LDAP Sync Config Gotcha

Ran into a small gotcha while configuring the LDAP Sync for OIM. In step 13.7 of the Enterprise Deployment guide you are setting the LDAPSync parameters while running the OIM configuration utility. The docs seem to indicate that you are only entering a relative DN for the users and roles containers, that the rest of the DN root is defined elsewhere. We were getting errors creating new users after configuring it this way, we realized it must not be building the full correct DN for new users.

To repair, export /db/LDAPContainerRules.xml from the metadata repository and change the containers from just the 'cn=Users' to the full dn root 'cn=Users,dc=company,dc=com' and likewise for the Roles. Reimport and you should be all set.

Looking for OIM xlconfig.xml in 11g?

The new OIM stores its metadata config files in the database so you have to export it, edit, and re-import the file.

I found documentation on how to accomplish this in section 17.5.6 in the Enterprise Deployment Guide via command line. You can also perform the operation using Enterprise Manager by following section 18.2 in the OIM System Administration guide.

Installing OIM/OID/OVD 11g

We have successfully installed our development environment. We have two mid-tier nodes running in the current setup.

Node One:
WL AdminServer and Enterprise Manager
OIM/SOA

Node Two:
OID
OVD
ODSM

I found the best installation instructions that covered the gotchas was the Enterprise Deployment Guide for Identity Management. There are a couple of steps the basic installation guide misses that may cause issues when you add OIM into the same domain. Section 4.7.6 in the enterprise guide in particular.

Eric

IdM 11G!

It has been awhile since I've posted, but we are up to some exciting things here and I want to use this platform to provide some information, lessons learned, and other information as we begin our work toward a full upgrade/re-implementation of the IDM/IAM 11g Stack.

We have decided rather than try to upgrade to the 11g versions, we are going to take this opportunity to use all of the information and things we have learned over our 10g setups to re-implement on 11g. This will give us many benefits, not the least of which is parallelism, ability to gradually phase in new versions, new hardware/OS/database setups. As well as the many things we have learned how to do better, things we thought we would use and never did, overly complicated groups and attributes, etc.

Additional as we are replacing our main ERP system as a parallel project, this will give us the opportunity to have our OIM11g installation uncluttered with old, unused connectors and interfaces.

We have started installing our development environment and the installation is fairly straight forward.

Stay tuned!

OIM Connector for Live@edu

We have successfully created a SPML wrapper for the live@edu provisioning services to allow OIM to manage live@edu accounts using the Generic Technology Connector (GTC). It works well, fast easy to customize for your attribute needs. Does require a Windows 2008 Server or equivalent due to Microsoft requirements, but your OIM can run on any of it's supported platforms.

Manually Starting/Stopping the Scheduler Service

We found a very useful web page that allows you to stop and start the scheduler service without restarting the entire OIM mid-tier. Useful when you have a run-away task you need to kill without bringing everything down.

http://yourmidtierhost.com/xlScheduler/admin

You can use the system administrator username and password to stop and restart the service.

Enjoy!

10G Database Flashback, a must have!

I would highly recommend when installing the database for your OIM implementations that you enable, configure, and test the Flashback point-in-time recovery system within your 10g database. The import process, while an incredible time-saver for managing multiple environments, has a tendency to corrupt things from time to time. Specifically we have noticed that importing an updated process form that contains child forms tends to not function properly and can cause loss of the entire form configuration.

Flashback will allow your DBA to quickly recover your OIM database to the point just prior to your import attempt, saving you much heartache, pain, tears, and other such issues.