OIG 11G R2 Field Enablement Training

OIG 11G R2 Field Enablement Training Lab 14 - Reconciliation Lab Disclaimer: The Virtual Machine Image and other software are provided for use only during the workshop. Please note that you are responsible for deleting them from your computers before you leave. If you would like to try out any of the Oracle products, you may download them from the Oracle Technology Network (http://www.oracle.com/technology/index.html) or the Oracle E-Delivery WebSite (http://edelivery.oracle.com) Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 1 P a g e

Table of Contents OIG 11G R2 Field Enablement Training... 1 Lab 14 - Reconciliation Lab... 1 1. Introduction... 3 2. User On-boarding... 3 2.1 Understanding GTC... 3 2.2 On-boarding a new employee in HR System... 4 2.3 Importing the User from HRMS to OIG... 6 3 Importing Additional User Information from a Flat File... 8 3.1 Installing the Flat File Connector... 8 3.2 Executing FlatFileGenerator.sh for generate Metadata and install connector FlatFileTrusted... 11 3.3 Adding and Mapping additional fields through Design Console... 13 3.4 Update Lookups... 15 3.5 Verifying the result... 26 4 Account Reconciliation from Target... 27 5. Event Ad Hoc Linking and Closure... 31 6 Event Reevaluation and Closure... 36 Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 2 P a g e

1. Introduction In this lab we will take a look at how to reconcile the users using GTC database connector. We will also take a look at the reconciliation using the new ICF based flat file connector. We will also take a look at the Ad Hoc linking of reconciliation events as well as re evaluation of reconciliation events. 2. User On-boarding The organization s HR system has a portal where users (employees/contractors etc) are registered. Using a GTC for DB all the users are imported daily into the OIG system. In the following exercises let us try to understand the connector configuration and try out how it works. 2.1 Understanding GTC 1. Launch the Sysadmin console in a new browser window. 2. Login as ADMIN. 3. Click on the Generic Connector link under Configuration. A window pops up. 4. In the new window, click on Search Connectors button. 5. Click on the connector with HR APPLICATION TABLES as Connector Name. 6. In the next screen, click on Edit Parameters. 7. Click Continue. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 3 P a g e

8. A new popup window showing the attribute mapping screen appears. Take some time in understanding the mappings. 9. Click on Close at the top. 10. Click Exit in the popup window. 11. Confirm exit by clicking on Yes. 12. Sign-out and close the browser. 2.2 On-boarding a new employee in HR System 1. Hit the HR portal URL in the browser. Refer to the getting started guide if you are not aware of the URL. 2. Login as hradmin/oracle123. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 4 P a g e

3. Click on the New Employee link. 4. Fill the form with the below details. Identity Tab First Name Peter Last Name Smith Employee Type Employee Organization Information Systems Location San Francisco Active Yes, Active Job Tab Is Manager No Manager Crane, Danny Cost Center 101 Is Head of Dept No Position Information Systems Developer 5. Click on Create New Employee. 6. Note down the HR record id etc. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 5 P a g e

2.3 Importing the User from HRMS to OIG 1. Hit the Sysadmin console of OIG in a new browser window. 2. Login as ADMIN. 3. Click on Scheduler in System Management. 4. Search for HR APPLICATION TABLES_GTC task. 5. Click on Run Now. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 6 P a g e

6. Click on Refresh to check the status of the task. 7. Close the Scheduler window. 8. Sign out and close the browser. 9. Hit the Identity Self Service console. 10. Login as ADMIN. 11. Navigate to the Users section under Administration. 12. In the search window, provide PSMITH as the user Login. 13. Hit the search button. 14. As we can observe the user is now created in OIG. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 7 P a g e

