2 Deploying the Box Connector

The procedure to deploy the connector is divided across three stages namely preinstallation, installation, and postinstallation.

The following topics provide details on these stages:

• Preinstallation

• Installation

• Postinstallation

2.1 Preinstallation

Preinstallation for the Box connector involves performing a series of tasks on the target system.

Preinstallation involves the following tasks:

1. Create a Box service account on the target system to manage users on Box through Oracle Identity Manager.
   Ensure that the account is created with the Co-Admin role and Manage Users and Manage Groups administrative privileges.
2. Register the client application of the connector to provide a secure sign-in and authorization for your services.
3. On successful registration of the client application, configure your newly registered application to obtain the Client ID and Client Secret values.
   These values are required to generate access and refresh tokens for your application.
4. Generate access and refresh tokens using the Box service account created in Step 1 and the Client ID and Client Secret values obtained in Step 3.
   Access and refresh tokens must be generated manually for the first time. These tokens are used while configuring the IT Resource in IT Resource Parameters. Access and refresh tokens expire in 60 minutes and 60 days respectively. To avoid this, the Box Update Access Token scheduled job runs a scheduler to renew these values in a periodic manner. This scheduled job is discussed later.

   Note:

   In case the Box Update Access Token scheduled job fails to run as expected and both access and refresh tokens expire, you must perform this procedure to generate a new pair of access and refresh tokens. Once these values are obtained, you must configure the IT Resource in IT Resource Parameters

The detailed instructions for performing these preinstallation tasks are available in the Box product documentation. For more information, visit the Box website at https://docs.box.com/docs.

2.2 Installation

You must install the connector in Oracle Identity Manager. If necessary, you can also deploy the connector in a Connector Server.

The following topics provide details on installing the Box connector:

• Understanding Installation of the Box Connector

• Running the Connector Installer

• Configuring the IT Resource for the Target System

2.2.1 Understanding Installation of the Box Connector

You can run the connector code either locally in Oracle Identity Manager or remotely in a Connector Server.

Depending on where you want to run the connector code (bundle), the connector provides the following installation options:

• Run the connector code locally in Oracle Identity Manager. In this scenario, you deploy the connector in Oracle Identity Manager. Deploying the connector in Oracle Identity Manager involves performing the procedures described in Running the Connector Installer and Configuring the IT Resource for the Target System.

• Run the connector code remotely in a Connector Server. In this scenario, you deploy the connector in Oracle Identity Manager, and then, deploy the connector bundle in a Connector Server. See Using an Identity Connector Server in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for information about installing, configuring, and running the Connector Server, and then installing the connector in a Connector Server.

2.2.2 Running the Connector Installer

When you run the Connector Installer, it automatically copies the connector files to directories in Oracle Identity Manager, imports connector XML files, and compiles adapters used for provisioning.

To run the Connector Installer, perform the following procedure:

1. Copy the contents of the connector installation media into the following directory:

   OIM_HOME/server/ConnectorDefaultDirectory

2. Log in to Oracle Identity System Administration.
3. In the left pane, under Provisioning Configuration, click Manage Connector.
4. In the Manage Connector page, click Install.
5. From the Connector List list, select Box Connector RELEASE_NUMBER. This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory: OIM_HOME/server/ConnectorDefaultDirectory. If you have copied the installation files into a different directory, then:

   1. In the Alternative Directory field, enter the full path and name of that directory.

   2. To repopulate the list of connectors in the Connector List list, click Refresh.

   3. From the Connector List list, select Box Connector RELEASE_NUMBER.

6. Click Load.
7. To start the installation process, click Continue. In a sequence, the following tasks are automatically performed:

   1. Connector library configuration.

   2. Import of the connector XML files (by using the Deployment Manager).

   3. Adapter compilation.

   On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark along with a message stating the reason for failure is displayed. If a task fails, then make the required correction and perform one of the following steps:

   1. Retry the installation by clicking Retry.

   2. Cancel the installation and begin the procedure from Step 3.

8. If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed.
9. Click Exit to close the installation page.

When you run the Connector Installer, it copies the connector files and external code files to destination directories on the Oracle Identity Manager host computer. These files are listed in Files and Directories on the Box Connector Installation Media.

