5 Performing the Postconfiguration Tasks for the Oracle Internet Directory Connector

These are the tasks that you can perform after creating an application in Oracle Identity Governance.

• Configuring Oracle Identity Governance

• Harvesting Entitlements and Sync Catalog

• Managing Logging for the Oracle Internet Directory Connector

• Managing Logging for the Connector Server

• Localizing Field Labels in UI Forms

• Configuring the IT Resource for the Connector Server

• Configuring SSL for the Connector

5.1 Configuring Oracle Identity Governance

During application creation, if you did not choose to create a default form, then you must create a UI form for the application that you created by using the connector.

Note:

Perform the procedures described in this section only if you did not choose to create the default form during creating the application.

The following topics describe the procedures to configure Oracle Identity Governance:

• Creating and Activating a Sandbox

• Creating a New UI Form

• Publishing a Sandbox

• Updating an Existing Application Instance with a New Form

5.1.1 Creating and Activating a Sandbox

You must create and activate a sandbox to begin using the customization and form management features. You can then publish the sandbox to make the customizations available to other users.

See Creating a Sandbox and Activating a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance.

5.1.2 Creating a New UI Form

You can use Form Designer in Oracle Identity System Administration to create and manage application instance forms.

See Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Governance.

While creating the UI form, ensure that you select the resource object corresponding to the newly created application that you want to associate the form with. In addition, select the Generate Entitlement Forms check box.

5.1.3 Publishing a Sandbox

Before publishing a sandbox, perform this procedure as a best practice to validate all sandbox changes made till this stage as it is difficult to revert the changes after a sandbox is published.

1. In Identity System Administration, deactivate the sandbox.

2. Log out of Identity System Administration.

3. Log in to Identity Self Service using the xelsysadm user credentials and then activate the sandbox that you deactivated in Step 1.

4. In the Catalog, ensure that the application instance form for your resource appears with correct fields.

5. Publish the sandbox. See Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance.

5.1.4 Updating an Existing Application Instance with a New Form

For any changes that you do in the schema of your application in Identity Self Service, you must create a new UI form and update the changes in an application instance.

To update an existing application instance with a new form:

1. Create and activate a sandbox.

2. Create a new UI form for the resource.

3. Open the existing application instance.

4. In the Form field, select the new UI form that you created.

5. Save the application instance.

6. Publish the sandbox.

See Also:

• Creating a Sandbox and Activating a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance

• Creating Forms By Using the Form Designer in Oracle Fusion Middleware Administering Oracle Identity Governance

• Publishing a Sandbox in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance

5.2 Harvesting Entitlements and Sync Catalog

You can populate Entitlement schema from child process form table, and harvest roles, application instances, and entitlements into catalog. You can also load catalog metadata.

To harvest entitlements and sync catalog:

1. Run the reconciliation jobs for entitlements lookup field synchronization listed in Reconciliation Jobs for an OID Target Application or Reconciliation Jobs for a Target Application for OUD, ODSEE, and LDAPv3-Compliant Directory Server.
2. Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table.
3. Run the Catalog Synchronization Job scheduled job.

See Also:

Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Governance for a description of the Entitlement List and Catalog Synchronization Job scheduled jobs

5.3 Managing Logging for the Oracle Internet Directory Connector

Oracle Identity Governance uses the Oracle Diagnostic Logging (ODL) logging service for recording all types of events pertaining to the connector.

The following topics provide detailed information about logging:

• Understanding Log Levels

• Enabling Logging

5.3.1 Understanding Log Levels

When you enable logging, Oracle Identity Governance automatically stores in a log file information about events that occur during the course of provisioning and reconciliation operations.

ODL is the principle logging service used by Oracle Identity Governance and is based on java.util.logger. To specify the type of event for which you want logging to take place, you can set the log level to one of the following:

• SEVERE.intValue()+100

  This level enables logging of information about fatal errors.

• SEVERE

  This level enables logging of information about errors that might allow Oracle Identity Governance to continue running.

• WARNING

  This level enables logging of information about potentially harmful situations.

• INFO

  This level enables logging of messages that highlight the progress of the application.

• CONFIG

  This level enables logging of information about fine-grained events that are useful for debugging.

• FINE, FINER, FINEST

  These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

These message types are mapped to ODL message type and level combinations as shown in Table 5-2.

