3 Configuring the Connector
While creating a target or an authoritative application, you must configure connection-related parameters that the connector uses to connect to Oracle Identity Governance with your target system and perform connector operations. In addition, you can view and edit attribute mappings between the process form fields in Oracle Identity Governance and target system columns, predefined correlation rules, situations and responses, and reconciliation jobs.
3.1 Basic Configuration Parameters
These are the connection-related parameters that Oracle Identity Governance requires to connect to SharePoint Online application.
| Parameter | Mandatory ? | Description |
|---|---|---|
| authenticationType | Yes |
Enter the type of authentication used by your Azure AD target system. For this connector, the target system OAuth2.0 client credentials. This is a mandatory attribute while creating an application. Do not modify the value of the parameter. Default value: client_credentials |
| authenticationServerUrl | Yes |
Enter the URL of the authentication server that validates the client ID and client secret for your Azure AD target system. Sample value: https://login.microsoftonline.com/idmconnector.onmicrosoft.com/oauth2/v2.0/token |
| clientId | Yes | Enter the client identifier (a unique string) issued by the authorization server to your client application during the registration process. You obtained the client ID while performing the procedure described in Configuring the Newly Added Application. |
| clientSecret | Yes | Enter the secret key used to authenticate the identity of your client application. You obtained the secret key while performing the procedure described in Configuring the Newly Added Application. |
| Scope | Yes |
Enter the scope of your client application. Default value: https://graph.microsoft.com/.default |
| host | Yes |
Enter the host name of the machine hosting your target system. This is a mandatory attribute while creating an application. Sample value: graph.microsoft.com |
| uriPlaceHolder | Yes |
Enter the key-value pair for replacing place holders in the relURIs. The URI place holder consists of values which are repeated in every relative URL. Values must be comma separated. For example, tenant ID and API version values are a part of every request URL. Therefore, we replace it with a key-value pair. Sample value:"api_version;v1.0" |
| sharePointAuthenticationType | Yes |
Enter the type of authentication used by your SharePointOnline target system. For this connector, the target system OAuth2.0 client credentials. This is a mandatory attribute while creating an application. Do not modify the value of the parameter. Default value: client_credentials |
| sharePointAuthServerUrl | Yes |
Enter the URL of the authentication server that validates the client ID and client secret for your sharePoint target system. Sample value: https://accounts.accesscontrol.windows.net/db7b9691-7572-47c7-ac7b-a164135f9636/tokens/OAuth/2 |
| sharePointClientId | Yes |
Note: Enter the Client ID generated during the SharePoint app registration. |
| sharePointClientSecret | Yes |
Note: Enter the generated Client Secret during the SharePoint app registration. |
| sharePointHost | Yes | Sample value: idmconnector.sharepoint.com |
| resource | Yes |
Note: Enter the resource00000003-0000-0ff1-ce00-000000000000/TENANT-NAME.sharepoint.com@TENANT-ID.
|
| username | Yes | Sample value: balaji.s@idmconnector.onmicrosoft.com |
| password | Yes | Enter the password for basic authentication type |
| port | No |
Enter the port number at which the target system is listening. Sample value: 443 |
| proxyHost | No | Enter the name of the proxy host used to connect to an external target. |
| proxyPassword | No | Enter the password of the proxy user ID of the target system user account that Oracle Identity Governance uses to connect to the target system. |
| proxyPort | No | Enter the proxy port number. |
| proxyUser | No |
Enter the proxy user name of the target system user account that Oracle Identity Governance uses to connect to the target system. Sample value: 80 |
| sslEnabled | No |
If the target system requires SSL connectivity, then set the value of this parameter to true. Otherwise set the value to false. Default value: true |
3.2 Advanced Setting Parameters
These are the configuration-related entries that the connector uses during reconciliation and provisioning operations.
Note:
- Unless specified, do not modify entries in the below table.
- All parameters in the below table are mandatory.
| Parameter | Description |
|---|---|
| relURIs |
This entry holds the relative URL of every object class supported by this connector and the connector operations that can be performed on these object classes. This is a mandatory attribute while creating an application. Default value: "__ACCOUNT__.CREATEOP=/$(api_version)$/users","__ACCOUNT__.UPDATEOP=/$(api_version)$/users/$(__UID__)$","__ACCOUNT__.SEARCHOP=/$(api_version)$/users?$(Filter Suffix)$&$select=userType,displayName,givenName,userPrincipalName,id,city,usageLocation,accountEnabled,mailNickname,surname,country&$top=$(PAGE_SIZE)$&$skiptoken=$(PAGE_TOKEN)$","__ACCOUNT__=/$(api_version)$/users/$(__UID__)$?$select=displayName,givenName,userPrincipalName,id,city,usageLocation,accountEnabled,mailNickname,country,surname,userType","__ACCOUNT__.__SHAREPOINTGROUP__.SEARCHOP=/_api/Web/GetUserById($(__UID__)$)/Groups","__ACCOUNT__.__SHAREPOINTGROUP__.UPDATEOP=/_api/web/sitegroups/GetById($(__SHAREPOINTGROUP__.Id)$)/users","__ACCOUNT__.__SHAREPOINTGROUP__.REMOVEATTRIBUTE=/_api/web/sitegroups/GetById($(__SHAREPOINTGROUP__.Id)$)/users/removebyloginname('i%3A0%23.f%7Cmembership%7C$(__UID__)$')","__SHAREPOINTGROUP__.SEARCHOP=/_api/web/sitegroups","__OFFICEGROUP__.SEARCHOP=/$(api_version)$/groups?&$filter=securityEnabled+eq+false&groupTypes/any(c:c+eq+'Unified')&$top=$(PAGE_SIZE)$&$skiptoken=$(PAGE_TOKEN)$","__ACCOUNT__.__OFFICEGROUP__.SEARCHOP=/_api/Web/GetUserById($(__UID__)$)/Groups","__ACCOUNT__.__SHAREPOINTUSERLIST__=/_api/Web/siteusers('i%3A0%23.f%7Cmembership%7C$(__UID__)$')","__ACCOUNT__.__SHAREPOINTGROUPUSERS__=/_api/web/sitegroups/GetById($(__UID__)$)/users","__ACCOUNT__.manager.SEARCHOP=/$(api_version)$/users/$(__UID__)$/manager","__ACCOUNT__.manager=/$(api_version)$/users/$(__UID__)$/manager/$ref" |
| nameAttributes |
This entry holds the name attribute for all the objects that are handled by this connector. For example, for the __ACCOUNT__ object class that it used for User accounts, the name attribute is userPrincipalName. Default value: "__ACCOUNT__.userPrincipalName","__SHAREPOINTGROUP__.Title","__OFFICEGROUP__.displayName" |
| uidAttributes |
This entry holds the uid attribute for all the objects that are handled by this connector. For example, for User accounts, the uid attribute is objectId. In other words, the value __ACCOUNT__.objectId in decode implies that the __UID__ attribute (that is, GUID) of the connector for __ACCOUNT__ object class is mapped to objectId which is the corresponding uid attribute for user accounts in the target system. Default value: "__ACCOUNT__.id","__SHAREPOINTGROUP__.Id","__OFFICEGROUP__.id" |
| opTypes |
This entry specifies the HTTP operation type for each object class supported by the connector. Values are comma separated and are in the following format: OBJ_CLASS.OP=HTTP_OP In this format, OBJ_CLASS is the connector object class, OP is the connector operation (for example, CreateOp, UpdateOp, SearchOp), and HTTP_OP is the HTTP operation (GET, PUT, or POST). Default value: "__ACCOUNT__.CREATEOP=POST","__ACCOUNT__.UPDATEOP=PATCH","__ACCOUNT__.SEARCHOP=GET","__ACCOUNT__.TESTOP=GET","__ACCOUNT__.__SHAREPOINTGROUP__.UPDATEOP=POST","__ACCOUNT.__SHAREPOINTGROUP__.REMOVEATTRIBUTE=POST","__ACCOUNT__.manager.CREATEOP=PUT","__ACCOUNT__.manager.UPDATEOP=PUT" |
| pageSize |
The number of resources/users that appears on a page for a search operation. Default value: 100 |
| pageTokenAttribute |
The attribute in response payload that denotes the next page token. Default value: @odata.nextLink |
| pageTokenRegex |
This attribute is used in the URL while reconciliation to support pagination. Default value: (?<=skiptoken=).* |
| Any Incremental Recon Attribute Type |
By default, during incremental reconciliation, Oracle Identity Governance accepts timestamp information sent from the target system only in Long datatype format. Setting the value of this parameter to True indicates that Oracle Identity Governance will accept timestamp information in any datatype format. Default value: True |
