4 Performing the Postconfiguration Tasks
These are the tasks that you can perform after creating an application in Oracle Identity Governance.
-
Configuring the Connector for a Target System with an Autoincrement Primary Key
-
Configuring Secure Communication Between the Target System and Oracle Identity Governance
-
Configuring Secure Communication Between the Connector Server and Oracle Identity Governance
-
Configuring the Connector for Stored Procedures and Groovy Scripts
4.1 Configuring the Connector for a Target System with an Autoincrement Primary Key
Note:
Perform the procedure described in this section only if both the conditions are true:
-
You have configured your target system as a target resource.
-
The key column of the target system is configured with an autoincrement option.
Perform the following steps to configure the connector for a target system with an autoincrement primary key:
-
By default, the key column of the target system is mapped to the OIM User Login field in the reconciliation rule. Before you perform any connector operation, you can modify the reconciliation rule to map the OIM User Login field to a different target system column.
-
If the key column of the child table has been configured with the autoincrement option, then modify the child form by removing the 'required=true' property for the key field of the child table by using the Design Console.
-
If the prepopulate adapter contains a mapping for the key column, then either disable the prepopulate adapter or modify it to remove the connector key column by using the Design Console.
4.2 Configuring Oracle Identity Governance
During application creation, if you did not choose to create a default form, then you must create a UI form for the application that you created by using the connector.
Note:
Perform the procedures described in this section only if you did not choose to create the default form during creating the application.
The following topics describe the procedures to configure Oracle Identity Governance:
4.2.1 Creating and Activating a Sandbox
You must create and activate a sandbox to begin using the customization and form management features. You can then publish the sandbox to make the customizations available to other users.
See Creating a Sandbox and Activating a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance.
4.2.2 Creating a New UI Form
You can use Form Designer in Oracle Identity System Administration to create and manage application instance forms.
See Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Governance.
While creating the UI form, ensure that you select the resource object corresponding to the newly created application that you want to associate the form with. In addition, select the Generate Entitlement Forms check box.
4.2.3 Publishing a Sandbox
Before publishing a sandbox, perform this procedure as a best practice to validate all sandbox changes made till this stage as it is difficult to revert the changes after a sandbox is published.
-
In Identity System Administration, deactivate the sandbox.
-
Log out of Identity System Administration.
-
Log in to Identity Self Service using the xelsysadm user credentials and then activate the sandbox that you deactivated in Step 1.
-
In the Catalog, ensure that the application instance form for your resource appears with correct fields.
-
Publish the sandbox. See Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance.
4.2.4 Updating an Existing Application Instance with a New Form
For any changes that you do in the schema of your application in Identity Self Service, you must create a new UI form and update the changes in an application instance.
To update an existing application instance with a new form:
-
Create and activate a sandbox.
-
Create a new UI form for the resource.
-
Open the existing application instance.
-
In the Form field, select the new UI form that you created.
-
Save the application instance.
-
Publish the sandbox.
See Also:
-
Creating a Sandbox and Activating a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance
-
Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Governance
-
Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance
4.3 Harvesting Entitlements and Sync Catalog
To harvest entitlements and sync catalog:
- Run the scheduled jobs for lookup field synchronization listed in Scheduled Job for Lookup Field Synchronization.
- Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Governance for more information about this scheduled job.
- Run the Catalog Synchronization Job scheduled job. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Governance for more information about this scheduled job.
4.4 Managing Logging for Oracle Identity Governance
Oracle Identity Governance uses the Oracle Diagnostic Logging (ODL) logging service for recording all types of events pertaining to the connector.
The following topics provide detailed information about logging:
4.4.1 Understanding Log Levels
When you enable logging, Oracle Identity Governance automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations.
ODL is the principle logging service used by Oracle Identity Governance and is based on java.util.logger. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:
-
SEVERE.intValue()+100
This level enables logging of information about fatal errors.
-
SEVERE
This level enables logging of information about errors that might allow Oracle Identity Governance to continue running.
-
WARNING
This level enables logging of information about potentially harmful situations.
-
INFO
This level enables logging of messages that highlight the progress of the application.
-
CONFIG
This level enables logging of information about fine-grained events that are useful for debugging.
-
FINE, FINER, FINEST
These levels enable logging of information about fine-grained events, where FINEST logs information about all events.
These message types are mapped to ODL message type and level combinations as shown in Table 4-1.
