Deploying the Connector

2 Deploying the Connector

The procedure to deploy the connector is divided across three stages namely preinstallation, installation, and postinstallation.

This chapter also includes information about:

2.1 Preinstallation

Preinstallation involves copying external code files to a given location on the computer hosting the connector server, and then creating a target system account for performing connector operations.

This section is divided into the following topics:

Note:

You must install single user notes client only on the connector server machine.

2.1.1 Understanding the Connector Deployment Architecture

The Lotus Notes/Domino connector requires a distributed deployment architecture.

Figure 2-1 shows the architecture required for deploying the connector.

Figure 2-1 Connector Deployment Architecture

Description of "Figure 2-1 Connector Deployment Architecture"

Machine 1 has Oracle Identity Manager deployed.

Note:

Deploying the Lotus Notes/Domino connector on the Oracle Identity Manager computer is not certified. You must deploy the Domino Identity Connector bundle in the Java Connector Server (Machine 2 in the figure).
Machine 2 has the Lotus Notes/Domino connector and the Java Connector Server deployed.

You must install the Java Connector Server and the Lotus Notes client on the same computer where you deploy the Lotus Notes/Domino connector.

Since the connector binary is dependent on Lotus Notes client and the latter is only available in 32-bit version, we can not release 64-bit binary for the connector. The Domino connector uses the 32-bit Domino C API and therefore is supported only with the 32-bit version of Lotus Notes, so you must deploy 32-bit notes client. Both windows and Linux Os are supported.

Note:

See Using an Identity Connector Server in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager for information about installing and configuring a connector server and about running the connector server.

You can download the necessary Java Connector Server from the Oracle Technology Network web page.
Machine 3 has the Domino target deployed.

2.1.2 Files and Directories on the Connector Installation Media

These are the list of files and directories in the connector installation media and their descriptions.

Table 2-1 describes the files and directories on the installation media.

Table 2-1 Files and Directories On the Connector Installation Media

File in the Installation Media Directory	Description
`org.identityconnectors.domino-2.0.2.jar`	This JAR file contains the Domino Identity Connector bundle that must be deployed into the connector server before you can install the OIM Lotus Notes/Domino connector.
`configuration/IBMLotusDomino-CI.xml`	This XML file contains configuration information that is used during connector installation.
`xml/Domino-Datasets.xml`	This file, used in conjunction with the `OIM Import Deployment Manager` file, contains the parameters necessary to import the datasets for request-based provisioning.
`resources/`	This directory contains all of the resource bundles with language-specific information that is used by the connector. During connector deployment, these resource bundles are copied to the Oracle Identity Manager database. Note: A resource bundle is a file containing localized versions of the text strings that include GUI element labels and messages.
`test-utility/example-config.groovy`	This file contains an example that you can modify to test basic provisioning operations.
`test-utility/test-utility.jar`	This jar file contains a utility used to test basic provisioning operations (create, update, and delete) on a configurable target resource.
`xml/Domino-ConnectorConfig.xml`	This XML file contains definitions for the following components of the connector: IT resource type IT resource Resource object Process definition Process tasks Adapters Process form Lookup definitions

2.1.3 Using External Code Files

Ensure you have the Notes.jar file available. This file comes packaged with the IBM Lotus Notes software.

Copy the Notes.jar file from the LOTUS_HOME/Domino/jvm/lib/ext directory into the CONNECTOR_SERVER_HOME/lib directory.

Here, LOTUS_HOME is the directory in which IBM Lotus Notes and Domino is installed and CONNECTOR_SERVER_HOME is the directory in which the connector server is installed.

Testing the Connector describes the procedure to use the testing utility. Before running the testing utility, copy the Notes.jar files into the OIM_HOME/server/ThirdParty directory.

2.1.4 Creating a Target System Account for Connector Operations

Oracle Identity Manager uses a target system user account to provision to, and reconcile data from, the target system. See the target system documentation for creating a target system account.

Note:

To perform the procedure described in Configuring the IT Resource, the user must be "Administrator." In addition, if Lotus scripts are used in pre-actions or post-actions, the user must also have "Sign or run restricted LotusScript/Java agents" rights.

For IBM Lotus Notes and Domino, the user must have the minimum rights for provisioning/reconciliation. Use the following procedure to specify the minimum rights required for the Domino administrator:

Create the Identity Manager administrator in Domino. Use a certifier ID that has access to all organizations needed to manage users.
Add the user to the access control list (ACL) of the address book for the server, names.nsf.
1. Give the user Editor access.
2. Assign the user the following roles:
  
  GroupModifier
  
  UserCreator
  
  UserModifier
3. Ensure the user has the following rights:
  
  Create documents, Delete documents, Read public documents, Write public documents, and Replicate or Copy documents
These selections are illustrated in Figure 2-2.

Figure 2-2 Adding User to the ACL

Description of "Figure 2-2 Adding User to the ACL"
Add the user to the registration log ACL, certlog.nsf, with Editor access. For example, see Figure 2-3.