2.2.3 Configuring the IT Resource for the Target System

An IT resource for your target system is created after you install the connector. You configure this IT resource to let the connector connect Oracle Identity Manager with your target system.

This section provides information about the following topics:

• IT Resource Parameters

• Specifying Values for the IT Resource Parameters

2.2.3.1 IT Resource Parameters

An IT resource is composed of parameters that store connection and other generic information about a target system. Oracle Identity Manager uses this information to connect to a specific installation or instance of your target system.

The list of IT resource parameters for this connector can be grouped into the following categories:

• Connection Parameters

• Authentication Parameters

Table 2-1 lists connection parameters.

Table 2-1 Connection IT Resource Parameters

Parameter	Description
Host	Host name or IP address of the computer hosting the target system. Sample value: api.box.com/2.0
Port	Port number at which the target system is listening. Sample value: 443
authenticationType	Type of authentication used by your target system. The Box target system uses manual input of access token and refresh token for OAuth2.0 authentication. Default value: other Do not modify the value of the parameter.
clientId	Enter the client identifier (a unique string) issued by the authorization server to your client application during the registration process. You would have obtained the client ID while configuring the newly registered application as a part of preinstallation. Sample value: XDETh0r2eWuULCDVt
clientSecret	Enter the secret key used to authenticate the identity of your client application. You would have obtained the secret key while configuring the newly registered application as a part of preinstallation. Sample value: c1ZsdZisTOoYN5NITirarIDepDkiJTGHdzNFT0m
Configuration Lookup	Name of the lookup definition that stores configuration information used during reconciliation and provisioning operations. Default value: Lookup.Box.Configuration
Connector Server Name	If you have deployed the Box connector in a Java Connector Server, then enter the name of the IT resource for the Connector Server.
sslEnabled	If the target system requires SSL connectivity, then set the value of this parameter to true. Otherwise set the value to false. Default value:true
proxyHost	Name of the proxy host used to connect to an external target system. Sample value: proxy.box.com
proxyPort	Proxy port number. Sample value: 80
proxyUser	Proxy user name of the target system user account that Oracle Identity Manager uses to connect to the target system.
proxyPassword	Password of the proxy user ID of the target system user account that Oracle Identity Manager uses to connect to the target system.

Table 2-2 lists authentication parameters.

Table 2-2 Authentication IT Resource Parameters

Parameter	Description
clientId	The client identifier issued to the client during the registration process. Sample value: XDETh0r2eWuULCDVt
clientSecret	The client secret identifier issued to the client during the registration process. Sample value: c1ZsdZisTOoYN5NITirarIDepDkiJTGHdzNFT0m
customAuthHeaders	Takes access token and refresh token values. Sample value 1: “access_token=U7CWQIfwxDHhgtcz5NSXUs9udzvcxJOBy” Sample value 2:“refresh_token=j2SJIEXMDmTTYmHHMbmproppQAy58xeepe1CAasdggkgzSnk3vstlBLV9pKV20hUR”

2.2.3.2 Specifying Values for the IT Resource Parameters

The IT resource for the target system contains connection information about the target system. Oracle Identity Manager uses this information during provisioning and reconciliation.

The Box IT resource is automatically created when you run the Connector Installer. You must specify values for the parameters of the IT resource. To specify values:

1. Log in to Oracle Identity System Administration.
2. In the left pane, under Configuration, click IT Resource.
3. In the IT Resource Name field on the Manage IT Resource page, enter Box and then click Search.
4. Click Edit for the IT resource.
5. From the list at the top of the page, select Details and Parameters.
6. Specify values for the parameters of the Box IT Resource. IT Resource Parameters describes each parameter.
7. To save the values, click Update.

