|
Oracle® Identity Management Guide to Delegated Administration
10g Release 2 (10.1.2) B14086-01 |
|
 Previous |
 Next |
|
Oracle® Identity Management Guide to Delegated Administration
10g Release 2 (10.1.2) B14086-01 |
|
|
Previous |
Next |
This appendix lists and describes the various windows, fields, and control devices in the Oracle Internet Directory Self-Service Console.
This section lists and describes the windows and fields in the Self-Service Console. It contains these topics:
Use this window to view and add attributes for user entries.
Table A-1 Add New Attributes Window
| Field | Description |
|---|---|
| Directory Attribute Name | The attribute name |
| UI Label | Specify the friendly name of the attribute to be displayed in the user interface. For example, you can display the sn attribute as Last Name in the interface.
|
| Required Field? | Specify whether you want the attribute to be required in user creation and modification. Required attributes appear in the interface with an asterisk (*) to the left of the field. If you do not select this check box, then the attribute is optional. |
| Viewable | Specify whether you want the attribute to appear in search results by selecting this check box. |
| Self-Editable | Specify whether the end user can modify the value for this attribute in his or her own entry by using the Edit My Profile window. |
| Password Reset Validation | Select to specify that this attribute can be used to validate the user if the user forgets his or her password. |
| Searchable | By default, when a user enters a search request, the Oracle Internet Directory Self-Service Console searches based on the cn, firstname, lastname, and e-mail attributes. You can customize the attributes that can be searchable. For example, if you want to enable searching based on the attribute you are adding, then select this check box. The only restriction is that, to be searchable, the attribute must be cataloged.
|
| UI Type | Specify the type of interface for this field. Options are:
|
Use this window to specify access rights for a group entry.
Table A-2 Assign Privileges to Group Window
| Privilege | Description of Access Granted |
|---|---|
| Allow group creation | Create group entries |
| Allow group editing | Modify group entries |
| Allow group deletion | Delete group entries |
| Allow privilege assignment to groups | Assign access rights to groups |
| Allow service management | Enable group members to manage services for users. If this is selected, then a Services link becomes available in the Directory tab page when the latter is accessed by group members. |
| Allow account management | Enable group members to manage services for users. If this is selected, then an Accounts link becomes available in the Directory tab page when the latter is accessed by group members. |
| Allow Oracle Delegated Administration Services configuration | Configure Oracle Delegated Administration Services user interface |
Use this window to specify access rights for a user entry.
Table A-3 Assign Privileges to User Window
| Privilege | Description of Access Granted |
|---|---|
| Allow user creation | Create user entries |
| Allow user editing | Modify user entries |
| Allow user deletion | Delete user entries |
| Allow group creation | Create group entries |
| Allow group editing | Modify group entries |
| Allow group deletion | Delete group entries |
| Allow privilege assignment to users | Assign access rights to users |
| Allow privilege assignment to groups | Assign access rights to groups |
| Allow service management | Enable group members to manage services for users. If this is selected, then a Services link becomes available in the Directory tab page when the latter is accessed by group members. |
| Allow account management | Enable group members to manage services for users. If this is selected, then an Accounts link becomes available in the Directory tab page when the latter is accessed by group members. |
| Allow Oracle Delegated Administration Services configuration | Configure Oracle Delegated Administration Services user interface |
| Allow resource management for Oracle Reports- and Forms-based applications | Enable users to configure resources--such as databases or applications--to which access is allowed |
Use this window to change the password of the Oracle component you previously selected in the Change My Password window. The new password you specify must conform to any relevant password policy set by the administrator.
To change your password to another Oracle component that is not enabled for Oracle Application Server Single Sign-On:
In the Application Passwords section, select the Oracle component for which you want to specify a new password.
Choose Update Password. This displays the Change Application Password window.
In the New Password field, enter your new password, then confirm it in the Confirm New Password field. Note that the new password you specify must conform to any relevant password policy set by the component administrator.
Choose Submit.
This window enables you to change your passwords for OracleAS Single Sign-On and various Oracle components. Note that the new password you specify must conform to any relevant password policy set by the administrator.
To change your password to Oracle Application Server Single Sign-On:
In the Single Sign-On section, in the Old Password field, enter your current password.
