Notification Template Limitations. Bridge Limitations

Transcription

1 Oracle Cloud Known Issues for Oracle Identity Cloud Service Release E February 2018 Notification Template Limitations Note the following limitations with Oracle Identity Cloud Service notification templates. Notification Template Customizations Notification Template Customizations Oracle Identity Cloud Service provides you with templates for user and administrator notifications. You can tailor the recipients and content of these templates to meet the business and security requirements for your enterprise applications. Note that customizations to any notification templates won't be upgraded with new content or variables associated with future versions of the templates. This also applies to notification templates that you don't customize. Bridge Limitations The following section describes known limitations with the bridge for Oracle Identity Cloud Service. Restoring an old backup in Microsoft Active Directory affects identity synchronization The client for the bridge operates on a Microsoft Windows environment only When configuring a bridge and selecting OUs, if I select a parent OU, none of the children OUs are selected The Microsoft Active Directory server password has changed or expired, but I can't enter the new password in the client for the bridge 1

2 The client for the bridge crashes or stops synchronizing after upgrading Oracle Identity Cloud Service Removing the domain for the bridge may take time After regenerating the Client Secret for the bridge, the bridge doesn t work The bridge can t import users from Microsoft Active Directory into Oracle Identity Cloud Service Restoring an old backup in Microsoft Active Directory affects identity synchronization Please clean up the users in Oracle Identity Cloud Service and start over. The client for the bridge operates on a Microsoft Windows environment only With the bridge, Oracle Identity Cloud Service can connect to your Microsoft Active Directory enterprise directory structure. For version of Oracle Identity Cloud Service, use a Windows 7+ or Windows Server operating system, and version 4.6+ (This supports TLS 1.2.) of the Microsoft.NET software framework (which is required for the bridge to run). For more information about the certified versions for Oracle Identity Cloud Service, your operating system, and the Microsoft.NET software framework, refer to Understanding the Bridge in Administering Oracle Identity Cloud Service. When configuring a bridge and selecting OUs, if I select a parent OU, none of the children OUs are selected This issue has been seen intermittently and a fix is planned for a future release. If you experience this issue, first expand the parent OU, deselect it, and then select the parent OU again. All visible child OUs are now selected. The Microsoft Active Directory server password has changed or expired, but I can't enter the new password in the client for the bridge To prevent this behavior from happening, before you use the bridge to import any Microsoft Active Directory user accounts into Oracle Identity Cloud Service, enable the 2

3 Password Never Expires option for the accounts in Microsoft Active Directory. Otherwise, the passwords for the accounts expire. If this occurs, then you can change the passwords using the following steps. 1. Go to the Service MMC Console on the host machine where the bridge is running. 2. Select Oracle Identity Cloud Service Active Directory Service, click Properties, click the Log On tab, and then change the account credentials. 3. Restart the service. 4. Go to the Directory Integrations page and ensure that the bridge has an Active status. Note: The status of the service can also be checked in the configuration UI installed with the bridge. The client for the bridge crashes or stops synchronizing after upgrading Oracle Identity Cloud Service After an Oracle Identity Cloud Service upgrade, the bridge client might crash due to new features implementation. To resolve this issue: 1. Uninstall the bridge client from your Microsoft Windows machine. 2. Go to the Identity Cloud Service admin console, click Settings, and then click Directory Integrations. Delete the bridge. 3. Add a new Microsoft Active Directory bridge. 4. Download the new version of the bridge client and install it on your Microsoft Windows machine. Users previously synchronized to the Oracle Identity Cloud Service are not affected by the recreation of the bridge and new installation of the client software, if you use the same configuration for the new bridge as for the deleted one. Removing the domain for the bridge may take time If you have a Microsoft Active Directory server with a large amount of organizational units (OUs), and you then attempt to remove the domain for the bridge from the 3

4 Directory Integrations page of the Identity Cloud Service console, it may take several minutes for this to occur. After regenerating the Client Secret for the bridge, the bridge doesn t work If you're using the version of the client for the bridge, then you must upgrade your client to the latest version. See Creating a Bridge to install the updated client for the bridge. The bridge can t import users from Microsoft Active Directory into Oracle Identity Cloud Service The bridge must be able to access the Microsoft Active Directory organizational units (OUs) and the parent OUs that contain the users you want to import into Oracle Identity Cloud Service. To ensure that the bridge can access the OUs: 1. Launch Active Directory Users and Computers. 2. Right-click the OU that contains the users you want to import into Oracle Identity Cloud Service, and select Properties from the drop-down menu. 3. In the Properties window, click the Security tab. 4. In the Advanced Security Settings window, click the Security tab, and click Advanced. 5. Click Add. 6. In the Permission Entry window, click the Select a Principal link. 7. In the Select User, Computer, Service Account, or Group window, search for the user with which the bridge is configured, and click OK. 8. In the Permission Entry window: a. From the Type drop-down menu, select Allow. b. From the Applies to drop-down menu, select This Object and all descendant objects. c. From the Permissions pane, select the List contents, Read all properties, and Read permissions check boxes. d. Click OK. 9. In the Advanced Security Settings window, click OK. 10. In the Properties window, click OK. 11. Close Active Directory Users and Computers. Identity Provider Limitations 4