2.3 Postinstallation

Postinstallation for the Box connector involves configuring Oracle Identity Manager, enabling logging to track information about all connector events, and configuring SSL. It also involves performing some optional configurations such as localizing the user interface.

The postinstallation steps are divided across the following sections:

• Configuring Oracle Identity Manager

• Localizing Field Labels in UI Forms

• Clearing Content Related to Connector Resource Bundles from the Server Cache

• Managing Logging for the Box Connector

• Configuring SSL for the Box Connector

2.3.1 Configuring Oracle Identity Manager

You must create an UI form and an application instance for the resource against which you want to perform reconciliation and provisioning operations. In addition, you must run entitlement and catalog synchronization jobs.

These procedures are described in the following sections:

• Creating and Activating a Sandbox

• Creating a New UI Form

• Creating an Application Instance

• Publishing a Sandbox

• Harvesting Entitlements and Sync Catalog

• Updating an Existing Application Instance with a New Form

2.3.1.1 Creating and Activating a Sandbox

You must create and activate a sandbox to begin using the customization and form management features. You can then publish the sandbox to make the customizations available to other users.

See Creating a Sandbox and Activating and Deactivating a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

2.3.1.2 Creating a New UI Form

You can use Form Designer in Oracle Identity System Administration to create and manage application instance forms. See Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Manager.

While creating the UI form, ensure that you select the resource object corresponding to the Box connector that you want to associate the form with. In addition, select the Generate Entitlement Forms check box.

2.3.1.3 Creating an Application Instance

Perform the following steps to create an application instance:

1. In the left pane of the System Administration console, under Configuration, click Application Instances. The Application Instances page is displayed.
2. From the Actions menu, select Create. Alternatively, click Create on the toolbar. The Create Application Instance page is displayed.
3. Specify values for the following fields:

   • Name: The name of the application instance.

   • Display Name: The display name of the application instance.

   • Description: A description of the application instance.

   • Resource Object: The resource object name. Click the search icon next to this field to search for and select the Box User.

   • IT Resource Instance: The IT resource instance name. Click the search icon next to this field to search for and select Box.

   • Form: Select the form name (created in Creating a New UI Form).

4. Click Save. The application instance is created.
5. Publish the application instance to an organization to make the application instance available for requesting and subsequent provisioning to users. See Publishing an Application Instance to Organizations  in Oracle Fusion Middleware Administering Oracle Identity Manager.

2.3.1.4 Publishing a Sandbox

Before you publish a sandbox, perform the following procedure as a best practice to validate all sandbox changes made till this stage as it is hard to revert changes once a sandbox is published:

1. In the System Administration console, deactivate the sandbox.
2. Log out of the System Administration console.
3. Log in to the Self Service console using the xelsysadm user credentials and then activate the sandbox that you deactivated in Step 1.
4. In the Catalog, ensure that the Box application instance form appears with correct fields.
5. Publish the sandbox. See  Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

2.3.1.5 Harvesting Entitlements and Sync Catalog

To harvest entitlements and sync catalog:

1. Run the scheduled jobs for lookup field synchronization listed in Scheduled Job for Lookup Field Synchronization for Box Connector.
2. Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table.
3. Run the Catalog Synchronization Job scheduled job.  

See Also:

Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for a description of the Entitlement List and Catalog Synchronization Job scheduled jobs

2.3.1.6 Updating an Existing Application Instance with a New Form

For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:

1. Create a sandbox and activate it. See Creating a Sandbox and Activating and Deactivating a Sandbox  in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.
2. Create a new UI form for the resource. See Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Manager.
3. Open the existing application instance.
4. In the Form field, select the new UI form that you created.
5. Save the application instance.
6. Publish the sandbox. See Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

2.3.2 Localizing Field Labels in UI Forms

You can localize UI form field labels by using the resource bundle corresponding to the language you want to use. Resource bundles are available in the connector installation media.