Table 4-1 Log Levels and ODL Message Type:Level Combinations
| Java Level | ODL Message Type:Level |
|---|---|
|
SEVERE.intValue()+100 |
INCIDENT_ERROR:1 |
|
SEVERE |
ERROR:1 |
|
WARNING |
WARNING:1 |
|
INFO |
NOTIFICATION:1 |
|
CONFIG |
NOTIFICATION:16 |
|
FINE |
TRACE:1 |
|
FINER |
TRACE:16 |
|
FINEST |
TRACE:32 |
The configuration file for OJDL is logging.xml, which is located at the following path:
DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml
Here, DOMAIN_HOME and OIM_SERVER are the domain name and server name specified during the installation of Oracle Identity Governance.
4.4.2 Enabling Logging
To enable logging in Oracle WebLogic Server:
-
Edit the logging.xml file as follows:
-
Add the following blocks in the file:
<log_handler name='dbat-handler' level='[LOG_LEVEL]' class='oracle.core.ojdl.logging.ODLHandlerFactory'> <property name='logreader:' value='off'/> <property name='path' value='[FILE_NAME]'/> <property name='format' value='ODL-Text'/> <property name='useThreadName' value='true'/> <property name='locale' value='en'/> <property name='maxFileSize' value='5242880'/> <property name='maxLogSize' value='52428800'/> <property name='encoding' value='UTF-8'/> </log_handler>
<logger name="ORG.IDENTITYCONNECTORS.DATABASETABLE" level="[LOG_LEVEL]" useParentHandlers="false"> <handler name="dbat-handler"/> <handler name="console-handler"/> </logger> -
Replace both occurrences of
[LOG_LEVEL]with the ODL message type and level combination that you require. Table 4-1 lists the supported message type and level combinations.Similarly, replace
[FILE_NAME]with the full path and name of the log file in which you want log messages to be recorded.The following blocks show sample values for
[LOG_LEVEL]and[FILE_NAME]:<log_handler name='dbat-handler' level='NOTIFICATION:1' class='oracle.core.ojdl.logging.ODLHandlerFactory'> <property name='logreader:' value='off'/> <property name='path' value='/<%OIM_DOMAIN%>/servers/oim_server1/logs/DBATlogs.log'/> <property name='format' value='ODL-Text'/> <property name='useThreadName' value='true'/> <property name='locale' value='en'/> <property name='maxFileSize' value='5242880'/> <property name='maxLogSize' value='52428800'/> <property name='encoding' value='UTF-8'/> </log_handler> <logger name="ORG.IDENTITYCONNECTORS.DATABASETABLE" level="NOTIFICATION:1" useParentHandlers="false"> <handler name="dbat-handler"/> <handler name="console-handler"/> </logger>
With these sample values, when you use Oracle Identity Governance, all messages generated for this connector that are of a log level equal to or higher than the
NOTIFICATION:1level are recorded in the specified file. -
-
Save and close the file.
-
Set the following environment variable to redirect the server logs to a file:
For Microsoft Windows:
set WLS_REDIRECT_LOG=FILENAMEFor UNIX:
export WLS_REDIRECT_LOG=FILENAMEReplace FILENAME with the location and name of the file to which you want to redirect the output.
-
Restart the application server.
4.5 Configuring the IT Resource for the Connector Server
If you have used the Connector Server, then you must configure values for the parameters of the Connector Server IT resource.
Table 4-2 Parameters of the IT Resource for the Connector Server
| Parameter | Description |
|---|---|
|
Host |
Enter the host name or IP address of the computer hosting the Connector Server. Sample value: |
|
Key |
Enter the key for the Connector Server. |
|
Port |
Enter the number of the port at which the Connector Server is listening. By default, this value is blank. You must enter the port number that is displayed on the terminal when you start the Connector Server. Sample value: |
|
Timeout |
Enter an integer value which specifies the number of milliseconds after which the connection between the Connector Server and Oracle Identity Governance times out. Recommended value: A value of 0 means that the connection never times out. |
|
UseSSL |
Enter Default value: Note: It is recommended that you configure SSL to secure communication with the connector server. To configure SSL, see Configuring the Java Connector Server with SSL in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance. |
4.6 Localizing Field Labels in UI Forms
To localize a field label that is added to the UI forms:
-
Create a properties file (for example, DBAT_ja.properties) containing localized versions for the column names in your target system (to be displayed as text strings for GUI elements and messages in the Administrative and User Console).
-
Log in to Oracle Enterprise Manager.
-
In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.