Figure 2-3 Adding User to the Registration Log ACL

Description of "Figure 2-3 Adding User to the Registration Log ACL"
Add the user to the Administration Requests ACL, admin4.nsf, with Editor access as illustrated in Figure 2-4.

Figure 2-4 Adding User to the Administration Requests ACL

Description of "Figure 2-4 Adding User to the Administration Requests ACL"
Add the newly created user to the server security by opening the Security panel and editing the server configuration as follows:
- If access to the Domino server is restricted, ensure the Identity Manager account has access to the server by specifying the account name (or a group to which the account belongs) in the Access Server field.
- If a before or after action calls a Domino agent, you might have to add the user to the Run unrestricted LotusScript/Java agents or Run restricted LotusScript/Java agent field, depending on how the agent being called is configured.

2.2 Installation

Installing the connector involves the following procedures:

2.2.1 Installing the Domino Identity Connector on the Connector Server

Before installing the OIM Lotus Notes/Domino connector, you must install the Domino Identity Connector (bundle/org.identityconnectors.domino-2.0.1.jar in the installation media directory) into the Java Connector Server.

Note:

You can download the Java Connector Server from the Oracle Technology Network web page.
For information about installing, configuring, and running a connector server, see Using an Identity Connector Server in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.

To do so:

Stop the Java Connector Server.
Copy the Domino connector bundle into the Java Connector Server CONNECTOR_SERVER_HOME\bundles directory.
Copy the Notes.jar file from the Lotus Notes installation directory to the CONNECTOR_SERVER_HOME\lib directory.
Ensure that the PATH variable specifies the directory where nnotes.dll resides.

Note:

You must switch Lotus Notes to the user ID configured in OIM for provisioning before starting the Connector Server or error messages will result.
Start the Java Connector Server.

2.2.2 Running the Connector Installer

To run the Connector Installer:

Copy the contents of the connector installation media into the following directory:

OIM_HOME/server/ConnectorDefaultDirectory

Note:

In an Oracle Identity Manager cluster, you must copy these files to each node in the cluster.
If you are using Oracle Identity Manager release 11.1.1.x, then:
1. Log in to Oracle Identity Manager Administrative and User Console by using the user account.
2. On the Welcome to Identity Manager Advanced Administration page, in the System Management region, click Manage Connector.
If you are using Oracle Identity Manager release 11.1.2.x, then:
1. Log in to Oracle Identity System Administration by using the user account.
2. In the left pane, under System Management, click Manage Connector.
In the Manage Connector page, click Install.
From the Connector List list, select IBM Lotus Notes Domino RELEASE_NUMBER. This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory in Step 1.

If you have copied the installation files into a different directory, then:
1. In the Alternative Directory field, enter the full path and name of that directory.
2. To repopulate the list of connectors in the Connector List list, click Refresh.
3. From the Connector List list, select IBM Lotus Notes Domino RELEASE_NUMBER.
Click Load.
To start the installation process, click Continue.

The following tasks are performed in sequence:
1. Configuration of connector libraries
2. Import of the connector Target Resource user configuration XML file (by using the Deployment Manager).
3. Compilation of adapters
On successful completion of a task, a check mark is displayed for the task. If a task fails, then an X mark and a message stating the reason for failure are displayed. Depending on the reason for the failure, make the required correction and then perform one of the following steps:
- Retry the installation by clicking Retry.
- Cancel the installation and begin again from Step 1.
If all three tasks of the connector installation process are successful, then a message indicating successful installation is displayed. In addition, a list of the steps that you must perform after the installation is displayed.

Figure 2-5 Connector Installation Success Screen

Description of "Figure 2-5 Connector Installation Success Screen"

These steps are as follows:
1. Ensuring that the prerequisites for using the connector are addressed
  
  Note:
  
  At this stage, run the Oracle Identity Manager PurgeCache utility to load the server cache with content from the connector resource bundle in order to view the list of prerequisites. See Clearing Connector Resource Bundles Content from the Server Cache for information about running the PurgeCache utility.
  
  There are no prerequisites for some predefined connectors.
2. Configuring the IT resource for the connector
  
  Record the name of the IT resource displayed on this page. The procedure to configure the IT resource is described later in this guide.
3. Configuring the scheduled jobs that are created when you installed the connector
  
  Record the names of the scheduled jobs displayed on this page. The procedure to configure these scheduled jobs is described later in this guide.

When you run the Connector Installer, it copies the connector files and external code files to destination directories on the Oracle Identity Manager host computer. These files are listed in Table 2-1.

If you are installing Oracle Identity Manager in a cluster, then you must copy all the JAR files and the contents of the connectorResources directory into the corresponding directories on each node of the cluster. See Table 2-1 for information about the files that you must copy and their destination locations on the Oracle Identity Manager server.

