Deploying the SIL and SIL Providers
27.7 Enabling SSL Communication
The following sections contain information on enabling Secure Sockets Layer SSL communication for various SoD purposes. ■ Enabling SSL Between Oracle Application Access Controls Governor and Oracle Identity Manager ■ Enabling SSL Between SAP GRC and Oracle Identity Manager ■ Calling SoD Check Web Service Over SSL27.7.1 Enabling SSL Between Oracle Application Access Controls Governor and Oracle Identity Manager
To enable SSL communication between Oracle Application Access Controls Governor and Oracle Identity Manager: 1. Export the certificate on the Oracle Application Access Controls Governor host computer as follows:a. Run the following commands from the JAVA_HOMEbin directory:
keytool -genkey -alias tomcat -keyalg RSA -keystore JAVA_HOMElibsecurity.keystore keytool -certreq -alias tomcat -file JAVA_HOMElibsecurityxell.cvs -keystore JAVA_HOMElibsecurity.keystore keytool -export -alias tomcat -file JAVA_HOMElibsecurityserver.cert -keystore JAVA_HOMElibsecurity.keystore See Also: The connector guide for detailed information about disabling these process tasks. Note: It is assumed that you have set sslEnable to true during the registration process. Note: In Step 1, JAVA_HOME refers to the directory on the Oracle Application Access Controls Governor host computer.Parts
» Oracle Fusion Middleware Online Documentation Library
» The Form View The Table View
» Starting the Design Console Assignment Windows
» Search Operations Oracle Fusion Middleware Online Documentation Library
» Forms Accessible from the Design Console
» Introduction to Adapters Oracle Fusion Middleware Online Documentation Library
» Types of Adapters Oracle Fusion Middleware Online Documentation Library
» Automatic Compilation of Adapters
» Compiling Adapters Manually Compiling Adapters
» To compile every adapter that resides within the Oracle Identity Manager
» To enable the adapter to automate a process task, select Process Task T.
» Select the type of adapter you want, for example, Process Task T. Then, click OK.
» From the toolbar, click Save.
» Tabs of the Adapter Factory Form
» Click Add. About Adapter Variables
» Modifying an Adapter Variable
» Select the adapter that contains the adapter variable you want to edit, for example,
» Click the Variable List tab and double-click the row header of the adapter variable
» Make the necessary edits, for example, changing the adapter variables data type
» On the Edit a Variable toolbar, click Save. The modified information about the
» Deleting an Adapter Variable
» Click Delete. About Adapter Variables
» Click Add. Creating Adapter Tasks
» Click an option—for example, New Object Instance—and click Continue. The Add
» Click Set. Creating Adapter Tasks
» On the Add an Adapter Factory Task window toolbar, click Save. The information
» On the toolbar, click Close. The Add an Adapter Factory Task window
» To compile the adapter, click Build.
» Click Continue. Creating Adapter Tasks
» Optional. If you want your remote task to be reusable, select the Persistent
» From the Add an Adapter Factory Task window, select a JAR file, class file,
» From the Add an Adapter Factory Task window toolbar, click Save.
» From this window toolbar, click Close.
» Creating a Stored Procedure Task
» For Oracle Identity Manager Installations that use Oracle Database, copy the
» Select the adapter to which you wish to add a stored procedure task, for example,
» Click the Adapter Tasks tab.
» Select the Functional Task option.
» From the display area to the right of the option, select Stored Procedure, and click
» In the Task Name field, enter the name of the stored procedure task you are
» In the Description text area, you can enter a description for this stored procedure
» Click the Database list. The databases, which are defined in the IT Resources form,
» Click the Schema list. The schemas appear, which are associated with the
» Optional. Repeat steps 3 through 13 to create additional stored procedure tasks
» Optional. If you want your utility task to be reusable, select Persistent Instance,
» Click the Application API list. The class files appear, which belong to the
» From the Add an Adapter Factory Task windows toolbar, click Save. The
» From this windows toolbar, click Close.
» To Create an Oracle Identity Manager API Task
» Select the adapter to which you wish to add an Oracle Identity Manager API task,
» Select the Utility Task option.
» From the display area to the right of the option, select Xellerate API, and click
» Click Continue. The Add an Adapter Factory Task window is displayed.
» Close the Add an Adapter Factory window to activate the main screen. The Oracle
» Optional. To create additional Oracle Identity Manager API tasks for the adapter,
» Reassigning the Value of an Adapter Variable
» Click Add. The Adapter Task Selection window is displayed.