Table 5-1 Log Levels and ODL Message Type:Level Combinations

Java Level	ODL Message Type:Level
SEVERE.intValue()+100	INCIDENT_ERROR:1
SEVERE	ERROR:1
WARNING	WARNING:1
INFO	NOTIFICATION:1
CONFIG	NOTIFICATION:16
FINE	TRACE:1
FINER	TRACE:16

Table 5-2 Log Levels and ODL Message Type:Level Combinations

Java Level	ODL Message Type:Level
SEVERE.intValue()+100	INCIDENT_ERROR:1
SEVERE	ERROR:1
WARNING	WARNING:1
INFO	NOTIFICATION:1
CONFIG	NOTIFICATION:16
FINE	TRACE:1
FINER	TRACE:16
FINEST	TRACE:32

The configuration file for OJDL is logging.xml, which is located at the following path:

DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER/logging.xml

Here, DOMAIN_HOME and OIM_SERVER are the domain name and server name specified during the installation of Oracle Identity Governance.

5.3.2 Enabling Logging

Edit the logging.xml file located in the DOMAIN_HOME/config/fmwconfig/servers/OIM_SERVER directory to enable logging in Oracle WebLogic Server.

To enable logging in Oracle WebLogic Server:

1. Edit the logging.xml file as follows:

   1. Add the following blocks in the file:

      <log_handler name='OIMCP.LDAP' level='[LOG_LEVEL]' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
      <property name='logreader:' value='off'/>
           <property name='path' value='[FILE_NAME]'/>
           <property name='format' value='ODL-Text'/>
           <property name='useThreadName' value='true'/>
           <property name='locale' value='en'/>
           <property name='maxFileSize' value='5242880'/>
           <property name='maxLogSize' value='52428800'/>
           <property name='encoding' value='UTF-8'/>
         </log_handler>
      

      <logger name="ORG.IDENTITYCONNECTORS.LDAP" level="[LOG_LEVEL]" useParentHandlers="false">
           <handler name="OIMCP.LDAP"/>
           <handler name="console-handler"/>
         </logger>
      

   2. Replace both occurrences of [LOG_LEVEL] with the ODL message type and level combination that you require. Table 5-2 lists the supported message type and level combinations.

      Similarly, replace [FILE_NAME] with the full path and name of the log file in which you want log messages to be recorded.

      The following blocks show sample values for [LOG_LEVEL] and [FILE_NAME]:

      <log_handler name='OIMCP.LDAP' level='NOTIFICATION:1' class='oracle.core.ojdl.logging.ODLHandlerFactory'>
      <property name='logreader:' value='off'/>
           <property name='path' value='F:\MyMachine\middleware\user_projects\domains\base_domain1\servers\oim_server1\logs\oim_server1-diagnostic-1.log'/>
           <property name='format' value='ODL-Text'/>
           <property name='useThreadName' value='true'/>
           <property name='locale' value='en'/>
           <property name='maxFileSize' value='5242880'/>
           <property name='maxLogSize' value='52428800'/>
           <property name='encoding' value='UTF-8'/>
         </log_handler>
      

      <logger name="ORG.IDENTITYCONNECTORS.LDAP" level="NOTIFICATION:1" useParentHandlers="false">
           <handler name="OIMCP.LDAP"/>
           <handler name="console-handler"/>
         </logger>
      

      With these sample values, when you use Oracle Identity Governance, all messages generated for this connector that are of a log level equal to or higher than the NOTIFICATION:1 level are recorded in the specified file.

2. Save and close the file.
3. Set the following environment variable to redirect the server logs to a file:

   For Microsoft Windows:

   set WLS_REDIRECT_LOG=FILENAME
   

   For UNIX:

   export WLS_REDIRECT_LOG=FILENAME
   

   Replace FILENAME with the location and name of the file to which you want to redirect the output.

4. Restart the application server.

5.4 Managing Logging for the Connector Server

The conf directory contains the logging.properties file, which you can edit to meet your requirements.

The following topics provide detailed information about logging:

• Understanding Logging on the Connector Server

• Enabling Logging for the Connector Server

5.4.1 Understanding Logging on the Connector Server

When you enable logging, the connector server stores in a log file information about events that occur during the course of provisioning and reconciliation operations for different statuses. By default, the connector server logs are set at INFO level and you can change this level to any one of these.

