Import CallbackConfiguration.xml to the Metadata Services MDS repository

Using the Callback Service 4-13

4.5 Troubleshooting the Callback Service

Table 4–4 lists the troubleshooting steps that you can perform if you encounter callback service errors: Table 4–4 Trobleshooting Callback Service Problem Solution Not able to submit SPML request Failed Authentication. Make sure that the SPML request is submitted with a valid SPML user member of SPML_App_Role group with its correct credentials. If the request is submitted from client APIs, then note that compatible client policy must be applied. The following is the sample eror response displayed when a SPML request is submitted with incorrect credentials: env:Envelope xmlns:env=http:schemas.xmlsoap.orgsoapenvelopeenv:H eaderenv:Bodyenv:Fault xmlns:ns0=http:docs.oasis-open.orgwss200401oasis-2004 01-wss-wssecurity-secext-1.0.xsdfaultcodens0:FailedAuthe nticationfaultcodefaultstringFailedAuthentication : The security token cannot be authenticated.faultstringfaultactorenv:Faultenv:B odyenv:Envelope 4-14 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager For a given request type, for example Assign Role, Oracle Identity Manager is making callbacks to more than one callback Web service although the policyName matches with one callback service. This is because when callbackOnly is set to false for all the eligible entity type and operation, for example Assign Role request types, the callbacks are triggered for all matching entity types and operations. PolicyName matching is ignored when callbackOnly attribute is set to false. If callbackOnly Attribute is set to true, then it checks for the policy name. All the callback Web service URLs present in that policy are triggered when the entity type and operation condition is also met. All the callback Web service URLs present in that policy are triggered when the entity type and operation condition is also met. The policy reference URI oraclewss_saml_or_username_token_se rvice_policy is not valid. Make sure that WSM Policy Manager is deployed and targeted to the interacting servers such as Oracle Identity Manager and SPML request starting server. In addition, make sure that WSM Policy Manager is in active mode and is ready for serving the requests. Not sure what is SPML APPID and Oracle Identity Manager APPID, and where these APPIDs are to be created. SPML APPID is used for submitting SPML requests to Oracle Identity Manager. Any client that seeks user provisioning service with Oracle Identity Manager must contain SPML APPID in their repository. For example, when Fusion Applications is the client to Oracle Identity Manager, Fusion Applications typically use LDAP directory as their repository. Oracle Identity Manager APPID is used for sending callbacks to all the Web services registered in the CallbackConfiguration.xml file for a given SPML request type. Oracle Identity Manager repository or database contains only SPML APPID. Oracle Identity Manager APPID is not present in Oracle Identity Manager repository but is present in the Credentials Store Framework CSF under map name oim and with key appid.credentials. SPML repository or LDAP contains both SPML APPID and Oracle Identity Manager APPID. When Fusion Applications sends a SPML request to Oracle Identity Manager, it uses SPML APPID to communicate to Oracle Identity Manager. This SPML APPID is present in the SPML repository or LDAP. This user is authenticated at Oracle Identity Manager side against the database. Therefore, Oracle Identity Manager database contains SPML APPID in it. When Oracle Identity Manager communicates with Fusion Applications, it uses Oracle Identity Manager APPID to communicate to Fusion Applications. This Oracle Identity Manager APPID is present in the CSF. This user is authenticated at Fusion Applications side again LDAP by checking the Oracle Identity Manager APPID in LDAP repository. Therefore, LDAP contains Oracle Identity Manager APPID in it. Table 4–4 Cont. Trobleshooting Callback Service Problem Solution