» From the display area, select SET VARIABLE, and click Continue. The Add Set
» On the toolbar in the Add Set Variable Task Parameters window, click Save. The
» On the Add Set Variable Task Parameters window toolbar, click Close. The Add
» Select the adapter to which you wish to add a logic task for example, the Check
» Select the Logic Task option.
» From the display area, select the type of logic task you want to create. Then, click
» From the Add Adapter Factory Logic Task Parameters window toolbar, click Save.
» From this window toolbar, click Close. The Add Adapter Factory Logic Task
» On the toolbar, click Close.
» To recompile the adapter, click Build.
» Select the task that must be placed inside of another task, and click the Right
» On the toolbar, click Save. To compile the adapter, click Build.
» Click Delete. On the toolbar, click Save.
» Click Add. Working with Responses
» Click the field that appears within the Description column.
» Enter a description for this response for example, The user was created successfully..
» Double-click the field that appears within the Status column.
» Click the desired status level for example, Completed C. Then, click OK. Click the Responses tab.
» Click Delete. Working with Responses
» Enable the desired check boxes. Then, from the toolbar, click Save.
» Double-click the Form Description field. A Lookup dialog box appears with the
» Select the form you want for example, Solaris. Then, click OK.
» Click Save. Then, click Close
» Associating Rule Generators with Processes
» Removing Rule Generators from Form Fields
» Open the Data Object Manager form.
» Select the form that contains a rule generator you want to remove.
» The selected form, along with its rule generators, appear in the Data Object
» Click the rule generator that you want to remove from the form field.
» Click Delete. Working with Rule Generator Adapters
» Disabling and Re-enabling Adapters Working with Entity Adapters
» Open the Process Definition form, which is located in the Process Management
» Select the process, which contains a task to which you want to attach an adapter.
» Double-click the row header of the task to which you want to attach a task
» Click the Assignment tab. The Assignment dialog box is displayed.
» Double-click the Priority field. From this field, set the priority number for the
» Double-click the Rule lookup field. From the Lookup dialog box that is displayed,
» Double-click the Target Type lookup field. From the Lookup dialog box that is
» Double-click the Adapter lookup field. From the Lookup dialog box that is
» On the toolbar that is displayed within the Assignment tab, click Save.
» Click Map. Working with Task Assignment Adapters
» Set the mappings for each variable that appears in the Adapter Variables region of
» On the toolbar, click Save. Then, click Close.
» Open the Form Designer form.
» Query for the form to which you want to attach a prepopulate adapter for
» Click Add. Working with Prepopulate Adapters
» From the Field Name combo box, select the form field, such as User ID, to which
» In the Order field, enter the priority number of the rule you selected in Step 11, for
» On the prepopulate Adapters window toolbar, click Save.
» On the Map Adapter Variable window toolbar, click Save. Then, click Close.
» Removing Prepopulate Adapters from Form Fields
» Click Delete. The prepopulate adapter is removed from the form field. It cannot be
» Click Add. Working with Process Task Adapters
» To access Oracle Identity Manager adapters, click the Adapter option.
» From the Handler Selection windows toolbar, click Save.
» Click OK. Working with Process Task Adapters
» On the Editing Task window toolbar, click Save. Click the Integration tab.
» Click OK. On the toolbar, click Close.
» Adapter Mapping Information Oracle Fusion Middleware Online Documentation Library
» Oracle Identity Manager receives the request and creates an Assign Roles request
» Oracle Identity Manager initiates an SoD validation with Oracle Applications
» Mapping Oracle Identity Manager Attributes
» Sending Event Callbacks Oracle Fusion Middleware Online Documentation Library
» Import CallbackConfiguration.xml to the Metadata Services MDS repository
» Troubleshooting the Callback Service
» Click Save. Event Handler Manager Form
» Double-click the Form Description field.
» Click OK. Data Object Manager Form
» Enter a name for the rule in the Name field.
» Select the target resource with which this rule is to be associated in the Object
» Enter a description for the rule in the Description field.
» Go to the Rule definition to which you want to add elements.
» Click Add Rule Element on the Rule Elements tab.
» Select a user-related data item from the User Data menu.
» Select an operator from the Operator menu.
» Overview of Business Rule Definition Overview of Task Creation
» Define the Metadata for the Scheduled Task
» Configure the Scheduled Task XML File
» Develop the Scheduled Task Class
» Add a plugin element for each scheduled task that you are adding.
