SPML Provisioning Format Provider

Predefined Providers for Generic Technology Connectors 19-11 ■ SPML Web Service Target Namespace In the WSDL file, this is the value of the targetNamespace attribute of the definition element. ■ SPML Web Service Soap Message Body Prefix This is the name of the custom prefix element that contains the SOAP message body. If the target Web service is running on Oracle WebLogic Server, IBM WebSphere Application Server, JBoss Application Server, or Oracle Application Server, then you need not specify a value for this parameter. However, if you are using a different application server, you must enter the name of the custom prefix element. The following is the prefix element if the Web service is running on Oracle WebLogic Server: SPMLv2Document xmlns=http:xmlns.oracle.comOIMprovisioning ■ ID Attribute for Child Dataset Holding Group Membership Information This is the name of the unique identifier field for a provisioning staging child data set that holds group membership information. For provisioning operations on the child data set that contains this field, the SOAP packet will contain SPML code for group operations. The following is an SPML code block for this type of group operation: modification modificationMode=add capabilityData capabilityURI=urn:oasis:names:tc:SPML:2:0:reference mustUnderstand=true reference typeOfReference=memberOf xmlns=urn:oasis:names:tc:SPML:2:0:reference toPsoID ID=Groups:1 targeted=120 reference capabilityData modification For provisioning operations on the child data sets that do not contain this field, the SOAP packet will contain ordinary SPML code. The following is an SPML code block for this type of group operation: modification dsml:modification name=Group Membership operation=add dsml:valueAdminOra, System Admins, USAdsml:value dsml:modification modification

19.3.3 Nonmandatory Parameters

For Oracle WebLogic Server, you need not specify values for the following parameters: ■ SPML Web Service Complex Data Type ■ SPML Web Service Soap Message Body Prefix ■ ID Attribute for Child Dataset Holding Group Membership Information

19.3.4 Parameters with Predetermined Values

For Oracle WebLogic Server, you can specify predetermined values for the following parameters: 19-12 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager ■ Web Service URL: http:IP_address:port_numberspmlwsOIMProvisioning ■ SPML Web Service Binding style DOCUMENT or RPC: RPC ■ SPML Web Service Operation Name: processRequest

19.4 Web Services Provisioning Transport Provider

The Web Services provisioning transport provider acts as a Web service client and carries provisioning request data from Oracle Identity Manager to the target system Web service. The following types of target system Web services are supported: ■ RPC-literal ■ RPC-encoded ■ DOCUMENT-literal The following is the parameter of the Web Services provisioning transport provider: Web Service URL Use this parameter to specify the URL of the Web service that you want to use for sending a provisioning request to the target system. This is a run-time parameter. In the WSDL file, the Web service URL is the value of the location attribute of the wsdlsoap:address element. If you include the Web Services provisioning transport provider in the generic technology connector that you create, you may want to configure Secure Sockets Layer SSL communication between the target system and Oracle Identity Manager. The following section provides information about this procedure. 19.4.1 Configuring SSL Communication Between Oracle Identity Manager and the Target System Web Service This section describes the procedure to configure the application server on which Oracle Identity Manager is installed for SSL communication. You can perform this procedure only if all the following conditions are true: ■ You want to include the Web Services provisioning transport provider in the generic technology connector that you plan to create. ■ The target Web service is running on an SSL-enabled application server. To configure SSL communication between Oracle Identity Manager and the target system Web service: 1. Export the target application server certificate as follows: ■ For a target system Web service deployed on JBoss Application Server, Oracle WebLogic Server, or Oracle WebLogic Server, run the following command: JAVA_HOMEjrebinkeytool -export -alias default -file exported-certificate-file -keystore app-server-specific-keystore -storetype jks –storepass keystore-password –provider Note: You can perform this procedure prior to creating the generic technology connector. Predefined Providers for Generic Technology Connectors 19-13 sun.security.provider.Sun In this command: Replace JAVA_HOME with the full path to the SUN JDK directory. Replace exported-certificate-file with the name of the file in which you want the exported certificate to be stored. Replace app-server-specific-keystore with the path to the keystore on the application server. Replace keystore-password with the password for the keystore. ■ For a target system Web service deployed on IBM WebSphere Application Server or Oracle WebLogic Server on AIX, run the following command: JAVA_HOMEjrebinkeytool -export -alias default -file exported-certificate-file -keystore app-server-specific-keystore -storetype jks –storepass keystore-password -provider com.ibm.crypto.provider.IBMJCE In this command: Replace JAVA_HOME with the full path to the IBM JDK directory. Replace exported-certificate-file with the name of the file in which you want the exported certificate to be stored. Replace app-server-specific-keystore with path to the keystore on the application server. Replace keystore-password with the password for the keystore. When the command is run, the exported certificate file is stored in the file that you specify as the value of exported-certificate-file. 2. Import the certificate file exported in the preceding step into the Oracle Identity Manager truststore as follows: a. Copy the certificate file exported in the preceding step into a temporary directory on the Oracle Identity Manager server. b. Run the following command: JAVA_HOMEjrebinkeytool -import -trustcacerts -alias servercert -noprompt -keystore OIM_HOME\config\.xlkeystore -file certificate_file In this command: – Replace JAVA_HOME with full path to the JDK directory. For Oracle Identity Management Server deployed on IBM WebSphere Application Server, the path must be that of the IBM JDK directory. For Oracle Identity Manager deployed on JBoss Application Server, Oracle WebLogic Server, or Oracle WebLogic Server, the path must be that of the SUN JDK directory. – Replace OIM_HOME with the full path of the Oracle Identity Manager home directory – Replace certificate_file with the path of the temporary directory into which you copy the certificate file. Note: If the application server is enabled for one-way SSL communication, you need not perform the rest of this procedure. 19-14 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager 3. Import the Oracle Identity Manager certificate into the target system application server truststore as follows: a. Export the Oracle Identity Manager certificate file. For Oracle Identity Manager deployed on Oracle WebLogic Server, run the following command: JAVA_HOMEjrebinkeytool -export -alias xell -file OIM_HOME\config\xell.cert -keystore OIM_HOME\config\.xlkeystore -storetype jks –provider sun.security.provider.Sun In this command: - Replace JAVA_HOME with the full path to the SUN JDK directory. - Replace OIM_HOME with the full path of the Oracle Identity Manager home directory. b. Import the certificate file that you export in Step 3a into the truststore of the application server as follows: Copy the exported Oracle Identity Manager certificate file to a temporary directory on the target application server. Next, run the following command on the target application server: – If the target application server is JBoss Application Server, Oracle WebLogic Server, or Oracle WebLogic Server, run the following command: JAVA_HOMEjrebinkeytool –import –alias alias -trustcacerts -file OIM-certificate-file -keystore app-server-specific-truststore -storetype jks –storepass truststore-password –provider sun.security.provider.Sun In this command: Replace JAVA_HOME with the full path to the SUN JDK directory. Replace alias with an alias for the certificate in the truststore of the tar- get application server. Replace OIM-certificate-file with the name of the exported Ora- cle Identity Manager certificate file. Replace app-server-specific-truststore with path to the trust- store on the target application server. Replace truststore-password with the password for the truststore on the target application server. – If the target application server is IBM WebSphere Application Server, run the following command: JAVA_HOMEjrebinkeytool -import -alias alias -trustcacerts -file OIM-certificate-file -keystore app-server-specific-truststore -storetype pkcs12 –storepass truststore-password -provider com.ibm.crypto.provider.IBMJCE Note: Perform the following steps only if the application server is enabled for two-way SSL communication. Predefined Providers for Generic Technology Connectors 19-15 In this command: Replace JAVA_HOME with the full path to the SUN JDK directory. Replace alias with an alias for the certificate in the target truststore. Replace OIM-certificate-file with the name of the exported Oracle Identity Manager certificate file. Replace app-server-specific-truststore with the path to the truststore on the target application server. Replace truststore-password with the password for the truststore on the target application server.