| jsonResourcesTag |
This entry holds the json tag value that is used during reconciliation for parsing multiple entries in a single payload. Default value: "__ACCOUNT__=value","__SHAREPOINTGROUP__=value","__OFFICEGROUP__=value" |
| httpHeaderContentType |
This entry holds the content type expected by the target system in the header. Default value: application/json |
| httpHeaderAccept |
This entry holds the accept type expected from the target system in the header. Default value: application/json |
| specialAttributeTargetFormat |
This entry lists the format in which an attribute is present in the target system endpoint. For example, the alias attribute will be present as aliases.alias in the target system endpoint. Values are comma separated and are presented in the following format: OBJ_CLASS.ATTR_NAME= TARGET_FORMAT Default value: "__ACCOUNT__.__SHAREPOINTGROUP__=value","__ACCOUNT__.__OFFICEGROUP__=value","__ACCOUNT__.manager=id" |
| specialAttributeHandling |
This entry lists the special attributes whose values should be sent to the target system one by one ("SINGLE"). Values are comma separated and are in the following format: OBJ_CLASS.ATTR_NAME.PROV_OP=SINGLE For example, the __ACCOUNT__.manager.UPDATEOP=SINGLE value in decode implies that during an update provisioning operation, the manager attribute of the __ACCOUNT__ object class must be sent to the target system one-by-one. Default value: "__ACCOUNT__.__SHAREPOINTGROUP__.UPDATEOP=SINGLE","__ACCOUNT__.__SHAREPOINTGROUP__.ADDATTRIBUTE=SINGLE","__ACCOUNT__.__SHAREPOINTGROUP__.REMOVEATTRIBUTE=SINGLE","__ACCOUNT__.manager.CREATEOP=SINGLE","__ACCOUNT__.manager.UPDATEOP=SINGLE" |
| customPayload |
This entry lists the payloads for all operations that are not in the standard format. Default value: "__ACCOUNT__.__SHAREPOINTGROUP__.UPDATEOP={ \"__metadata\": { \"type\": \"SP.User\"}, \"LoginName\": \"i:0#.f|membership|$(__UID__)$\"}","__ACCOUNT__.manager.CREATEOP={\"@odata.id\":\"https://graph.microsoft.com/v1.0/directoryObjects/$(manager)$\"}","__ACCOUNT__.manager.UPDATEOP={\"@odata.id\":\"https://graph.microsoft.com/v1.0/directoryObjects/$(manager)$\"}" |
| statusAttributes |
This entry lists the name of the target system attribute that holds the status of an account. For example, for the __ACCOUNT__ object class that it used for User accounts, the status attribute is accountEnabled. Default value: "__ACCOUNT__.accountEnabled" |
| passwordAttribute |
This entry holds the name of the target system attribute that is mapped to the __PASSWORD__ attribute of the connector in OIM. Default value: passwordProfile.password |
| targetObjectIdentifier |
This entry specifies the key-value pair for replacing place holders in the relURIs. Values are comma separated and in the KEY;VALUE format. Default value: "__ACCOUNT__.__OFFICEGROUP__=securityEnabled;false" |
| urlIdentifierKeys |
This entry is used to identify SharePointOnline url. These values should be comma separated. Default value: "site","/_api/Web/" |
3.3 Attribute Mappings
The following topic provides the details of attribute mappings on the Schema page:
3.3.1 Attribute Mappings for the Target Application
The Schema page for a target application displays the default schema (provided by the connector) that maps Oracle Identity Governance attributes to target system attributes. The connector uses these mappings during reconciliation and provisioning operations.
Default Attributes for SharePoint Online Target Application
Table 3-1 lists the user-specific attribute mappings between the process form fields in Oracle Identity Governance and SharePoint Online target application attributes. The table also lists whether a specific attribute is used during provisioning or reconciliation and whether it is a matching key field for fetching records during reconciliation.
If required, you can edit the default attribute mappings by adding new attributes or deleting existing attribute as described in Creating a Target Application in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.