» Create the Directory Structure for the Scheduled Task
» Background of the Plug-in Framework
» Configuring Plug-ins Oracle Fusion Middleware Online Documentation Library
» Set the values for WLS_HOME and OIM_HOME in ant.properties.
» Build the wlfullclient.jar in Oracle WebLogic server:
» Change directories to WLS_HOMEserverlib.
» About Mapped Values Plug-in Points
» An Overview of User Management Operations
» Create the metadata XML file containing definitions of all the custom events.
» Troubleshooting an Event Handler
» Login to the Administrative and User Console, and then click Advanced.
» In the Welcome page, under Configuration, click Manage Resource.
» Click Search. Viewing Resource Details
» Select the Organization Associated For the Resource option.
» Rearranging Elements Operations on the Workflow Visualizer
» General Tab Accessing the Task Details
» Depends On Tab This tab displays the task name that the current task is
» Information Workflow Designer Main Page
» Display Options Clicking Display Options opens the Set Display Options
» Generate Image Clicking Generate Image saves the current view of the
» Legend Clicking Legend opens the Legend dialog box, which is shown in
» Depending on whether you want to set or remove specific access permissions Click Update.
» If you want to unassign an administrative role, select the Unassign check box in
» Click Assign Role. Oracle Fusion Middleware Online Documentation Library
» For the administrative roles that you want to assign to the IT resource, select the
» Click Update Permissions. Oracle Fusion Middleware Online Documentation Library
» Depending on the changes that you want to make, select or deselect the check
» From the list of IT resources displayed in the search results, click the Delete icon
» To confirm that you want to delete the IT resource, click Confirm Delete.
» Select or clear the Encrypted option.
» Click Save. Managing Resources By Using the Design Console
» Creating a Rule Rule Designer Form
» Click Add Element. Managing Resources By Using the Design Console
» From the Toolbar of the Edit Rule Element dialog box, click Save, and click Close. Click Add Rule.
» Select a nested rule and click Save. Click Close.
» In the Name field, enter the name of the resource object.
» To request the resource object for a user, select Order For User.
» Double-click the Type lookup field.
» If you want to be able to request the resource object for yourself, select the Self Click Save.
» Click Assign. Click OK. Click Delete. Click Assign.
» Click Delete. Managing Resources By Using the Design Console
» Click Assign. Managing Resources By Using the Design Console
» Click OK. Managing Resources By Using the Design Console
» Click Add Field. Managing Resources By Using the Design Console
» Enter the name of the field on the target resource or trusted source in the Field
» Select one of the following values from the menu in the Field Type field:
» Select the Required check box.
» Click Delete Field. Managing Resources By Using the Design Console
» Select a value from the Rule Action menu.
» Click Save, and close the Add a new Action Rule dialog box.
» On the Resource Object tab, create the ActDir resource object for trusted source
» Select the Trusted Source check box on the Resource Object tab.
» Click the System Management tab, and then click System Configuration.
» Optional. If you have selected the User option in the From box, double-click the
» Add information in the Subject field.
» Click Save. Email Definition Form
» Double-click the Object Name lookup field.
» Double-click the Table Name lookup field. Click Save.
» Click Add. Process Definition Form
» In the Task Name field, enter the name of the process task.
» From the Toolbar of the Creating New Task window, click Save. Then, click Close.
» Click Delete. Process Definition Form
» Click Save. Process Definition Form
» Double-click Process Data Field, and select the correct mapping from the Lookup
» Double-click the Process Data Field field.
» Select the Reconciliation Field Mappings tab.
» Click Delete Map. Process Definition Form
» Click Assign. Process Definition Form
» Click OK. Process Definition Form
» Modifying a Process Tasks General Information
» In the Description field, enter explanatory information about the process task.
» Optional. In the Duration area, enter the expected completion time of the process
» To enable a user to cancel the process task if its status is Pending, select the Allow
» Optional. If the process task is Rejected, you might want Oracle Identity Manager
» From the Child Table box, select the child table of the custom form where Oracle
» Select Conditional and specify the condition to be met for the task to be added to
» To assign an event handler to the process task, select the System option.
» Select the event handler or adapter that you want to assign to the process task.
» From the Handler Selection windows Toolbar, click Save. Click OK.
» Click Map. Process Definition Form
» Complete the Map To, Qualifier, IT Asset Type, IT Asset Property, Literal Value,
» From the Preceding Tasks region, click Delete.
» Click the Task Dependency tab.
» From the Dependent Tasks region, click Assign. Click OK.
» From the Dependent Tasks region, click Delete.
» In the Responses region, click Add.
» Enter information in the Response field.