In the New Password field, enter your new password, then confirm it by entering it again in the Confirm New Password field.
In the Password Reset section, in the Password Reset Hint field, enter a question—for example, your mother's maiden name. If you later forget your password, then you will be asked this question. If your answer is correct, then your password will be retrieved for you.
In the Answer to Password Hint field, enter the answer to the hint you just entered in the previous field.
Choose Submit.
|
Note: When you enter an answer to your password hint in the Answer to Password Hint field, be sure to remember the answer exactly as you entered it, including extra spaces, additional hyphens, or capitalizations. If you have to provide the answer later on, then any deviations from what you are now specifying will cause the password reset to fail. |
If any Oracle component has enabled you to change your password to that component, then the Application Passwords section appears in this window.
To change the password for an Oracle component:
In the Application Passwords section, select the component, then choose Update Password. This displays the Change Application Password window.
Enter and confirm the new password.
Use this window to customize the way that categories of attributes are displayed to a user who is adding or modifying an entry. Specifically, you can use this window to customize the name of each category and the order in which it is displayed.
To create a new category, choose Create. This displays the Create Category window, which prompts you for the UI label--that is, the name of the category as it is displayed to the user.
To order the categories, choose Order Category. The Order Category window displays a list of the categories. You can rank the categories by using the up and down arrow buttons to the right of the list.
To set the display order of attributes for each category, or to remove an attribute from being displayed, select the category, then choose Edit. In the Order Category window, use the arrow buttons to make your changes.
To delete a category, select it, then choose Delete.
Use this window to specify the roles that users can assign to others.
To enable users to assign roles to users, in the Enable Roles category, select Enable Role assignment in the user management interface.
To add a role that users can assign to other users:
Choose Add Role to display the Search and Select: Role window.
In the Group Name Begins With field, enter the first few letters of the name of the administrative group you want to add.
From the search results, select the name of the administrative group you want to add, then choose Select. This returns you to the Configure Roles window. The administrative group you just selected appears in the Roles list.
When a user performs a search, the results are displayed in a table. Use this window to specify the number of columns in that table and their headings.
To configure search table columns:
In the All Attributes box, select one or more attributes that you want to be represented in the search results. These will serve as column headings in the search results table.
Use the left-right arrows to move the attributes to the Selected Attributes box.
In the Selected Attributes box, order the attributes by using the up-down arrows to the right of the box. The first attribute in the list represents the column farthest to the left in the search results table.
Use this window to view, add, modify, and delete attributes for user entries.
Table A-4 Configure User Attributes Window
| Field | Description |
|---|---|
| Directory Attribute Name | The attribute name |
| UI Label | Specify the friendly name of the attribute to be displayed in the user interface. For example, you can display the sn attribute as Last Name in the interface.
|
| Required Field? | Specify whether you want the attribute to be required in user creation and modification. Required attributes appear in the interface with an asterisk (*) to the left of the field. If you do not select this check box, then the attribute is optional. |
| Viewable | Specify whether you want the attribute to appear in search results by selecting this check box. |
| Self-Editable | Specify whether the end user can modify the value for this attribute in his or her own entry by using the Edit My Profile window. |
| Password Reset Validation | Select to specify that this attribute can be used to validate the user if the user forgets his or her password. |
| Searchable | By default, when a user enters a search request, the Oracle Internet Directory Self-Service Console searches based on the cn, firstname, lastname, and e-mail attributes. You can customize the attributes that can be searchable. For example, if you want to enable searching based on the attribute you are adding, then select this check box. The only restriction is that, to be searchable, the attribute must be cataloged.
|
| UI Type | Specify the type of interface for this field. Options are:
|
When you create user entries, use this window to view and add the object classes.
This window displays the object classes commonly associated with user entries. To add other object classes to a user entry, choose Add Object Class.
If you forget and want to reset your password, then use this window to provide information that the server can use to validate your identity.
If you set your password hint, then this window asks you a question based on that hint. Enter the answer to the password hint you specified.
If you did not previously set a password hint, then this window prompts you for other personal data as configured by your administrator.
If you want to delete a group entry, this window prompts you to confirm the deletion. Choose Yes or No.
When creating a new attribute category, use this window to specify the UI Label—that is, the name of the category as it is displayed to the user.