2.2.3 Configuring the IT Resource

The IT resource for the target system is created during connector installation. This IT resource contains connection information about the target system. Oracle Identity Manager uses this information during reconciliation and provisioning.

You can use one of the following methods to configure an IT resource:

Note:

If you have configured your target system as a trusted source, then create an IT resource of type Lotus Notes. For example, Lotus Notes Trusted. The parameters of this IT resource are the same as the parameters of the IT resources described in Table 2-2 of this section.

For either method, specify the parameters for the resource, as described in Parameters of the IT Resource, as appropriate for your environment.

2.2.3.1 Parameters of the IT Resource

Table 2-2 describes the parameters of the IT resource for the target system.

Table 2-2 IT Resource Parameters

Parameter	Description
`useCAProcess`	Set the value of this parameter to `true` if you are using CA Certificates. Otherwise, set the value of this parameter to `false.` Default is: `false.`
`caCertiferName`	Enter the hierarchical CA Certifier name here. For example: `/ca/org1` In this example, CA is the CA Certifier under org1 organization.
`adminIdFile`	Fully-qualified path to the Administrator ID file. For example: `C:\Lotus\Notes\Data\admin.id`
`adminName`	Administrator account name, such as Administrator/ACM
`adminPassword`	Administrator password.
`administrationServer`	For Notes User: Name of the host where the administration server is running. For Web User: Canonical name of the administration server. For example : `CN=Myserver/O=org`
`certifierIdFile`	Fully-qualified path to the Certifier ID file. For example: `C:\Lotus\Domino\Data\cert.id`
`certifierPassword`	Password for the specified Certifier ID file.
`Configuration Lookup`	Name of the Lookup definition containing the configuration information. Values can be: `Lookup.Configuration.Domino` for Target Reconciliation `Lookup.Configuration.Domino.Trusted` for Trusted Reconciliation Note: If you create another lookup definition in which to store connector configuration parameters, then specify the name of the new lookup definition as the value of this parameter.
`ConnectorServerName`	Enter the name of the host where the connector server is running. Name of the IT resource for the Connector Server. You create an IT resource for the Connector Server in Creating the IT Resource for the Connector Server. Note: Enter a value for this parameter only if you have deployed the Lotus Notes/Domino connector in the Connector Server.
`deleteDenyGroup`	Enter the name of the Deleted User group to which users who are deleted must be assigned.
`disableDenyGroup`	Specify to disable user accounts in the connector. Not returned by default. When you disable a user account, the user automatically becomes a member of a Deny Access group. Re-enable the user account to remove the user from the Deny Access group. Note: To create a Deny List group on the Domino installation, you must create the group in the IT resource. Refer to "Configuring the Target System" for instructions.
`idType`	Type of ID file: Specify `0` for flat Specify `1` for hierarchical Default is: `0`
`MailReplicaServer`	Specifies the names of servers to which the mail database will replicate. Use this value only when registering new users. You cannot update this value and it is not reconciled.
`mailServer`	Default mail server to use when creating users. Use the abbreviated format. For example: `server/org` Only one mail server is supported at a time, but you can change servers if necessary.
`mailSystem`	Indicates the default mail system when creating users: Specify one of the following values: `0`: Notes `1`: CCMAIL `2`: VIMMail `99`: None Default is: `0`
`mailTemplateName`	Name of mail template. Valid only during create.
`policy`	Specify the name of the Domino explicit policy to be assigned to the user. When set, this value could modify or override other user attribute values. Refer to the Domino documentation for more information.
`registrationLog`	Enter the name of the log file to be used when creating IDs. Default is: `C:/Lotus/Domino/Data/certlog.nsf`
`registrationServer`	Enter the canonical name of the server to be used when creating IDs and performing other registration functions. Sample value: `CN=MyServer/OU=MyOrg`
`roamCleanPer`	If the value of Roaming Cleanup is 1, specifies the period in days that cleanup will be performed.
`roamCleanSetting`	Cleanup setting for files belonging to roaming Domino accounts. Values can be: 0: Never 1: Periodically in days 2: At shutdown 3: Prompt
`roamRplSrvrs`	List of servers that will contain replicas of roaming files.
`roamSrvr`	Server destination for roaming files belonging to a Domino account.
`userDatabaseName`	Specify the filename of the user database. Note: This parameter does not support secondary directory. Instead, only read/write data from/into the primary directory `(=names.nsf)` is supported.

2.2.3.2 Edit an Existing IT Resource Instance

To simplify the IT resource configuration process, the IBM Lotus Notes and Domino connector provides two empty IT Resource instances:

Lotus Domino for configuring the target system as a managed (target) resource
Lotus Domino Trusted for configuring the target system as an authoritative (trusted) source

Note:

It is recommended that you do not configure the target system as both an authoritative (trusted) source and a managed (target) resource.

You can use either instance to configure an IT resource by editing the parameter values to suit your deployment requirements.

