2 Deploying the Connector

2.1.1.1 Files and Directories on the Installation Media

Table 2-1 lists the files and directories on the installation media.

2.1.1.2 Determining the Release Number of the Connector

You might have a deployment of an earlier release of the connector. While deploying the latest release, you might want to know the release number of the earlier release. To determine the release number of the connector that has already been deployed:

1. In a temporary directory, extract the contents of the connector JAR file that is in the OIM_HOME/xellerate/JavaTasks directory.

   For 11.1.x and 11.1.2.x server, download Connector JAR file from OIM database using DownloadJars utility.

2. Open the Manifest.mf file in a text editor. The Manifest.mf file is one of the files bundled inside the connector JAR file.

   In the Manifest.mf file, the release number of the connector is displayed as the value of the Version property.

2.1.1.3 Creating a Backup of the Existing Common.jar File

The Common.jar file is in the deployment package of each 9.1.x release of the connector. With each new release, code corresponding to that particular release is added to the existing code in this file. For example, the Common.jar file shipped with Connector Y on 12-July contains:

• Code specific to Connector Y

• Code included in the Common.jar files shipped with all other 9.1.x release of the connectors that were released before 12-July

If you have installed a release 9.1.x connector that was released after the current release of the Oracle E-Business User Management connector, back up the existing Common.jar file, install the Oracle E-Business User Management connector, and then restore the Common.jar file. The steps to perform this procedure are as follows:

1. Determine the release date of your existing release 9.1.x connector as follows:

   1. Extract the contents of the following file in a temporary directory:

      OIM_HOME/xellerate/JavaTasks/Common.jar

      Note:

      On Oracle Identity Manager releases 11.1.x and 11.1.2.x or later, use the Oracle Identity Manager Download JARs utility to download the Common.jar file from the database, and then extract the contents of this file into a temporary directory.

      See Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager 11g Release 1 (11.1.1) for instructions about using the Download JARs utility.

   2. Open the Manifest.mf file in a text editor.

   3. Note down the Build Date and Build Version values.

2. Determine the Build Date and Build Version values of the current release of the Oracle E-Business User Management connector as follows:

   1. On the installation media for the connector, extract the contents of the lib/Common.jar and then open the Manifest.mf file in a text editor.

   2. Note down the Build Date and Build Version values.

3. If the Build Date and Build Version values for the Oracle E-Business User Management connector are less than the Build Date and Build Version values for the connector that is installed, then:

   • If you are using Oracle Identity Manager release 9.1.0.x, then:

     1. Copy the OIM_HOME/xellerate/JavaTasks/Common.jar to a temporary location.

     2. After you perform the procedure described in Section 2.2, "Installation" overwrite the new Common.jar file in the OIM_HOME/xellerate/JavaTasks directory with the Common.jar file that you backed up in the preceding step.

   • If you are using Oracle Identity Manager release 11.1.x, then run the Oracle Identity Manager Upload JARs utility to post the Common.jar file to the Oracle Identity Manager database. This utility is copied into the following location when you install Oracle Identity Manager:

     Note:

     Before you run this utility, verify that the WL_HOME environment variable is set to the directory in which Oracle WebLogic Server is installed.

     For Microsoft Windows:

     OIM_HOME/server/bin/UploadJars.bat
     

     For UNIX:

     OIM_HOME/server/bin/UploadJars.sh
      
     

     When you run the utility, you are prompted to enter the login credentials of the Oracle Identity Manager administrator, URL of the Oracle Identity Manager host computer, context factory value, type of JAR file being uploaded, and the location from which the JAR file is to be uploaded. Specify 1 as the value of the JAR type.

     See Also:

     Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for detailed information about the Upload JARs utility

2.1.2.1 Creating a Target System User Account for Connector Operations

Oracle Identity Manager requires a target system user account to access the target system during connector operations. You provide the credentials of this user account while performing the procedure described in Section 2.3.3.6, "Configuring the IT Resource."

To create a target system user account for connector operations:

1. From the installation media, copy one of the following directories to a temporary directory on either the target system host computer or a computer on which the Oracle Database Client has been installed:

   See Also:

   Section 2.1.1.1, "Files and Directories on the Installation Media" for information about the contents of the scripts directory

   • scripts/script1

     The scripts in this directory create wrapper packages in the APPS schema. These wrapper packages are used for connector provisioning operations.

   • scripts/script2

     The scripts in this directory create wrapper packages in the schema of the user that you are creating. These wrapper packages are used for connector provisioning operations.

