Capture and Archiving of Role Profile Audit Data

6-10 Oracle Fusion Middleware Users Guide for Oracle Identity Manager Oracle Identity Manager generates a snapshot when an audit is created for a role, even if an initial snapshot is missing. The current snapshot is treated as the initial snapshot. The following are the components of a role profile and the tables that constitute these components: ■ User role record: UGP table, including all UDFs for roles ■ Subrole information: GPG table

6.4.1.2 Storage of Snapshots

When Oracle Identity Manager takes a snapshot of a role profile, it stores the snapshot in a GPA table. The structure of this table is as described in Table 6–6 .

6.4.1.3 Trigger for Taking Snapshots

When any data element in the role profile snapshot changes, Oracle Identity Manager creates a snapshot. The creation of role profile snapshots is triggered by events that result in changes in any of the following: ■ Role profile data ■ Subrole information

6.5 Enabling and Disabling Auditing

This section describes how to enable and disable auditing in Oracle Identity Manager in the following sections: ■ Disabling Auditing ■ Enabling Auditing

6.5.1 Disabling Auditing

To disable auditing in Oracle Identity Manager: Table 6–6 Definition of the GPA Table Column Data Type Description GPA_KEY NUMBER 19,0 Key for the audit record UGP_KEY NUMBER 19,0 Key for the role whose role snapshot is recorded EFF_FROM_DAT E TIMESTAMP 6 Date and time at which the snapshot entry became effective EFF_TO_DATE TIMESTAMP 6 Date and time at which the snapshot entry was no longer effective In other words, this is the date and time at which the next snapshot entry was created. For the entry representing the latest user profile, the To Date column value is set to NULL SRC VARCHAR2 4000 Source of the entry, User ID of the user responsible for the change, and the API used to carry out the change SNAPSHOT CLOB XML representation of the snapshot DELTAS CLOB XML representation of old and new values corresponding to a change made to the snapshot SIGNATURE CLOB Can be used to store a digital signature for the snapshot for nonrepudiation purposes Auditing 6-11 1. Set the value of User profile audit data collection level XL.UserProfileAuditDataCollection system property to None, as described in Modifying System Properties in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. 2. Disable the Issue Audit Messages Task scheduled job as described in Disabling and Enabling Jobs in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. If pending audit changes are required to be recorded in the audit tables, then disable the scheduled task after all the pending audit changes are processed.

6.5.2 Enabling Auditing

To enable auditing in Oracle Identity Manager: 1. Set the value of User profile audit data collection level XL.UserProfileAuditDataCollection system property to one of the levels defined in Audit Levels on page 6-3. See Modifying System Properties in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for information about modifying the values of system properties. 2. Enable the Issue Audit Messages Task scheduled job as described in Disabling and Enabling Jobs in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. 3. Generate snapshots by running the GenerateSnapshot script as described in Generating an Audit Snapshot in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. The following is the command-line usage of the GenerateSnapshot script: .GenerateSnapshot.sh -username OIM_ADMIN_USERNAME -numOfThreads 8 -serverURL t3:WLS_SERVER:PORT -ctxFactory weblogic.jndi.WLInitialContextFactory [-inputFile fileWithUserKeys] Here: ■ OIM_ADMIN_USERNAME is the Oracle Identity Manager administrator username. ■ WLS_SERVER is the Oracle WebLogic Server name. ■ PORT is the port number of the WebLogic Server.