Lookup definitions used during connector operations can be categorized as follows:
This section discusses the lookup definitions that are created in Oracle Identity Manager after you generate and deploy the connector.
These lookup definitions are either prepopulated with values or values must be manually entered in them after the connector is deployed. In addition, you can customize entries in the lookup definitions to suit your requirements. This section discusses the following lookup definitions:
Note:
RESOURCE has been used as a place holder text for IT resource name. Therefore, replace all instances of RESOURCE in this guide with the value that you specified for the itResourceName entry in the ScriptConfiguration.groovy file. See Understanding Entries in the Predefined Sections of the Groovy File for more information about entries in the ScriptConfiguration.groovy file.
The Lookup.RESOURCE.Configuration lookup definition holds connector configuration entries that are used during reconciliation (both trusted source and target resource) and provisioning operations.
Table 4-1 lists the entries in this lookup definition.
Table 4-1 Entries in the Lookup.RESOURCE.Configuration Lookup Definition
| Code Key | Decode | Description |
|---|---|---|
|
Bundle Name |
org.identityconnectors.genericscript |
This entry holds the name of the connector bundle class. Do not modify this entry. |
|
Bundle Version |
1.0.11150 |
This entry holds the version of the connector bundle class. Do not modify this entry. |
|
Connector Name |
org.identityconnectors.genericscript.GenericScriptConnector |
This entry holds the name of the connector class. Do not modify this entry. |
|
schema file |
file:///URL |
This entry holds the file URL of the schema file that you want to use. |
|
resource property file |
file:///URL |
This entry holds file URL of the properties file containing connection-specific information related to your target system. |
|
User Configuration Lookup |
Lookup.RESOURCE.UM.Configuration |
This entry holds the name of the lookup definition that contains configuration information specific to the user object type. See Lookup.RESOURCE.UM.Configuration for more information about this lookup definition. |
|
connectionScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to connect to the target system. |
|
checkAliveScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to check whether the connector's physical connection to the target system is alive. This script must do only the minimum that is necessary to check that the connection is still alive. |
|
disposeScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to dispose any configuration objects. |
|
createScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to create objects in your target system. |
|
updateScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to update objects in your target system. |
|
deleteScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to delete objects in your target system. |
|
executeQueryScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to fetch objects from your target system. |
|
syncScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to fetch incremental changes for objects from your target system. |
|
lookupScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to fetch values of lookup attributes from your target system. |
|
addMultiValuedAttributeScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to add multivalued child data for objects in your target system. |
|
removeMultiValuedAttributeScript[LOADFROMURL] |
file:///URL |
This entry holds the file URL of the script containing the implementation to remove multivalued child data for objects in your target system. |
The Lookup.RESOURCE.UM.Configuration lookup definition contains entries specific to the user object type. This lookup definition is preconfigured.
Table 4-2 lists the default entries in this lookup definition when you have configured your target system as a target resource.
Table 4-2 Entries in the Lookup.RESOURCE.UM.Configuration Lookup Definition for a Target Resource Configuration
| Code Key | Decode |
|---|---|
|
Provisioning Attribute Map |
Lookup.RESOURCE.UM.ProvAttrMap |
|
Recon Attribute Map |
Lookup.RESOURCE.UM.ReconAttrMap |
Table 4-3 lists the default entries in this lookup definition when you have configured your target system as a trusted source.
Table 4-3 Entries in the Lookup.RESOURCE.UM.Configuration Lookup Definition for a Trusted Source Configuration
| Code Key | Decode |
|---|---|
|
Recon Attribute Map |
Lookup.RESOURCE.UM.ReconAttrMap |
|
Recon Attribute Defaults |
Lookup.RESOURCE.UM.ReconAttrMap.Defaults |
The Lookup.RESOURCE.UM.ReconAttrMap lookup definition holds mappings between resource object fields and target system attributes. Depending on whether you have configured your connector for the target resource mode or trusted source mode, this lookup definition is used during target resource or trusted source user reconciliation runs, respectively.
