Click Save. Error Message Definition Form

14-2 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager ■ Status change, such as enable or disable ■ Changes to user based on attestation processes ■ Organization change ■ Attribute propagation ■ Password propagation For each of these changes, the process definition provides a facility to add hooks to be run upon any of these changes. For reconciliation, the process definition provides the hooks in the form of the following conditional tasks: ■ Reconciliation Insert Received: This conditional task is inserted when an account is created via reconciliation. ■ Reconciliation Update Received: This conditional task is inserted when an existing account linked to a user is updated via reconciliation. Data in the process form or status of the account are updated. ■ Reconciliation Delete Received: This conditional task is inserted when an existing account is revoked via reconciliation. These tasks provide starting points for the workflows. You can create custom workflows in the provisioning process, and create a dependency between the reconciliation trigger tasks and the workflows. This causes the workflows to be run upon the respective triggers. Every reconciliation event that is successfully linked to a user or an account inserts a single trigger from the conditional tasks. All the data in the user profile and the account profile is available as context-sensitive data for any adapter that is attached to one of these dependant tasks.

14.2 Understanding Reconciliation APIs

The reconciliation APIs are a set of published APIs that can be used to create reconciliation events with single-valued and multi-valued attribute data and other features. Reconciliation connector developers must use these APIs to push data to the reconciliation event repository. Most of these APIs existed in earlier versions of Oracle Identity Manager. However, in 11g Release 1 11.1.1, the implementation has changed and is based on the new reconciliation architecture introduced in the release. Existing standard connectors also use these APIs; since the earlier APIs continue to be supported, no changes are necessary to those connectors. callingEndOfJobAPI is the only new reconciliation API in 11g Release 1 11.1.1. Each run of a connector is known as a job. In 11g Release 1 11.1.1, reconciliation events are submitted to the reconciliation engine in batches. At the end of a job, the scheduler which executes the connector scheduled task executes a listener, which in See Also: Part V, Requests and Approval Processes and Part I, Concepts for details about creating conditional tasks, adapters, and dependencies See Also: Chapter 31, Using APIs for more information about using APIs in Oracle Identity Manager Customizing Reconciliation Operations 14-3 turn invokes the callingEndOfJOBAPI. This API submits any open batch for processing to the reconciliation engine. The API calls are similar for Multilanguage Supported MLS and non-MLS data. The connector passes in data to be reconciled as a HashMap. The difference is that if an attribute is MLS-enabled, then the key is the attribute name, while the value is another HashMap of MLS data. The keys of this MLS-specific HashMap are language codes, and the values are the corresponding locale-specific data obtained from target system. If there is any MLS data that does not have a locale defined with it in the target system, that data is passed with key base in the MLS input data HashMap.

14.3 Postprocessing for Trusted Reconciliation

If the user login is not passed for trusted reconciliation, then the login handler generates the user login. The password is generated in postprocessing event handler. You can configure Oracle Identity Manager to send notification for the same. Notification is sent only when the value of the Recon.SEND_NOTIFICATION system property is set to true. See System Properties in Oracle Identity Manager in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for information about the Recon.SEND_NOTIFICATION system property. In SSO disabled environment, for user creation via reconciliation, both the user login and password are generated in postprocess handlers and a single notification is sent for both user login and password. In SSO enabled environment, because the password is not to be generated, if login is generated in postprocess handler, then notification is sent only for the user login.

14.4 Troubleshooting Reconciliation

Before troubleshooting issues related to reconciliation, change the reconciliation logging level to INFO. To do so, add the following line in the logging.xml file, and restart Oracle Identity Manager. LOGGER NAME=ORACLE.IAM.RECONCILIATION LEVEL=INFO This section describes troubleshooting reconciliation issues in the following sections: ■ Troubleshooting General Reconciliation Issues ■ Troubleshooting Trusted Source Reconciliation ■ Troubleshooting Target Resource Reconciliation ■ Troubleshooting Database-Related Reconciliation Issues

14.4.1 Troubleshooting General Reconciliation Issues

Table 14–1 lists the troubleshooting steps that you can perform if you encounter reconciliation errors: