‘Changed Attributes’ Log Truncation in Waveset Audit Log

You may have noticed in Waveset’s auditlog reports that when too many attribute values have changed in a transaction, you don’t see the nicely printed before/attempted/after table of changed values.  This is a known limitation in the default database schema because the column that holds this info is a 4000 length VARCHAR field.  Waveset ships with a sample .sql script that allows you to change this column to a CLOB - IF your repository is an Oracle Database.  

OIM 11g R2: Too many role request emails?

In OIM 11g R2, Oracle introduced a new feature called "Catalog", using which a user of an Organization can search and request for roles using a shopping cart type of functionality.  There is also an option to generate emails to notify the user at what stage his/ her Role Request is at.  Since, the Role request could go through multiple approvals, emails are sent for each stage of approval.  Currently with OOTB Role Request workflow, upto 9 emails sent for the whole Role Approval processes completion and around 5 to 8 emails generated for Role Rejection.  Though this could be a useful feature to some customers, it could be a nuisance for others who would be expecting at the most 2 emails for either Role Approval or Rejection.

This post describes a way to limit the number of emails generated to 2, one when the initial Role Request is made and one when a final decision (either Approve or Reject) is made.

OIM Issues after installing ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.0.2 (BP02)

After installing Patch 14760806 also called ORACLE IDENTITY MANAGEMENT SUITE BUNDLE PATCH 11.1.2.0.2 (BP02),  to fix a few existing issues with OIM 11.1.2.0.1, we saw "access denied" issues while accessing OIM Identity Console as an "End User".   "System Administrator" users could access the console with out any issues.  The reason for this is that an OOTB Authorization plugin that allows an "End User" to access his/ her profile is not applied after applying the patch and it has to be manually deployed.  The same plugin is also responsible for allowing a user to request roles using Catalog tool.  This post describes the error messages displayed, the worked around (suggested by Oracle) and a few missing instructions in Oracle documentation for the plugin deployment.

Demystifying Shared Storage Requirements for Oracle Identity Management 11gR2

I've spent the day going through and planning the disk environment for a HA deployment of OIM, OAM, OPAM and OVD.  There really isn't a very good reference on this topic, there are a couple of publications from Oracle: the Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management, and the Oracle Identity Management 11.1.2 Enterprise Deployment Blueprint that have some good information but these documents do need to be updated to reflect the most recently supported WebLogic server (10.3.6).

One small checkbox during installation, one large impact on implementation: LDAP Sync in OIM

For those of us that have run the Oracle Identity Manager config, you have probably noticed a small checkbox  on the OIM Server screen called "Enable LDAP Sync" and asked yourself: Hmmm, I wonder what that does?

Oracle Identity Management 11gR2 Enterprise Deployment

Oracle has just released an updated version of its Identity Management 11.1.2 Enterprise Deployment Blueprint and I must say, this is tremendous effort from Oracle to fill in some of the gaps in its documentation.  It is nice to have a single place to go to for the steps that are required for setting up OAM and OIM to work together in a clustered, highly available design.

Searching for OAM 11gR2 reports for BI Publisher

Back in the days of OAM 10g there was a set of 13 standard reports that Oracle made available for BI Publisher.  These old reports can be found at http://www.oracle.com/technetwork/middleware/id-mgmt/oam-reports-1-132943.zip.  I am now on the search for reports for OAM 11gR2.  There are signs of hope, Oracle's license for OAM includes a Restricted Use License for BI Publisher.

Extending Waveset Data Exporter

I was extending Data Exporter (A.K.A. Waveset Data Warehouse) today to include some custom user attributes as described here.  I ran into a compiler class import issue with the ant script distributed with the source (in Waveset distribution):

Oracle Identity Analytics 11g - Flat-File Account Imports Fail after upgrade to PS1 (11.1.1.5)

Customers that have upgraded to Oracle Identity Analytics 11g PS1 (11.1.1.5) may have noticed that flat-file account imports, previously successful, now error-out post-upgrade.