3 Importing Additional User Information from a Flat File Employees do not provide their contact numbers on day one at the company. This information is stored in a temporary file and is uploaded to the system via a flat file. Let us see the power of OIG in importing user records from a flat file and appending the information to the right records. Prerequisites 1. The new ICF based Flat File connector is supplied in /app/software directory. Open a terminal and navigate to /app/software directory 2. Unzip the connector unzip FlatFile-11.1.1.5.0.zip 3. Now copy the connector to OIM s default directory mv FlatFile-11.1.1.5.0 /app/middleware/oracle_idm1/server/connectordefaultdirectory/. 3.1 Installing the Flat File Connector 1. Launch the Identity System Administration console in a new browser window. 2. Login as Admin 3. Click on the Generic Connector link under Configuration. A window pops up. 4. Click on the button 5. Form the list select the Flat File connector and click button Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 8 P a g e

6. Now click button to install the connector 4. Wait until the connector was installed and then you will see the following screen. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 9 P a g e

7. Click button to close the connector installer wizard 8. Optionally you can check the scheduler job for the flat file in the steps 8-10 to verify that the objects were created 9. Open Scheduler under System Management section 10. In the new window, search for Flat File* in the blank field. 11. Select Flat File Users Loader from the list Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 10 P a g e

3.2 Executing FlatFileGenerator.sh for generate Metadata and install a new connector named FlatFileTrusted In the terminal window follow the next steps: 1. Change in /app/software % cd /app/software 2. Unzip again the connector % unzip FlatFile-11.1.1.5.0.zip 3. Edit FlatFileConfiguration.groovy file % gedit FlatFile-11.1.1.5.0/metadata-generator/resources/FlatFileConfiguration.groovy 4. Let give a new name to the connector, we need to modify the variable itresourcedefname with the value FlatFileTrusted, it must be without any spaces 5. Just below of Trusted/Target mode section, the variable trusted must be set with a value equal to true 6. Next section you will find disconnected/connected resource section, the variable disconnectedresource must be equal to false 7. In the next rows below you will find the variable schemafile which should be equal to the path where file will be located, for this exercise the value is equal to /app/dummydata/lab14/flatfiletrusted.properties 8. Save the file & close it 9. Observe the properties file: % view /app/dummydata/lab14/flatfiletrusted.properties 10. List of fields must be considered for be used, in this case are User Login and contactnumber 11. Change to next directory: % cd FlatFile-11.1.1.5.0/metadata-generator/bin 12. Set permissions in the file in order to set it executable % chmod 777 FlatFile-11.1.1.5.0/metadata-generator/FlatFileGenerator.sh 13. Execute it using the next instruction: %./FlatFileGenerator.sh../resources/FlatFileConfiguration.groov y trusted Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 11 P a g e

14. Verify in FlatFile-11.1.1.5.0/metadata-generator/ that the file FlatFileTrusted.zip had been generated 15. Copy the generated file into /app/middleware/oracle_idm1/server/connectordefaultdirectory/. % cp FlatFileTrusted.zip \ /app/middleware/oracle_idm1/server/connectordefaultdirectory 16. Change to next directory: % cd /app/middleware/oracle_idm1/server/connectordefaultdirectory 17. Unzip the file FlatFileTrusted.zip % unzip FlatFileTrusted.zip 18. Observe FlatFileTrusted-ConnectorConfig.xml % gedit FlatFileTrusted/xml/FlatFileTrusted-ConnectorConfig.xml 19. From Identity System Administration, install the connector using the files created in the last steps Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 12 P a g e

20. Continue 3.3 Manage IT Resource 1. In the Identity System Administration Console, click on Manage IT Resource 2. Click on the button 3. Search and Edit the Flat File Users from the IT Resource Name column 4. Fill the schemafile field with the location of users file, in this case with the value: /app/dummydata/lab14/flatfiletrusted.properties Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 13 P a g e

5. Click on button 6. Close the window 7. Search and Edit the FlatFileTrusted from the IT Resource Name column 8. Fill the Configuration Lookup parameter set the value Lookup.FlatFile.UM.Configuration.Trusted 9. Click on button Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 14 P a g e

3.4 Update Lookups 1. Click on Lookups from the Identity System Administration Console 2. Search for Lookup.FlatFile.Configuration in the Meaning field, use the button 3. Check the existence of Lookup.FlatFile.UM.Configuration value in the Meaning column inside the list of values as shown in the space of Lookup.Flatfile.Configuration: Lookup Values Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 15 P a g e