• Error

  This level enables logging of information about errors that might allow connector server to continue running.

• WARNING

  This level enables logging of information about potentially harmful situations.

• INFO

  This level enables logging of messages that highlight the progress of the operation.

• FINE, FINER, FINEST

  These levels enable logging of information about fine-grained events, where FINEST logs information about all events.

5.4.2 Enabling Logging for the Connector Server

Edit the logging.properties file located in the CONNECTOR_SERVER_HOME/Conf directory to enable logging.

To do so:

1. Navigate to the CONNECTOR_SERVER_HOME/Conf directory.
2. Open the logging.properties file in a text editor.
3. Edit the following entry by replacing INFO with the required level of logging:

   .level=INFO
   

4. Save and close the file.
5. Restart the connector server.

5.5 Localizing Field Labels in UI Forms

You can localize UI form field labels by using the resource bundle corresponding to the language you want to use. The resource bundles are available in the connector installation package.

Note:

Perform the procedure described in this section only if you are using Oracle Identity Manager release 11.1.2.x or later and you want to localize UI form field labels.

To localize field label that is added to the UI forms:

1. Log in to Oracle Enterprise Manager.

2. In the left pane, expand Application Deployments and then select oracle.iam.console.identity.sysadmin.ear.

3. In the right pane, from the Application Deployment list, select MDS Configuration.

4. On the MDS Configuration page, click Export and save the archive (oracle.iam.console.identity.sysadmin.ear_V2.0_metadata.zip) to the local computer.

5. Extract the contents of the archive, and open the following file in a text editor:

   SAVED_LOCATION\xliffBundles\oracle\iam\ui\runtime\BizEditorBundle.xlf

   Note:

   You will not be able to view the BizEditorBundle.xlf unless you complete creating the application for your target system or perform any customization such as creating a UDF.

6. Edit the BizEditorBundle.xlf file in the following manner:

   1. Search for the following text:

      <file source-language="en"  
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      

   2. Replace with the following text:

      <file source-language="en" target-language="LANG_CODE"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      

      In this text, replace LANG_CODE with the code of the language that you want to localize the form field labels. The following is a sample value for localizing the form field labels in Japanese:

      <file source-language="en" target-language="ja"
      original="/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf"
      datatype="x-oracle-adf">
      

   3. Search for the application instance code. This procedure shows a sample edit for Oracle Internet Directory application instance. The original code is:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_OID_USR_FNAME__c_description']}">
      <source>Username</source>
      </target>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.adform.entity.oidformEO.UD_OID_USR_FNAME__c_LABEL">
      <source>Username</source>
      </target>
      </trans-unit>
      

   4. Open the resource file from the connector package, for example OID_ja.properties, and get the value of the attribute from the file, for example, global.udf.UD_OID_USR_FNAME=\u540D.

   5. Replace the original code shown in Step 6.b with the following:

      <trans-unit id="${adfBundle['oracle.adf.businesseditor.model.util.BaseRuntimeResourceBundle']['persdef.sessiondef.oracle.iam.ui.runtime.form.model.user.entity.userEO.UD_OID_USR_FNAME__c_description']}">
      <source>Username</source>
      <target>\u30E6\u30FC\u30B6\u30FC\u540D</target>
      </trans-unit>
      <trans-unit id="sessiondef.oracle.iam.ui.runtime.form.model.OracleDBForm.entity.OracleDBForm.UD_OID_USR_FNAME__c_LABEL">
      <source>Username</source>
      <target>\u30E6\u30FC\u30B6\u30FC\u540D</target>
      </trans-unit>
      

   6. Repeat Steps 6.a through 6.d for all attributes of the process form.

   7. Save the file as BizEditorBundle_LANG_CODE.xlf. In this file name, replace LANG_CODE with the code of the language to which you are localizing.

      Sample file name: BizEditorBundle_ja.xlf.

7. Repackage the ZIP file and import it into MDS.

   See Also:

   Deploying and Undeploying Customizations in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance for more information about exporting and importing metadata files

8. Log out of and log in to Oracle Identity Governance.

5.6 Configuring the IT Resource for the Connector Server

If you have used the Connector Server, then you must configure values for the parameters of the Connector Server IT resource.