When you explore the rbacx.log, it will contain the following error:

20:59:09,251 ERROR [CSVAccountFileReader] ---> Error occured file reading file:
java.lang.RuntimeException: Unable to import accounts
at com.vaau.rbacx.iam.file.csv.CSVAccountFileReader.importAccounts(CSVAccountFileReader.java:354)
at com.vaau.rbacx.iam.file.csv.CSVAccountFileReader.readCSVFileInternal(CSVAccountFileReader.java:168)
at com.vaau.rbacx.iam.file.csv.AbstractCSVFileReader.readInternal(AbstractCSVFileReader.java:85)
at com.vaau.rbacx.iam.file.support.AbstractFileReader.read(AbstractFileReader.java:160)
at com.vaau.rbacx.iam.file.support.AbstractFileReader.run(AbstractFileReader.java:82)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:908)
at java.lang.Thread.run(Thread.java:662)
Caused by: java.lang.NullPointerException
at java.util.Date.getMillisOf(Date.java:939)
at java.util.Date.after(Date.java:912)
at com.vaau.rbacx.manager.AccountManagerImpl.hasAccountChanged(AccountManagerImpl.java:844)
at com.vaau.rbacx.manager.AccountManagerImpl.updateAccounts(AccountManagerImpl.java:716)
at com.vaau.rbacx.manager.AccountManagerImpl.createOrUpdateAccounts(AccountManagerImpl.java:158)
at com.vaau.rbacx.core.support.RbacxDataImporterImpl.importAccounts(RbacxDataImporterImpl.java:915)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:307)
at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:149)
at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:106)
at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:204)
at $Proxy136.importAccounts(Unknown Source)
at com.vaau.rbacx.iam.file.csv.CSVAccountFileReader.importAccounts(CSVAccountFileReader.java:310)
at com.vaau.rbacx.iam.file.csv.CSVAccountFileReader.readCSVFileInternal(CSVAccountFileReader.java:168)
at com.vaau.rbacx.iam.file.csv.AbstractCSVFileReader.readInternal(AbstractCSVFileReader.java:84)
at com.vaau.rbacx.iam.file.support.AbstractFileReader.read(AbstractFileReader.java:160)
at com.vaau.rbacx.iam.file.support.AbstractFileReader.run(AbstractFileReader.java:82)
at java.util.concurrent.ThreadPoolExecutor$Worker.runTask(ThreadPoolExecutor.java:886)
... 2 more

OIA 11.1.1.5 introduced a code fix to address Bug 12752492 - user risk summary is not recalculated when re-imported account.  The code provided new columns, including RISK_UPDATE_DATE, that have been added to most tables to support the fix, as noted in the database update script (i.e. migrate-rbacx-11.1.1.3.xto11.1.1.5.0-oracle.sql). The accounts table affected are noted in this alter statement:

alter table rbacxservice.accounts add risk_update_date timestamp;

Other tables such as attribute_value_metadata have the risk_update_date set to sysdate after the column is created in the script. However, this is not the case for the accounts table - meaning the value is left null by default. It appears that a globaluser update (i.e. user import from a provisioning system like Oracle Waveset) may also set the RISK_UPDATE_DATE on the accounts associated with the user to the sysdate of the import. However, orphaned accounts could remain null. The fix for Bug 12752492 attempts to compare the current time with the risk_update_date value in the database for an account being imported - a value of null results in the null pointer exception as noted in the log above.

Properties file dbimp.properties does not have correct key-value format.

While trying to create a DIP (11.1.1.2) profile for Database Import using manageSyncProfiles command from ../Oracle_IDM1/bin,  I was getting the following error.  

[oracle@somehost bin]$ ./manageSyncProfiles register -h localhost -p 7005 -D weblogic -f dbimp.properties
Properties file dbimp.properties does not have correct key-value format.

Oracle Waveset 8.1.1.6

Oracle Waveset 8.1.1 Patch 6 is available for download

Removing Accented Letters in Oracle Waveset (Sun IDM)

Have you ever needed to clean-up entries with accented letters and wondered  if Oracle Waveset (formerly Sun IDM) could manage this for you?

PeopleTools 8.51 SSO using Oracle Access Manager 11g (11.1.1.3)

For many years, Oracle has provided a well documented OAM SSO solution for PeopleSoft using typical header variable integration. However, PeopleBooks for PeopleTools 8.51 has become so, shall we say, refined, it's now harder to acheive success with such time-tested integration steps.

Unable to open wallet error while bringing up OVD11g

OVD 11g installed on Windows 2008 workstation fails to start with the following diagnostic log error:

Good ol’  Oblix schema alive and well in OAM11g

While preparing to install OAM 11g, some of us were curious whether all the "ob..." attributes would remain intact or if they would be renamed with, for instance, an "orcl..." prefix. It struck one of my colleagues that the "ob" attributes would survive, if only to facilitate a workable upgrade path or to ease product development.

Enterprise Manager (EM) Console 11g shows OID is down

The Oracle Enterprise Manager Fusion Middleware Control 11g shows OID is down even though opmnctl shows OID is up.

Resources Missing After Upgrade

It is unlikely that many will have this problem, but if you do this could save some time and headache troubleshooting...