If you are using Oracle Identity Manager release 11.1.1.x, then:
1. Log in to the Administrative and User Console.
2. On the Welcome page, open Manage IT Resource in the upper-right corner of the page.
If you are using Oracle Identity Manager release 11.1.2.x or later, then:
1. Log in to Identity System Administration.
2. In the left pane, under Provisioning Configuration, click IT Resource.
In the IT Resource Type combo box, select Lotus Notes, and then click Search.

The Lotus Domino and Lotus Domino Trusted IT resource types are displayed.
Select one of these resource types and then click Edit to modify the necessary IT Resource parameters.

For a description of the different IT resource parameters, refer to Table 2-2.

2.2.3.3 Create a New IT Resource

To create a new Lotus Notes IT resource and specify values for the parameters for that resource, follow these steps:

If you are using Oracle Identity Manager release 11.1.1.x, then:
1. Log in to the Administrative and User Console.
2. On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Create IT Resource.
If you are using Oracle Identity Manager release 11.1.2.x or later, then:
1. Create and activate a sandbox. For detailed instructions on creating and activating a sandbox, see Managing Sandboxes of Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager.
2. In the left pane, under Configuration, click IT Resource.
Provide an IT Resource value.
Click the Search icon and select Lotus Notes, or type Lotus Notes directly into the IT Resource Type field.

The Lotus Domino and Lotus Domino Trusted IT resource types are displayed.
Select one of the IT resource type options and then click Continue.
Specify values for the parameters of the IT resource.

For a description of the different IT resource parameters, refer to Table 2-2.
To save the values, click Update.

2.3 Postinstallation

Postinstallation involves performing certain procedures such as configuring Oracle Identity Manager, creating the IT resource for the Connector Server, enabling the Reset Password option, localizing field labels, and so on.

The following sections discuss postinstallation procedures:

2.3.1 Configuring Oracle Identity Manager 11.1.2 or Later

If you are using Oracle Identity Manager 11.1.2 or later, you must create additional metadata such as a UI form and an application instance. In addition, you must run entitlement and catalog synchronization jobs. These procedures are described in the following sections:

2.3.1.1 Creating and Activating a Sandbox

Create and activate a sandbox as follows:

On the upper navigation bar, click Sandboxes. The Manage Sandboxes page is displayed.
On the toolbar, click Create Sandbox. The Create Sandbox dialog box is displayed.
In the Sandbox Name field, enter a name for the sandbox. This is a mandatory field.
In the Sandbox Description field, enter a description of the sandbox. This is an optional field.
Click Save and Close. A message is displayed with the sandbox name and creation label.
Click OK. The sandbox is displayed in the Available Sandboxes section of the Manage Sandboxes page.
Select the sandbox that you created.
From the table showing the available sandboxes in the Manage Sandboxes page, select the newly created sandbox that you want to activate.
On the toolbar, click Activate Sandbox.

The sandbox is activated.

2.3.1.2 Creating a New UI Form

Create a new UI form as follows.

In the left pane, under Configuration, click Form Designer.
Under Search Results, click Create.
Select the resource type for which you want to create the form, for example, Lotus Notes User.
Enter a form name and click Create.

2.3.1.3 Creating an Application Instance

Create an application instance as follows. For detailed instructions, see Managing Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager.

In the System Administration page, under Configuration in the left pane, click Application Instances.
Under Search Results, click Create.
Enter appropriate values for the fields displayed on the Attributes form and click Save.
In the Form drop-down list, select the newly created form and click Apply.
Publish the application instance to an organization to make the application instance available for requesting and subsequent provisioning to users. See Managing Organizations Associated With Application Instances in Oracle Fusion Middleware Administering Oracle Identity Manager for detailed instructions.

2.3.1.4 Publishing a Sandbox

To publish the sandbox that you created in Creating and Activating a Sandbox.:

Close all the open tabs and pages.
From the table showing the available sandboxes in the Manage Sandboxes page, select the sandbox that you created in Creating and Activating a Sandbox.
On the toolbar, click Publish Sandbox. A message is displayed asking for confirmation.
Click Yes to confirm. The sandbox is published and the customizations it contained are merged with the main line.

2.3.1.5 Harvesting Entitlements and Sync Catalog

To harvest entitlements and sync catalog:

Run the scheduled jobs for lookup field synchronization.
Run the Entitlement List scheduled job to populate Entitlement Assignment schema from child process form table. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about this scheduled job.
Run the Catalog Synchronization Job scheduled job. See Predefined Scheduled Tasks in Oracle Fusion Middleware Administering Oracle Identity Manager for more information about this scheduled job.

2.3.1.6 Updating an Existing Application Instance with a New Form

For any changes you do in the Form Designer, you must create a new UI form and update the changes in an application instance. To update an existing application instance with a new form:

Create a sandbox and activate it as described in Creating and Activating a Sandbox.
Create a new UI form for the resource as described in Creating a New UI Form.
Open the existing application instance.
In the Form field, select the new UI form that you created. You must first refresh to populate the new form in the list.
Save the application instance.
Publish the sandbox as described in Publishing a Sandbox.