If you have configured the connector for target resource mode:
The following is the format of the Code Key and Decode values in this lookup definition:
For single-valued attributes
Code Key: Reconciliation attribute of the resource object against which target resource user reconciliation runs must be performed
Decode: Corresponding target system attribute name
For multivalued attributes
Code Key: RO_ATTR_NAME~ATTR_NAME[LOOKUP]
In this format:
RO_ATTR_NAME specifies the reconciliation field for the child table.
ATTR_NAME is the name of the multivalued attribute.
[LOOKUP] is a keyword that is appended to the code key value if the child data is picked from a lookup or declared as an entitlement.
Decode: Combination of the following elements separated by the tilde (~) character:
EMBED_OBJ_NAME~RELATION_TABLE_NAME~ATTR_NAME
In this format:
EMBED_OBJ_NAME is the name of the object (for example, an account's address) on the target system that is embedded in another object.
RELATION_TABLE_NAME is the name of child table in the target system.
ATTR_NAME is the name of the column in the child table corresponding to the multivalued attribute in the Code Key column.
If you have configured your connector for trusted source mode:
The following is the format of the Code Key and Decode values in this lookup definition:
Code Key: Reconciliation attribute of the resource object against which trusted source user reconciliation runs must be performed
Decode: Corresponding target system attribute name
The entries in this lookup definition depend on the data available in the target system. The entries of this lookup definition are populated based on the values specified for the alias entry in the ScriptConfiguration.groovy file. See Understanding Entries in the Predefined Sections of the Groovy File for more information about the alias entry.
The Lookup.RESOURCE.UM.ProvAttrMap lookup definition holds mappings between process form fields and target system attribute names. This lookup definition is used for performing provisioning operations.
The following is the format of the Code Key and Decode values in this lookup definition:
Code Key: Name of the label on the process form
Decode: Corresponding target system attribute name
For entries corresponding to child form fields, the following is the format of the Code Key and Decode values:
Code Key: CHILD_FORM_NAME~FIELD_NAME
In this format:
CHILD_FORM_ NAME specifies the name of the child form.
FIELD_NAME specifies the name of the label on the child form.
Decode: Combination of the following elements separated by the tilde (~) character:
EMBED_OBJ_NAME~RELATION_TABLE_NAME~COL_NAME
In this format:
EMBED_OBJ_NAME is the name of the object (for example, an account's address) on the target system that is embedded in another object.
COL_NAME is the name of the column in the child table corresponding to the child form specified in the Code Key column.
RELATION_TABLE_NAME is the name of child table in the target system.
The entries in this lookup definition depend on the data available in the target system. The values in the lookup definition are populated based on the value specified for the alias entry in the ScriptConfiguration.groovy file. See Understanding Entries in the Predefined Sections of the Groovy File for more information about the alias entry.
The Lookup.RESOURCE.UM.ReconAttrMap.Defaults lookup definition holds default values of the mandatory fields on the OIM User form that are not mapped with the target system attributes. This lookup definition is created only if you have configured the connector for the trusted source mode.
This lookup definition is used when there is a mandatory field on the OIM User form, but no corresponding attribute in the target system from which values can be fetched during trusted source reconciliation runs. In addition, this lookup definition is used if the mandatory field on the OIM User form has a corresponding column that is empty or contains null values.
The following is the format of the Code Key and Decode values in this lookup definition:
Code Key: Name of the user field on the Administrative and User Console.
Decode: Corresponding default value to be displayed.
For example, the Role field is a mandatory field on the OIM User form. Suppose the target system contains no attribute that stores information about the role for a user account. During reconciliation, no value for the Role field is fetched from the target system. However, as the Role field cannot be left empty, you must specify a value for this field. Therefore, the Decode value of the Role Code Key has been set to Full-Time. This implies that the value of the Role field on the OIM User form displays Full-Time for all user accounts reconciled from the target system.