Simple Mode Root CA Strikes Again

Upgrade from COREid 7 to OAM  10.1.4.0.1 process drops the root CA......

transfilter.dll disappears and won’t load in IIS

I just had the most frustrating experience. I am in the midst of upgrading OAM 7.x to 10.1.4.3. I had all the components upgraded to 10.1.4.0.1 so I got backups taken.

SAML Back Inside?

SAML Service coming back to OAM in a future release?

OAM 11g R1

AuthN and AuthZ responses supports....

Will your OAM installation fail in July 2010?

Is your OAM installation setup in simple mode? Then chances are your installation is going to break on July 25, 2010. You may have heard a faint ticking every time you got near one of your OAM machines, but never had a chance to figure out where this impending failure was going to come from. As you know,according to Mayan Calendar, in 2012 in simple mode OAM generates certificates for you using the simpleCA root CA (tools\openssl\simpleCA). This root certificate is also used to complete the chain of trust when establishing SSL connections.

But did you know that root CA certificates expire? The OAM certificate expires Jul 25 18:03:57 2010 GMT after which your OAM components will no longer be able to communicate with each other

UTF-8 and Oracle Access Manager 10g

OAM supports UTF-8 in incoming data, and can generate HTML pages encoded with UTF-8, but what about internally? Is UTF-8 data available in plugins? In HTTP header variables?

Oracle Specialized Gold Partner - Security and Identity

Oracle has designated Nulli as an Oracle Gold Partner in the Oracle PartnerNetwork Specialized Program. Nulli having achieved Pillar Partner - Security and Identity status is now being recognized as a Gold Specialized partner for our implementation services excellence for the Oracle Access Manager, Identity Manager, Internet Directory, Virtual Directory and the Oracle suite of identity products including the Oracle Entitlement Server.

Setting Permissions for your Oracle Access Manager Bind Account in OID

The bind account that OAM uses to connect to OID directory services needs to have full rights over the portion of the DIT that you intend to manage with OAM.

OAM and OSSO Integrated in 11g

Forcing OAM Browser Based Setup

One of the key tasks during development and deployment of OAM is running the product browser-based-setup process. It is this process that results in the initial 'oblix branch' being written to the directory service. So, when a customer wants to start again, the question is, "How do I make that setup process happen again?"

VDE Shadow Object LDIF

If you are using the OVD Shadow Joiner feature then you will need to add the vdeShadowObject object class to the directory hosting the shadow objects. Here is a little LDIF file for just such a need...

OAS 10.1.4 Installation Hangs

I was installing OAS 10.1.4.0.1 today as I needed to use OID for an OAM deployment.

Introducing Stitcher - OAM Configuration Migration Solution

Many of our readers are aware that we have had the "COREid Migration Service" available for public use for the past three years. This service has been a resounding success with several high profile North American OAM customers relying on it to maintain consistency across their environments. The expression, "If it ain't broke, don't fix it." best describes our attitude towards the initial release.

Credential Mapping Error

Setting up IWA is a fairly straight forward task.

Panels in User Manager’s Employees tab

Panel tabs in OAM, how are they used?

OAM Identity Server Deletes User When RDN Modified (on OID)

Modifiying the RDN for User in Oracle Internet Directory (OID 10g) - known issue.....

SDK-Access Server Time Difference Reminder

When using a older Access Server SDK (7.0.4) with a newer Access Server (10.1.4) running in backward compatibility mode recently,

IdXml Change Attribute WF Does Not Run

IdXml interprets attribute access differently vs using a portal insert to perform the same change....

Reactivate OAM User

In order to be able to search for deactivated users, the logged in user need to be a participant in a reactivate user workflow definition.

OID Indexes

Here are a few simple notes for handling OID indexes.

Deleting a User with IDXML

Certain actions (such as creating or removing an LDAP entry) are only available via OAM's 'workflow' engine. A freshly installed OAM system has no workflows configured, thus, no immediate mechanism to affect such actions.

OAM Identity XML (IDXML) via XMLHttpRequest

It makes sense that the ideal HTTP Client for IDXML processing is the authenticated user's browser. After all, it already has the ObSSOCookie.

OAM Search Results Virtual Attribute

What if you want to include a virtual attribute in your search results that is derived form another attribute?

One Bad Mapper Can Spoil the Whole Bunch (if you’re not careful)

Creating a mapping file for OVD to use on inbound and/or outbound LDAP transactions can sometimes be tricky to get absolutely correct the first time. Invariably, the message

               Could not complete mapping

is bound to show up at least once when you are trying something new.

Error: Look up of symbol - ObInitEventAPI failed

WebGate - Oracle Client Conflict

When installing the 10.1.4 WebGate to protect an application with web services that relied on the Oracle Client for database connectivity, the application failed to run after the install. The following message is what was received back from the application:

        The provider is not compatible with the version of Oracle client

Sending “Authorization” header with initial HTTP request

If OAM protects a web resource with a basic authentication scheme, any browser request for that request returns a 401 with a "WWW-Authenticate: basic" header.