   To determine whether to copy the scripts in the script1 or the script2 directory:

   1. If you are using the User Management connector, then run the following queries:

      SELECT text FROM user_source WHERE name = 'FND_USER_PKG' AND type = 'PACKAGE' AND UPPER(text) LIKE '%AUTHID%';
      SELECT text FROM user_source WHERE name = 'FND_GLOBAL' AND type = 'PACKAGE' AND UPPER(text) LIKE '%AUTHID%';
      SELECT text FROM user_source WHERE name = 'WF_LOCAL_SYNCH' AND type = 'PACKAGE' AND UPPER(text) LIKE '%AUTHID%';
      SELECT text FROM user_source WHERE name = 'UMX_ACCESS_ROLES_PVT' AND type = 'PACKAGE' AND UPPER(text) LIKE '%AUTHID%';
      SELECT text FROM user_source WHERE name = 'FND_USER_RESP_GROUPS_API' AND type = 'PACKAGE' AND UPPER(text) LIKE '%AUTHID%';
      

   2. If you are using the User Management with HR Foundation connector, then run the following queries:

      SELECT text FROM user_source WHERE name = 'OIM_EMPLOYEE_WRAPPER' AND type = 'PACKAGE' AND UPPER(text) LIKE '%AUTHID%';
      

   3. If you are using the User Management with TCA Foundation connector, then run the following queries:

      SELECT text FROM user_source WHERE name = 'OIM_TCA_WRAPPER' AND type = 'PACKAGE' AND UPPER(text) LIKE '%AUTHID%';
      

   4. If any of the queries that you run returns a row containing the text AUTHID CURRENT_USER, then use the script1 directory. Otherwise, use either the script1 or the script2 directory.

2. On the computer where you copy the scripts directory, verify that there is a TNS entry in the tnsnames.ora file for the target system database.

3. Depending on the host platform, run either the OIM.sh or OIM.bat file.

4. When you run the script, you are prompted for the following information:

   • ORACLE_HOME path

     This prompt is displayed only if the ORACLE_HOME environment variable has not been set on the computer on which you are running the script.

   • Enter the system user name

     Enter the login (user name) of a DBA account with the privileges to create and configure a new target system user.

   • Enter the name of the database

     Enter the connection string or service name given in the tnsnames.ora file to connect to the target system database.

   • Enter the name of the tablespace to be created

     Enter a name for the tablespace to be created for the user.

   • Enter the name of the datafile to be created

     Enter a name for the datafile to be created for the user.

   • Enter the path for the datafile to be created

     Enter the path where the datafile must be created. The path is relative to the repository of the directory in which the target system is installed. If you do not enter a value at this prompt, then the default directory is created.

   • Enter New database Username to be created

     Enter a user name for the target system account that you want to create.

   • Enter the New user password

     Enter a password for the target system account that you want to create.

   • Connecting with newly created database user

     Enter the connection string or service name that you provided earlier.

At the end of the operation, a log file (OIM_APPS_USER.log) is created in the scripts directory. If the user is successfully created, then a message to this effect is recorded in the log file.

During the account creation process, the following privileges are granted:

• Privileges Granted to the Account for All 3 Connectors

• Additional Privileges Granted to the Account for the User Management with HR Foundation Connector

• Additional Privileges Granted to the Account for the User Management with TCA Foundation Connector

Privileges Granted to the Account for All 3 Connectors

The following privileges are granted to the new database user account for all 3 connectors:

EXECUTE ON APPS.WF_LOCAL_SYNCH

EXECUTE ON APPS.FND_USER_PKG

EXECUTE ON APPS.FND_API

EXECUTE ON APPS.FND_GLOBAL

EXECUTE ON APPS.UMX_ACCESS_ROLES_PVT

EXECUTE ON APPS.FND_USER_RESP_GROUPS_API

SELECT ON APPS.FND_APPLICATION

SELECT ON APPS.FND_RESPONSIBILITY

SELECT ON APPS.FND_RESPONSIBILITY_TL

SELECT ON APPS.FND_RESPONSIBILITY_VL

SELECT ON APPS.FND_USER_RESP_GROUPS_DIRECT

SELECT ON APPS. PER_ALL_PEOPLE_F

SELECT ON APPS.FND_APPLICATION_TL

SELECT ON APPS.WF_LOCAL_USER_ROLES

SELECT ON APPS.WF_USER_ROLES

SELECT ON APPS.WF_LOCAL_ROLES

SELECT, UPDATE ON APPS.FND_USER

SELECT ON APPS.FND_SECURITY_GROUPS

SELECT ON APPS.FND_SECURITY_GROUPS_TL

EXECUTE ON APPS.OIM_FND_USER_PKG

EXECUTE ON APPS.OIM_FND_GLOBAL

EXECUTE ON APPS.WF_LOCAL_SYNCH_PKG

EXECUTE ON APPS.OIM_UMX_ACCESS_ROLES_PVT

EXECUTE ON APPS.OIM_FND_USER_RESP_GROUPS_API

Additional Privileges Granted to the Account for the User Management with HR Foundation Connector

In addition to the privileges listed in the "Privileges Granted to the Account for All 3 Connectors" section, the following privileges are granted to the account for the User Management with HR Foundation connector:

EXECUTE ON APPS.HR_EMPLOYEE_API

EXECUTE ON APPS.HR_PERSON_API

SELECT ON APPS.PER_ALL_ASSIGNMENTS_F

SELECT ON APPS.PER_PEOPLE_F

SELECT ON APPS.PER_PERSON_TYPES

SELECT ON APPS.PER_PERIODS_OF_SERVICE

Additional Privileges Granted to the Account for the User Management with TCA Foundation Connector

In addition to the privileges listed in the "Privileges Granted to the Account for All 3 Connectors" section, the following privileges are granted to the account for the User Management with TCA Foundation connector:

EXECUTE ON APPS.FND_OID_USERS

EXECUTE ON APPS.FND_OID_UTIL

SELECT, UPDATE ON APPS.HZ_PARTIES

SELECT, UPDATE ON APPS.HZ_PERSON_PROFILES

REVOKE SELECT ON APPS.PER_ALL_PEOPLE_F

2.1.2.2 Compiling Custom Wrapper Packages

The following custom wrapper packages are used during the Person Create and Update operations:

• OIM_EMPLOYEE_WRAPPER

• OIM_TCA_WRAPPER

OIM_UMX_ACCESS_ROLES_PVT.pck wrapper package is used during the Revoke Role operation.