-
In the right pane, from the Application Deployment list, select MDS Configuration.
-
On the MDS Configuration page, click Export and save the archive to the local computer.
-
Extract the contents of the archive, and open the following file in a text editor:
SAVED_LOCATION/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle_en.xlf
-
Edit the BizEditorBundle.xlf file in the following manner:
-
Search for the following text:
<file source-language="en" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf" datatype="x-oracle-adf">
-
Replace with the following text:
<file source-language="en" target-language="LANG_CODE" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf" datatype="x-oracle-adf">In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:
<file source-language="en" target-language="ja" original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf" datatype="x-oracle-adf">
-
Search for the application instance code. This procedure shows a sample edit for Database Application Tables application instance. The original code is:
<trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_ACMEDBAP_APP_DFLT_HOME__c_description']}"> <source>APP_DFLT_HOME</source> <target/> </trans-unit> <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.ACMEFORM.entity.ACMEFORMEO.UD_ACMEDBAP_APP_DFLT_HOME__c_LABEL"> <source>APP_DFLT_HOME</source> <target/> </trans-unit> -
Open the properties file created in Step 1 and get the value of the attribute, for example, global.udf.D_ACMEDBAP_APP_DFLT_HOME=\u4567d.
-
Replace the original code shown in Step 7.c with the following:
<trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_ACMEDBAP_APP_DFLT_HOME__c_description']}"> <source>APP_DFLT_HOME</source> <target>\u4567d</target> </trans-unit> <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.ACMEFORM.entity.ACMEFORMEO.UD_ACMEDBAP_APP_DFLT_HOME__c_LABEL"> <source>APP_DFLT_HOME</source> <target>\u4567d</target> </trans-unit> -
Repeat Steps 7.a through 7.d for all attributes of the process form.
-
Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing.
Sample file name: BizEditorBundle_ja.xlf.
-
-
Repackage the ZIP file and import it into MDS.
See Also:
Deploying and Undeploying Customizations in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance for more information about exporting and importing metadata files
-
Log out of and log in to Oracle Identity Governance.
4.7 Configuring Secure Communication Between the Target System and Oracle Identity Governance
Note:
It is recommended that you perform the procedure described in this section to secure communication between the target system and Oracle Identity Governance.
The procedure to secure communication depends on the database that you are using:
-
Configuring Secure Communication Between IBM DB2 and Oracle Identity Governance
-
Configuring Secure Communication Between Microsoft SQL Server and Oracle Identity Governance
-
Configuring Secure Communication Between MySQL and Oracle Identity Governance
-
Configuring Secure Communication Between Oracle Database and Oracle Identity Governance
4.7.1 Configuring Secure Communication Between IBM DB2 and Oracle Identity Governance
Note:
-
IBM DB2 version 11.x and later support secure communication over SSL.
-
Before configuring secure communication between IBM DB2 and Oracle Identity Governance, you must install the IBM Global Security Kit (GSKit).
See the IBM DB2 documentation for more information about enabling SSL communication between IBM DB2 and a client system. In this context, the client is Oracle Identity Governance.
To configure secure communication between IBM DB2 and Oracle Identity Governance:
4.7.2 Configuring Secure Communication Between Microsoft SQL Server and Oracle Identity Governance
To configure secure communication between Microsoft SQL Server and Oracle Identity Governance:
4.7.3 Configuring Secure Communication Between MySQL and Oracle Identity Governance
To configure secure communication between MySQL and Oracle Identity Governance:
4.7.4 Configuring Secure Communication Between Oracle Database and Oracle Identity Governance
To secure communication between Oracle Database and Oracle Identity Governance, you can perform either one or both of the following procedures:
4.7.4.1 Configuring Data Encryption and Integrity in Oracle Database
See Configuring Network Data Encryption and Integrity in Oracle Database Security Guide for information about configuring data encryption and integrity.
4.7.4.2 Configuring SSL Communication in Oracle Database
To enable SSL communication between Oracle Database and Oracle Identity Governance:
Note:
See Enabling Secure Sockets Layer in Oracle Database Security Guide for detailed information about enabling SSL communication between Oracle Database and Oracle Identity Governance.
4.8 Configuring Secure Communication Between the Connector Server and Oracle Identity Governance
If you have deployed this connector on a Connector Server, then it is recommended that you secure communication between the Connector Server and Oracle Identity Governance. The procedure to configure secure communication is the same as the procedure described in section Configuring Secure Communication Between the Target System and Oracle Identity Governance. While performing the procedure described in that section, consider the Connector Server as a separate system, similar to the target system.
