
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION)))
  (ADDRESS_LIST= 
   (LOAD_BALANCE=off)
   (FAILOVER=on)
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION)))
  (CONNECT_DATA=
   (SERVICE_NAME=SERVICE_NAME)))

If you have configured only SSL communication and imported the certificate that you create on the target system host computer into the JVM certificate store of Oracle Identity Manager, then you must derive the value for the JDBC URL parameter from the value of NET_SERVICE_NAME in the tnsnames.ora file. For example:

Note:

As shown in this example, you must include only the (ADDRESS=(PROTOCOL=TCPS)(HOST=HOST_NAME)(PORT=2484)) element because you are configuring SSL. You need not include other (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION)) elements.

jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCPS)(HOST=myhost)(PORT=2484)))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=mysid)))

Both Data Encryption and Integrity and SSL Communication Are Configured

If both data encryption and integrity and SSL communication are configured, then specify a value for the JDBC URL parameter in the following manner:

Enter a comma-separated combination of the values for the JDBC URL parameter described in Only SSL Communication Is Configured. For example:

jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCPS)(HOST=myhost)(PORT=2484)))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=mysid)))

Localizing Field Labels in UI Forms

You can localize UI form field labels by using the resource bundle corresponding to the language you want to use. The resource bundles are available in the connector installation media.

To localize field label that you add in UI forms:

Note:

Perform the procedure described in this section only if you are using the HRMS Target connector and want to localize field labels. If you are using HRMS Trusted connector, then perform the procedure described in Localizing Display Labels of UDFs of Administering Oracle Identity Governance guide.

  1. Log in to Oracle Enterprise Manager.

  2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.

  3. In the right pane, from the Application Deployment list, select MDS Configuration.

  4. On the MDS Configuration page, click Export and save the archive to the local computer.

  5. Extract the contents of the archive, and open the following files in a text editor:

    • For Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle_en.xlf

    • For releases prior to Oracle Identity Manager 11g Release 2 PS2 (11.1.2.2.0):

      SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle.xlf

  6. Edit the BizEditorBundle.xlf file in the following manner:

    1. Search for the following text:

      <file source-language="en"  
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      
    2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      
    3. Search for the application instance code. This procedure shows a sample edit for Oracle E-Business Suite application instance. The original code is:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_EBS_HRMS_EMPNO__c_description']}">
      <source>Employee Number</source>
      <target/>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.EBSHRMSForm1.entity.EBSHRMSForm1EO.UD_EBS_HRMS_EMPNO__c_LABEL">
      <source>Employee Number</source>
      <target/>
      
    4. Open the resource file (for example, EBS-HRMS.properties) from the connector package, and get the value of the attribute from the file, for example, global.udf.UD_EBS_HRMS_EMPNO=\u4567d.

    5. Replace the original code shown in Step 6.c with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_EBS_HRMS_EMPNO__c_description']}">
      <source>Employee Number</source>
      <target>\u5F93\u696D\u54E1\u756A\u53F7</target>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.EBSHRMSForm1.entity.EBSHRMSForm1EO.UD_EBS_HRMS_EMPNO__c_LABEL">
      <source>Employee Number</source>
      <target>\u5F93\u696D\u54E1\u756A\u53F7</target>
      </trans-unit>
      
    6. Repeat Steps 6.a through 6.d for all attributes of the process form.

    7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing.

      Sample file name: BizEditorBundle_ja.xlf.

  7. Repackage the ZIP file and import it into MDS.

    See Also:

    Deploying and Undeploying Customizations in Developing and Customizing Applications for Oracle Identity Governance, for more information about exporting and importing metadata files

  8. Log out of and log in to Oracle Identity Manager.

Removing the Default Validation Check for Provisioning Operations

During a provisioning operation for child data, the connector API validates data against a combination of the Grade Id, Department Id, and Organization Id fields. If this valid combination is not found, an error is encountered and the provisioning operation fails. If you do not want to use this strict validation, then you must remove the default validation check to perform the provisioning operation successfully. To do so:

  1. Open any SQL client. For example, SQL Developer.
  2. Open the body of the OIM_EMPLOYEE_WRAPPER.pck wrapper package.
  3. Comment out the following lines of code by prefixing them with a double hyphen (--):
           IF create_person_assignment_api.grade_id IS NOT NULL THEN
              select count(*) into validcount from PER_VALID_GRADES where business_group_id =create_person_assignment_api.organization_id 
              and job_id=create_person_assignment_api.job_id and grade_id=create_person_assignment_api.grade_id;
              if validcount = 0 then
                raise_application_error (-20001, 'Invalid combination of organization, job and grade');
              end if;
          ELSE
              select count(*) into valid_job_count from PER_JOBS where job_id = create_person_assignment_api.job_id;
              if valid_job_count = 0 then
                 raise_application_error (-20001, 'Invalid combination of organization, job and grade');
                end if;
          END IF;
    
  4. Re-compile the wrapper package.

As an alternative to this procedure, you can edit the scripts\OIM_EMPLOYEE_WRAPPER.pck file by commenting out the lines of code and then running either the Run_HRMS_DBScripts.sh or Run_HRMS_DBScripts.bat file. See Preinstallation for more information about running the script.