If you plan to use the APPS account for reconciliation, provisioning, and revoke role operations, then:

1. Copy the packages from the scripts directory on the installation media into a directory on the target system host computer.

2. Log in to the database as the APPS user.

3. Run the following commands at the SQL prompt:

   Note:

   See Section 2.1.1.1, "Files and Directories on the Installation Media" for information about the location of the packages containing these SQL scripts.

   @<DIRECTORY_PATH_WHERE_THE_PACKAGES_ARE_SAVED>/OIM_EMPLOYEE_WRAPPER.pck
   @<DIRECTORY_PATH_WHERE_THE_PACKAGES_ARE_SAVED>/OIM_TCA_WRAPPER.pck
   @<DIRECTORY_PATH_WHERE_THE_PACKAGES_ARE_SAVED>/OIM_UMX_ACCESS_ROLES_PVT.pck
   

2.1.2.3 Setting the Employee Number Creation Mode

If you plan to use the User Management with HR Foundation connector, then the target system must be configured to manual mode for generating employee numbers. By default, employee numbers are automatically generated. To set the employee number generation mode to manual:

1. Log in to the target system.

2. Select the Oracle E-Business HRMS responsibility. For example: Human Resource Vision Enterprise.

3. Navigate to Workstructures > Organization > Description.

4. Search for and select the business group,

5. Click Others.

6. Select Business Group Info from the list of values.

7. Open the flexfield to view the setting for employee number generation

8. Set the value of Employee Number Generation to Manual.

9. Click OK.

2.3.1.1 Configuring the Oracle Applications Access Controls Governor to Act As the SoD Engine

If you are using Oracle Identity Manager release 9.1.0.x, then see the "Configuring Oracle Application Access Controls Governor" section in the "Segregation of Duties (SoD) in Oracle Identity Manager" chapter in Oracle Identity Manager Tools Reference for information about this procedure.

If you are using Oracle Identity Manager releases 11.1.x and 11.1.2.x or later, then see the "Configuring Oracle Application Access Controls Governor" section of the "Configuring SoD Validation" chapter in Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for information about this procedure.

2.3.1.2 Specifying a Value for the TopologyName IT Resource Parameter

The TopologyName IT resource parameter holds the name of the combination of the following elements that you want to use for SoD validation of entitlement provisioning operations:

• Oracle Identity Manager installation

• Oracle Applications Access Controls Governor installation

• Oracle E-Business Suite installation

The value that you specify for the TopologyName parameter must be the same as the value of the topologyName element in the SILConfig.xml file. For Oracle Identity Manager releases 11.1.x and 11.1.2.x or later, if you are using default SIL registration, then specify sodoaacg as the value of the topologyName parameter.

See one of the following for more information about this element:

• For Oracle Identity Manager release 9.1.0.x, the "Segregation of Duties (SoD) in Oracle Identity Manager" chapter in Oracle Identity Manager Tools Reference.

• For Oracle Identity Manager releases 11.1.x and 11.1.2.x or later, the "Configuring SoD Validation" chapter in Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager.

See Section 2.3.3.6, "Configuring the IT Resource" section for information about specifying values for parameters of the IT resource.

2.3.1.3 Disabling and Enabling SoD

This section describes the procedures to disable and enable SoD.

To disable SoD:

1. Log in to one of the following consoles:

   • If you are using Oracle Identity Manager release 9.1.0.x, then log in to the Design Console.

   • If you are using Oracle Identity Manager release 11.1.x, then log in to the Administrative and User Console.

   • If you are using Oracle Identity Manager release 11.1.2.x or later, then log in to the System Administration console.

2. Set the XL.SoDCheckRequired system property to FALSE as follows:

   For Oracle Identity Manager release 9.1.0.x:

   1. Expand Administration, and then double-click System Configuration.

   2. Search for and open the XL.SoDCheckRequired system property.

   3. Set the value of the system property to FALSE. The following screenshot shows this page:

      
      

      Note:

      You need not change the values of the XL.SIL.Home.Dir and Triggers Synchronous SoD checks offline system properties.

   4. Click the Save icon.

   For Oracle Identity Manager releases 11.1.x:

   1. On the Welcome page, click Advanced in the upper-right corner of the page.

   2. On Welcome to Identity Manager Advanced Administration page, in the System Management section, click Search System Properties.

   3. On the left pane, in the Search System Configuration field, enter XL.SoDCheckRequired, which is the name of the system property as the search criterion.

   4. In the search results table on the left pane, click the XL.SoDCheckRequired system property in the Property Name column.

   5. On the System Property Detail page, in the Value field, enter FALSE.

   6. Click Save to save the changes made.

      A message confirming that the system property has been modified is displayed.