Before you configure secure communication:
-
Ensure that the Connector Server is running under a user that has the appropriate rights to access the keystore.
-
Ensure that the keystore on the Connector Server is present and accessible.
-
Ensure that the keystore on the Connector Server contains the expected certificates.
-
If you are not using the default Java keystore on the Connector Server, then modify the keystore paths and password in the IT resource URL or the jndiProperties property (of the DBATConfiguration.groovy file) to match the location on the Connector Server.
4.9 Configuring the Connector for Stored Procedures and Groovy Scripts
The connector runs default SQL queries and SQL statements when you use it to perform reconciliation and provisioning operations, respectively. Instead of default SQL statements and queries, if you want the connector to use custom stored procedures for performing reconciliation or provisioning operations, then you must perform the procedure described in this section.
See Also:
Sample Stored Procedures and Groovy Scripts for sample stored procedures and Groovy scripts
This section contains the following topics:
4.9.1 Configuring the Connector for Custom Stored Procedures
To configure the connector for custom stored procedures:
-
On the target system, create the stored procedures that must be used for performing provisioning operations. The following are sample stored procedures (created on Oracle Database) that run the DELETE SQL statement for deleting the groups and roles child data. For target systems other than Oracle Database, the syntax of this sample procedure may vary.
The stored procedure for
DELETE_USERGROUPis as follows:create or replace PROCEDURE DELETE_USERGROUP ( userin IN VARCHAR2, gId IN VARCHAR2 ) AS BEGIN DELETE from USER_GROUP where USERID=userin and GROUPID=gId; END DELETE_USERGROUP;
The stored procedure for
DELETE_USERROLEis as follows:create or replace PROCEDURE DELETE_USERROLE ( userin IN VARCHAR2, rId IN VARCHAR2 ) AS BEGIN DELETE from USER_ROLE where USERID=userin and ROLEID=rId; END DELETE_USERROLE;
-
On the Oracle Identity Governance host computer, create Groovy scripts that call the relevant stored procedures on the target system to perform provisioning operations. See Groovy Script Arguments for information about the arguments that can be directly used in the groovy script.
Note:
See Sample Groovy Script for a sample Groovy script that calls the DELETE_USERGROUP and DELETE_USERROLE stored procedure.
-
Update the Advanced configuration details definition to include information about the Groovy scripts as listed in Table 4-3.
Note:
Instead of the file URL of the Groovy script, you can directly enter the Groovy script. In such a case, ensure that the corresponding attribute does not contain
[LOADFROMURL]. For example, if you directly enter the Groovy script for the create user account provisioning operation, then the corresponding attribute name must becreateScript, instead ofcreateScript[LOADFROMURL].The following is a sample value for the removeMultiValuedAttributeScript[LOADFROMURL] entry:
file:///home/myname/dbat/scripts/removechilddata.groovy -
To reset the password during the update procedure, do the following:
-
Check whether script argument "attributes" contains password (__PASSWORD__) attribute.
import org.identityconnectors.common.security.GuardedString; GuardedString pass = attributes.get("__PASSWORD__")!=null?attributes.get"__PASSWORD__").getValue().get(0):null; -
If "attributes" contains __PASSWORD__ attribute (not null), call targetstore procedure/sql query to reset password.
upstmt = conn.prepareStatement("UPDATE PASSWORD.... if(pass!=null){ pass.access(new GuardedString.Accessor(){ public void access(char[] clearChars){ upstmt.setString(1, new String(clearChars)); } }); } else { //Update other attributes } upstmt.executeUpdate();
-
4.9.2 Groovy Script Arguments
The following arguments can be directly used in the Groovy script:
-
connector - The Database Application Tables connector object.
-
conn - JDBC connection.
-
timing - When the Groovy script is called. In addition, the timing attribute also explains the type of operation being performed. For example, if it is search operation, then the object class being search is also returned.
The following is the format of the timing argument for lookup field synchronization:
executeQuery:OBJECT_CLASS
In this format, OBJECT_CLASS is replaced with the type of object being reconciled.
For example, for a lookup field synchronization scheduled job that contains the object type "Role", the value of the timing argument will be as follows:
executeQuery:Role -
attributes - All attributes.
-
trace - Logger as a script trace bridge to the application.
-
where - String where condition for execute query, or null.