Table 4-4 lists the default entries in this lookup definition.
Table 4-4 Entries in the Lookup.RESOURCE.UM.ReconAttrMap.Defaults Lookup Definition
| Code Key | Decode |
|---|---|
|
Role |
Full-Time |
|
Organization Name |
Xellerate Users |
|
Xellerate Type |
End-User |
During a provisioning operation, you use a lookup field on the process form to specify a single value from a set of values.
For example, you may want to select a role from a lookup field (displaying a set of roles) to specify the role being assigned to the user.
While configuring the ScriptConfiguration.groovy file, if you specified a value for the lookupAttributeList entry, then the connector creates a lookup definition for every target system attribute specified in this entry and then associates it with the corresponding lookup field on the OIM User process form. The connector creates a lookup definition named in the following format:
Lookup.${IT_RES_NAME}.${FIELD_NAME}
In this format, the connector replaces:
IT_RES_NAME with the value of the itResourceDefName entry in the ScriptConfiguration.groovy file.
FIELD_NAME with the name of the field for which the lookup field is created.
Lookup field synchronization involves copying additions or changes made to the target system attributes (listed in the lookupAttributeList entry) into corresponding lookup definitions (used as an input source for lookup fields) in Oracle Identity Manager. This is achieved by running scheduled jobs for lookup field synchronization.
The following example illustrates the list of lookup definitions created for a given lookupAttributeList value:
Suppose the value of the itResourceDefName entry is ACME. If the value of the lookupAttributeList entry is ['Roles', 'Groups'], then the connector creates the following lookup definitions:
Lookup.ACME.Roles
Lookup.ACME.Groups
After you perform lookup field synchronization, data in the lookup definition is stored in the following format:
Code Key value: IT_RESOURCE_KEY~LOOKUP_FIELD_ID
In this format:
IT_RESOURCE_KEY is the numeric code assigned to each IT resource in Oracle Identity Manager.
LOOKUP_FIELD_ID is the target system code assigned to each lookup field entry. This value is populated based on the target system attribute name specified in the Code Key attribute of the scheduled job for lookup field synchronization.
Sample value: 1~SA
Decode value: IT_RESOURCE_NAME~LOOKUP_FIELD_ID
In this format:
IT_RESOURCE_NAME is the name of the IT resource in Oracle Identity Manager.
LOOKUP_FIELD_ID is the target system code assigned to each lookup field entry. This value is populated based on the target system attribute name specified in the Decode attribute of the scheduled job for lookup field synchronization.
Sample value: GenScript~SYS_ADMIN
See Also:
Scheduled Job for Lookup Field Synchronization for information about the attributes of the scheduled job for lookup field synchronization
Reconciliation involves duplicating in Oracle Identity Manager the creation of and modifications to user accounts on the target system.
This section discusses the following topics related to configuring reconciliation:
Reconciliation rules are automatically created when you generate the Generic Scripting connector. The following is the format of the rule element:
User Login Equals NameAttribute
In this rule element:
User Login is the User ID field on the OIM User form.
NameAttribute is the value of the account qualifier in the schema.properties file that you created in Defining the Schema.
For example, if the value of the NameAttribute account qualifier is __NAME__, then the rule element is as follows:
User Login Equals__NAME__
Full reconciliation involves reconciling all existing user records from the target system into Oracle Identity Manager.
In incremental reconciliation, only records created or modified after the latest date or timestamp the last reconciliation was run are considered for reconciliation.
After you deploy the connector, you must first perform full reconciliation.
You can perform a full reconciliation run in one of the following manners:
Remove or delete any value currently assigned to the Filter attribute and run the scheduled job for user data reconciliation. See Scheduled Jobs for Reconciliation of User Records for more information about the user reconciliation scheduled job and Filter attribute.
Remove or delete any value currently assigned to the Sync Token attribute and run the scheduled job for incremental reconciliation. See Scheduled Jobs for Incremental Reconciliation for more information about the scheduled job for incremental reconciliation and Sync Token attribute.