   For Oracle Identity Manager releases 11.1.2.x:

   1. In the left pane, under System Management, click System Configuration. The Advanced Administration is displayed with the System Configuration section in the System Management tab is active.

   2. On the left pane, in the Search System Configuration field, enter XL.SoDCheckRequired, which is the name of the system property as the search criterion.

   3. In the search results table on the left pane, click the XL.SoDCheckRequired system property in the Property Name column.

   4. On the System Property Detail page, in the Value field, enter FALSE.

   5. Click Save to save the changes made.

      A message confirming that the system property has been modified is displayed.

3. If you are going to perform the procedure described in Section 2.3.3.9, "Enabling Request-Based Provisioning", then for all approval process definitions, the human approval tasks must be made unconditional as follows:

   • Log in to the Design Console.

   • Expand Process Management, and then double-click Process Definition.

   • Search for and open the approval-type process definition for the connector that you are using. See Section 4.9, "Configuring the Connector for Multiple Installations of the Target System" for information about the connector objects.

   • On the Task tab, search for the Manager Approval task.

   • Make this task unconditional by deselecting the Conditional check box. See the following screenshot:

     
     

   • Save the changes to the process definition.

4. Restart Oracle Identity Manager.

To enable SoD:

1. Log in to one of the following consoles:

   • If you are using Oracle Identity Manager release 9.1.0.x, then log in to the Design Console.

   • If you are using Oracle Identity Manager release 11.1.x, then log in to the Administrative and User Console.

   • If you are using Oracle Identity Manager release 11.1.2.x, then log in to the System Administration console.

2. Set the XL.SoDCheckRequired system property to TRUE as follows:

   For Oracle Identity Manager release 9.1.0.x:

   1. Expand Administration, and then double-click System Configuration.

   2. Search for and open the XL.SoDCheckRequired system property.

   3. Set the value of the system property to TRUE. The following screenshot shows this page:

      
      

      Note:

      You need not change the values of the XL.SIL.Home.Dir and Triggers Synchronous SoD checks offline system properties.

   4. Click the Save icon.

   For Oracle Identity Manager releases 11.1.x:

   1. On the Welcome page, click Advanced in the upper-right corner of the page.

   2. On Welcome to Identity Manager Advanced Administration page, in the System Management section, click Search System Properties.

   3. On the left pane, in the Search System Configuration field, enter XL.SoDCheckRequired, which is the name of the system property as the search criterion.

   4. In the search results table on the left pane, click the XL.SoDCheckRequired system property in the Property Name column.

   5. On the System Property Detail page, in the Value field, enter FALSE.

   6. Click Save to save the changes made.

      A message confirming that the system property has been modified is displayed.

   For Oracle Identity Manager releases 11.1.2.x or later:

   1. In the left pane, under System Management, click System Configuration. The Advanced Administration is displayed with the System Configuration section in the System Management tab is active.

   2. On the left pane, in the Search System Configuration field, enter XL.SoDCheckRequired, which is the name of the system property as the search criterion.

   3. In the search results table on the left pane, click the XL.SoDCheckRequired system property in the Property Name column.

   4. On the System Property Detail page, in the Value field, enter FALSE.

   5. Click Save to save the changes made.

      A message confirming that the system property has been modified is displayed.

3. If you are using Oracle Identity Manager release 9.1.0.x, then:

   1. In the Design Console, expand Administration, and then double-click System Configuration.

   2. Search for and open the XL.SIL.Home.Dir system property.

   3. Verify that the value of this system property is set to the full path and name of the SIL_HOME directory. Here, SIL_HOME is the directory in which you have copied the SIL XML files.

4. If you are going to perform the procedure described in Section 2.3.3.9, "Enabling Request-Based Provisioning", then for all approval process definitions, the human approval tasks must be made conditional as follows:

   • On the Design Console.

   • Expand Process Management, and then double-click Process Definition.

   • Search for and open the approval-type process definition for the connector that you are using. See Section 4.9, "Configuring the Connector for Multiple Installations of the Target System" for information about the connector objects.

   • On the Task tab, search for the Manager Approval task.

   • Make this task conditional by selecting the Conditional check box. See the following screenshot:

     
     

   • Save the changes to the process definition.

5. Restart Oracle Identity Manager.

2.3.2.1 Configuring Data Encryption and Integrity in Oracle Database

See Oracle Database Advanced Security Administrator's Guide for information about configuring data encryption and integrity.

2.3.2.2 Configuring SSL Communication in Oracle Database

To enable SSL communication between Oracle Database and Oracle Identity Manager:

1. See Oracle Database Advanced Security Administrator's Guide for information about enabling SSL communication between Oracle Database and Oracle Identity Manager.

2. Export the certificate on the Oracle Database host computer.

3. Copy the certificate to Oracle Identity Manager.

4. Import the certificate into the JVM certificate store of the application server on which Oracle Identity Manager is running.

   To import the certificate into the certificate store, run the following command:

   keytool -import -file FILE_LOCATION -keystore TRUSTSTORE_LOCATION -storepass TRUSTSTORE_PASSWORD -trustcacerts -alias ALIAS
   

   In this command:

   • Replace FILE_LOCATION with the full path and name of the certificate file.