-
handler - resultSetHandler or SyncResultsHandler for the connector objects produced by the execute query, sync operation or null return.
-
quoting - The type of table name quoting to be used in SQL. The default value is an empty string. The value of this argument is obtained from the IT resource.
-
nativeTimestamps - Specifies whether the script retrieves the timestamp data of the columns as java.sql.Timestamp type from the database table. This information is obtained from the IT resource.
-
allNative - Specifies whether the script must retrieve the data type of the columns in a native format from the database table. The value of this argument is obtained from the IT resource.
-
rethrowAllSQLExceptions - The value of this argument is also obtained from the IT resource. The value of this argument specifies whether the script must throw exceptions when a zero (0x00) error code is encountered.
-
enableEmptyString - Specifies whether support for writing an empty string instead of a NULL value must be enabled. The value of this argument is obtained from the IT resource.
-
filterString - String filter condition for execute query, or null.
-
filterParams - List of filter parameters. Each parameter is present in the COLUMN_NAME:VALUE format. For example, FIRSTNAME:test.
-
syncattribute - Name of the database column configured for incremental reconciliation. This argument is available in the sync script, which is called during an incremental reconciliation run.
-
synctoken - Value of the sync attribute. This argument is available in the sync script.
4.9.3 Sample Groovy Script
The following is a sample Groovy script that calls the DELETE_USERGROUP and DELETE_USERROLE stored procedure created in step 1 of Configuring the Connector for Custom Stored Procedures.
import org.identityconnectors.framework.common.objects.*;
System.out.println("[removeMultiValuedAttributeScript] Removing Child data::"+ attributes);
try {
childDataEOSet = null;
delSt = null;
//Get UID
String id = attributes.get("__UID__").getValue().get(0);
if(attributes.get("USER_GROUP")!=null)
{
childDataEOSet=attributes.get("USER_GROUP").getValue();
//Delete child data using stored procedure
delSt= conn.prepareCall("{call DELETE_USERGROUP(?,?)}");
if(childDataEOSet !=null){
System.out.println("[removeMultiValuedAttributeScript] Removing Group data.");
//Iterate through child data and delete
for( iterator = childDataEOSet.iterator(); iterator.hasNext(); )
{
eo = iterator.next();
attrsSet = eo.getAttributes();
grpattr=AttributeUtil.find("GROUPID",attrsSet);
if(grpattr!=null){
groupid=grpattr.getValue().get(0);
delSt.setString(1, id);
delSt.setString(2, groupid);
delSt.executeUpdate();
System.out.println("[removeMultiValuedAttributeScript] Deleted Group::"+ grpattr);
} }; } }
} finally {
if (delSt != null)
delSt.close();
};
try {
childDataEOSet = null;
delSt = null;
String id = attributes.get("__UID__").getValue().get(0);
if(attributes.get("USER_ROLE")!=null)
{
childDataEOSet=attributes.get("USER_ROLE").getValue();
delSt= conn.prepareCall("{call DELETE_USERROLE(?,?)}");
if(childDataEOSet !=null){
System.out.println("[removeMultiValuedAttributeScript] Removing Role data.");
for( iterator = childDataEOSet.iterator(); iterator.hasNext(); )
{
eo = iterator.next();
attrsSet = eo.getAttributes();
roleattr=AttributeUtil.find("ROLEID",attrsSet);
if(roleattr!=null){
rolename=roleattr.getValue().get(0);
delSt.setString(1, id);
delSt.setString(2, rolename);
delSt.executeUpdate();
System.out.println("[removeMultiValuedAttributeScript] Deleted Role::"+ rolename);
} }; } }
} finally {
if (delSt != null)
delSt.close();
};
4.9.4 Entries Specific to Groovy Script Configuration
Table 4-3 describes the lookup entries specific to groovy script configuration.
Table 4-3 Entries Specific to Groovy Script Configuration
| Code Key | Decode |
|---|---|
|
createScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for the create user account provisioning operation. |
|
updateScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for the update user account provisioning operation. |
|
deleteScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for the delete user account provisioning operation. |
|
executeQueryScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for full and filtered reconciliation. |
|
lookupScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for lookup field synchronization. |
|
syncScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for incremental reconciliation. |
|
addMultiValuedAttributeScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for the add multivalued attributes provisioning operation. |
|
removeMultiValuedAttributeScript[LOADFROMURL] |
Enter the file URL of the Groovy script created for the remove multivalued attributes provisioning operation. |