Creating Additional Nondefault Profiles for Reconciliation Based on Resource Objects

Managing Reconciliation Events 1-15 1. Create a copy of the exported profile XML file with a different name. 2. Make changes to the file to reflect the new profile name, horizontal table names, and new reconciliation field names and mappings. 3. Import the new profile to MDS by using the MDS import tool. 4. Copy the entity definition XML files with new names based on the new profile name. If the reconciliation field names also change, then change the XML files to refer to the new reconciliation field names. 5. Import the entity definition XML files to MDS by using the MDS import tool. 6. Create new horizontal tables in the database based on the new profile name.

1.3.1.2 Creating New Profiles for Trusted Source Reconciliation

The procedure for creating new profiles for trusted source reconciliation is similar to the procedure in Creating Additional Nondefault Profiles for Reconciliation Based on Resource Objects on page 1-14. The only difference is that trusted source reconciliation may or may not be associated with a resource object, and therefore, you can use the XML files corresponding to the LDAPUser profile as samples.

1.3.2 Updating Reconciliation Profiles

To change a property in a reconciliation profile, for instance batch size: 1. Export the dbPROFILE_NAME profile document from MDS. 2. Make changes in the XML file, for example, change the batch size value. 3. Import the updated profile into MDS by using the MDS import tool.

1.3.3 Changing the Profile Mode

You can use one of the following methods to change the profile mode property from CHANGELOG to REGULAR: ■ Change the value of the mode attribute in the profile, for example: generalconfig mode=REGULAR createEntityUsingSPFlag=true dateFormat=yyyyMMdd hh:mm:ss z ownerMatchingRuleWhereClause= UGP.ugp_ldap_guid=RA_SAMPLE_HIERARCHY.RECON_ROLE_GUID entitytype=RoleRole version=1.0 trustedSrcFlag=false Note: You can export or import files to MDS by using the MDS exportimport utility, which is run by running the weblogicExportMetadata.sh and weblogicImportMetadata.sh scripts. For information about running these scripts, see MDS Utilities and User Modifiable Metadata Files in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. See Also: Mode of Reconciliation in the Oracle Fusion Middleware Users Guide for Oracle Identity Manager for information about changelog and regular reconciliation modes 1-16 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager accountPostProcessingRequiredFlag=NOT_SET sequentialProcessingFlag=false batchSize=-1 retryInterval=30 maxRetryCount=5 defaultProfileFlag=true name=sample-hierarchy ■ Change the attribute during event creation: The event creation API, introduced in Oracle Identity Manager 11g Release 1 11.1.1, contains three parameters. The first two parameters are same as those used in previous create event APIs. The third parameter can have attributes such as dateFormat, changeType, eventFinished, and actionDate. You can use this API to set the changeType as follows: public long createReconciliationEventString objName, MapString, Object inputData, EventAttributes eventAttribs;

1.4 Populating Data in the RECON_EXCEPTIONS Table

The RECON_EXCEPTIONS table in Oracle Identity Manager database is used to capture error messages generated during account reconciliation. This data is collected for the purpose of generating reports. If a reconciliation match is found to a deleted user, then you must insert USER_DELETED in the REX_EXCEPTION column and the key of the deleted user in the USR_KEY column of the RECON_EXCEPTIONS table. If no match is found, then insert USER_NOT_FOUND in the REX_EXCEPTION column. If account match is found, then check if the account is already deprovisioned. Then insert into RECON_EXCEPTIONS table with the value RESOURCE_DEPROVISIONED in the REX_EXCEPTION column for the user who is to be provisioned. To populate the RECON_EXEPTIONS table with exception data: 1. Fetch all the events with the change type = Modify , Delete and event status as Single User Match Found, Single Org Match Found. 2. Provision the resource object for the entities by performing the following: a. Collect the exception data from RECON_EXCEPTION DB table. To do so, perform any one of the following: Check if the value of the XL.EnableExceptionReports property is TRUE. If it is set to TRUE, then continue to the next step. Otherwise, do not collect the exception data. Select the obj_initial_recon_date in the obj table for the resource object being provisioned, and check if it is earlier than todays date. If an earlier Note: Using the API to set the changeType attribute overrides the value of the changeType attribute set in the profile. See Also: Account Reconciliation in the Oracle Fusion Middleware Users Guide for Oracle Identity Manager for information about account reconciliation