   • Replace ALIAS with an alias for the certificate.

   • Replace TRUSTSTORE_PASSWORD with a password for the certificate store.

   • Replace TRUSTSTORE_LOCATION with one of the certificate store paths given in Table 2-3. This table shows the location of the certificate store for each of the supported application servers.

   Note:

   In an Oracle Identity Manager cluster, you must import the file into the certificate store on each node of the cluster.

   Table 2-3 Certificate Store Locations

   Application Server	Certificate Store Location
   Oracle WebLogic Server	If you are using Oracle jrockit_R27.3.1-jdk, then copy the certificate into the following directory: JROCKIT_HOME/jre/lib/security If you are using the default Oracle WebLogic Server JDK, then copy the certificate into the following directory: WEBLOGIC_HOME/java/jre/lib/security/cacerts
   IBM WebSphere Application Server	For a nonclustered configuration of any supported IBM WebSphere Application Server release, import the certificate into the following certificate store: WEBSPHERE_HOME/java/jre/lib/security/cacerts For IBM WebSphere Application Server 6.1.x, in addition to the cacerts certificate store, you must import the certificate into the following certificate store: WEBSPHERE_HOME/Web_Sphere/profiles/SERVER_NAME/config/cells/CELL_NAME/nodes/NODE_NAME/trust.p12 For example: C:/Web_Sphere/profiles/AppSrv01/config/cells/tcs055071Node01Cell/nodes/tcs055071Node0/trust.p12 For IBM WebSphere Application Server 5.1.x, in addition to the cacerts certificate store, you must import the certificate into the following certificate store: WEBSPHERE_HOME/etc/DummyServerTrustFile.jks
   JBoss Application Server	JAVA_HOME/jre/lib/security/cacerts
   Oracle Application Server	ORACLE_HOME/jdk/jre/lib/security/cacerts

   
   

2.3.3.1 Modifying Dependent Lookup Query Properties for Lookup Fields on Microsoft SQL Server

In this connector, the child forms of a resource implement the dependent lookup feature of Oracle Identity Manager. By default, the queries for synchronization of lookup field values from the target system are based on Oracle Database SQL. If your Oracle Identity Manager installation is running on Microsoft SQL Server, then you must modify the lookup queries for synchronization of lookup definitions as follows:

1. On the Design Console, expand Development Tools and double-click Form Designer.

2. Search for and open the process form for the connector that you are using.

3. Click Create New Version to create a version of the process form. Then, enter a version name and click the Save icon.

4. Go to the Properties tab.

5. Select the properties of the attribute according to your requirement.

6. Modify the Lookup Query property for the field. Existing and new values are listed in Table 2-4. The following screenshot shows this page:

   
   

7. Click the Save icon.

8. Click Make Version Active to activate the new version of the process form.

9. Create a new version of the parent form for the child form you modified and make that version active.

   See Section 4.9, "Configuring the Connector for Multiple Installations of the Target System" for information about the process forms.

2.3.3.2 Configuring Oracle Identity Manager 11.1.2 or Later

If you are using Oracle Identity Manager release 11.1.2.x or later, you must create additional metadata such as a UI form and an application instance. In addition, you must run entitlement and catalog synchronization jobs. These procedures are described in the following sections:

• Section 2.3.3.2.1, "Creating and Activating a Sandbox"

• Section 2.3.3.2.2, "Creating a New UI Form"

• Section 2.3.3.2.3, "Creating an Application Instance"

• Section 2.3.3.2.4, "Publishing a Sandbox"

• Section 2.3.3.2.5, "Harvesting Entitlements and Sync Catalog"

• Section 2.3.3.2.6, "Updating an Existing Application Instance with a New Form"

2.3.3.3 Clearing Content Related to Connector Resource Bundles from the Server Cache

When you deploy the connector, the resource bundles are copied from the resources directory on the installation media into the OIM_HOME/xellerate/connectorResources directory for Oracle Identity Manager release 9.1.0.x and Oracle Identity Manager database for Oracle Identity Manager releases 11.1.x and 11.1.2.x or later. Whenever you add a new resource bundle to the connectorResources directory or make a change in an existing resource bundle, you must clear content related to connector resource bundles from the server cache.

To clear content related to connector resource bundles from the server cache:

1. In a command window, perform one of the following steps:

   • If you are using Oracle Identity Manager release 9.1.0.x, then switch to the OIM_HOME/xellerate/bin directory.

   • If you are using Oracle Identity Manager releases 11.1.x and 11.1.2.x or later, then switch to the OIM_HOME/server/bin directory.

   Note:

   You must perform Step 1 before you perform Step 2. An exception is thrown if you run the command described in Step 2 as follows:

   For Oracle Identity Manager release 9.1.0.x:

   OIM_HOME/xellerate/bin/SCRIPT_FILE_NAME
   

   For Oracle Identity Manager releases 11.1.x and 11.1.2.x or later:

   OIM_HOME/server/bin/SCRIPT_FILE_NAME
   

2. Enter one of the following commands:

   • For Oracle Identity Manager release 9.1.0.x:

     On Microsoft Windows: PurgeCache.bat ConnectorResourceBundle

     On UNIX: PurgeCache.sh ConnectorResourceBundle

     Note:

     You can ignore the exception that is thrown when you perform Step 2. This exception is different from the one mentioned in Step 1.