Use this window to create a group entry. You must enter information in all fields preceded by an asterisk (*). The fields are:
Table A-5 Create Group Window
| Field | Description |
|---|---|
| Basic Information |
|
| Name | Enter a name for this group. This will be used as the RDN for this group. |
| Display Name | Enter a friendly name for this group. For example, if the RDN is OracleDBCreators, then you could enter the display name as Oracle Database Creators.
|
| Description | (Optional) Enter a brief description of this group. |
| Group Visibility | To hide this group from all but its owners, select Private. Otherwise, accept the default, Public. |
| Make this group privileged. | Select this box if you want to assign privileges to this group. You cannot assign privileges to a non-privileged group. |
| Owners | Use this section to add or remove owners of this group.
To add a user as an owner of this group:
To add a group as an owner of this group:
To remove a user or group as an owner of this group, select the user or group, then choose Remove. |
| Members | Use this section to configure members of this group.
To add a user as a member of this group:
To remove a user from this group, in the Members section, select the user's name and choose Remove. To add a group as a member of this group:
|
| Roles Assignment | Use this section to assign roles to this group.
To specify the roles that you want to assign to this group, in the Roles Assignment section, in the Select column, select the role that you want to assign to this group. To remove the role from the group, in the Roles Assignment section, in the Select column, deselect the role that you want to remove from this group. |
As the administrator for a service provider, you can use this window to create a new Identity Management Realm entry that includes the following information:
The name of the realm and that of the contact person for it
The display of realm and product logos
Table A-6 Create Identity Management Realm Window
| Field | Description |
|---|---|
| Basic Information |
|
| Realm Name | Enter a relatively short version of the name of the realm for this realm. The name you enter is used to create the DN for this realm entry. This field is mandatory. |
| Realm Contact | Enter the name of the person to contact for any issues regarding this realm. |
| Description | Enter any additional information about this realm. This field is optional. |
| Logo Management |
|
| Enable Realm Logo | Select to display the realm logo on the Identity Management Realm Configuration window. |
| Enable Product Logo | Select to display the product logo on the Identity Management Realm Configuration window.
Note: If both Enable Realm Logo and Enable Product Logo are selected, then the realm logo appears at the top, with the product logo beneath it. |
| Update Realm Logo | Enter the path and file name of the logo for this realm or, alternatively, navigate to it by choosing Browse. |
If you have the correct privileges, then you can use the Create Resource Type window to create a resource type.
Table A-7 Create Resource Type Window
| Property | Description |
|---|---|
| Display Name | Name to be used when the resource type appears in the user interface. |
| Description | Textual description that explains the purpose of the resource type and any other information you want to enter for it. |
| Authentication Class | Leave this field blank. |
| Connection String | Format for constructing the connection string using the values stored in Oracle Internet Directory for the resource. For example:
|
| User Name/ID Field Name | Display name of the user name field that appears on the Create Resource window when a user creates new resource access information. Typically, this display name is something like "Username" or "User Name". |
| Password Field Name | Display name of the password field in the Create Resource window. Typically, this display name is "Password". |
| Additional Fields | Display name of the additional fields displayed in the Create Resource window beyond user name and password. For example, you might use one of these fields to contain a server or domain name. Typically, this display name is descriptive of the field contents, such as "Server" or "Domain". |
Use this window to create a user entry by providing appropriate information in the various fields. You must enter information in all fields preceded by an asterisk (*).
In this window, some of the sections are unique to your environment, others are integral to the Self-Service Console. The latter are:
Roles Assignment, which enables you to assign one or more roles to this user
Resource Access Information, which enables you to grant this user access to resources specific to Oracle Forms and Oracle Reports.
Enter values in the fields unique to your environment.
|
Note: You cannot use a tilde (~) in a user name. |
To enter values for fields that are integral to Self-Service Console:
In the Roles Assignment section, in the Select column, select the role that you want to assign to this user.
In the Resource Access Information section, in the Select column, select the resource to which you want this user to have access. If no resource access information has been specified, then you can create it. To do this:
In the Resource Access Information section, choose Create. The Create Resource window appears.
In the Resource Name field, specify the name of the resource or service to be accessed by the component on your behalf.