After you create the application for your target system, you must create an IT resource for the Connector Server as described in Creating IT Resource of Oracle Fusion Middleware Administering Oracle Identity Governance. While creating the IT resource, ensure to use to select Connector Server from the IT Resource Type list.

In addition, specify values for the parameters of the IT resource for the Connector Server listed in Table 5-3.

Table 5-3 Parameters of the IT Resource for the LDAP Connector Server

Parameter	Description
Host	Enter the host name or IP address of the computer hosting the Connector Server. Sample value: myhost.com
Key	Enter the key for the Connector Server.
Port	Enter the number of the port at which the Connector Server is listening. By default, this value is blank. You must enter the port number that is displayed on the terminal when you start the Connector Server. For example: 8759
Timeout	Enter an integer value which specifies the number of milliseconds after which the connection between the Connector Server and Oracle Identity Governance times out. Recommended value: 0 A value of 0 means that the connection never times out.
UseSSL	Enter true to specify that you will configure SSL between Oracle Identity Governance and the Connector Server. Otherwise, enter false. Default value: false Note: It is recommended that you configure SSL to secure communication with the connector server. To configure SSL, see Configuring the Java Connector Server with SSL for Oracle Identity Governance in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Governance.

5.7 Configuring SSL for the Connector

You must configure SSL to secure communication between Oracle Identity Governance and your target system.

This section provides information about configuring SSL for the connector:

• Configuring SSL on the Target System

• Configuring Oracle Identity Governance for SSL

Caution:

Configuring SSL is an optional procedure; however, it is recommended that you configure SSL. If you do not configure SSL, passwords can be transmitted over the network in clear text. For example, this problem can occur when you are creating a user or modifying a user's password.

5.7.1 Configuring SSL on the Target System

Configuring SSL on the target system involves generating a certificate and exporting its public key, and then importing the certificate into the JRE of the target system.

1. On the target system, ensure that SSL is enabled and a port is specified for the Directory Server to accept connections from LDAPS clients.

   For more information, refer to the documentation for your specific target system .

2. Generate a self-signed certificate.
3. Export the public key for the certificate you generated in the previous step.

   For example, on an OUD target system:

   keytool -exportcert -alias server-cert -file config/server-cert.txt -rfc 
   -keystore config/keystore -storetype JKS 
   

   Or, on an ODSEE target system:

   odsee-instance/bin/dsadm export-cert -o /tmp/odsee.cert . defaultCert
   

   Or, on an eDirectory target system, you can export the trust certificate from the JDK key store on which eDirectory is installed:

   keytool -J-ns -import -alias ALIAS_NAME -file FULL_PATH\trustedrootcert.der -keystore sys:java\lib\security\cacerts
   

   Choose and confirm the PKCS#12 file password.

4. Import the server certificate into the JRE of the target system.

   For example, on an OUD target system:

   keytool -importcert -alias server-cert -file config/server-cert.txt  
   -keystore config/truststore -storetype JKS 
   

5.7.2 Configuring Oracle Identity Governance for SSL

Configuring SSL on Oracle Identity Governance involves importing the target system certificate into both the JDK used by Oracle Identity Governance and Oracle WebLogic Server keystore.

1. Import the target system certificate into the JDK (or JRE) used by Oracle Identity Governance. For example:

   keytool -import -keystore my_cacerts -file cert_file_name -storepass password
   

   In this command:

   • my_cacerts is the full path and name of the certificate store (the default is cacerts).

   • cert_file_name is the full path and name of the certificate file.

   • password is the password of the keystore.

   For example:

   keytool -import -keystore /home/OIM/java/jdk/lib/security/cacerts 
   -file /home/target.cert -storepass kspassword
   

2. Import the target system certificate into the Oracle WebLogic Server keystore. For example:

   keytool -import -keystore WEBLOGIC_HOME/server/lib/DemoTrust.jks 
   -file cert_file_name -storepass password
   

   In this command:

   • cert_file_name is the full path and name of the certificate file.

   • password is the password of the keystore.

   For example:

   keytool -import -keystore WEBLOGIC_HOME/server/lib/DemoTrust.jks
   -file /home/target.cert -storepass DemoTrustKeyStorePassPhrase