     In this command, ConnectorResourceBundle is one of the content categories that you can delete from the server cache. See the following file for information about the other content categories:

     OIM_HOME/xellerate/config/xlconfig.xml

   • For Oracle Identity Manager releases 11.1.x and 11.1.2.x:

     On Microsoft Windows: PurgeCache.bat All

     On UNIX: PurgeCache.sh All

     When prompted, enter the user name and password of an account belonging to the SYSTEM ADMINISTRATORS group. In addition, you are prompted to enter the service URL in the following format:

     t3://OIM_HOST_NAME:OIM_PORT_NUMBER
     

     In this format:

     • Replace OIM_HOST_NAME with the host name or IP address of the Oracle Identity Manager host computer.

     • Replace OIM_PORT_NUMBER with the port on which Oracle Identity Manager is listening.

   See Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information about the PurgeCache utility.

2.3.3.4 Enabling Logging

Depending on the Oracle Identity Manager release you are using, perform instructions in one of the following sections:

• Section 2.3.3.4.1, "Enabling Logging on Oracle Identity Manager Release 9.1.0.x"

• Section 2.3.3.4.2, "Enabling Logging on Oracle Identity Manager Releases 11.1.x and 11.1.2.x"

2.3.3.5 Determining Values for the JDBC URL and Connection Properties Parameters

This section discusses the JDBC URL and Connection Properties parameters. You apply the information in this section while performing the procedure described in Section 2.3.3.6, "Configuring the IT Resource".

The values that you specify for the JDBC URL and Connection Properties parameters depend on the security measures that you have implemented:

• Section 2.3.3.5.1, "Supported JDBC URL Formats"

• Section 2.3.3.5.2, "Only Data Encryption and Integrity Is Configured"

• Section 2.3.3.5.3, "Only SSL Communication Is Configured"

• Section 2.3.3.5.4, "Both Data Encryption and Integrity and SSL Communication Are Configured"

NET_SERVICE_NAME=
 (DESCRIPTION=
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (CONNECT_DATA= 
     (SERVICE_NAME=SERVICE_NAME)))

NET_SERVICE_NAME= 
 (DESCRIPTION_LIST=
  (DESCRIPTION= 
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (CONNECT_DATA= 
     (SERVICE_NAME=SERVICE_NAME)))
  (DESCRIPTION= 
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (CONNECT_DATA= 
     (SERVICE_NAME=SERVICE_NAME))))

NET_SERVICE_NAME= 
 (DESCRIPTION= 
  (ADDRESS_LIST= 
   (LOAD_BALANCE=on)
   (FAILOVER=off)
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION)))
  (ADDRESS_LIST= 
   (LOAD_BALANCE=off)
   (FAILOVER=on)
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION))
   (ADDRESS=(PROTOCOL_ADDRESS_INFORMATION)))
  (CONNECT_DATA=
   (SERVICE_NAME=SERVICE_NAME)))

jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCPS)(HOST=myhost)(PORT=2484)))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=mysid)))

2.3.3.6 Configuring the IT Resource

The IT resource is automatically created when you run the Connector Installer. You must specify values for the parameters of the IT resource as follows:

1. Log in to the Administrative and User Console.

2. If you are using Oracle Identity Manager release 9.1.0.x, expand Resource Management, and then click Manage IT Resource.

3. If you are using Oracle Identity Manager release 11.1.x, then:

   • On the Welcome to Oracle Identity Manager Self Service page, click Advanced.

   • On the Welcome to Oracle Identity Manager Advanced Administration page, in the Configuration section, click Manage IT Resource.

4. If you are using Oracle Identity Manager release 11.1.2.x or later, then:

   • Create and activate a sandbox. For detailed instructions on creating and activating a sandbox, see the "Managing Sandboxes" section of Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager.

   • In the left pane, under Configuration, click IT Resource.

5. In the IT Resource Name field on the Manage IT Resource page, enter EBS-APPS12 and then click Search.

6. Click the edit icon for the IT resource. The following screenshot shows this page:

   
   

7. From the list at the top of the page, select Parameters. The following screenshot shows this page:

   
   

8. Specify values for the parameters of the IT resource. Table 2-6 describes each parameter.

   Note:

   The ALL USERS group has READ permission on the default IT resource. This is to ensure that end users can select the IT resource during request-based provisioning. If you create another IT resource, then you must assign the READ permission for the ALL USERS group on the IT resource.