19.5 Transformation Providers

A transformation provider is used to transform user data while it is in transit between the source and destination data sets listed in the following table. The following predefined transformation providers are included in the current release of Oracle Identity Manager: ■ Concatenation Transformation Provider ■ Translation Transformation Provider

19.5.1 Concatenation Transformation Provider

You use the concatenation transformation provider to concatenate the values of two fields of data sets to create the input for a single field of another data set. The following example explains the output format of this provider: Suppose the input values are the following fields of the source data set: ■ First Name: John ■ Last Name: Doe When the concatenation transformation provider is applied to these two fields, the output value is as follows: John Doe See Also: SSL configuration documentation for the target application server Note: Use the information provided in this section while performing the instructions given in Section 21.2.4.3, Step 3: Modify Connector Configuration Page . Source Data Set Destination Data Set Purpose of the Transformation Source Reconciliation Staging Data is transformed before it is used to create reconciliation events. Oracle Identity Manager Provisioning Staging Data is transformed before it is used to create the provisioning request to be sent to the target system. 19-16 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager The following procedure describes how to add a concatenation transformation provider while creating a generic technology connector: On the Step 2: Mapping page in the pop-up window, perform the following steps:

1. From the Dataset list in the Input 1 region, select the data set containing the first

field that you want to concatenate. From the Field Name list, select the first field. Alternatively, you can use the Literal option to specify a literal or fixed value as the first concatenation input. For the example described earlier, from the Dataset list in the Input 1 region, select the data set containing the First Name field. Then, from the Field Name list, select First Name .

2. From the Dataset list in the Input 2 region, select the data set containing the

second field that you want to concatenate. Then, from the Field Name list, select the second field. Alternatively, you can use the Literal option to specify a literal or fixed value as the second concatenation input. For the example described earlier, from the Dataset list in the Input 2 region, select the data set containing the Last Name field. Then, from the Field Name list, select Last Name .

19.5.2 Translation Transformation Provider

A translation operation involves accepting a certain literal value as input and converting it into another value. The following example illustrates a translation operation: Suppose the Source data set contains the Country field and data values stored in this field can take one of the following values: ■ Austria ■ France ■ Germany ■ India ■ Japan When these values are propagated to the reconciliation staging data set, you want to convert these values to the following: ■ AT ■ FR Note: As shown in the preceding example, the concatenation transformation provider adds a space between the values of the two input fields. Note: This procedure explains in detail the instruction given in Step 5 of Section 21.2.4.3.1, Adding or Editing Fields in Data Sets . It is assumed that you have already selected the Concatenation option from the Mapping Action list on the Step 1: Field Information page and that you have performed Steps 2 and 3 given in that section.