2.3.2 Localizing Application Instance Form

To localize the application instance form:

Publish the sandbox containing application instance form that is supposed to be localized.
Export the MDS file, "/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle.xlf".

In this file, you can see message keys and messages to be localized.

sessiondef.oracle.iam.ui.runtime.form.model.testAppInstance.entity.testAppInstanceEO.UD_TES8393_ACCOUNTID__c_LABEL

See Also:

Deploying and Undeploying Customizations in Oracle Fusion Middleware Developing and Customizing Applications for Oracle Identity Manager, for more information about exporting metadata files
Export the file to localize, for example, for German:

/xliffBundles/oracle/iam/ui/runtime/BizEditorBundle_de.xlf

Note:

This file may not exist in MDS. If it does not exist, create a new one, but path must be the same.
Provide localization for messages in German, follow the same format as in the file exported in step 2.
Import /xliffBundles/oracle/iam/ui/runtime/BizEditorBundle_de.xlf back to MDS.
Logout and relogin.

2.3.3 Enabling the Reset Password Option in Oracle Identity Manager 11.1.2 or Later

In Oracle Identity Manager 11.1.2 or later, you can reset password for an account after logging in as the user by navigating to My Access, Accounts tab.The Reset Password option is enabled for only those accounts that follow the UD_FORMNAME_PASSWORD naming convention for the password field.

Note:

In Oracle Identity Manager 11.1.2 prior to release 11.1.2.1.0, if you want to change the password of a Lotus Notes account under My Information, the account is not available for selection in the drop-down list of accounts. See bug 16483800 in Known Issues and Workarounds for more information about this known issue.

To enable the Reset Password option in Oracle Identity Manager 11.1.2.x or later:

Log in to Oracle Identity System Administration.
In the left pane, under Configuration, click Form Designer.
Enter UD_LOTUS in the Table Name field and click the Query for records button.
Click Create New Version.
In the Create a New Version dialog box, specify the version name in the Label field, save the changes, and then close the dialog box.
From the Current Version list, select the newly created version.
Delete the existing label UD_LOTUS_USERPWS and add a similar label as UD_LOTUS_PASSWORD with similar values for all columns.
Save and Click on Make Version Active.
Close the Form Designer.
In the left pane, under Process Management, Click Process Definition.
Enter Lotus User in Name filed and Click the Query for records button.
Open the Password Updated task.
Click integration tab.
Perform the following steps:
1. Click and open fieldName and change Literal Value to UD_LOTUS_PASSWORD.
2. Save and close.
  Note:
  
  If password Updated task fails after these steps, you might be encountering cache issue. As a work around, you must do these steps:
  1. Click and open fieldValue and toggle Qualifier value to something other than Password (for example: ID File Name) and save it. Again Revert it back to Password. Save and close.
  2. Click and open fieldOldValue and toggle Qualifier value to something other than Password (for example: ID File Name) and save it. Again Revert it back to Password. Save and close.
Update the application instance with the new form as described in Updating an Existing Application Instance with a New Form.
Run FVC utility from OIM_HOME/designconsole with proper from and to version of the Form.
Access OIM DB and run following sql script to make necessary changes to already existing users:

update UD_LOTUS set UD_LOTUS_PASSWORD=UD_LOTUS_USERPWS;

2.3.4 Configuring Oracle Identity Manager

Configuring Oracle Identity Manager involves the following procedures:

Note:

In an Oracle Identity Manager cluster, you must perform this step on each node of the cluster.

2.3.4.1 Setting Up the Lookup.Configuration.Domino Lookup Definition

The Lookup.Configuration.Domino lookup definition is created when you deploy the connector. You must set values for some of the entries in this lookup definition. To set values for these entries:

On the Design Console, expand Administration and then double-click Lookup Definition.
Search for and open the Lookup.Configuration.Domino lookup definition.

Set values for the entries specified in Table 2-3.

Note:

You must not change any of the Code Key values of this lookup definition.

Table 2-3 Entries in the Lookup.Configuration.Domino Lookup Definition

Code Key	Decode Description
Bundle Name	This entry holds the name of the connector bundle class. Do not modify this entry.
Bundle Version	This entry holds the version of the connector bundle class. Do not modify this entry.
Connector Name	This entry holds the name of the connector class. Do not modify this entry.

2.3.4.2 Configuring Trusted Source Reconciliation

You can configure the connector to designate the target system as a target resource or trusted source.

Note:

You can skip this section if you do not want to designate the target system as a trusted source for reconciliation. As mentioned earlier in this guide, it is recommended that you do not configure the target system as both a trusted source and target resource.

The following is a summary of the steps involved in configuring trusted source reconciliation:

Create a new Lotus Notes-type IT resource as described in Configuring the IT Resource.
Configure the new IT resource properly by using resource parameters that are appropriate for your environment. This configuration is similar to configuring a non-trusted resource.)
Set the Configuration Lookup parameter value to Lookup.Configuration.Domino.Trusted.
Search for the Domino Connector Trusted User Reconciliation scheduled task and set the IT Resource Name value to the name of the IT Resource you just configured in the preceding steps.