To perform incremental reconciliation, configure and run the scheduled job for incremental reconciliation. The scheduled job for incremental reconciliation is generated only if you specify a value for the changeLogColumn property in the IT resource or ScriptConfiguration.groovy file. The first time you run the scheduled job for incremental reconciliation, a full reconciliation is performed. Subsequently, incremental reconciliation is performed.
At any given point in time, you can switch from incremental reconciliation to full reconciliation. All you need to do is perform a full reconciliation run.
By default, all target system records that are added or modified after the last reconciliation run are reconciled during the current reconciliation run.
Note:
This connector does not support complex filters.
You can customize this process by specifying the subset of added or modified target system records that must be reconciled. You do this by creating filters for the reconciliation module.
You can perform limited reconciliation by creating filters for the reconciliation module. This connector provides a Filter attribute (a scheduled task attribute) that allows you to use any of the attributes of the target system to filter target system records.
When you specify a value for the Filter attribute, only the target system records that match the filter criterion are reconciled into Oracle Identity Manager. If you do not specify a value for the Filter attribute, then all the records in the target system are reconciled into Oracle Identity Manager.
You specify a value for the Filter attribute while configuring the user reconciliation scheduled job.
For detailed information about Filters, see ICF Filter Syntax in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.
As discussed earlier, lookup field synchronization involves obtaining the most current values from specific attributes in the target system to the lookup definitions (used as an input source for lookup fields) in Oracle Identity Manager.
You can perform lookup field synchronization by configuring and running the scheduled jobs for lookup field synchronization.
Scheduled jobs for lookup field synchronization are created only if you have specified a value for the lookupAttributeList entry in the ScriptConfiguration.groovy file. The names of these scheduled jobs are in the following format:
IT_RES_NAME Target FIELD_NAME Lookup Reconciliation
For every attribute specified in the lookupAttributeList entry, a corresponding scheduled job for reconciling lookup values from the target system is created. This is illustrated by the following example:
Suppose the value of the itResourceDefName entry is ACME. If the value of the lookupAttributeList entry is ['Roles', 'Groups'], then the connector creates the following scheduled jobs:
ACME Target Roles Lookup Reconciliation
ACME Target Groups Lookup Reconciliation
See Also:
Scheduled Job for Lookup Field Synchronization for information about the attributes of the scheduled job for lookup field synchronization
When you run the Connector Installer, scheduled jobs are automatically created in Oracle Identity Manager.
This section discusses the following topics related to scheduled jobs:
After you generate the connector, scheduled jobs for lookup field synchronization are created only if you have specified a value for the lookupAttributeList entry in the ScriptConfiguration.groovy file.
For every attribute specified in the lookupAttributeList entry, a corresponding scheduled job for reconciling lookup values from the target system is created.
Table 4-5 describes the attributes of the scheduled job for lookup field synchronization. Configuring Scheduled Jobs describes the procedure to configure scheduled jobs.
Note:
Attribute values are predefined in the connector XML file that you import. Specify values only for those attributes that you want to change.
Values (either default or user-defined) must be assigned to all the attributes. If even a single attribute value were left empty, then reconciliation would not be performed.
Table 4-5 Attributes of the Scheduled Job for Lookup Field Synchronization
| Attribute | Description |
|---|---|
|
Code Key Attribute |
Enter the name of the attribute that is used to populate the Code Key column of the lookup definition (specified as the value of the Lookup Name attribute). |
|
Decode Attribute |
Enter the name of the attribute that is used to populate the Decode column of the lookup definition (specified as the value of the Lookup Name attribute). |
|
IT Resource Name |
Name of the IT resource for the target system installation from which you want to reconcile records. The default value of this attribute is the same as the value of the ITResourceDefName entry in the ScriptConfiguration.groovy file. |
|
Lookup Name |
Name of the lookup definition in Oracle Identity Manager that must be populated with values fetched from the target system. The value for this attribute is populated automatically if you have specified a value for the lookupAttributeList entry while configuring the ScriptConfiguration.groovy file. The value of this attribute is in the following format:
For example, if you have specified Roles as the value of the lookupAttributeList entry, then the value of this attribute is |
|
Object Type |
Enter the type of object you want to reconcile. Default value: Note: For lookup field synchronization, the object type must be any object other than "User." |
After you generate the connector, the scheduled task for user data reconciliation is automatically created in Oracle Identity Manager.
