Self Service User Profile Modifications

As we are completing our configuration for deployment, we noticed the the attributes that a person can modify on their profile by default is more than we wanted to allow. For example since we use our HR system as our system of record for names, we did not want a person being able to change their name through OIM. The OOTB policy allows all users to edit their Name, Email Address, and Display Names. All of which we did not want them to be able to do.

Since this is an OOTB authorization policy, it can't be edited in the OIM UI nor overridden. By creating another policy we were able to add attributes to edit, but not disallow those already permitted. In looking around we located where the OOTB policies are defined and the ant scripts that load the policies into the embedded OES server. By commenting out the unwanted attributes and running the appropriate ant target we were able to remove the ability to self modify the attributes.

This is not a supported solution and you will need to be careful each time you patch the server to ensure the policy is updated correctly. (FYI: We have filed an enhancement request to have this changed to be the default policy.)

With that caution here goes:

In the ORACLE_HOME/server/seed_data/Seed/OESPolicies directory, you can locate the SelfServiceUserManagementPolicies.xml file. Make a copy of this for posterity and open it for editing in your favorite tool.

The offending section is right at the top, simply comment out the attributes you don't want to be editable.





Next, setup your environment as you would for patching by exporting the WL_HOME, ANT_HOME, OIM_ORACLE_HOME, and ORACLE_HOME paths.

In the ORACLE_HOME/server/bin directory make a copy of the weblogic.profile and patch_weblogic.sh files. Edit your copies and change the profile to that of your copy and the ant target to update-oes-ootb-polices. I had to add an additional entry to the profile for the OIM DB password in order to get it to work, hence the copy. So in your profile copy add the entry OIM.DBPassword=. Run the script, it does take some time to update the OES policies. Once done, you can go into the UI and verify that it removed those attributes.