   Table 2-6 IT Resource Parameters

   Parameter	Description
   Admin ID	Enter the user name of the target system account to be used for provisioning operations. You create this account by performing the procedure described in Section 2.1.2.1, "Creating a Target System User Account for Connector Operations". Default value: apps
   Admin Password	Enter the password of the target system account specified by the Admin ID parameter.
   Connection Properties	Specify the connection properties for the target system database. See Section 2.3.3.5, "Determining Values for the JDBC URL and Connection Properties Parameters" for detailed information.
   Connection Retries	Enter the number of consecutive attempts to be made at establishing a connection with the target system. Default value: 3
   Connection Timeout	Enter the time in milliseconds within which the target system is expected to respond to a connection attempt. For a particular connection attempt, if the target system does not respond within the time interval specified by the Connection Timeout parameter, then it is assumed that the connection attempt has failed. Default value: 1200
   Context Application Name	An application context is a set of elements associated with an artifact in Oracle E-Business Suite. The context implements user preferences and access control on the artifact. The Context Application Name, Context Responsibility Name, and Context User ID parameters define the context that is used for connector operations. For the Context Application Name parameter, enter the name of the application to which this user belongs. Default value: 0
   Context Responsibility Name	Enter the responsibility assigned to the user in whose context connector operations are performed on the target system. Default value: 0
   Context User ID	Enter the user ID of the user in whose context connector operations are performed on the target system. Default value: 0
   Enable Revoked User	Enter yes if you want revoked resources to be enabled when the user name of the revoked resources are used to provision resources. Otherwise, enter no. When you perform a Revoke Account provisioning operation on an OIM User, the account of that user on the target system is disabled. If the Enable Revoked User parameter is set to yes and if you perform a Create Account provisioning operation for the same OIM User, then the account that was previously disabled on the target system is enabled. While performing the provisioning operation, you must specify the same User Name value as the one assigned to the account the first time. Field values that you provide during the Create Account operation are used to overwrite existing field values of the Oracle E-Business Suite account. Default value: yes
   JDBC URL	Specify the JDBC URL for the target system database. See Section 2.3.3.5, "Determining Values for the JDBC URL and Connection Properties Parameters" for detailed information.
   Manage HR Record	If you have installed the connector in the User Management with HR Foundation connector, then set this parameter to yes. Otherwise, set the value to no. Note: If you are using the User Management with TCA Foundation connector, then do not set a value for this parameter.
   Minimum Password Length	Enter the minimum number of characters that the password must contain. Note: If the minimum password length has been set on the target system, then the value of the Minimum Password Length IT resource parameter and minimum password length on the target system must be the same. Default value: 1
   Retry Interval	Enter the interval in milliseconds between consecutive attempts at establishing a connection with the target system. Default value: 10000
   SSL Enabled	Enter yes if you plan to configure SSL to secure communication between Oracle Identity Manager and the target system. Otherwise, enter no. Default value: no
   SSO Enabled	Enter yes if the target system is SSO enabled. Otherwise, enter no. Default value: no
   SSO IT Resource	This is the name of the IT resource created for the LDAP-based system. See Section 2.3.3.7, "SSO IT Resource" for information related to SSO IT Resource.
   SSO Identifier	Enter the name of the attribute that uniquely identifies a user throughout all the systems on the organization. This attribute need not be the same as the attribute specified in the SSO Login Attribute parameter. For Oracle Internet Directory: orclGUID For Microsoft Active Directory: objectGUID For Sun Java System Directory: nsUniqueID During a Create User provisioning operation, the connector takes the SSO Identifier value of the user from the LDAP-based system and populates it in the USER_GUID field of the target system.
   SSO Login Attribute	Enter the name of the LDAP system user attribute that stores the user ID of users. For Oracle Internet Directory: uid For Microsoft Active Directory: sAMAccountName For Sun Java System Directory: uid Sun Java System Directory and OID both use different attributes to store the user ID of users. You can specify the name of the attribute as the value of the SSO Login Attribute parameter.
   Statement Timeout	Enter the time in milliseconds within which a query run on the target system is expected to return results. If the results of a query are not returned within the specified time, then it is assumed that the connection with the target system has failed. The connector then attempts to reestablish a connection with the target system. Default value: 1200
   Manage TCA Record	If you have installed the connector in the User Management with TCA Foundation connector, then set this parameter to yes. Otherwise, set the value to no. Note: If you are using the User Management with HR Foundation connector, then do not set a value for this parameter.
   TopologyName	If you have installed the OAACG SIL provider, then enter the value of the Topology element in the SILConfig.xml file. See the SoD documentation for more information. Default value: None
   Configuration Lookup Name	This parameter holds the name of the lookup definition that stores configuration information for connector operations. Depending on the connector that you are using, the value is one of the following: For the User Management connector: Lookup.EBS.UM.Configuration For the User Management with HR Foundation connector: Lookup.EBS.UMHRMS.Configuration For the User Management with TCA Foundation connector: Lookup.EBS.UMTCA.Configuration You must not change the value of this parameter. However, if you create a copy of this lookup definition, then you can enter the name of the newly created lookup definition as the value of the Configuration Lookup Name parameter.
   Connection Pooling Parameters
   Abandoned connection timeout	Time (in seconds) after which a connection must be automatically closed if it is not returned to the pool Note: You must set this parameter to a value that is high enough to accommodate processes that take a long time to complete (for example, full reconciliation). Default value: 600
   Connection wait timeout	Maximum time (in seconds) for which the connector must wait for a connection to be available Default value: 60
   Inactive connection timeout	Time (in seconds) of inactivity after which a connection must be dropped and replaced by a new connection in the pool Default value: 600
   Initial pool size	Number of connections that must be established when the connection pool is initialized The pool is initialized when it receives the first connection request from a connector. Default value: 1 Sample value: 3
   Max pool size	Maximum number of connections that must be established in the pool at any point of time This number includes the connections that have been borrowed from the pool. Default value: 100 Sample value: 30
   Min pool size	Minimum number of connections that must be in the pool at any point of time This number includes the connections that have been borrowed from the pool. Default value: 5
   Validate connection on borrow	Specifies whether or not a connection must be validated before it is lent by the pool The value can be true or false. It is recommended that you set the value to true. Default value: false
   Timeout check interval	Time interval (in seconds) at which the other timeouts specified by the other parameters must be checked Default value: 30
   Pool preference	Preferred connection pooling implementation Value: Default Note: Do not change this value of this parameter.
   Connection pooling supported	Enter true if you want to enable connection pooling for this target system installation. Otherwise, enter false. Default value: false
   Target supports only one connection	Indicates whether the target system can support one or more connections at a time Value: false Note: Do not change the value of this parameter.
   ResourceConnection class definition	Implementation of the ResourceConnection class Value: oracle.iam.connectors.ebs.common.vo.EBSResourceConnectionImpl Note: Do not change the value of this parameter. The value in this parameter is used only when the Connection pooling supported IT resource parameter is set to True.
   Native connection pool class definition	Wrapper to the native pool mechanism that implements the GenericPool Note: Do not specify a value for this parameter.
   Pool excluded fields	Comma-separated list of IT parameters whose change must not trigger a refresh of the connector pool Value: Configuration Lookup Name,Manage TCA Record,Enable Revoked User,Statement Timeout,Context User ID,Context Application Name,Context Responsibility Name,TopologyName,SSO Enabled,SSO Identifier,SSO Login Attribute,SSO IT Resource,Manage HR Record Note: Do not change the value of this parameter unless you are adding or deleting a parameter from the IT resource. You must ensure that the total length of the list does not exceed 2000 characters. If you are adding a parameter to the IT resource, then that parameter name must be added to the above list with a comma separator. If you are deleting a parameter from the IT resource, then that parameter must be removed from the list if it exists in the list. You must restart Oracle Identity Manager for changes that you make to this parameter to take effect.