Table 3-1 Default Attributes for SharePoint Online Target Application
| Display Name | Target Attribute | Data Type | Mandatory Provisioning Property? | Provision Field? | Recon Field? | Key Field? | Case Insensitive? | Advanced Flag Settings |
|---|---|---|---|---|---|---|---|---|
|
Object Id |
__UID__ |
String |
No |
Yes |
Yes |
Yes |
Not Applicable |
Yes |
|
User Principal Name |
__NAME__ |
String |
Yes |
Yes |
Yes |
No |
Yes |
Yes |
|
First Name |
givenName |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Last Name |
surname |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Display Name |
displayName |
String |
Yes |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Usage Location |
usageLocation |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
City |
city |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Country |
country |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Manager |
manager |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Preferred Language |
preferredLanguage |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Mail NickName |
mailNickname |
String |
Yes |
Yes |
Yes |
No |
Not applicable |
Yes |
|
Account Enabled |
accountEnabled |
String |
No |
Yes |
Yes |
No |
Not applicable |
Yes |
|
AzureAD Server |
Long |
Yes |
No |
Yes |
Yes |
Not applicable |
Yes |
|
|
Status |
__ENABLE__ |
String |
No |
No |
Yes |
No |
Not applicable |
Yes |
|
Password |
__PASSWORD__ |
String |
No |
Yes |
No |
No |
Not applicable |
Yes |
|
Change Password On Next Logon |
passwordProfile.forceChangePasswordNextLogin |
String |
No |
Yes |
No |
No |
Not applicable |
Yes |
Figure 3-1 shows the default User account attribute mappings.
Figure 3-1 Default Attribute Mappings for Sharepoint Target User Account
Description of "Figure 3-1 Default Attribute Mappings for Sharepoint Target User Account"
SharePointOnline SPGroups Entitlement
Table 3-2 lists the group forms attribute mappings between the process form fields in Oracle Identity Governance and SharePoint Online target application attributes. The table lists whether a given attribute is mandatory during provisioning. It also lists whether a given attribute is used during reconciliation and whether it is a matching key field for fetching records during reconciliation.
Note:
In the Table 3-2 list only the attribute Group Name is updated during provisioning, the remaining attributes will be updated during recon.Table 3-2 Default Attribute Mappings for SPGroups
| Display Name | Target Attribute | Data Type | Mandatory Provisioning Property? | Recon Field? | Key Field? | Case Insensitive? |
|---|---|---|---|---|---|---|
| Group Name | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~Id | String | Yes | Yes | Yes | No |
| Owner Title | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~OwnerTitle | String | No | Yes | No | Not applicable |
| Group Type | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~odata.type | String | No | Yes | No | Not applicable |
| AutoAcceptRequestToJoinLeave | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~AutoAcceptRequestToJoinLeave | String | No | Yes | No | Not applicable |
| AllowRequestToJoinLeave | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~AllowRequestToJoinLeave | String | No | Yes | No | Not applicable |
| OnlyAllowMembersViewMembership | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~OnlyAllowMembersViewMembership | String | No | Yes | No | Not applicable |
| AllowMembersEditMembership | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~AllowMembersEditMembership | String | No | Yes | No | Not applicable |
| Group Url | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~odata.id | String | No | Yes | No | Not applicable |
| PrincipalType | __SHAREPOINTGROUP__~__SHAREPOINTGROUP__~PrincipalType | String | No | Yes | No | Not applicable |
Figure 3-2 shows the default SPGroups entitlement mapping
Figure 3-2 Default Attribute Mappings for SharePoint Online SPGroups
Table 3-3 Default Attribute Mappings for SharePoint Online AzureADGroups Forms
| Display Name | Target Attribute | Data Type | Mandatory Provisioning Property? | Recon Field? | Key Field? | Case Insensitive? |
|---|---|---|---|---|---|---|
| SharePointOnline Group Name | __OFFICEGROUP__~__OFFICEGROUP__~sharepointId | String | No | Yes | Yes | No |
| Office Group Name | __OFFICEGROUP__~__OFFICEGROUP__~id | String | No | Yes | Yes | No |
Figure 3-3 shows the default attribute mappings for AzureADGroups.