4. Search for Lookup.FlatFile.UM.Configuration in the Meaning field, use the button 5. Click on edit button 6. Replace the Dummy value in the Meaning field for Lookup.FlatFileTrusted.UM.ReconAttrMap.Defaults 7. Click Save button Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 16 P a g e

8. Now, search for Lookup.FlatFileTrusted.UM.ReconAttrMap.Defaults in the Meaning field, using the button 9. Click in the button and add NAME for meaning field and User Login for code 10. Add another row with the value contactnumber like meaning and also put for the code field 11. Save the changes 12. Search for Lookup.FlatFile.UM.Configuration.Trusted in the Meaning field, use the button 13. Click on this value 14. Edit Lookup.FlatFile.UM.Configuration.Trusted and click on edit button 15. Replace the Dummy value with Lookup.FlatFileTrusted.UM.ReconAttrMap.Defaults 16. Click on button and close de window 3.4 Adding and Mapping additional fields through Design Console 17. Start Design Console 18. Open Resource Objects in the left panel under Resource Management Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 17 P a g e

19. Search using FlatFile* in the Name field 20. Click on Object Reconciliation tab 21. Add Reconciliation Data Field with button a. Specify contactnumber in Field Name b. String like Field Type 22. Save and quit 23. Go to Reconciliation Action Rules tab just to review the available Rule Conditions for this object 24. Go to Process Definition leaf under Process Management in the left panel and in the right form look for Flat* in the Name field using buttom 25. You will see the next screen: Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 18 P a g e

26. Click on Reconciliation Field Mappings 27. Click on 28. Select from Field Name the option contactnumber and Telephone Number like User Attribute 29. Click Save in the Add Reconciliation Field Mapping window 30. Click Save again on the main Design Console window 31. Click on Resource Objects tab in the bottom of the window Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 19 P a g e

32. Click on the button. 33. Click on Ok button. 34. From the left panel click on Reconciliation Rules under Development Tools 35. Click on button, and you should see the next data 36. Click on Reconciliation Rules tab from the bottom of the window 37. Click on FlatFileTrusted User row, you will see one rule inside Rule Definitions panel Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 20 P a g e

38. Back to the Design Console application 39. Click Lookup Definition under Administration tab on the left panel 40. Search Lookup.Flat* in the Code field, clicking the button Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 21 P a g e

41. Click on the Lookup Definition Table tab in the bottom of the application Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 22 P a g e

42. Click on Lookup.FlatFileTrusted.UM.ReconAttrMap code just to look on the values inside the Lookup Definition 43. Back to Lookup Definition Table tab 44. Click on Lookup.FlatFileTrusted.UM.ReconAttrMap.Defaults code just to look on the values inside the Lookup Definition Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 23 P a g e

45. Click on Resource Objects tab in the bottom of the window and observe the values 46. Go to Identity Self Service console 47. Click on Users under Administration 48. Search for user JKRAUSE in User Login field and with Starts with operator from the menu 49. Click on JKRAUSE in the Search Results panel 50. Repeat the search in the Users tab but now looking for DCRANE user with Starts with operator from the menu in the User Login field 51. Compare both users 52. Go to the System Administration console 53. Click on Scheduler and Search for Flat File Users Loader 54. Fill directory /app/dummydata/lab14/users on Flat File directory field under Parameters 55. Fill FlatFileTrusted on the Target IT Resource Name field 56. Fill FlatFileTrusted User on the Target Resource Object Name field Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 24 P a g e

57. Before execute the next step, ensure that users.csv file is under the directory /app/dummydata/lab14/users Open the users.csv file Add the following and save the file PSMITH,6505067000 58. Click on and then button and then button several times until than the Job Status was Stopped and the Execution Status was Success 59. In the /app/dummydata/lab14/users/ directory the file users.csv will disappear and archived folder will be created with one zipped file of the users file. 60. In the Search Reconciliation Events search for last three events from Flat file connector Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 25 P a g e