Upgrading the Connector

You can upgrade the connector from an earlier release to the current release 11.1.1.5.0.

If you have already deployed an earlier release of this connector (EBS Employee Reconciliation), then upgrade the connector to the current release 11.1.1.5.0. The following sections discuss the procedure to upgrade the connector:

Note:

  • Upgrade to the current release (11.1.1.5.0) of the HRMS Trusted connector from EBS Employee Reconciliation connector release 9.1.0.7.x is supported.

  • There is no upgrade to the current release of the connector for HRMS Target. This is because this is the first time the HRMS Target is being released.

  • Before you perform the upgrade procedure, it is strongly recommended that you create a backup of the Oracle Identity Manager database. Refer to the database documentation for information about creating a backup.

  • As a best practice, first perform the upgrade procedure in a test environment.

Preupgrade Steps

Perform the following preupgrade steps:

  1. Perform a reconciliation run to fetch all latest updates to Oracle Identity Manager.
  2. Define the source connector (an earlier release of the connector that must be upgraded) in Oracle Identity Manager. You define the source connector to update the Deployment Manager XML file with all customization changes made to the connector. See Managing Connector Lifecycle in Oracle Fusion Middleware Administering Oracle Identity Manager for more information.
  3. If required, create the connector XML file for a clone of the source connector.
  4. Disable all the scheduled jobs by stopping the scheduler service.

Upgrade Steps

Depending on the environment in which you are upgrading the connector, perform one of the following steps:

  • Staging Environment

    Perform the upgrade procedure by using the wizard mode.

  • Production Environment

    Perform the upgrade procedure by using the silent mode.

See Managing Connector Lifecycle in Oracle Fusion Middleware Administering Oracle Identity Governance for detailed information about the wizard and silent modes.

Postupgrade Steps

Perform the following procedure:

  1. Download the latest version of this connector from Oracle Technology Network and extract its contents to any directory on the computer hosting Oracle Identity Manager.
  2. Run the Upload JARs utility to post the latest version of the connector bundle JAR file (org.identityconnectors.ebs-1.0.1115.jar) from the /bundle directory of the installation media to the Oracle Identity Manager database.

    For Microsoft Windows:

    OIM_HOME/server/bin/UploadJars.bat

    For UNIX:

    OIM_HOME/server/bin/UploadJars.sh

    When you run the utility, you are prompted to enter the login credentials of the Oracle Identity Manager administrator, URL of the Oracle Identity Manager host computer, context factory value, type of JAR file being uploaded (specify the JAR type as ICFBundle, option 4), and the location from which the JAR file is to be uploaded.

  3. Run either the Run_HRMS_DBScripts.sh or Run_HRMS_DBScripts.bat file. See Preinstallation for more information about running the script.

    Note:

    You can either create new target admin user for connector operations (or) first drop target admin user of 9.1.0.7.x connector and then create the same new target admin user for connector operations.

  4. Configure the upgraded IT resource of the source connector. See Configuring the IT Resource for the Target System for information about configuring the IT resource.
  5. Restart Oracle Identity Manager. Alternatively, you can purge the cache for the changes to reflect in Oracle Identity Manager. See Purging Cache in Oracle Fusion Middleware Administering Oracle Identity Governance for more information about the PurgeCache utility.

After upgrading the connector, you can perform either full reconciliation or incremental reconciliation. This ensures that records created or modified since the last reconciliation run (the one that you performed in Preupgrade Steps) are fetched into Oracle Identity Manager. From the next reconciliation run onward, the reconciliation engine automatically enters a value for the Latest Token attribute.

Before you perform lookup field synchronization, ensure to remove all preupgrade entries from the lookup definitions Oracle Identity Manager. After upgrade these values must be synchronized with the lookup fields in the target system.

See the following sections for more information about performing full or incremental reconciliation:

Postcloning Steps

You can clone this connector by setting new names for some of the objects that comprise the connector. The outcome of the process is a new connector XML file. Most of the connector objects, such as Resource Object, Process Definition, Process Form, IT Resource Type Definition, IT Resource Instances, Lookup Definitions, Reconciliation Rules and so on in the new connector XML file have new names.

Note:

See Managing Connector Lifecycle in Administering Oracle Identity Manager for detailed information about cloning connectors and the steps mentioned in this section.

After a copy of the connector is created by setting new names for connector objects, some objects might contain the details of the old connector objects. Therefore, depending on the connector that you are cloning, you must modify the following Oracle Identity Manager objects to replace the base connector artifacts or attribute references with the corresponding cloned artifacts or attributes:

  • For the HRMS Trusted connector

    • IT Resource

      The cloned connector has its own set of IT resources. You must configure both the cloned connector IT resources and ensure you use the configuration lookup definition of the cloned connector.