5 Note the following identity provider limitations with Oracle Identity Cloud Service. Issue with SAML Identity Providers Issue with SAML Identity Providers If you have activated only one SAML identity provider and you don't want this identity provider to appear in the Sign In page, then don't assign the identity provider to either the default identity provider policy or to any app-specific identity provider policies. Network Perimeter Limitations Note the following network perimeter limitations with Oracle Identity Cloud Service English Translation Issues for Network Perimeters English Translation Issues for Network Perimeters Any errors related to adding, modifying, or removing network perimeters are for the English translation only. These errors will not appear for other translations. This issue can be fixed by applying the patch for Safari Browser Limitations If you are using the Safari browser (version 8), note the following limitations and their solutions. Also note that Mozilla Firefox and Google Chrome work correctly with Oracle Identity Cloud Service. Downloading Reports Saving CSV Files from User or Group Exports When I download Identity Cloud Service metadata using Safari, there are no XML tags. Why? Downloading Reports Clicking Download Report opens the PDF in the same tab instead of downloading the report. Press Command + S to save the report. 5

6 Click the back button on your browser to go back to Reports. Saving CSV Files from User or Group Exports Clicking Download in the Jobs Details page opens the exported information in the same tab. Copy the entire contents of the tab and paste it into a text editor, and then save the file with a.csv extension. Click the back button on your browser to go back to Jobs details. When I download Identity Cloud Service metadata using Safari, there are no XML tags. Why? When either creating or viewing the details of an identity provider, you have the option of downloading the Identity Cloud Service metadata and then importing that metadata into the identity provider. In Safari, when you click Download, the metadata opens in the same tab and omits all XML metadata labels. To correct this issue, in Safari, go to Preferences, Advanced, and then turn on Show Develop menu in menu bar. Restart Safari and download the metadata again. Safari will display the correct XML content. Interface Limitations Note the following limitations and their solutions when using the Oracle Identity Cloud Service interfaces. Unable to Cancel a Service Instance My export job reports that it was successful. But my completion percentage is not 100%. How can that be? Unable to Delete Users from the Identity Cloud Service console if the User is Federated A Trusted Application With "No Resources" Defined Doesn't Display in the My Apps Page When creating a SAML application, I set the NameID Value to blank but on creation, the NameID Value is updated to "Primary ". Why? Coordinated Universal Time Display Issue Unable to Cancel a Service Instance You cannot cancel a service instance after you have created it. 6

7 To remove a service instance, wait until Oracle Cloud notifies you that your service instance is active and ready to use. Then, delete the service instance. My export job reports that it was successful. But my completion percentage is not 100%. How can that be? During the execution of an export job, if some of the resources have been deleted (for example, resources that were eligible for export, but still not picked up by export job), the job status reports the export was successful, but it won't show a 100% completion percentage. For example, assume that the tenant administrator submits a job to export 1000 users. However, during job execution, someone has deleted 50 users (which were about to be exported). In this example, the job status reports that the export was successful but the completion percentage will be 95%. Unable to Delete Users from the Identity Cloud Service console if the User is Federated Users synced from Active Directory (AD) and marked federated can't be deleted from Identity Cloud Service console. Removed these users from AD directly. A Trusted Application With "No Resources" Defined Doesn't Display in the My Apps Page If an administrator creates a Trusted Application using the Identity Cloud Service UI and selects the No Resources option on the Resource Configuration page, the application displays the following error when the administrator tries to enable the Display in My Apps option. "Cannot update application <AppName>. An Application with a LoginTarget that specifies 'OIDC' as its loginmechanism must have the OAuthResource facet enabled." To work around this issue, first update the Resource Configuration page to include resources and then enable the Display in My Apps option. When creating a SAML application, I set the NameID Value to blank but on creation, the NameID Value is updated to "Primary ". Why? 7

8 This is a known issue. To work around this issue, create the application, update the NamedID Value to blank, and then save the application. Coordinated Universal Time Display Issue If the user's timezone (determined from user's preference on My Profile Details or from the tenant settings on Default Settings) is set to (UTC+00:00) Etc/UTC Coordinated Universal Time, time and date information might not be displayed on pages that show dates and times. The following areas are affected: Partner Certificate listings App Role provisioning table listings Jobs listings Report details Partner Certificates listing Imported users under an Application To work around this issue, set the timezone to an equivalent alternative value, such as London GMT or Dublin GMT. API Limitations Note the following API limitations with Oracle Identity Cloud Service. OAuth 2.0 Limitation Embedded Cloud Cache (ECC) Job Imports OAuth 2.0 Limitation The OAuth 2.0 implementation in Oracle Identity Cloud Service does not support getting scopes from multiple resource servers in a single token request. Embedded Cloud Cache (ECC) /KerberosRealmUsers endpoint. The >= and <= attributes, when used in a search filter, are not supported with this endpoint. Job Imports 8