A scheduled job, which is an instance of this scheduled task is used to reconcile user data from the target system. The following scheduled jobs are used for user data reconciliation:
RESOURCE Target Resource User Reconciliation
This scheduled job is used to reconcile user data in the target resource (account management) mode of the connector.
RESOURCE Trusted Resource User Reconciliation
This scheduled job is used to reconcile user data in the trusted source (identity management) mode of the connector.
Table 4-6 describes the attributes of both scheduled jobs.
Table 4-6 Attributes of the User Reconciliation Scheduled Jobs
| Attribute | Description |
|---|---|
|
Filter |
Enter the search filter for fetching records from the target system during a reconciliation run. See Limited Reconciliation for more information. |
|
Incremental Recon Attribute |
Enter the name of the target system attribute that holds the time stamp at which the record was last modified. The value in this attribute is used during incremental reconciliation to determine the newest or latest record reconciled from the target system. Sample value: |
|
ITResource Name |
Name of the IT resource for the target system installation from which you want to reconcile user records. Sample value: |
|
Latest Token |
This attribute holds the value of the attribute that is specified as the value of the Incremental Recon Attribute attribute. The Latest Token attribute is used for internal purposes. By default, this value is empty. Note: Do not enter a value for this attribute. The reconciliation engine automatically enters a value in this attribute. Sample value: |
|
Object Type |
Type of object you want to reconcile. Default value: Note: User is the only object that is supported. Therefore, do not change the value of this attribute. |
|
Resource Object Name |
Name of the resource object that is used for reconciliation. Sample value: |
|
Scheduled Task Name |
Name of the scheduled task that is used for reconciliation. The default value of this attribute in the RESOURCE Target Resource User Reconciliation scheduled job is The default value of this attribute in the RESOURCE Trusted User Reconciliation scheduled job is |
After you generate the connector, the scheduled task for reconciling data about deleted users records is automatically created in Oracle Identity Manager.
A scheduled job, which is an instance of this scheduled task is used to reconcile data about deleted users in the target system. The following scheduled jobs are used for reconciliation of deleted user records data:
RESOURCE Target Resource User Delete Reconciliation
This scheduled job is used to reconcile data about deleted user records in the target resource (account management) mode of the connector. During a reconciliation run, for each deleted user record on the target system, the target system resource is revoked for the corresponding OIM User.
RESOURCE Trusted User Delete Reconciliation
This scheduled job is used to reconcile data about deleted user records in the trusted source (identity management) mode of the connector. During a reconciliation run, for each deleted target system user record, the corresponding OIM User is deleted.
Table 4-7 describes the attributes of both scheduled jobs.
Table 4-7 Attributes of the Delete User Reconciliation Scheduled Jobs
| Attribute | Description |
|---|---|
|
IT Resource Name |
Name of the IT resource for the target system installation from which you want to reconcile information about deleted user records. Sample value: |
|
Object Type |
Type of object you want to reconcile. Default value: Note: User is the only object that is supported. Therefore, do not change the value of this attribute. |
|
Resource Object Name |
Name of the resource object that is used for reconciliation. Sample value: |
After you generate the connector, the scheduled task for performing incremental reconciliation is automatically created in Oracle Identity Manager.
The following scheduled jobs are used for incremental reconciliation:
RESOURCE Target Incremental Resource User Reconciliation
This scheduled job is used to perform incremental reconciliation in the target resource (account management) mode of the connector.