Trusted reconciliation should now be configured properly.

2.3.4.3 Changing to the Required Input Locale

Changing to the required input locale (language and country setting) involves installing the required fonts and setting the required input locale.

You may require the assistance of the system administrator to change to the required input locale.

2.3.4.4 Clearing Connector Resource Bundles Content from the Server Cache

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the Oracle Identity Manager database. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

In a command window, switch to the OIM_HOME/server/bin directory.
Note:

You must perform Step 1 before you perform Step 2. An exception is thrown if you run the command described in Step 2 as follows:
```
OIM_HOME/server/bin/SCRIPT_FILE_NAME
```
Enter the following command:
Note:

You can use the PurgeCache utility to purge the cache for any content category. Run PurgeCache.bat CATEGORY_NAME on Microsoft Windows. The CATEGORY_NAME argument represents the name of the content category that must be purged.

For example, the following commands purge Metadata entries from the server cache:

PurgeCache.bat MetaData

On Microsoft Windows: PurgeCache.bat All

When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:
```
t3://OIM_HOST_NAME:OIM_PORT_NUMBER
```
In this format:
- Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.
- Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

2.3.4.5 Enabling Logging in the Java Connector Server

The Connector Server logging is controlled by the logging.properties file under the CONNECTOR_SERVER_HOME/conf folder. This file can be used to edit the properties to enable logging. To do so, perform the following steps:

Open the logging.properties file.
To enable logging for the Lotus Notes/Domino connector, add ORG.IDENTITYCONNECTORS.DOMINO.level=FINEST to the current file.
Save and close the file.
Restart the Java connector server.
The logs will be written to the console or to a file as per the handlers definition.

By default, the logs can be found in the logs/connectorserver%u.log file.

2.3.4.6 Enabling Request-Based Provisioning

Note:

Perform the procedure described in this section only if you want to enable request-based provisioning.

In request-based provisioning, an end user creates a request for a resource or entitlement by using the Administrative and User Console. Administrators or other users can also create requests for a particular user. Requests for a particular resource or entitlement on the resource can be viewed and approved by approvers designated in Oracle Identity Manager.

Note:

Direct provisioning cannot be used if you enable request-based provisioning.

Enabling request-based provisioning involves performing the following procedures:

2.3.4.6.1 Copying Predefined Request Datasets

A request dataset is an XML file that specifies the information to be submitted by the requester during a provisioning operation. Predefined request datasets are shipped with this connector. These datasets specify information about the default set of attributes for which the requester must submit information during a request-based provisioning operation.

Use the Deployment Manager to import the xml/Domino-Datasets.xml file supplied with the Lotus Notes/Domino connector zip file. Then, you can use this xml file in conjunction with the OIM Import Deployment Manager file, to import the necessary datasets for request-based provisioning.

Depending on your requirements, you can modify the file names of the request datasets. In addition, you can modify the information in the request datasets.

2.3.4.6.2 Importing Request Datasets into the MDS

All request datasets must be imported into the metadata store (MDS), which can be done by using the Oracle Identity Manager MDS Import utility.

To import a request dataset definition into the MDS:

Set up the environment for running the MDS Import utility as follows:

Set Environment Variable: Set the OIM_ORACLE_HOME environment variable to the Oracle Identity Management Oracle home directory inside the Middleware home directory. For example, for Microsoft Windows, set the OIM_ORACLE_HOME environment variable to C:\Oracle\Middleware\Oracle_IDM1\ directory.

Set Up the Properties File: Set the necessary properties in the weblogic.properties file, which is located in the same folder as the utilities.

Note:

While setting up the properties in the weblogic.properties file, ensure that the value of the metadata_from_loc property is the parent directory of the /custom/connector/RESOURCE_NAME directory. For example, while performing the procedure in Copying Predefined Request Datasets, if you copy the files to the E:\MyDatasets\custom\connector\Exchng directory, then set the value of the metada_from_loc property to E:\MyDatasets.

Table 2-4 Parameters in the Properties File

Property Name	Description	Notes
wls_servername	Name of the Oracle WebLogic Server on which Oracle Identity Manager is deployed
application_name	The application name	Value is: `oim` if importing/exporting an out-of-the-box event handler. `OIMMetadata` for customizable metadata. If importing or exporting custom data, set application_name to OIMMetadata.
metadata_from_loc	Directory location from which an XML file should be imported. This property is used by weblogicImportMetadata.sh script.	Microsoft Windows paths include // as file or directory separator.
metadata_to_loc	Directory location from which an XML file should be imported. This property is used by weblogicExportMetadata.sh script.	Microsoft Windows paths include // as file or directory separator.
metadata_files	Full path and name of an XML file. This property is used by weblogicExportMetadata.sh and weblogicDeleteMetadata.sh scripts.	For example, you may specify /file/User.xml to export a user entity definition. You can indicate multiple xml files as comma-separated values.

