Introducing the SoD Invocation Library

27-8 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager Synchronizing Oracle Identity Manager Metadata With Oracle Identity Analytics Import the resource metadata and resources from Oracle Identity Manager to Oracle Identity Analytics. See the Oracle Identity Analytics documentation for more information. Defining Identity Audit Policies in Oracle Identity Analytics Set up identity audit rules and policies using Oracle Identity Analytics. Rules are created on the resource attributes. For entitlement SoD Check, give encoded values for roles and responsibilities as in Oracle Identity Manager. See the Oracle Identity Analytics documentation for more information.

27.6 Enabling and Disabling SoD

The following sections contain information on enabling and disabling SoD. ■ Enabling SoD ■ Disabling SoD

27.6.1 Enabling SoD

To enable the SoD feature:

1. Set the XL.SoDCheckRequired system property to true. See Administering

System Properties in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for information about system properties.

2. Set the topologyName parameter in the Connector IT Resource instance to the

value present in SILConfig.xml. If you are using default SIL registration, set the topologyName parameter in connector IT Resource to one of the following: ■ sodoaacg if you are using the EBS connector and OAACG as the SoD engine ■ oaacgpsft if you are using the PSFT connector and OAACG as the SoD engine ■ sodgrc if you are using GRC as the SoD engine ■ sodoia if you are using OIA as the SoD engine

3. Deploying SIL and SIL Providers

To deploy SIL and SIL providers for default combination of target systems and SoD engines:

a. Create a new IT Resource for Sod Engine with the name type as follows:

– For EBS-OAACG: OAACG-ITRes eBusiness Suite OAACG – For SAP-GRC: GRC-ITRes SoD Provider – For OIA: IT resource with name OIA-ITRes OIA is predefined. – For PSFT-OAACG: IT resource with name PSFT-OAACG-ITResOAACG is predefined. Note: Connector IT resource must have the ALL USERS role so that any user is able to access the IT Resource information. This is required for SOD requests raised by users. Using Segregation of Duties SoD 27-9 b. Edit the created IT Resource as described in Creating an IT Resource to Hold Information about the SoD Engine on page 27-43.

4. Enabling SoD in Direct Provisioning and Access Policy Based Provisioning:

SoD is enabled only if Holder and SODChecker tasks are present in the provisioning workflow. Enabling SoD in Request Provisioning: Steps 1 and 2 enables default SoD check in approval. The default SoD check is performed before the request goes for approval. If the SoD check is required after one level of approval, then default SoD check approval workflow, which is DefaultSODApproval, must be attached by creating an approval policy. SoD check can also be performed in any approval workflow on demand. This can be done by calling the SoD check Web service from BPEL. For more information, see Modifying the Approval Workflow for SoD on page 27-13.

5. Adding CSF Credentials for SoD Check:

a. Login to the Enterprise Manager console and on the left tab, expand Weblogic

Domain .

b. Open base_domain.

c. On top of the right pane, from the WebLogic Domain list, select Security, and

then open Credentials. d. Select the Create Key option, and then select Map oim. e. Provide the key as sodcheck.credentials, and select Type as Password. f. Provide Username as oiminternal and password as not used. Click OK to save the key.

27.6.2 Disabling SoD

You can disable SoD by performing any one of the following: Note: ■ To configure with OAACG8.5, add a new field to this IT resource with name as sodServerURL and value https:HOST_NAME:PORTURI, where URL is grccservicesGrccService . For OAACG8.2.1, the value of URL is agsservicesAGService. ■ See Administering System Properties in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager for information about how to set system property values. Note: If DefaultSODApproval workflow is attached to operational level of approval, then the system administrator first needs to approve, and then only SoD Check is performed. After SoD Check is performed, approval is required by SoD Administrators role. According to this workflow, first approval task is generated that is assigned to the system administrator, then SoD Check is performed, and then an approval task is generated. Any user who is a member of the SoD Administrators role can approve the second approval task after viewing the SoD Check results. 27-10 Oracle Fusion Middleware Developers Guide for Oracle Identity Manager ■ Set the XL.SoDCheckRequired system property to false. ■ Remove the value of the topologyName parameter for the connector IT Resource so that its value is set to blank. If the topologyName parameter in ITResource is set to None, then SoD check is not performed. Disabling SoD in Direct Provisioning and Access Policy Based Provisioning Disable the Holder and SODChecker process tasks. Disabling SoD in Request Provisioning For disabling the default SoD check in approval, you can perform any one of the steps to disable SoD. If you want to perform the default SoD check in approval and only disable the SoD check in BPEL, then remove approval policy for SoD or remove call to SoD Check Web service from the approval workflow.

27.7 Enabling SSL Communication

The following sections contain information on enabling Secure Sockets Layer SSL communication for various SoD purposes. ■ Enabling SSL Between Oracle Application Access Controls Governor and Oracle Identity Manager ■ Enabling SSL Between SAP GRC and Oracle Identity Manager ■ Calling SoD Check Web Service Over SSL

27.7.1 Enabling SSL Between Oracle Application Access Controls Governor and Oracle Identity Manager

To enable SSL communication between Oracle Application Access Controls Governor and Oracle Identity Manager: 1. Export the certificate on the Oracle Application Access Controls Governor host computer as follows:

a. Run the following commands from the JAVA_HOMEbin directory:

keytool -genkey -alias tomcat -keyalg RSA -keystore JAVA_HOMElibsecurity.keystore keytool -certreq -alias tomcat -file JAVA_HOMElibsecurityxell.cvs -keystore JAVA_HOMElibsecurity.keystore keytool -export -alias tomcat -file JAVA_HOMElibsecurityserver.cert -keystore JAVA_HOMElibsecurity.keystore See Also: The connector guide for detailed information about disabling these process tasks. Note: It is assumed that you have set sslEnable to true during the registration process. Note: In Step 1, JAVA_HOME refers to the directory on the Oracle Application Access Controls Governor host computer.