Lab 3: Configuration of OIM to manage user accounts lifecycle in DSEE application

Transcription

1 OIM 11g Workshop Lab 3 Lab 3: Configuration of OIM to manage user accounts lifecycle in DSEE application Contents Lab 3: Configuration of OIM to manage user accounts lifecycle in DSEE application Introduction Contents Install DSEE Connector Create IT Resources Execute Direct Provisioning for Connector health-check Extend OIM User schema to add custom attributes Extend the connector to add support of custom attributes Execute required Lookup reconciliation scheduled jobs Configure Pre-populate adapters Configure few Important Parameters for Request and RBAC based provisioning scenarios49 3. Conclusion

2 OIM 11g Workshop - Lab 3 1. Introduction ACME CAPITAL is all set to extend the provisioning solution to accommodate extra applications coming onboard from MEDICLAIM acquisition. The Permanent Contact Number information for ACME OIM Users needs to be maintained. ACME DSEE application is the source of this information where homephone attribute is being maintained with the required value. Also OIM has to be used to provision to ACME DSEE application instances and LCM of the DSEE accounts of existing MEDICLAIM users would also be done from OIM, moving forward, account reconciliation would be needed from initially from DSEE to OIM. The need is recognized to install the OIM iplanet connector pack to provide ACME the user/account provisioning/reconciliation capabilities w.r.t. ACME DSEE application instances and also extend the connector to support the attribute homephone storing the Permanent Contact Number information. 2. Contents 2.1. Install DSEE Connector 2.2. Create IT Resources 2.3. Execute Direct Provisioning for Connector health-check 2.4. Extend OIM User schema to add custom attributes 2.5. Extend the connector to add support of custom attributes 2.6. Execute required Lookup reconciliation scheduled jobs 2

3 OIM 11g Workshop Lab Configure Pre-populate adapters 2.8. Configure few Important Parameters for Request and RBAC based provisioning scenarios 2.1.Install DSEE Connector Purpose This step includes the configuration required to install OIM connector (SJSDS ) to integrate OIM with DSEE Steps Extract first and then Copy the required connector pack (SJSDS_90440.tar) and files to the relevant directory locations Extract SJSDS_90440.tar and Copy it from /odrive/installs/oim-cp directory to /odrive/oracle/oim11g_mwh/oracle_idm1/server/connectordefaultdirectory/ [oracle@orclfmw ~]$ cd /odrive/installs/oim-cp [oracle@orclfmw oim-cp]$ cp -r SJSDS_90440/ /odrive/oracle/oim11g_mwh/oracle_idm1/server/connectordefaultdirectory Copy the required external jar file ldapbp.jar from /odrive/installs/oim-cp directory to /odrive/oracle/oim11g_mwh/oracle_idm1/server/thirdparty/ [oracle@orclfmw oim-cp]$ cp ldapbp.jar /odrive/oracle/oim11g_mwh/oracle_idm1/server/thirdparty In order to run the Connector Installation Wizard, log in to the Administrative and User Console by using the xelsysadm account. 3

4 OIM 11g Workshop - Lab Navigate to the Advanced Administration console. In the System Management Panel, click on Manage Connector A new Connector Management window will pop up. Click on Install button. 4

5 OIM 11g Workshop Lab From the Connector List list, select Sun Java System Directory This list displays the names and release numbers of connectors whose installation files you copy into the default connector installation directory: 5

6 OIM 11g Workshop - Lab Click Load To start the installation process, click Continue. 6

7 OIM 11g Workshop Lab 3 The following tasks are performed in sequence: If all three tasks of the connector installation process are successful, and then a message indicating successful installation is displayed, you can click Create IT Resource. 7

8 OIM 11g Workshop - Lab 3 Checkpoint At this point you have installed the connector pack for Sun Java System Directory Server Enterprise Edition (DSEE) that is going to be used for the next labs. 2.2.Create IT Resources Purposes This step includes the configuration required to create an IT resource for the relevant instance of DSEE server. Steps In order to create an IT Resource for the DSEE Connector, log in to the Administrative and User Console by using the xelsysadm account In the Welcome page of the Advanced Administration, under Configuration, click Create IT Resource Alternatively, click the Configuration tab, click Resource Management, and then select Create IT Resource On the Step 1: Provide IT Resource Information page, enter the following information: IT Resource Name IT Resource Type DSEE Server ACME Select an IT resource type for the IT resource. Click the lookup which will open another popup. On that one, select LDAP Server and click Select. 8