In a command window, change to the OIM_HOME/server/bin directory.
Run the following command:
```
weblogicImportMetadata.bat
```
When prompted, enter values for the following:
- Please enter your username [weblogic]
  
  Enter the user name used to log in to Oracle WebLogic Server.
  
  Sample value: WL_User
- Please enter your password [weblogic]
  
  Enter the password used to log in to Oracle WebLogic Server.
- Please enter your server URL [t3://localhost:7001]
  
  Enter the URL of the application server in the following format:
  
  t3://HOST_NAME_IP_ADDRESS:PORT
  
  In this format, replace:
  
  - HOST_NAME_IP_ADDRESS with the host name or IP address of the computer on which Oracle Identity Manager is installed.
  
  - PORT with the port on which Oracle Identity Manager is listening.
The request dataset is imported into the MDS.

2.3.4.6.3 Enabling the Auto Save Form Feature

To enable the Auto Save Form feature:

Log in to the Design Console.
Expand Process Management, and then double-click Process Definition.
Search for and open the Lotus User process definition.
Select the Auto Save Form check box.
Click the Save icon.

2.3.4.6.4 Running the PurgeCache Utility

Run the PurgeCache utility to clear content belonging to the Metadata category from the server cache. See Clearing Connector Resource Bundles Content from the Server Cache for instructions.

The procedure to enable request-based provisioning ends with this step.

2.3.4.7 Enabling IT Resource Name Values in the Process Form

IT Resource Name values are not populated in the process form after target reconciliation by default. To configure the process form to include these values, perform the following steps:

From the Design Console:

Locate the Lotus User resource object.
Click the Object Reconciliation tab.
Double-click the Server name reconciliation field and change the field name to IT Resource Name. Save it.
Locate the Lotus User process definition.
Click the Reconciliation Field Mapping tab.
Ensure the IT Resource Name field is correctly mapped to the UD_LOTUS_SERVER NAME.
Return to the Lotus User resource object and then to the Object Reconciliation tab.
Click Create Reconciliation Profile.

2.3.5 Configuring the Target System

To configure the target system, you must create a Deny Access Group.

This section discusses the following topics:

2.3.5.1 Creating a Deny Access Group

If there is no Deny Access group on the IBM Lotus Notes and Domino installation, then you must create one as follows:

Log in to the Lotus Notes client as the administrator.
On the People & Groups tab, click the Groups folder on the left pane.
Click Add Group.
On the New Group tab, provide the following values:
- Group name: Specify a name for the group, for example, noaccess.
- Group type: Select Deny List Only.
Click Save & Close.
On the Configuration tab, click All Server Documents on the left pane.
On the right pane, double-click the row for the server that you are using.
Open the Security tab.
In the Server Access section, double-click Not Access Server.
In the Select Names dialog box, use the Add button to add the group that you create in Step 4 and then click OK.
Click Save & Close.
To view the Deny Access group that you created, perform Steps 6 through 9.

2.3.5.2 Disabling a User Account

When you configure the IT resource, you specify the name of the Deny Access group (for example, noaccess) that you created in Step 4 of Creating a Deny Access Groupas the value of the disableDenyGroup IT resource parameter.

To disable a user account in the connector, you specify the disableDenyGroup in the IT resource. If this parameter is not set in the IT resource, then when you disable a user the connector sets the Check Password user attribute to Lockout ID.

When you disable a user account, the user automatically becomes a member of a Deny Access group. When you reenable the user account, the user is removed from the Deny Access group.

2.3.6 Creating the IT Resource for the Connector Server

To create the IT resource for the Connector Server:

Log in to the Administrative and User Console.
On the Welcome to Oracle Identity Manager Self Service page, click Advanced.
On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration region, click Create IT Resource.
On the Step 1: Provide IT Resource Information page, perform the following steps:
- IT Resource Name: Enter a name for the IT resource.
- IT Resource Type: Select Connector Server from the IT Resource Type list.
- Remote Manager: Do not enter a value in this field.
Click Continue. Figure 2-6 shows the IT resource values added on the Create IT Resource page.

Figure 2-6 Step 1: Provide IT Resource Information

Description of "Figure 2-6 Step 1: Provide IT Resource Information"

On the Step 2: Specify IT Resource Parameter Values page, specify values for the parameters of the IT resource and then click Continue. Figure 2-7 shows the Step 2: Specify IT Resource Parameter Values page.

Figure 2-7 Step 2: Specify IT Resource Parameter Values

Description of "Figure 2-7 Step 2: Specify IT Resource Parameter Values"

Table 2-5 provides information about the parameters of the IT resource.

