Connector Installation Oracle Fusion Middleware Online Documentation Library

Integration Solutions 5-7 deployment process must be copied to the corresponding directories on each node of the cluster. 5-8 Oracle Fusion Middleware Users Guide for Oracle Identity Manager 6 Auditing 6-1 6 Auditing Oracle Identity Manager provides a powerful audit engine to collect extensive data for audit and compliance purposes. You can use the audit functionality together to capture, archive, and view entity and transactional data for compliance monitoring and IT-centric processes and forensic auditing. Therefore, with the audit and compliance modules, Oracle Identity Manager provides profile auditing, reporting, and attestation features. You can capture, transport, store, retrieve, and remove historical data over its life cycle. Security is maintained at every stage of the data life cycle. For information about attestation processes, see Managing Attestation Processes on page 19-1. This chapter consists of the following topics: ■ Overview ■ Audit Engine ■ User Profile Auditing ■ Role Profile Auditing ■ Enabling and Disabling Auditing

6.1 Overview

This section provides an overview of auditing in the following sections: ■ Auditing Design Components ■ Profile Auditing ■ Standard and Customized Reports

6.1.1 Auditing Design Components

Figure 6–1 shows the design components for Oracle Identity Manager auditing process. 6-2 Oracle Fusion Middleware Users Guide for Oracle Identity Manager Figure 6–1 Design Components of the Auditing Process Any action that a user performs in Oracle Identity Manager translates into an Application Programming Interface API call or into a Message Driven Bean MDB picking up a message to process an action. One action can cause multiple changes. All changes are combined into an audit transaction. Each API method that can modify data objects calls the startTransaction method in the audit engine at the beginning of the API call and the endTransaction method at the end of the API call. This defines boundaries for the audit transaction. The audit engine generates a transaction ID to identify the changes made in the transaction.

6.1.2 Profile Auditing

Oracle Identity Manager provides auditing and historical archiving of profile information. It takes a snapshot of a profile, stores the snapshot in an audit table in the database, and updates the snapshot each time the profile data changes. In the context of profile auditing, the term snapshot means a copy taken of the entire profile data at any instant when the data is modified.

6.1.3 Standard and Customized Reports

The BI Publisher provides standard reports for viewing archived data. You can also create customized reports. For information about reporting, refer to the following: ■ Using Reporting Features on page 20-1 ■ Reporting in Oracle Fusion Middleware Developers Guide for Oracle Identity Manager for information about reporting

6.2 Audit Engine

User profile audits cover changes to user profile attributes, user membership, resource provisioning, access policies, and resource forms. The audit engine collects auditing information in Oracle Identity Manager. Whenever a profile is modified, the audit engine captures the changes the delta and updates or generates, if missing the snapshots of the user and role profiles and stores these Data Parsing Data Writing Change Notification Usage Audit Transaction Management API or MDB Data Objects Auditor Audit Engine Oracle Identity Manager Database Design Components Oracle Identity Manager Server