To localize a field label that is added to the UI forms:

1. Log in to Oracle Enterprise Manager.
2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.
3. In the right pane, from the Application Deployment list, select MDS Configuration.
4. On the MDS Configuration page, click Export and save the archive to the local computer.
5. Extract the contents of the archive, and open the following file in a text editor: SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle_en_US.xlf
6. Edit the BizEditorBundle_en_US.xlf file in the following manner:

   1. Search for the following text:

      <file source-language="en" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle_en_US" datatype="x-oracle-adf">

   2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle_en_US" datatype="x-oracle-adf">

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle_en_US" datatype="x-oracle-adf">

   3. Search for the application instance code. This procedure shows a sample edit for Box application instance. The original code is:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_BOX_LOGIN__c_description']}">
      <source>Login</source>
      <target/>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.BoxForm.entity.BoxFormEO.UD_BOX_LOGIN__c_LABEL">
      <source>Login</source>
      <target/>
      </trans-unit>

   4. Open the resource file from the connector package, for example Box_ja.properties, and get the value of the attribute from the file, for example,

      global.udf.UD_BOX_LOGIN=\u30ED\u30B0\u30A4\u30F3

   5. Replace the original code shown in Step 6.c with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_BOX_LOGIN__c_description']}">
      <source>Login</source>
      <target>\u30ED\u30B0\u30A4\u30F3</target>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.BoxForm.entity.BoxFormEO.UD_BOX_LOGIN__c_LABEL">
      <source>Login</source>
      <target>\u30ED\u30B0\u30A4\u30F3</target>
      </trans-unit>

   6. Repeat Steps 6.a through 6.d for all attributes of the process form.

   7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing. Sample file name: BizEditorBundle_ja.xlf.

7. Repackage the ZIP file and import it into MDS.

   See Also:

   Deploying and Undeploying Customizations in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for more information about exporting and importing metadata files
8. Log out of and log in to Oracle Identity Manager.

2.3.3 Clearing Content Related to Connector Resource Bundles from the Server Cache

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the Oracle Identity Manager database. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

1. In a command window, switch to the OIM_HOME/server/bin directory.
2. Enter one of the following commands:

   • On Microsoft Windows: PurgeCache.bat All

   • On UNIX: PurgeCache.sh All

   Note:

   You can use the PurgeCache utility to purge the cache for any content category. Run PurgeCache.bat CATEGORY_NAME on Microsoft Windows or PurgeCache.sh CATEGORY_NAME on UNIX. The CATEGORY_NAME argument represents the name of the content category that must be purged.

   For example, the following commands purge Metadata entries from the server cache:

   • PurgeCache.bat MetaData

   • PurgeCache.sh MetaData

   Before running the PurgeCache utility, ensure the WL_HOME and JAVA_HOME environment variables are set.

   When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

   t3://OIM_HOST_NAME:OIM_PORT_NUMBER

   In this format:

   • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

   • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

2.3.4 Managing Logging for the Box Connector

Oracle Identity Manager uses Oracle Diagnostic Logging (ODL) logging service for recording all types of events pertaining to the connector.

The following topics provide detailed information about logging:

• Understanding Log Levels
• Enabling Logging

2.3.4.1 Understanding Log Levels

When you enable logging, Oracle Identity Manager automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations.

ODL is the principle logging service used by Oracle Identity Manager and is based on java.util.Logger. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

• SEVERE.intValue()+100

  This level enables logging of information about fatal errors.

• SEVERE

  This level enables logging of information about errors that might allow Oracle Identity Manager to continue running.

• WARNING

  This level enables logging of information about potentially harmful situations.

• INFO

  This level enables logging of messages that highlight the progress of the application.

• CONFIG

  This level enables logging of information about fine-grained events that are useful for debugging.

• FINE, FINER, FINEST

  These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These message types are mapped to ODL message type and level combinations as shown in Table 2-3.

