OIM 11g R2 PS1 : Target Resource Not Visible On Accounts Tab

Issue Description:

Sometimes when we provision some target resource in OIM 11g R2 PS1, we can see from the log that tasks got triggered which are responsible for creating the account but when we go to "Accounts" tab for that user, we don't see that Target Resource instance there.

Root Cause - Missing Application Instance Key:

Look for the entry in OIU table for that user, you would be able to see that data exists in the table but still it is not visible on the screen. Look for APPLICATION_INSTANCE_KEY column, you would see NULL. 

Solution:

Populate that column with correct "Application Instance Key" and Refresh the screen. You can use SQL Query to do that.

OR

We have an OOTB schedule job "Update Accounts With App Instance Job" for updating the Application Instance Key in OIU table.


Question:
Why Application Instance Key is null for few accounts.

Answer:
As per Oracle, here is the explanation:

The application instance might not be available when the account is provisioned. This is possible when:

• Oracle Identity Manager is upgraded, when app_instance_key is to be populated for all the existing entries in the OIU table.
• Accounts are brought in via reconciliation, but the application instances are not available when the accounts are reconciled. The application instances are created after the reconciliation.
• Accounts are provisioned via access policies, but the application instances are not available when the accounts are provisioned. The application instances are created after the provisioning.
  
  But I believe there may be some other reasons as well for "NULL APPLICATION_INSTANCE_KEY"
  
  
  

OIM 11g R2 PS2 Features

• ·         Organization Assignment Based on Membership Rules
• ·         Better UI To Add Beneficiary From Same Screen
• ·         Flexibility To Submit Request For Entitlement Provisioning Without Primary Account
• ·         OOTB - Insert Start Date and End Date For Entitlements
• ·         Save And Submit Later Feature
• ·         Enhanced Certifications/Attestations
• ·         Better Handling Of Multiple Accounts
• ·         Hierarchical Entitlements

Other OIM 11g R2 Features




. 

OIM 11g R2 PS2 : High Level Step Installation

 Here are the High Level Steps for OIM 11g R2 PS2 Suite Installation:

OIM 11g R2 PS2 - Screens

• Installation of Database
• Schema Creation Through RCU
• Installation of Weblogic
• Installation of SOA Suite
•  Mandatory Patches for SOA Suite  (11.1.1.7) -> Will be available under IAM Suite Disk 1
•  Installation of OIM Suite
•  Weblogic Domain Creation
•  Upgrading OPSS Schema using Patch Set Assistant
•  Configure Database Security Store for OIM Domain
•  Start Servers
•  Configuration of OIM Servers, Design Console
  
  

OIM 11g R2 PS2 : New Feature Screens

Here are some screens for OIM (Oracle Identity Manager)11g R2 PS2 (11.1.2.2.0):

New Login Screen - New Look and Feel

Home Page

New Catalog Screen - Add Beneficiary Within Same Same Screen

New Organization Screen (Certifier)

Membership Rule for Organization

Not Equal To In Membership Rule

System Entities in Sysadmin Console

Download: OIM 11g R2 PS2

OIM 11g R2 PS2 is out, here is the link to download:

Click Here To Download

Certification Matrix:

Certification Matrix: Click Here To Download

Enetitlement Revocation Information

Something to share (OIM 11g R2 PS1):

If entitlements get provisioned to users, we can verify from the Entitlement Tab under User Details but if entitlement gets "Revoked" from a user, there's no way to find that information from OIM User Interface (Enhancement request can be opened with Oracle).

OIM is a tool for Auditing so I believe that it stores that information somewhere but Where ???

"ENT_ASSIGN_HIST". It contains a column called "VALID_TO_DATE" which stores the Revocation Date.

Provisioning Through API - OIM 11g R2 PS1

Here is the code to initiate provisioning through code:

public void provisionAccess(ProvisioningService provisioningService, ApplicationInstanceService applicationInstanceService){
       
 oracle.iam.provisioning.vo.ApplicationInstance applicationInstance;
 try {
        applicationInstance = applicationInstanceService.findApplicationInstanceByName("AD User");
            long applicationInstanceKey = applicationInstance.getApplicationInstanceKey();
            FormInfo accountForm = applicationInstance.getAccountForm();
            long formKey = accountForm.getFormKey();
            AccountData accountData = new AccountData(String.valueOf(formKey), null, new HashMap());
            oracle.iam.provisioning.vo.Account account = new Account(applicationInstance, accountData);
            provisioningService.provision("1111", account); // 1111 is the Beneficiary Key
        } catch (ApplicationInstanceNotFoundException e) {
            e.printStackTrace();
        } catch (GenericAppInstanceServiceException e) {
            e.printStackTrace();
        } catch (oracle.iam.platform.authopss.exception.AccessDeniedException e) {
            e.printStackTrace();
        } catch (UserNotFoundException e) {
            e.printStackTrace();
        } catch (GenericProvisioningException e) {
            e.printStackTrace();
        } catch (Exception e) {
            e.printStackTrace();
        }
   }

Office 365 - Add / Remove License in Bulk

We can add/remove license in office 365 from a csv file. You can have a csv file which will contain principal names of all the users for whom you want to add/remove license. Header will be UserPrincipalName.

And execute these commands:

Connect-MsolService --> Provide username and password 

Get-MsolAccountSku |ft AccountSkuId   

--> Above command It will return values like :EXCHANGESTANDARD

Add License:

$AccountSkuId="PROVIDE_VALUE_HERE"                      --> Provide Value here
$UsageLocation="PROVIDE_VALUE_HERE"                     --> Provide Value here like US, IN
$Users=Import-Csv C:\Users.csv
$Users | ForEach-Object {
Set-MsolUser -UserPrincipalName $_.UserPrincipalName -UsageLocation $UsageLocation
Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -AddLicenses $AccountSkuId
}


Remove License:

$AccountSkuId="PROVIDE_VALUE_HERE"                     --> Provide Value here
$UsageLocation="PROVIDE_VALUE_HERE"                     --> Provide Value here like US, IN
$Users=Import-Csv C:\Users.csv
$Users | ForEach-Object {
Set-MsolUser -UserPrincipalName $_.UserPrincipalName -UsageLocation $UsageLocation
Set-MsolUserLicense -UserPrincipalName $_.UserPrincipalName -RemoveLicenses $AccountSkuId
}

FVC (Form Version Control Utility)

Description:

If we add new field(s) in Process Form, that field won't be available for the existing provisioned users.

Solution:

FVC (Form Version Control Utility) comes with OIM which updates the form which are associated with existing users.


OR

Update PROCESS_FORM_TABLE set PROCESS_FORM_TABLE_VERSION =
(Select SDK_ACTIVE_VERSION from SDK where SDK_NAME='PROCESS_FORM_TABLE');
COMMIT;

NOTE:

Replace PROCESS_FORM_TABLE  with actual process form i.e. "UD_XXX"

Weird Issue With LDAP/ICF Connector

Issue: 

Integrated ODSEE (LDAP) with OIM 11g R2 PS1 using OID-11.1.1.5.0 connector. Wanted to test the reconciliation with one user so I gave the filter as equalTo('uid','RAJIVDEWAN') and ran the reconciliation; No reconciliation event generated.


Workaround: 

Changed the filter from:

equalTo('uid','RAJIVDEWAN')

to 

equalTo('uid','rajivdewan')


And I was able to see the reconciliation event. 

I don't know whether it's a connector issue or it's an ICF issue.