Global Database Name in Linux OAM and DB (OCI) environment for DB auditing

SelfSSL Connection Errors

The IIS Resource Kit's SelfSSL tool is a quick and sneaky way to get both IIS and ADAM running SSL for quick OAM sandbox environments.

WebGate Installation Error - Access Server you specified is currently down

When you know that it is in fact not down, and you've checked that all your WebGate parameters are correct a million times...

Request for Feedback - Oracle Access Manager Configuration Manager

Installing Oracle Directory Manager

Invalid Parameter: ObWorkflowName

This is a simple one, but a nuisance none-the-less.

IIS6 and Tomcat

This is a little bit off topic as OAM goes but everytime I want a quick OAM / Servlet container working environment, it takes me too long to discover this info.

Dot Net Parsing Oracle Access Manager XML

IDXML - There is no profile configured for this kind of user

IDXML can be cool. It can also cause one to question one's future in front of a keyboard.

Creating Custom Style Shared Folder

When creating a custom style for Oracle Access Manager (formerly COREid) the product creates a localized directory for you in the default language, but all of the files in the localized copy point back to the main style sheets in the shared directory. In order to keep the vanilla sheets for style0 (Classic Style) intact it is advisable to create a duplicate shared directory (i.e. newstyle_shared).

WebGate Cannot Initialize

A web server with a WebGate installed on it suddenly does not serve pages and generates 500 errors.

Policy Domain/Policy Not Enforced

Successful migrations of Oracle Access Manager (formerly COREid) configuration data rely heavily on consistent directory naming of entries between envionments.

Anonymous Authentication Resources SLOW

Can’t See Workflow

Successful migrations of Oracle Access Manager (formerly COREid) configuration data rely heavily on consistent directory naming of entries between envionments.

COREid Migration Service

COREid Migration Service Preview

COREid Migration Service Enters Pre-Beta Phase

Nulli Secundus is pleased to announce that our COREid Migration Service has entered a pre-beta (invitation only) phase.

Create Clean Schema File from AD/AM

Have you ever wanted to get a nice clean schema file containing all of your custom attirbutes and object class entries but exluding the special microsofty attributes from and AD/AM (or AD) instance so that you can archive it off into a source control system or just simply migrate it to another environment?

WebGate and the IE / CSS Flicker Bug

Gettng quite specific here - but if you have this problem, you'll appreciate the info...

COREid services start before LDAP

In COREid deployments where the Access and/or Identity services are installed on the same box as the LDAP server, the COREid service(s) sometimes start faster than LDAP.

Simplifying COREid Identity System Menus

A common request for COREid customization is removing unused menu options in the User Manager, Group Manager, and Org. Manager applications (like Create User Identity, Deactivated User Identities, Configuration, etc).

Simple Mode Cert Regeneration (Access)

When simple mode certificates are going to expire, .......

Simple Mode Cert Regeneration (Identity)

AD/AM Unsecured Passwords

Have you ever needed to bulk load AD/AM with a bunch of LDIF users for testing or conversion purposes, but been frustrated by its inability to allow password changes over an unsecured port?

Access Manager Looping

Ever enabled the NetPoint Identity Domain policy domain but not NetPoint Access Manager?

Certificate Expiration Dates #2

COREid Dual Transport Mode Operation

Simple Mode Certificate Duration

By default Oracle COREid simple mode certificates are issued for 1 year (365 days) by default.

Ultimate COREid XSL Customization Development Environment

Some people look at the vanilla COREid interface and make a quick decision that they don't like it, or that it's not what they hoped it to be.

Access Server SDK on IIS5 / IIS6 (Part 2)

Access Server SDK on IIS5 / IIS6

Horizontal Migration of COREid Configuration Data

New Response Phrase - No Old Response

Substitution Syntax in Search Base and Attribute Access Control

Have you ever got confused when using substitution syntax in COREid search base and attribute access control settings?

ADAM Changing Page (Search) Limit

Ever wanted to reduce or increase the AD/AM search limit (page size)?

HeaderVar Not Showing Up Or Wrong Value

Have you ever had some header variables show up and not others?

Disappearing Workflows During Horizontal Migration

[RFE]Regex Capturing In Policies - Nice to Have!

OK, so COREid supports rudimentary pattern matching in policy patterns. For instance, one can create a URL pattern in a policy definition that matches multiple URLs with a single policy (pattern).

Search Results Counter

Unable to initiate workflow Status Code 1