Configuring Oracle Identity Analytics

Using Segregation of Duties SoD 27-13

27.8 Configuring Workflows on Non SoD-enabled Connectors

Perform the procedures described in this section only if you are not using one of the preconfigured SoD-compatible connectors Oracle e-Business User Management, SAP User Management, and SAP CUA. This section discusses the following procedures: ■ Modifying the Approval Workflow for SoD ■ Modifying the Provisioning Workflow for SoD

27.8.1 Modifying the Approval Workflow for SoD

To modify the approval workflow for SoD validation:

1. Instead of object forms in earlier releases of Oracle Identity Manager, the data to

be entered while creating a request in 11g Release 1 11.1.1 is entered in request datasets. If the request datasets are not already present for the target system resource to be provisioned, then create new parent and child datasets and import them to MDS by using the MDS Import Utility. Note: It is assumed that Oracle Identity Manager and SOA are running on the same Java Runtime Environment JRE. If SOA and Oracle Identity Manager are running on different JREs, then WebLogic certificate exchange is required for SSL communication. For details, see Oracle WebLogic Server 10g Release 3 10.3 documentation in the Oracle Technology Network OTN Web site by using the following URL: http:www.oracle.comtechnetworkmiddlewareweblogi cdocumentationindex.html 27-14 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager The following is a sample request dataset for the eBusiness Suite User TCA Foundation resource. Create an appropriate request dataset for the resource being used. request-data-set xmlns=http:www.oracle.comschemaoimrequest xmlns:xsi=http:www.w3.org2001XMLSchema-instance xsi:schemaLocation=http:www.oracle.comschemaoimrequest name=eBusiness Suite User TCA Foundation entity=eBusiness Suite User TCA Foundation operation=PROVISION -- Parent form having fields -- AttributeReference name=Effective Date From attr-ref=Effective Date From type=Date length=50 widget=date required=true Note: ■ No SoD Check fields must be added in the request dataset. These fields are part of common dataset and is available by default irrespective of the connector being used. The SoD fields in the common dataset are -- Common SoD check attributes used for Provision Resource -- AttributeReference name=SoDCheckStatus attr-ref=SoDCheckStatus length=50 type=String widget=text read-only=true available-in-bulk=false system-type=true AttributeReference name=SoDCheckTrackingID attr-ref=SoDCheckTrackingID length=50 type=String widget=text read-only=true available-in-bulk=false system-type=true AttributeReference name=SoDCheckResult attr-ref=SoDCheckResult length=4000 type=String widget=text read-only=true available-in-bulk=false system-type=true AttributeReference name=SoDCheckTimestamp attr-ref=SoDCheckTimestamp length=50 type=Date widget=text read-only=true available-in-bulk=false system-type=true AttributeReference name=SoDCheckEntitlementViolation attr-ref=SoDCheckEntitlementViolation length=4000 type=String widget=text read-only=true available-in-bulk=false system-type=true Here, the attr-ref tag values represent mapping to process form fields. Therefore, any connector enabled for SoD must have these specific form field labels in the parent process form. For example, SoDCheckStatus attribute value is mapped to parent process form field with label as SoDCheckStatus. ■ For detailed information about request datasets, see Step 1: Creating a Request Dataset for the Resources on page 23-1. ■ For information about MDS ImportExport Utility, see Chapter 33, MDS Utilities and User Modifiable Metadata Files . ■ Object forms in earlier releases of Oracle Identity Manager have been replaced by request datasets in 11g Release 1 11.1.1. Therefore, although the object forms may be present in the connector, they are not used.