» Enter information in the Description field. This field contains explanatory
» Double-click the Status lookup field.
» From the Responses region, click Delete.
» From the Tasks to Generate region, click Assign.
» In the Undo Tasks region, click Assign.
» Click OK. From the Undo Tasks region, click Delete.
» From the Recovery Tasks region, click Assign.
» Click OK. From the Recovery Tasks region, click Delete.
» Click Assign. Click OK. Double-click the Status lookup field. Click Save.
» Double-click the row heading of the process task, which has a status that you want
» Click the Task to Object Status Mapping tab.
» Select the desired process task status.
» Double-click the Object Status lookup field.
» Click Save. Click the Assignment tab. Click Add.
» In the Table Name field, enter the name of the database table that is associated
» In the Description field, enter explanatory information about the form.
» Select the Process option. This is because the form is assigned to a provisioning
» Adding a Data Field to a Form
» In the Additional Columns tab, click Add.
» In the Name field, enter the name of the data field, which is displayed in the
» Double-click the Variant Type lookup field.
» In the Order field, enter the sequence number, which will represent where the Click Save.
» Click Delete. Form Designer Form
» Click Assign. Click OK. Click Delete.
» Click Save. Form Designer Form
» Click Add Property. Form Designer Form
» Click Delete Property. Form Designer Form
» Click Assign. Form Designer Form
» Select the user group, and assign it to the record of the user-created form.
» Click OK. Form Designer Form
» If you want this user group to be able to remove information from the current
» Creating an Additional Version of a Form
» Search for the specific form of which you want to create a different version.
» Click the Current Version box.
» Click the Create New Version button.
» In the Label field, enter the name of the additional version of the form.
» From the Create a New Version windows toolbar, click Save.
» From this toolbar, click Close.
» In the Code field, enter the code that represents the error message definition.
» In the Description field, enter a description for the error message.
» In the Remedy field, you can enter a description for how to correct the condition
» In the Help URL field, you can enter the link to the URL that contains an online
» Optional Double-click the Action Lookup field.
» Optional Double-click the Severity Lookup field. From the Lookup dialog box
» In the Note field, enter explanatory information about the error message.
» Click Save. Error Message Definition Form
» Overview of Process Management Developing Reconciliation Scheduled Tasks
» Overview Oracle Fusion Middleware Online Documentation Library
» In the Code field, enter the name of the lookup definition.
» In the Field field, enter the name of the table column of the Oracle Identity
» If the lookup definition is to represent a lookup field or box, select the Lookup
» In the Group field, enter the name of the Oracle Identity Manager or user-defined
» Creating and Modifying a Lookup Value
» Open the Lookup Definition form.
» If you are creating a lookup value, click Add.
» Add or edit the information in the Code Key field.
» Add or edit the information in the Decode field.
» Click Save. Lookup Definition Form
» Open the User Defined Field Definition form.
» Double-click the Form Name lookup field.
» Click Add. User Defined Field Definition Form
» Remote Manager Form Oracle Fusion Middleware Online Documentation Library
» Introducing the ICF Architecture
» Extending an Identity Connector Bundle
» Make sure that you have set the properties required by your deployment in the
» Installing the .NET Connector Server Configuring the .NET Connector Server
» Installing Multiple Connectors on a .NET Connector Server
» Developing a Flat File Connector
» Creating the IT Resource Type Definition
» Creating the Resource Object
» Add the following Lookup Code Information as illustrated in
» Double click Create User to edit as illustrated in
» Click the Object Reconciliation tab as illustrated in
» Click Add Rule. Select createObject as the method for the task.
» Select resource object FLATFILERO.
» Save and add the rule element.
» Save the rule. Select createObject as the method for the task.
» Requirement for Generic Technology Connectors
» Functional Architecture of Generic Technology Connectors
» Features of Generic Technology Connectors
» Connector Objects Created by the Generic Technology Connector Framework
» Roadmap for Information on Generic Technology Connectors in This Guide
» Shared Drive Reconciliation Transport Provider
» CSV Reconciliation Format Provider
» SPML Provisioning Format Provider
» Web Services Provisioning Transport Provider
» From the Dataset list in the Input 1 region, select the data set containing the first
» On the Step 3: Mapping page, from the Dataset list in the Input region, select
» In the Lookup Code Name region, select Literal and enter the name of the
» Validation Providers Oracle Fusion Middleware Online Documentation Library
» If an instance of the reconciliation transport provider is not available in cache, the
» If an instance of the reconciliation format provider is not available in cache, the
» Role of Providers During Provisioning
» If an instance of the provisioning transport provider is not available in cache, the
» If an instance of the provisioning format provider is not available in cache, the
» The generic technology connector adapter is one of the connector objects created
» Open a new file in a text editor.