   
   

9. To save the values, click Save.

Additional Configuration Step for Connection Pooling

If you are using Oracle Identity Manager release 9.1.0.x that is running on Oracle Application Server, then edit the opmn.xml file as follows:

1. Open the following file in a text editor:

   OAS_HOME/opmn/conf/opmn.xml

2. Search for the following block of lines:

   <process-type id="home" module-id="OC4J" status="enabled">
   <module-data>
   <category id="start-parameters">
   

3. After this block of lines, add the following line:

   <data id="oc4j-options" value="-userThreads"/>
   

4. Save and close the file.

5. Restart the server.

2.3.3.7 SSO IT Resource

Perform the procedure mentioned below to set the value of SSO IT Resource field to LDAP System:

1. Create a new IT Resource type, named for example LDAP system, with the following fields:

   • Server Address

   • Port

   • Root DN

   • Admin Id

   • Admin Password

     Note:

     Click the encrypted check box here

   • SSL

   You can provide default values or populate values as mentioned in the following step.

2. Create a new IT Resource, named for example LDAP system with the following field values:

   • Server Address: Host name or IP address of the machine where LDAP is running

   • Port: LDAP port

   • Root DN: DN of the container under which users are stored in LDAP

   • Admin Id: DN to bind to LDAP

   • Admin Password: Password of the DN to bind to LDAP

   • SSL: True or False

3. Modify EBS-APPS12 IT resource, and set the value of field SSO IT Resource to be LDAP System.

2.3.3.8 Disabling the Auto Save Form Feature on Oracle Identity Manager Releases 11.1.x and 11.1.2.x

The Auto Save Form option is meant for request-based provisioning in Oracle Identity Manager release 9.1.0.x. When you deploy the connector, this option is enabled by default. However, Oracle Identity Manager releases 11.1.x and 11.1.2.x does not use object forms. If you are using Oracle Identity Manager releases 11.1.x and 11.1.2.x, then disable the Auto Save Form option as follows:

1. Log in to the Design Console.

2. Expand Process Management, and then double-click Process Definition.

3. Search for and open the process definition for the connector that you are using:

   See Section 4.9, "Configuring the Connector for Multiple Installations of the Target System" for a listing of the process definitions for each connector.

4. Deselect the Auto Save Form check box.

5. Click the Save icon.

2.3.3.9 Enabling Request-Based Provisioning

In request-based provisioning, an end user creates a request for a resource or entitlement by using the Administrative and User Console. Administrators or other users can also create requests for a particular user. Requests for a particular resource or entitlement on the resource can be viewed and approved by approvers designated in Oracle Identity Manager.

The following are features of request-based provisioning:

• A user can be provisioned only one resource (account) on the target system.

  Note:

  Direct provisioning allows the provisioning of multiple Oracle E-Business Suite accounts on the target system.

• Direct provisioning cannot be used if you enable request-based provisioning.

Depending on the Oracle Identity Manager release that you are using, perform the procedure described in one of the following sections:

• Section 2.3.3.9.1, "Enabling Request-Based Provisioning on Oracle Identity Manager Release 9.1.0.x"

• Section 2.3.3.9.2, "Enabling Request-Based Provisioning on Oracle Identity Manager Releases 11.1.x and 11.1.2.x:"