From the Resource Type list, select the type of resource to be accessed. Default options are: OracleDB (an Oracle9i Database Server). ExpressPDS (Oracle Express Pluggable Data Source), and JDBCPDS (Java Database Connectivity Pluggable Data Source). Other resource types may appear in this list as specified by the administrator.
Choose Next. The Resource Access Information window appears.
In the Resource Access Information window, enter the appropriate information.
Verify that you have entered all information correctly, then choose Submit.
Use this window to edit a group entry. You must enter information in all fields preceded by an asterisk (*).
Use this window to change the information in your profile. You must enter a value in any field marked with an asterisk (*).
Use this window to edit a subscription list for a service recipient.
In the Service Recipient field, give this recipient a name.
In the Start Date field, specify the date on which the recipient can begin using the service, and, in the End Date field, the date on which that usage ends.
To add users to the subscription list:
Choose Add User. This displays the Search and Select window.
In the Search and Select window, perform a search for the user you want to add to the list.
From the search results, select the user you want to add, then choose Select.
To remove a user from the subscription list, select the user, then choose Remove.
From this window, you can add, modify, or delete the subscription list for a service recipient.
Use this window to:
Modify values in a user entry
Specify resource access information for a user
See a list of groups that this user is a member of
Use this window to find and modify information about a user entry.
Table A-8 Editing Attribute Window
| Field | Description |
|---|---|
| UI Label | Specify the friendly name of the attribute to be displayed in the user interface. For example, you can display the sn attribute as Last Name in the interface.
|
| Required Field | Specify whether you want the attribute to be required in user creation and modification. Required attributes appear in the interface with an asterisk (*) to the left of the field. If you do not select this check box, then the attribute is optional. |
| Viewable | Specify whether you want the attribute to appear in search results by selecting this check box. |
| Self-Editable | Specify whether the end user can modify the value for this attribute in his or her own entry by using the Edit My Profile window. |
| Password Reset Validation | Select to specify that this attribute can be used to validate the user if the user forgets his or her password. |
| Searchable | By default, when a user enters a search request, the Oracle Internet Directory Self-Service Console searches based on the cn, firstname, lastname, and e-mail attributes. You can customize the attributes that can be searchable. For example, if you want to enable searching based on the attribute you are editing, then select this checkbox.The only restriction is that, to be searchable, the attribute must be cataloged.
|
| UI Type | Specify the type of interface for this field. Options are:
|
Use this window to configure the entry for an identity management realm.
Table A-9 Identity Management Realm Window
| Field | Description |
|---|---|
| Directory Configuration |
|
| Attribute for Login Name | Enter the attribute by which you want users to identify themselves when they log in--for example, UID, EmployeeNumber, SSN.
This is the attribute that uniquely identifies the user. Oracle Application Server Single Sign-On locates the user by using this attribute during login. When you make changes to this attribute, be sure that the user entries contain this attribute and are unique. You can enforce the uniqueness by setting up an attribute uniqueness constraint on this attribute under the user search base. This field is mandatory. |
| Attribute for RDN | The attribute used for creating the RDN component of the user entry. The value you enter for this field should not be the same as the value you entered in the Attribute for Login Name field. |
| User Search Base | Enter the DN of the entry under which the user entries for this realm are located.Make sure you enter the valid DN and users are present under this context. Oracle Application Server Single Sign-On looks for users under this context during user login.
Also, be sure that all the ACLs are set up properly. Any discrepancy among the ACLs will disrupt either the login process or the behavior of Oracle Internet Directory Self-Service Console. This field is mandatory. |
| User Creation Base | Enter the DN of the entry under which to create users for this realm. This should be the same as that for the user search base.
If you want to distribute the users under different contexts under the user search base, then you can set this value to be different than that of the user search base. In either case, this DN should be either that of the user search base, or of a context under the user search base. For example, if the user search base is
Note: The Oracle Internet Directory Self-Service Console expects these contexts to be present and the privileges under these contexts to be set correctly. |
| Group Search Base | Enter the DN of the entry under which group entries for this realm are located. This field is mandatory. |
| Group Creation Base | Enter the DN of the entry under which to create groups for this realm |
| Search Return Limit | Enter the maximum number to be displayed in a search. This field is mandatory. |
| Logo Management |
|
| Enable Realm Logo | Select to display the realm logo on the Identity Management Realm Configuration window. |
| Enable Product Logo | Select to display the product logo on the Identity Management Realm Configuration window.