3.5 Verifying the result 61. Login to the Identity Self Service Console 62. Search the user PSMITH 63. Click on PSMITH and then click on Attributes 64. Check field Telephone Number field and verify that it already has the value specified in users.csv file Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 26 P a g e

4 Account Reconciliation from Target Now that we have on-boarded users into the Identity system, it is time to import their accounts from the end IT resources. We shall import Graham s Enterprise OUD account and link it with his identity. 1. Hit the OIM Identity Self Service URL in a new browser. 2. Login as ADMIN. 3. Click on Users under Administration. 4. Search for PSMITH. Click on the User Login to open. 5. Navigate to the Account sub tab. Notice that there are no accounts linked to the user. Note: If you have already executed Labs 2 & 3.1. There might be account provisioned to the user already due to Access Policy based provisioning. In this case revoke the account first. 6. Logout and close the browser. 7. We don t have the user PSMITH in OUD, so we need to create the user first, in order to run the reconciliation and link it to OIM user. 8. In the VM environment in the Command line console/terminal hit the following commands. #cd /app/oud/oracleunifieddirectory-11.1.2.0/bin #./ldapmodify -v -a -h identity.oracleads.com -p 2389 -D 'cn=directory Manager' -w Oracle123 9. Now the Terminal window is in a listening mode. Insert the following text and hit Enter twice. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 27 P a g e

dn: uid=psmith,ou=people,dc=example,dc=com objectclass: person objectclass: organizationalperson objectclass: inetorgperson objectclass: top givenname: Peter uid: PSMITH cn: Peter Smith sn: Smith userpassword:oracle123 10. You should see a success message like below Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 28 P a g e

11. Hit Ctrl + C in the terminal window to close the ldapmodify listen mode. 12. Now let us verify his account in the OUD. 13. In the VM environment, hit the following commands. # cd /app/oud/oracleunifieddirectory-11.1.2.0/bin #./ldapsearch -v -h localhost -p 2389 -D 'cn=directory Manager' -w Oracle123 -b "dc=example,dc=com" "(uid=psmith)" 14. You should be able to see the existing user record in OUD. 15. Open the Sysadmin console in a browser. 16. Login as ADMIN. 17. Click on Scheduler under System Management. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 29 P a g e

18. Search for a scheduled job by name, LDAP Connector User Search reconciliation. 19. Update the IT Resource Name as Enterprise Directory - OUD 20. Click on Apply and then Run Now 21. Click on Refresh. 22. Click on Run Now. To know the status of the job, keep clicking on Refresh. 23. Once the job is completed, close the Scheduler window. 24. Logout of sysadmin console and close the browser. 25. Hit the Identity Self Service console in a browser. 26. Login as ADMIN. 27. Click on Users under Administration. 28. Search for PSMITH. 29. Click on the User Login field to open the user record. 30. Navigate to the accounts sub tab. Do you notice that the user now has an Enterprise Directory account? Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 30 P a g e

5. Event Ad Hoc Linking and Closure How do we link the admin accounts to their respective owners? In this exercise let us see how we can get this objective accomplished. 1. Create a new user ADMIN_GS in Enterprise directory. 2. In the VM environment in the Command line console/terminal hit the following commands. #cd /app/oud/oracleunifieddirectory-11.1.2.0/bin #./ldapmodify -v -a -h identity.oracleads.com -p 2389 -D 'cn=directory Manager' -w Oracle123 3. Now the Terminal window is in a listening mode. Insert the following text and hit Enter twice. dn: uid=admin_gs,ou=people,dc=example,dc=com objectclass: top objectclass: person objectclass: organizationalperson objectclass: inetorgperson uid: ADMIN_GS givenname: AdminAC sn: GS cn: Admin GS userpassword: Oracle123 4. You should see a success message. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 31 P a g e