Figure 3-3 Default Attribute Mappings for AzureADGroups
3.4 Correlation Rules
Learn about the predefined rules, responses and situations for Target applications. The connector uses these rules and responses for performing reconciliation.
3.4.1 Correlation Rules for the Target Application
When you create a target application, the connector uses correlation rules to determine the identity to which Oracle Identity Governance must assign a resource.
Predefined Identity Correlation Rules
By default, the SharePoint Online connector provides a simple correlation rule when you create a target application. The connector uses this correlation rule to compare the entries in Oracle Identity Governance repository and the target system repository, determine the difference between the two repositories, and apply the latest changes to Oracle Identity Governance.
Table 3-4 lists the default simple correlation rule for a SharePoint Online connector. If required, you can edit the default correlation rule or add new rules. You can create complex correlation rules also. For more information about adding or editing simple or complex correlation rules, see Updating Identity Correlation Rule in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.
Table 3-4 Predefined identity correlation rules
| Target Attribute | Element Operator | Identity Attribute | Case Sensitive? |
|---|---|---|---|
| __NAME__ | Equals | User Login | No |
- __NAME__ is a single-valued attribute on the target system that identifies the user account.
- User Login is the field on the OIG User form.
Figure 3-4 shows the simple correlation rule for SharePoint Online target application.
Figure 3-4 Simple Correlation Rule for SharePoint Online Target Application
Predefined Situations and Responses
The SharePoint Online connector provides a default set of situations and responses when you create a target application. These situations and responses specify the action that Oracle Identity Governance must take based on the result of a reconciliation event.
Table 3-5 lists the default situations and responses for a SharePoint Online Target application. If required, you can edit these default situations and responses or add new ones. For more information about adding or editing situations and responses, see Updating Situations and Responses in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance
Table 3-5 Predefined Situations and Responses for a SharePoint Online Target Application
| Situation | Response |
|---|---|
| No Matches Found | None |
| One Entity Match Found | Establish Link |
| One Process Match Found | Establish Link |
Figure 3-5 shows the situations and responses for a SharePoint Online that the connector provides by default.
Figure 3-5 Predefined Situations and Responses for a SharePoint Online Target Application
3.5 Reconciliation Jobs
These are the reconciliation jobs that are automatically created in Oracle Identity Governance after you create the application.
User Reconciliation Jobs
You can either use these predefined jobs or edit them to meet your requirements. Alternatively, you can create custom reconciliation jobs. For information about editing these predefined jobs or creating new ones, see Updating Reconciliation Jobs Updating Reconciliation Jobs in Oracle Fusion Middleware Performing Self Service Tasks with Oracle Identity Governance.
- SharePoint Online Full User Reconciliation:Use this reconciliation job to reconcile user data from a target applications.SharePoint Online Limited User Reconciliation: Use this reconciliation job to reconcile records from the target system based on a specified filter criterion.
- SharePoint Online Limited User Reconciliation: Use this reconciliation job to reconcile records from the target system based on a specified filter criterion.
Table 3-*describes the parameters of the SharePoint Online Full User Reconciliation job.
| Parameter | Description |
|---|---|
| Application name |
Name of the AOB application with which the reconciliation job is associated. This value is the same as the value that you provided for the Application Name field while creating your target application. Do not change the default value. |
| Latest Token |
This parameter holds the value of the target system attribute that is specified as the value of the Incremental Recon Attribute parameter. The Latest Token parameter is used for internal purposes. By default, this value is empty. Note: Do not enter a value for this parameter. The reconciliation engine automatically enters a value in this parameter. Sample value: <String>2017-11-30T04:44:29Z</String> |
| Object Type |
This parameter holds the name of the object type for the reconciliation run. Default value: User Do not change the default value. |
| Filter Suffix |
Enter the search filter for fetching user records from the target system during a reconciliation run. Sample value when incremental recon is enabled: &$filter=displayName+eq+'JAN2KKA1' Sample value when incremental recon is not enabled: &$filter=displayName+eq+'JAN2KKA1' For more information about creating filters, see Performing Limited Reconciliation. |
| Scheduled Task Name |
Name of the scheduled task used for reconciliation. Do not modify the value of this parameter. |
| Incremental Recon Attribute | Enter the name of the attribute that holds the timestamp at which the token record was modified. |