Table 2-3 Log Levels and ODL Message Type:Level Combinations

Java Level	ODL Message Type:Level
SEVERE.intValue()+100	INCIDENT_ERROR:1
SEVERE	ERROR:1
WARNING	WARNING:1
INFO	NOTIFICATION:1
CONFIG	NOTIFICATION:16
FINE	TRACE:1
FINER	TRACE16
FINEST	TRACE32

The configuration file for OJDL is logging.xml is located at the following path: DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml

Here, DOMAIN_HOME and OIM_SEVER are the domain and server names specified during the installation of Oracle Identity Manager.

2.3.4.2 Enabling Logging

To enable logging in Oracle WebLogic Server:

1. Edit the logging.xml file as follows:

   1. Add the following blocks in the file:

      <log_handler name='BOX-handler' level='[LOG_LEVEL]'class='oracle.core.ojdl.logging.ODLHandlerFactory'>
      <property name='logreader:' value='off'/>
      <property name='path' value='[FILE_NAME]'/> 
      <property name='format' value='ODL-Text'/>
      <property name='useThreadName' value='true'/>
      <property name='locale' value='en'/> <property name='maxFileSize' value='5242880'/>
      <property name='maxLogSize' value='52428800'/>
      <property name='encoding' value='UTF-8'/>
      </log_handler>

      <logger name="ORG.IDENTITYCONNECTORS.BOX" level="[LOG_LEVEL]" useParentHandlers="false">
      <handler name="BOX-handler"/> 
      <handler name="console-handler"/>
      </logger>

   2. Replace both occurrences of [LOG_LEVEL] with the ODL message type and level combination that you require. Table 2-3 lists the supported message type and level combinations. Similarly, replace [FILE_NAME] with the full path and name of the log file in which you want log messages to be recorded. The following blocks show sample values for [LOG_LEVEL] and [FILE_NAME]:

      <log_handler name='BOX-handler' level='NOTIFICATION:1' class='oracle.core.ojdl.logging.ODLHandlerFactory'> 
      <property name='logreader:' value='off'/>
      <property name='path' value='F:\MyMachine\middleware\user_projects\domains\base_domain1\servers\o im_server1\logs\oim_server1-diagnostic-1.log'/>
      <property name='format' value='ODL-Text'/> 
      <property name='useThreadName' value='true'/> 
      <property name='locale' value='en'/> 
      <property name='maxFileSize' value='5242880'/> 
      <property name='maxLogSize' value='52428800'/> 
      <property name='encoding' value='UTF-8'/>
      </log_handler>
      
      <logger name="ORG.IDENTITYCONNECTORS.BOX" level="NOTIFICATION:1"useParentHandlers="false">
      <handler name="BOX-handler"/> 
      <handler name="console-handler"/>
      </logger>

   With these sample values, when you use Oracle Identity Manager, all messages generated for this connector that are of a log level equal to or higher than the NOTIFICATION:1 level are recorded in the specified file.

2. Save and close the file.
3. Set the following environment variable to redirect the server logs to a file:
   • For Microsoft Windows:

     set WLS_REDIRECT_LOG=FILENAME

   • For UNIX:

     export WLS_REDIRECT_LOG=FILENAME

   Replace FILENAME with the location and name of the file to which you want to redirect the output.

4. Restart the application server.

2.3.5 Configuring SSL for the Box Connector

Configure SSL to secure data communication between Oracle Identity Manager and the target system.

1. Obtain the SSL certificate by obtaining the public key certificate of the target system.
2. Copy the public key certificate of the target system to the computer hosting Oracle Identity Manager.
3. Run the following keytool command to import the public key certificate into the identity key store in Oracle Identity Manager:
   keytool -import -keystore WEBLOGIC_HOME/server/lib/DemoTrust.jks -file CERT_FILE_NAME -storepass PASSWORD

   In this command:

   • CERT_FILE_NAME is the full path and name of the certificate file

   • PASSWORD is the password of the keystore.

   The following is a sample value for this command:

   keytool -import -keystore WEBLOGIC_HOME/server/lib/DemoTrust.jks -file /home/target.cert -storepass DemoTrustKeyStorePassPhrase

   Note:

   Change the parameter values passed to the keytool command according to your requirements. Ensure that there is no line break in the keytool arguments.