RESOURCE Trusted Incremental Resource User Reconciliation
This scheduled job is used to perform incremental reconciliation in the trusted source (identity management) mode of the connector.
Table 4-6 describes the attributes of both scheduled jobs.
Table 4-8 Attributes of the Scheduled Jobs for Incremental Reconciliation
| Attribute | Description |
|---|---|
|
ITResource Name |
Name of the IT resource for the target system installation from which you want to reconcile user records. Sample value: |
|
Object Type |
Type of object you want to reconcile. Default value: Note: User is the only object that is supported. Therefore, do not change the value of the attribute. |
|
Resource Object Name |
Name of the resource object that is used for reconciliation. Sample value: |
|
Scheduled Task Name |
Name of the scheduled task that is used for reconciliation. The default value of this attribute in the RESOURCE Target Incremental Resource User Reconciliation scheduled job is The default value of this attribute in the RESOURCE Trusted Incremental Resource User Reconciliation scheduled job is |
|
Sync Token |
This attribute must be left blank when you run incremental reconciliation for the first time. This ensures that data about all records from the target system are fetched into Oracle Identity Manager. After the first reconciliation run, the connector automatically enters a value for this attribute in an XML serialized format. From the next reconciliation run onward, only data about records that are modified since the last reconciliation run ended are fetched into Oracle Identity Manager." Sample value: Note: - Do not enter a value for this attribute. The reconciliation engine automatically enters a value in this attribute. - This attribute stores values in an XML serialized format. |
This section describes the procedure to configure scheduled jobs. You can apply this procedure to configure the scheduled jobs for lookup field synchronization and reconciliation.
To configure a scheduled job:
Log in to Oracle Identity System Administration.
In the left pane, under System Management, click Scheduler.
Search for and open the scheduled task as follows:
On the left pane, in the Search field, enter the name of the scheduled job as the search criterion. Alternatively, you can click Advanced Search and specify the search criterion.
In the search results table on the left pane, click the scheduled job in the Job Name column.
On the Job Details tab, you can modify the following parameters:
Retries: Enter an integer value in this field. This number represents the number of times the scheduler tries to start the job before assigning the Stopped status to the job.
Schedule Type: Depending on the frequency at which you want the job to run, select the appropriate schedule type.
Note:
See Creating Jobs in Oracle Fusion Middleware Administering Oracle Identity Manager for detailed information about schedule types.
In addition to modifying the job details, you can enable or disable a job.
On the Job Details tab, in the Parameters region, specify values for the attributes of the scheduled task.
Note:
Attribute values are predefined in the connector XML file that you import. Specify values only for those attributes that you want to change.
Values (either default or user-defined) must be assigned to all the attributes. If even a single attribute value is left empty, then reconciliation is not performed.
Attributes of the scheduled task are discussed in Scheduled Jobs.
Click Apply to save the changes.
Note:
The Stop Execution option is available in the Administrative and User Console. You can use the Scheduler Status page to either start, stop, or reinitialize the scheduler.
To perform provisioning operations in Oracle Identity Manager:
Log in to Oracle Identity Administrative and User console.
Create a user. See Creating a User in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Manager for more information about creating a user.
On the Account tab, click Request Accounts.
In the Catalog page, search for and add to cart the application instance created for the IT resource (in Associating the Form with the Application Instance), and then click Checkout.
Specify values for fields in the application form. In addition to specifying values for the parent form, if you want to add child values, then you can specify values for fields on the child form.
Note:
Ensure to select proper values for lookup type fields as there are a few dependent fields. Selecting a wrong value for such fields may result in provisioning failure.
Click Ready to Submit.
Click Submit.
If you want to provision entitlements, then:
On the Entitlements tab, click Request Entitlements.
In the Catalog page, search for and add to cart the entitlement, and then click Checkout.
Click Submit.
You can uninstall the connector if you wish.
If you want to uninstall the connector for any reason, see Uninstalling Connectors in Oracle Fusion Middleware Administering Oracle Identity Manager.