9 OIM 11g Workshop Lab 3 IT Resource Name Remote Manager DSEE Server ACME leave this field blank Click Continue. 9

10 OIM 11g Workshop - Lab On the Step 2: Specify IT Resource Parameter Values page, specify values for the parameters of the IT resource, and then click Continue. Parameter Admin Id Description DN value of the user who has administrator rights on Sun Java System Directory The value is: cn=directory Manager Admin Password Password of the user who has administrator rights on Sun Java System Directory The value is: abcd1234 Server Address IP address of the target Sun Java System Directory server The value is: orclfmw.example.com Port Port number to connect to the target Sun Java System Directory server The value is: 1389 Root DN Base DN where all the user operations are to be carried out 10

11 OIM 11g Workshop Lab 3 Parameter Description The value is: dc=mydomain,dc=com SSL Specifies whether or not an SSL connection is used for communication between Oracle Identity Manager and the target Sun Java System Directory server The value is: false On the Step 3: Set Access Permission to IT Resource page just clicks Continue. 11

12 OIM 11g Workshop - Lab On the Step 4: Verify IT Resource Details page, review the information that you provided on the first, second, and third pages. If you want to make changes in the data entered on any page, click Back to revisit the page and then make the required changes To proceed with the creation of the IT resource, click Continue. 12

13 OIM 11g Workshop Lab The Step 5: IT Resource Connection Result page displays the results of a connectivity test that is run using the IT resource information. Iplanet connector which we are using in this lab does not support any connectivity test. Cick Create Click Finish. Note: Please create three more IT resources using exactly the same connection parameters and other information as provided for the IT resource above. These are required mandatory for configurations of Lab 5 - Advanced Provisioning Infrastructure. Repeat the Steps to with following names, and MAKE SURE to set access permissions to these IT Resources as explained below: DSEE Server, Johannesburg DSEE Server, Prague 13

14 OIM 11g Workshop - Lab 3 DSEE Server, Chicago IMPORTANT! For DSEE Server, Johannesburg, DSEE Server, Prague and DSEE Server, Chicago IT Resources make sure to do the following procedure from the "Set Access Permission to IT Resource" step: On the Step 3 : Set Access Permission to IT Resource step, click Assign Role On the Assign Role step, check the assign checkbox for administrative role ALL USERS and then click Assign You will ONLY set Read Access permission to ALL USERS role 14

15 OIM 11g Workshop Lab Back to the Step 3 : Set Access Permission to IT Resource page, click Continue At Step 4 : Verify IT Resource Details page, click Continue At Step 5 : IT Resource Connection Result page, click Continue And then, click Finish 15

16 OIM 11g Workshop - Lab 3 Checkpoint At this point you have just created the IT Resources that are going to be used for the next labs. 2.3.Execute Direct Provisioning for Connector health-check Purposes This step is required to test if the provisioning module of installed DSEE connector is working properly. Reconciliation module of the same connector will get verified in Lab 3 On-boarding, Reconciliation from applications (FlatFileApp, DSEE) used by the acquisition (MEDICLAIM). Steps Ensure that DSEE Server is started and running successfully in the VM (Lab 1 has the relevant details for the steps involved) For testing purposes create a user called zdseetest as the picture below. Organization: ACME Health Insurance User Type: Full-Time Employee 16

17 OIM 11g Workshop Lab 3 Note: Before starting to try direct provisioning, one issue with the iplanet connector installation needs to be fixed. There is a problem with pre-population of a field common name. Launch the Design console, Under folder Development Tools Form Designer For the process form UD_IPNT_USR Button Create New Version Provide a Label value as fix Prepopulation and click Save icon. Make it the Current version. Click the tab Pre-Populate, remove the existing Pre populate adapter associated with the field common name, attach 'iplanetpp String' adapter and map the field to User->Display Name. Finally activate this particular version of the form Provision DSEE resource manually to test the integration for connectivity. Click tab Resources and choose option Add Select iplanet User and click Continue. 17

18 OIM 11g Workshop - Lab Click Continue. 18

19 OIM 11g Workshop Lab In the Server attribute, select the lookup to choose the appropriate instance of DSEE: Note : On this screen Select DSEE Server ACME and click Close. 19

20 OIM 11g Workshop - Lab This simple test requires neither DSEE Role nor Group. Just click Continue. 20

21 OIM 11g Workshop Lab The last step is shown a Summary to the user. Review it and click Continue The provisioning for the user will be initiated Close window then click Refresh. 21

22 OIM 11g Workshop - Lab Using LDAP Browser or any other tool of your choice, verify in the DSEE server if the user got successfully provisioned. Checkpoint In this step you just created a user and executed a direct provisioning to test the connector. 22