Table 2-5 Parameters of the IT Resource for the Connector Server

Parameter	Description
Host	Enter the host name or IP address of the computer hosting the connector server. Sample value: `RManager`
Key	Enter the key for the Java connector server.
Port	Enter the number of the port at which the connector server is listening. Default value: `8759`
Timeout	Enter an integer value which specifies the number of milliseconds after which the connection between the connector server and Oracle Identity Manager times out. Sample value: `300`
UseSSL	Enter `true` to specify that you will configure SSL between Oracle Identity Manager and the Connector Server. Otherwise, enter `false.` Default value: `false` Note: It is recommended that you configure SSL to secure communication with the connector server. To configure SSL, run the connector server by using the /setKey [`key`] option. The value of this key must be specified as the value of the Key IT resource parameter of the connector server.

On the Step 3: Set Access Permission to IT Resource page, the SYSTEM ADMINISTRATORS group is displayed by default in the list of groups that have Read, Write, and Delete permissions on the IT resource that you are creating.

Note:

This step is optional.

If you want to assign groups to the IT resource and set access permissions for the groups, then:
1. Click Assign Group.
2. For the groups that you want to assign to the IT resource, select Assign and the access permissions that you want to set. For example, if you want to assign the ALL USERS group and set the Read and Write permissions to this group, then you must select the respective check boxes in the row, as well as the Assign check box, for this group.
3. Click Assign.
On the Step 3: Set Access Permission to IT Resource page, if you want to modify the access permissions of groups assigned to the IT resource, then:
Note:
- This step is optional.
- You cannot modify the access permissions of the SYSTEM ADMINISTRATORS group. You can modify the access permissions of only other groups that you assign to the IT resource.
1. Click Update Permissions.
2. Depending on whether you want to set or remove specific access permissions for groups displayed on this page, select or deselect the corresponding check boxes.
3. Click Update.
On the Step 3: Set Access Permission to IT Resource page, if you want to unassign a group from the IT resource, then:
Note:
- This step is optional.
- You cannot unassign the SYSTEM ADMINISTRATORS group. You can unassign only other groups that you assign to the IT resource.
1. Select the Unassign check box for the group that you want to unassign.
2. Click Unassign.
Click Continue. Figure 2-8 shows the Step 3: Set Access Permission to IT Resource page.

Figure 2-8 Step 3: Set Access Permission to IT Resource

Description of "Figure 2-8 Step 3: Set Access Permission to IT Resource"
On the Step 4: Verify IT Resource Details page, review the information that you provided on the first, second, and third pages. If you want to make changes in the data entered on any page, click Back to revisit the page and then make the required changes.
To proceed with the creation of the IT resource, click Continue. Figure 2-9 shows Step 4: Verify IT Resource Details page.

Figure 2-9 Step 4: Verify IT Resource Details

Description of "Figure 2-9 Step 4: Verify IT Resource Details"
The Step 5: IT Resource Connection Result page displays the results of a connectivity test that is run using the IT resource information. If the test is successful, then click Continue. If the test fails, then you can perform one of the following steps:
- Click Back to revisit the previous pages and then make corrections in the IT resource creation information.
- Click Cancel to stop the procedure, and then begin from the first step onward.
  
  Figure 2-10 shows the Step 5: IT Resource Connection Result page.
  
  Figure 2-10 Step 5: IT Resource Connection Result
  
  Description of "Figure 2-10 Step 5: IT Resource Connection Result"
Click Finish. Figure 2-11 shows the IT Resource Created Page.

Figure 2-11 Step 6: IT Resource Created

Description of "Figure 2-11 Step 6: IT Resource Created"

2.4 Upgrading the Connector

If you need to upgrade the OIM Lotus Notes/Domino connector from earlier versions to version Release 11.1.1.6.0, see Upgrading Connectors in Oracle Fusion Middleware Administering Oracle Identity Manager for instructions.

Note:

For 11g R2 or later, a new UI form has to be created to see the upgraded fields. For steps to create a new UI form, follow post install section. After the creating the new UI form, modify the existing Application Instance with newly created UI form.

You can perform the upgrade process while in production, and with no downtime. Your customizations will remain intact and the upgrade should be transparent to your users.

Note:

During upgrade, you must keep the Trusted objects (resource object and process) as unmapped (map it to None).

2.5 Defining a Connector

You can use the Administrative and User Console to define a customized or reconfigured connector. Defining a connector is equivalent to registering the connector with Oracle Identity Manager.

A connector is automatically defined when you install it using the Install Connectors feature or when you upgrade it using the Upgrade Connectors feature. You must manually define a connector if:

You import the connector using the Deployment Manager.
You customize or reconfigure the connector.
You upgrade Oracle Identity Manager.

When you define a connector, the following events take place:

A record representing the connector is created in the Oracle Identity Manager database.

If this record already exists, then it is updated.
The status of the newly defined connector is set to Active. In addition, the status of a previously installed release of the same connector automatically is set to Inactive.

See Defining Connectors in Oracle Fusion Middleware Administering Oracle Identity Manager for detailed information about the procedure to define connectors.