5. Hit Ctrl + C in the terminal window to close the ldapmodify listen mode. 6. In a browser, open the sysadmin console. 7. Login as ADMIN. 8. Under System Management click on Scheduler. A popup window opens. 9. Search for a task by name, LDAP Connector User Search Reconciliation. 10. Remove the Latest token Value to make it Blank 11. Click on Run Now. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 32 P a g e

12. Keep clicking Refresh to know the status of the job. Proceed only after completion. 13. In the same window, navigate to Event Management. 14. Hit the arrow button to see all the recon events. Most of the recent events should be of the Profile Name as LDAP User. 15. The first event should probably be the one we are looking for. Else open the recent events till you find our user. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 33 P a g e

16. Click on Ad Hoc Link button. 17. In the Search box, search for GSMITH. 18. Select the user and click on Confirm. 19. Check the Service Account Checkbox. 20. Click on Link. 21. In the success confirmation dialog box, click OK. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 34 P a g e

22. Click on Refresh at the top. 23. You would not see any of those previously available buttons. 24. Logout. 25. Navigate to the Identity Self Service console. 26. Login as ADMIN. 27. Click on Users under Administration. 28. Search for GSMITH. 29. Open the identity by clicking on User Login. 30. Navigate to the Accounts sub tab. Do you notice the new account? Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 35 P a g e

6 Event Reevaluation and Closure It might happen that the accounts and their respective identities are not present in the system at the same time and respective linking might not happen. This exercise trains us on how to deal with such situations. 1. Create a new user SARORA in Enterprise directory. 2. In the VM environment in the Command line console/terminal hit the following commands. #cd /app/oud/oracleunifieddirectory-11.1.2.0/bin #./ldapmodify -v -a -h identity.oracleads.com -p 2389 -D 'cn=directory Manager' -w Oracle123 3. Now the Terminal window is in a listening mode. Insert the following text and hit Enter twice. dn: uid=sarora,ou=people,dc=example,dc=com objectclass: top objectclass: person objectclass: organizationalperson objectclass: inetorgperson uid: SARORA givenname: Sandhya sn: Arora cn: Sandhya Arora userpassword: Oracle123 4. You should see a success message. 5. Hit Ctrl + C in the terminal window to close the ldapmodify listen mode. 6. In a browser, open the sysadmin console. 7. Login as ADMIN. 8. Under System Management click on Scheduler. A popup window opens. 9. Search for a task by name, LDAP Connector User Search Reconciliation. 10. Click on Refresh. 11. Remove the Latest Token value to make it Blank Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 36 P a g e

12. Click on Run Now. 13. Keep clicking Refresh to know the status of the job. Proceed only after completion. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 37 P a g e

14. In the same window, navigate to Event Management. 15. Hit the arrow button to see all the recon events. Most of the recent events should be of the Profile Name as LDAP User. 16. The first event should probably be the one we are looking for. Else open the recent events till you find our user. 17. This account is not linked to any user as it did not find the appropriate user in OIG. Let us create one now. 18. In a new browser window open the Identity Self Service console. 19. Login as ADMIN. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 38 P a g e

20. Navigate to Users under Administration. 21. Click on Create. 22. Create a user with the below details. First Name Last Name Email Organization User Type Display Name User Login Password Sandhya Arora Sandhya.arora@oracleads.com Information Systems Full Time employee Sandhya Arora SARORA Oracle123 23. Click on Submit. 24. In the same window Opened in Step 15 above, (if already open) navigate to the Reconciliation Event sub tab. 25. Click on Reevaluate Event. 26. In the dialog box click on Reevaluate. 27. Click Reevaluate in the dialog box. What are we doing here? By clicking on Reevaluate we are asking the system to reconsider this entry and try for correlation once again. 28. Click on Refresh at the top. 29. Now you should be able to see that the Linked User value has changed from Not Linked to SARORA - Sandhya Arora. 30. Go to Matched Users sub tab. 31. Notice that Sandhya Arora is the user matched to this account. Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 39 P a g e

Oracle Proprietary - Restricted to Personal Use in an Oracle partner training class 40 P a g e