Note: If both Enable Realm Logo and Enable Product Logo are selected, then the realm logo appears at the top, with the product logo beneath it. |
| Update Realm Logo | Enter the path and file name of the logo for this realm or, alternatively, navigate to it by choosing Browse. |
If you have the administrative privileges, then you can use this window to create or modify a subscriber entry.
To create an entry for a new subscriber, choose Create. This displays the Create Identity Management Realm window.
To modify an entry for an existing subscriber, in the Search Realm field enter all or part of the subscriber's name, then choose Go. This displays the results of your search. Select the subscriber whose realm you want to modify, then choose Proceed.
If you have the necessary privileges, then you can use this window to edit the information in a group entry or to delete a group. The appropriate buttons appear depending on your privileges.
This window appears if your deployment of the Self-Service Console is enabled for OracleAS Single Sign-On. Use it to enter your OracleAS Single Sign-On user name and password.
When a user creates or edits her entry, the interface displays various categories—for example, one category might simply be "Basic Information," and another might be "Telephone Numbers." Each category prompts the user for values for various attributes. For example, the "Basic Information" category could prompt for first and last names, home address, zip code, and department; the "Telephone Numbers" category could prompt for home phone, work phone, mobile phone, and fax.
Use the arrows in this window to set the order in which attributes for a given category are displayed. You can use the Remove and Remove All arrows to remove one or all attributes from the list displayed to the user.
Use this window to locate yourself within the hierarchy of your organization. To see the entries under a name, choose the plus sign (+) next to that name. To see details for a given entry, choose the entry.
If you forget your password, then you can reset it by first filling in the fields on this page. This information is used to identify you to the server.
If you forget and want to reset your password, then use this window to enter a new password and then confirm it.
Use this window to specify resource access information for a user. More specifically, use it to specify the username and password and the name of the database that you want the user to access.
Use this window to search for group entries in the directory. If you have the appropriate privileges, then you can also use it to create group entries.
Use this window to search for user entries in the directory. If you have the appropriate privileges, you can also use it to create user entries.
This window lists the various services available in your domain. You can choose the appropriate button to:
Edit Services—that is, change the display name and network for each service
Edit Subscriptions—that is, specify service recipients, the users on their respective subscription lists, and the timeframe within which those users can access the services.
Use this window to change the setting for your time zone. To do this, select the time zone from the list, then choose Submit.
This window enables you to view the configuration settings of an identity management realm.
Table A-10 View Identity Management Realm Window
| Field | Description |
|---|---|
| Basic Information |
|
| Realm Name | Enter a relatively short version of the name of the realm for this realm. The name you enter is used to create the DN for this realm entry. This field is mandatory. |
| Realm Contact | Enter the name of the person to contact for any issues regarding this realm. |
| Description | Enter any additional information about this realm. This field is optional. |
| Logo Management |
|
| Enable Realm Logo | Select to display the realm logo on the Identity Management Realm Configuration window. |
| Enable Product Logo | Select to display the product logo on the Identity Management Realm Configuration window.
Note: If both Enable Realm Logo and Enable Product Logo are selected, then the realm logo appears at the top, with the product logo beneath it. |
| Update Realm Logo | Enter the path and file name of the logo for this realm or, alternatively, navigate to it by choosing Browse. |
This window displays the latest information you provided about yourself. To change this information, choose Edit My Profile.
|
Note: To refresh this window with the latest information in the server, choose Refresh My Profile. Do not use the refresh or reload button on your browser, which simply refreshes with information from the mid-tier cache and not from the server. |
The tabs in the window can help you navigate the directory.
The My Profile tab page displays directory information about yourself and enables you to change your OracleAS Single Sign-On password.
The Directory tab page enables you to search for user entries and other information in the directory.
The Configuration tab enables administrators to configure the directory and add or remove directory information.
If your deployment of the Self-Service Console is enabled for OracleAS Single Sign-On, and if you are not yet logged in, then selecting any of these tabs displays the OracleAS Single Sign-On log-in window.