» Deploying the Provider In this file, create entries for the following text strings:
» Reusing Providers Oracle Fusion Middleware Online Documentation Library
» Deploying the Custom Providers
» In the Name field, specify a name for the generic technology connector.
» Click Continue. Creating Generic Technology Connectors
» Configuring Reconciliation On the last page, click Close.
» Configuring Provisioning On the last page, click Close.
» Login to the Administrative and User Console.
» Click Advanced. Managing Generic Technology Connectors
» Under Configuration, click Manage Generic Connector.
» Search for the connector that you want to modify. To simplify your search, you
» In the results that are displayed, click the generic technology connector that you
» Exporting Generic Technology Connectors
» On the first page of the Deployment Manager Wizard, select Generic Connector
» Click Select Children. Managing Generic Technology Connectors
» Select the dependencies that you want to export, and click Confirmation.
» Importing Generic Technology Connectors
» Click View Selections. Click Import. The connector file is imported into Oracle Identity Manager.
» Overview Using the Generic Connection Pool Framework in Custom Connectors
» Best Practices Oracle Fusion Middleware Online Documentation Library
» General Issues for Generic Technology Connectors
» Configuration Issues for Generic Technology Connectors
» Step 1: Creating a Request Dataset for the Resources
» Go to the OIM_HOMEbin directory and run weblogicImportMetadata.sh or
» Step 3: Creating SOA Composites Required for Approval
» Step 4: Registering the SOA Composites in Oracle Identity Manager
» Step 5: Defining Request Approvals
» Step 6: Creating Request Templates
» Extending Request Management Operations
» Integration with Oracle SOA Suite
» Predefined SOA Composites Oracle Fusion Middleware Online Documentation Library
» Developing an Approval Process for Oracle Identity Manager
» Monitoring Oracle Identity Manager SOA Composites
» Right click Identity and Accessoim11.1.1.3.0, and select System Mbean
» Expand oracle.iam under application-defined Mbeans, and select Server:
» Click Apply. Enabling Oracle Identity Manager to Connect to SOA
» Enter Oracle Identity Manager server t3 URL when prompted.
» Enter the complete path of the property file name that you created in step 1 when
» Modifying a SOA Project in JDeveloper
» Disabling a SOA Composite on Oracle Identity Manager
» Deploying a SOA Composite in Oracle SOA Server
» Modifying a SOA Project in JDeveloper Disabling a SOA Composite on Oracle Identity Manager
» Enabling a SOA Composite with Oracle Identity Manager
» Software Prerequisites Oracle Fusion Middleware Online Documentation Library
» Get credentials for the system administrator.
» In the Confirm page, click Finish.
» Login as system administrator. Understanding the SoD Validation Process
» Introducing the SoD Invocation Library
» Installing the SoD-enabled Connectors
» Deploying the SIL and SIL Providers
» Click the Patches Updates tab.
» Click Advanced Search. Configuring the SoD Engine
» Select Product Family as Oracle Application Access Controls Governor and
» Configuring SAP GRC Click the Patches Updates tab.
» Configuring Oracle Identity Analytics
» Set the XL.SoDCheckRequired system property to true. See Administering
» Set the topologyName parameter in the Connector IT Resource instance to the
» Deploying SIL and SIL Providers
» Enabling SoD in Direct Provisioning and Access Policy Based Provisioning:
» Adding CSF Credentials for SoD Check:
» Login to the Enterprise Manager console and on the left tab, expand Weblogic
» Open base_domain. Oracle Fusion Middleware Online Documentation Library
» On top of the right pane, from the WebLogic Domain list, select Security, and
» Enabling SSL Communication Run the following commands from the JAVA_HOMEbin directory:
» Go to servers, oim_server1. You can see that SSL Listen Port is enabled.
» From the list on the top of the page, select System Mbeans Browser.
» Go to Application Defined Mbeans, oracle.iam, Server: oim_server1,
» Restart Oracle Identity Manager.
» Create a request for SoD-enabled resource. You can view the new workflow
» Instead of object forms in earlier releases of Oracle Identity Manager, the data to
» In the IT resource of the connector, create the TopologyName parameter if it does
» In the ApprovalProcess.bpel design, include the following BPEL activities:
» Applying SAML policy for request and callback for the AsyncSoD Web
Show more