Bundle Patch 1 for OIM 11.1.1.3 is now Available

The first bundle patch for OIM 11.1.1.3 has been released on My Oracle Support. Has quite a number of fixes listed.

Entity Adapters on the USR Data Form

Just received word from Oracle that Entity Adapters/Rule Generators in OIM 11g are no longer usable on the USR form, you must create these using the new EventHandler mechanism.

Trusted Reconciliations

There have been some important changes in the Trusted Reconciliation processes for bringing in new accounts/changed accounts from some system of record such as an HR system using the Generic Technology Connector or custom reconciliation connectors.

The default mechanism for reconciliations is now a batched reconciliation, this processes many changed records much faster than before but also has some limitations. If you were previously using pre-insert or pre-update entity adapters, these will NOT fire in a batched reconciliation. The GTC in trusted reconciliation uses the batched mode exclusively and I have not yet identified a way to switch it to one-off events. This is important in that if you use pre adapters to calculate or modify certain values on the User form such as login, email address, expiration dates, etc. they won't trigger. You either have to switch these to a post operation which may cause a potential infinite loop condition or avoid batched mode.

If you use the APIs and/or a connector that creates reconciliation records then you have the ability to use a non-batched operation. In this mode, the pre entity adapters DO fire. Additionally pre adapters DO trigger on manual operations through the UI. In order to force a non-batched recon event. You must call the API method processReconciliationEvent after creating and/or finishing your event.

As in:

tcReconciliationOperationsIntf reconObj = Platform.getService(Thor.API.Operations.tcReconciliationOperationsIntf.class);

long rceKey = createReconciliationEvent("Resource Object Name", HashMap of attributes, true);
processReconciliationEvent(rceKey);

UPDATE:
You also need to close the event with a:
closeReconciliationEvent (rceKey);
or the batch will attempt to redo the linking when it executes. This will cause a failed orchestration task to linger out there.

In the next post, I'll give a concrete example of how to do a pre-modify EventHandler to compute some attributes.

Changes in Reconciliations

OIM 11g has brought many changes in the reconciliation engine. Many of the changes are to improve performance and streamline the recon process. For those of us familiar with or using OIM 9.1 some of these changes will require some thought as to how to migrate processes over. I will be detailing some of the differences and how we have tackled them in the next few posts.

User Defined Attributes and GTC

When creating UDFs for the User form, Don't use spaces in the Name. Instead of Student Expiration Date, use Student_Expiration_Date for example. The GTC seems to have a hard time making the translation to the actual DB column name if you don't. I tried working with the customResource bundles in order to fix this, but no combination I tried seemed to work. I also tried editing the Process using the design console, but that just caused other issues. Only way I could get it to recon properly was with UDFs names without spaces.

If you do this, you will have ugly names on your User forms in the UI. Additionally if you need to localize for other languages, the way to add the localizations is somewhat obscure. You need to locate the IdentityTaskFlow.jar in your ORACLE_HOME/server/apps/oim.ear/admin.war/WEB-INF/lib directory. Inside this jar you will find the various language resource bundles at oracle/iam/identitytaskflow/resources/UserAttributes_en.properties and so on.

Extract this file. Add your UDF Names to Localization mappings to the file. The key should be in all lower case to work properly.

For example the above item would be added as:
student_expiration_date=Student Expiration Date

Update the jar and restart the OIM instance. Your UI should now reflect the localized names for your UDF fields!

Default SOA Workflows

I'm not sure if we ran into an installer thing, or something else, however while testing the approval workflows we were getting consistent failures. When we looked into it, the default SOA composites for the out of box workflows were not deployed to the SOA instance.

These are located in your ORACLE_HOME for OIM at ORACLE_HOME/server/workflows/composites. They are already registered with OIM, just not deployed into SOA. You can either extract the jar files from the zips in the above directory and deploy via the Enterprise Manager console or extract the zips and open with JDeveloper and deploy that way. Which ever you are more comfortable with. We used JDeveloper so we would have the defaults available to extend for our own purposes.

Useful Script to Automatically Start NodeManager at Boot-up

Found this excellent post with a script to start the NodeManager as a service.

http://weblogicserver.blogspot.com/2010/01/node-manager-as-unix-startup-process.html