23 OIM 11g Workshop Lab Extend OIM User schema to add custom attributes Purposes This step includes the configuration required to extend OIM User schema to add a custom attribute Permanent Contact Number. In this procedure, you will: Extend OIM User Schema Create Authorization Policy CustomAttr_Perm_Contact_Number Steps Detailed steps for adding custom attributes are already mentioned in Lab 2 - User Mgmt FGA. This section only provides you the relevant screenshots to add the custom attribute Permanent Contact Number Extend OIM User Schema Create an attribute using the following information: Attribute Name Category Name Back-end Attribute Name Display Type Properties Permanent Contact Number Basic User Information USR_UDF_CONNUM String Size: 50 23

24 24 OIM 11g Workshop - Lab 3

25 OIM 11g Workshop Lab 3 Create Authorization Policy CustomAttr_Perm_Contact_Number Create an Authorization Policy with Policy Name CustomAttr_Perm_Contact_Number, Description AuthZ required to let XELSYSADM view the custom attributes on modify user page, Entity Name User Management. Give it Permissions to View User Details (select All attributes) and Modify User Profile (select Permanent Contact Number attribute). Specify Data Constraints as All Users. In Assignment specify Assign by Role as SYSTEM ADMINISTRATORS. 25

26 26 OIM 11g Workshop - Lab 3

27 OIM 11g Workshop Lab 3 27

28 28 OIM 11g Workshop - Lab 3

29 OIM 11g Workshop Lab 3 29

30 30 OIM 11g Workshop - Lab 3

31 OIM 11g Workshop Lab 3 Checkpoint Finally the attribute Permanent Contact Number should be visible in the User Configuration. 2.5.Extend the connector to add support of custom attributes Purposes This step includes the configuration required to extend the OIM connector (SJSDS ) to add the support for one more DSEE user account attribute: homephone. Steps Extend the process form to add the support for homephone attribute 31

32 OIM 11g Workshop - Lab 3 This will add the Permanent Contact Number attribute on the DSEE connector process form UD_IPNT_USR Under folder Development Tools Form Form Designer For the process form UD_IPNT_USR Button Create New Version Provide a Label value as add - Permanent Contact Number and click Save icon. Add Permanent Contact Number attribute Still in Form Designer, select Additional Columns tab, and click Add 32

33 OIM 11g Workshop Lab 3 A new line is created Use the following information for the new attribute (double click in each field to edit): Name Variant Type UD_IPNT_USR_CONNUM (just type CONNUM as the rest is completed automatically) String Length 50 Field Label Field Type Order Permanent Contact Number TextField Provide the right value by incrementing one over the current maximum figure. 33

34 OIM 11g Workshop - Lab Finally, choose the recently added version in the dropdown Current Version and click button Make Version Active. After the update, ensure that the value of labels Latest Version and Active version get updated with the right text - add - Permanent Contact Number. 34

35 OIM 11g Workshop Lab 3 Add attribute mapping to iplanet Lookup Definition This will enhance the Attribute Map adding the relevant entry to the Attribute Map AttrName.Prov.Map.iPlanet Under folder Administration Form Lookup Definition entry AttrName.Prov.Map.iPlanet Button Add Code Key Decode Permanent Contact Number homephone 35

36 OIM 11g Workshop - Lab Click Save icon. Checkpoint In this step you have extended the connector to support a custom attribute called Permanent Contact Number which maps the LDAP attribute homephone. 36

37 OIM 11g Workshop Lab Execute required Lookup reconciliation scheduled jobs Purposes This section includes the steps required to populate the relevant lookup codes with valid data entries present in the DSEE Server, namely for DSEE roles and organizations. The lookup codes will then be used by LOVs on connector UI elements - process forms and request datasets. Steps Execute Organization Lookup reconciliation scheduled job Search for scheduled job iplanet Organization Lookup Reconciliation and execute it after updating the following parameters with the specified values. ITResourceName SearchContext DSEE Server ACME dc=mydomain,dc=com Click Run Now 37

38 OIM 11g Workshop - Lab 3 Execute Role Lookup reconciliation scheduled job Search for scheduled job iplanet Role Lookup Reconciliation and execute it after updating the following parameters with the specified values ITResourceName SearchContext DSEE Server ACME dc=mydomain,dc=com 38

39 OIM 11g Workshop Lab 3 Checkpoint Each of these scheduled jobs has a parameter named LookupCodeName. Look at the value there and you should be able to find a Lookup Definition by that name in the design console. If the scheduled job is executed correctly, the lookup definition would be populated with data entries extracted from the DSEE server. For job iplanet Organization Lookup Reconciliation, Lookup is Lookup.IPNT.Organization For job iplanet Role Lookup Reconciliation, Lookup is Lookup.IPNT.Role 39