9 The View Details button in the Jobs page of the Identity Cloud Service console doesn't work for jobs that are imported using REST APIs. Identity Cloud Service Application Catalog Limitation Learn about the issues you may encounter when using the instructions for integrating Identity Cloud Service. Topics Accessibility Limitations Accessibility Limitations At this time, the instructions for integrating Identity Cloud Service are not fully Section 508 compliant. Specifically, many images are missing alternative text and the use of the > character must be removed in future releases. Application Limitations Note the following limitations and their solutions when managing applications. Max numbers settings for application synchronization inaccurate Administrator doesn t get a warning during provisioning if the user exists Re-granting the Office 365 app to the same user fails User Field Missing Information on Import Home is Displayed When Work Is Expected Max numbers settings for application synchronization inaccurate There is an issue when enabling synchronization for an app catalog application. The number specified in the Max. number of creates and Max. number of deletes is allowing for the number entered +10. For example, if you specify the Max.number of creates to be 512, accounts in between 512 to 520 will also be created. The same behavior also occurs for numbers set in the Max. number of deletes field. 9

10 Administrator doesn t get a warning during provisioning if the user exists If a user to be provisioned exists on the app target, the administrator is supposed to be warned that the user exists. This behavior occurs if the user is assigned to the app using the following flow, click the app, and then click Assign User. However, this does not occur if the user is assigned as member to a group. There is not warning that the user exists on the app target. Re-granting the Office 365 app to the same user fails Problem: After performing a revoke operation, re-granting the Office 365 App to the revoked user in Office 365 fails as the revoked user account is present in the Office 365 recycle bin and not permanently deleted. Solution: Ensure that you log in to Azure PowerShell and run the following command: Remove-MsolUser -UserPrincipalName "user.idcs@fed-domain.com" -RemoveFromRecycleBin\ User Field Missing Information on Import If an administrator performs a parallel provisioning and synchronization (Import) operation, the User column might be missing the user name and fields for the returned data on the Import tab. Home is Displayed When Work Is Expected When provisioning and synchronization are enabled for an Oracle Cloud app and you import users, the User column of the import table sometimes lists the Home Address instead of listing the Work Address even if the setting is Primary Type=work. MAC Limitations Learn about the issues you may encounter when using a MAC and how to work around them. Topics The bridge doesn t run on a Mac OS X platform Touch ID Platform Limitation for the Oracle Mobile Authenticator App 10

11 Pending Notifications Limitations for the Oracle Mobile Authenticator App VoiceOver Mode Limitation for Oracle Mobile Authenticator App The bridge doesn t run on a Mac OS X platform You can run the bridge only on a Microsoft Windows environment. Touch ID Platform Limitation for the Oracle Mobile Authenticator App Touch ID is only supported with ios version 8 and higher. Pending Notifications Limitations for the Oracle Mobile Authenticator App Pending notifications that are currently in the Notification center of an ios device do not appear in the OMA app when the user manually opens the OMA App. VoiceOver Mode Limitation for Oracle Mobile Authenticator App To edit or delete an account in the OMA app when using VoiceOver mode, the user must be in Grid view. The Edit and Delete options are not available in List View when using VoiceOver mode. This affects only the ios 7 platform. MFA Limitations Note the following Multi-Factor Authentication (MFA) limitations with Oracle Identity Cloud Service. Topic Break Glass Limitation Internet Explorer v11 Compatibility Mode Limit to the Number of Security Questions That Display Languages Available for 2 Step One-Time Passcode Verification Template Break Glass Limitation 11

12 When MFA is enabled, an identity domain administrator must enroll in more than one factor. If an identity domain administrator gets locked out of the MFA-enabled environment and has not enrolled in multiple factors, it can t be unlocked further. Internet Explorer v11 Compatibility Mode When using Microsoft Internet Explorer version 11 in compatibility mode with the Windows 10 operating system, Oracle Identity Cloud Service supports only simple log in. In simple login mode, Multi-Factor Authentication (MFA) fails. To turn off compatibility mode in Internet Explorer: 1. Select Tools, and then Compatibility View settings. 2. Clear the Display intranet sites in Compatibility View check box. 3. Select the required websites from the list of websites that have been added to Compatibility View and click Remove. Limit to the Number of Security Questions That Display When defining security questions for MFA, you can add as many as you want. However, only 48 security questions can appear in the Oracle Identity Cloud Service administration console. Languages Available for 2 Step One-Time Passcode Verification Template The 2-Step One-Time Passcode Verification template is available in English only. Oracle Cloud Known Issues for Oracle Identity Cloud Service, Release E Copyright 2016, 2018, Oracle and/or its affiliates. All rights reserved. This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited. The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing. If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable: U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government. This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications. 12

13 Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group. This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of thirdparty content, products, or services, except as set forth in an applicable agreement between you and Oracle. 13