    • Scheduled Job

      The values of the Resource Object Name and IT Resource scheduled job attributes in the cloned connector refer to the values of the base connector. Therefore, these values (values of the Resource Object Name and IT resource scheduled job attributes that refer to the base connector) must be replaced with the new cloned connector artifacts.

  • For the HRMS Target connector

    • IT Resource

      The cloned connector has its own set of IT resources. You must configure both the cloned connector IT resources and ensure you use the configuration lookup definition of the cloned connector.

    • Scheduled Job

      The values of the Resource Object Name and IT Resource scheduled job attributes in the cloned connector refer to the values of the base connector. Therefore, these values (values of the Resource Object Name and IT resource scheduled job attributes that refer to the base connector) must be replaced with the new cloned connector artifacts.

    • Lookup Definition

      The cloned lookup definition (for example, Lookup.EBSHRMSClone.UM.ProvAttrMap) corresponding to the Lookup.EBSHRMS.UM.ProvAttrMap lookup definition has Code Key entries related to child form fields that still map to the old child form fields. You must change the values of these Code Key entries so that they map to the cloned child form fields. Similarly, you must change the values of the Code Key entries in the Lookup.EBSHRMS.UM.ReconAttrMap lookup definition to map to the clones child form fields.

      For example, consider UD_EBS_ADR1 and UD_EBS_ASG1 to be the cloned child forms of the UD_EBS_ADRS and UD_EBS_ASGN child forms respectively. After cloning, the Lookup.Oracle EBSHRMSClone.UM.ProvAttrMap lookup definition contains Code Key entries that correspond to the fields of the old child form UD_EBS_ADRS and UD_EBS_ASGN respectively. To ensure that the Code Key entries point to the fields of the cloned child form (UD_EBS_ADR1 and UD_EBS_ASG1), specify the following values in the corresponding Code Key columns:

      • UD_EBS_ADR1~Effective Date[DATE]

      • UD_EBS_ADR1~Address Id

      • UD_EBS_ADR1~Address1

      • UD_EBS_ADR1~Address2

      • UD_EBS_ADR1~Address3

      • UD_EBS_ADR1~Country

      • UD_EBS_ADR1~Start Date[DATE]

      • UD_EBS_ADR1~End Date[DATE]

      • UD_EBS_ADR1~Postal Code

      • UD_EBS_ADR1~Primary Flag

      • UD_EBS_ADR1~Region

      • UD_EBS_ADR1~Region2

      • UD_EBS_ADR1~Region3

      • UD_EBS_ADR1~Style

      • UD_EBS_ADR1~City

      • UD_EBS_ASG1~Effective Date[DATE]

      • UD_EBS_ASG1~Assignment Id

      • UD_EBS_ASG1~Change Reason

      • UD_EBS_ASG1~Grade Id[LOOKUP]

      • UD_EBS_ASG1~Job Id[LOOKUP]

      • UD_EBS_ASG1~Organization Id[LOOKUP]

      • UD_EBS_ASG1~Supervisor Id

    • Process Tasks

      You must change the literal value of the childTableName adapter variable from UD_EBS_ADRS and UD_EBS_ASGN to the cloned form names UD_EBS_ADR1 and UD_EBS_ASG1, respectively in the following process tasks:

      • Add Employee Address Process Task

      • Add Employee Assignments Process Task

      • Update Employee Address Process Task

      • Update Employee Assignments Process Task

      • Remove Employee Address Process Task

      • Remove Employee Assignments Process Task

      You must change the literal value of the parent form from UD_EBS_HRMS to the cloned form name UD_EBS_HRM1 in the UD_EBS_HRMS Updated in the Bulk adapter process task.

    • Localization Properties

      You must update the resource bundle of a user locale with new names of the process form attributes for proper translations after cloning the connector. You can modify the properties file of your locale in the resources directory of the connector bundle.

      For example, the process form (UD_EBS_HRMS) attributes are referenced in the Japanese properties file, EBS-HRMS_ja.properties, as global.udf.UD_EBS_HRMS_FIRST_NAME. During cloning, if you change the process form name from UD_EBS_HRMSCLONED to global.udf.UD_EBS_HRMSCLONED_FIRST_NAME, then you must add the process form attributes to global.udf.UD_EBS_HRMS_FIRST_NAME.

    • Replicate changes made to the form designer to a new UI form. To do so:

      1. Log in to Oracle Identity System Administration.
      2. Create and active a sandbox. See Creating a Sandbox in Developing and Customizing Applications for Oracle Identity Manager for more information.
      3. Create a new UI form to view the upgraded fields. See Managing Forms in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about creating a UI form.
      4. Associate the newly created UI form with the application instance of your target system. To do so, open the existing application instance for your resource, from the Form field, select the form (created in Step 3), and then save the application instance.
      5. Publish the sandbox. See Publishing a Sandbox in Developing and Customizing Applications for Oracle Identity Managerfor more information.