40 OIM 11g Workshop - Lab Configure Pre-populate adapters Purposes This step describes the procedure to configure a pre-populate adapter on DSEE connector process form. In this section, you will: Create a pre-populate adapter definition using Design console Add the pre-populate adapter on the DSEE connector process form UD_IPNT_USR Steps Create a pre-populate adapter definition using Design console Under folder Development Tools Adapter Factory Create a pre-populate adapter using the following information: Adapter Name Adapter type Description PrepopulateFormField Pre-populate Rule Generator PrepopulateFormField 40

41 OIM 11g Workshop Lab Click Save icon Add variable Click on tab Variable List. Click button Add. Window entitled Adapter Variable would open. Variable Name Type Description Map To formfield String formfield Resolve at runtime 41

42 OIM 11g Workshop - Lab Click Save icon Add adapter task Click on tab Adapter Tasks. Click button Add. Window entitled Adapter Task Selection would open. Select the Options : Logic Task SET VARIABLE Click button Continue 42

43 OIM 11g Workshop Lab In the next window, Set Variable Task, set the following configurations: Variable Name Operand Type Operand Qualifier Adapter return value Variable formfield Click Save 43

44 OIM 11g Workshop - Lab Close the window and compile the adapter by clicking the button Build. This should change the adapter Compile Status from Recompile to OK. Finally, click Save icon. 44

45 OIM 11g Workshop Lab 3 45

46 OIM 11g Workshop - Lab 3 Add the pre-populate adapter on the DSEE connector process form UD_IPNT_USR Under folder Development Tools Form Designer For the process form UD_IPNT_USR Button Create New Version Provide a Label value as add Prepopulation and click Save icon. Make it the Current version. Click the tab Pre-Populate. Click Add button. 46

47 OIM 11g Workshop Lab On the window Pre-Populate Adapter, Set the following configuration: Field Name Rule Adapter Permanent Contact Number Default PrepopulateFormField Click Save. Order will get populated automatically In the section Adapter Variables, select the only entry and click Map 47

48 OIM 11g Workshop - Lab New window Adapter Variable will open up. Set the following configuration: Variable Name Data Type Map To Qualifier formfield String User Definition Permanent Contact Number Click Save. Order will get populated automatically Finally, set the form version add Prepopulation active. It should finally show up as the Active Version. 48

49 OIM 11g Workshop Lab 3 Note: Please remove the pre-populate adapter adpiplanetcommonnameppstring that is attached to column Common name Checkpoint If you practice direct provisioning of DSEE accounts (resource object - iplanet User) to OIM Users assigned with a value of Permanent Contact Number, the process forms for the connector will be launched pre-populated with the right value. 2.8.Configure few Important Parameters for Request and RBAC based provisioning scenarios Purpose This step descries the procedure to configure a pre-populate adapter on DSEE connector process form. In this section, you will: Update DSEE connector Resource Object Update DSEE connector Process Definition Steps Update DSEE connector Resource Object Launch Design console. Under folder Resource Management Form Resource Object For the resource object iplanet User Check the checkboxes Allow Multiple and Self Request Allowed and click Save icon. 49

50 OIM 11g Workshop - Lab 3 Allow Multiple flag is required if for the same OIM user we would want to provision more than one instances of resource object iplanet User. Self Request Allowed flag is required if you want an OIM user to be able to request for resource object iplanet User using OIM Self service console. Also additional relevant request templates could be configured as explained in further lab Update DSEE connector Process Definition Under Folder Process Management Form Process Definition For the process definition iplanet User Check the checkboxes Auto Pre-populate and Auto Save Form and click Save icon. 50

51 OIM 11g Workshop Lab 3 Auto Pre-populate flag is required to automatically trigger the pre-populate adapters configured on the process form of resource object iplanet User when provisioning operation is getting executed for the same. If this flag is not checked, Pre-populate button has to be clicked to fill in the form on the OIM UI if direct provisioning is taken into practice. Auto Save Form flag is required for automatically saving the instance of process form of resource object iplanet User during a provisioning operation. If this flag is not checked, the process form would launch on the OIM UI with pre-populated data (if prepopulate adapters and the Auto Pre-populate flag are configured) or blank before provisioning data is finally saved and passed forward to the provisioning target. 51

52 OIM 11g Workshop - Lab 3 3. Conclusion In this lab, you accomplished the following: Install Connector Create IT Resources Extend Attribute Mapping Create Pre-populate adapters Relevant features that you should explore further: Extending/Customizing User Create-Update-Delete events by adding custom java code. This can be achieved by adding pre-process, validation and post-process orchestration handlers on the OIM User entity, as explained in Lab 4. 52