OIM API for adding process task and retry failed task

 In this blog you can find how to add new process task and retry any failed/rejected tasks using API.

Adding new process task:

/*******************************************************************************************
 * @param orcKey
 * @param taskKey
 * @throws Exception
 * Adding new process task.
 * SQL Query to find Task: Task Key (MIL_KEY) select mil_key,mil_name from mil where mil_name='User Principal Name Updated' 
 * and tos_key in (select tos_key from tos where tos_instance_src_field like 'UD_ADUSER.%');
 */
public void addTask (long orcKey, long taskKey)throws Exception{
    tcProvisioningOperationsIntf provAPI = oimClient.getService(tcProvisioningOperationsIntf.class);
    System.out.println("Added :::"+provAPI.addProcessTaskInstance(taskKey, orcKey)+" For ORC_KEY :: "+orcKey);
}

Retry failed/rejected task

/**
 *********************************************************************************************
 * @param ro
 * @param taskName
 * @param taskStatus
 * @throws Exception
 * Retrying Rejected task
 */
public void retryTask (String ro, String taskName, String taskStatus, String uid)throws Exception{
    tcProvisioningOperationsIntf provAPI = oimClient.getService(tcProvisioningOperationsIntf.class);
    
    Map filter = new HashMap();
    filter.put("Objects.Name", ro);
    filter.put("Process Definition.Tasks.Task Name", taskName);
    
    String taskStatus1[] = new String[] {taskStatus};
    Thor.API.tcResultSet rs = provAPI.findAllOpenProvisioningTasks(filter, taskStatus1);
    
    if (rs != null && rs.getTotalRowCount() > 0){
        System.out.println("Total Count :: "+rs.getTotalRowCount());
        for (int i=0; i< rs.getTotalRowCount(); i++){
            rs.goToRow(i);
            if (rs.getStringValue("Process Instance.Task Information.Target User").equalsIgnoreCase(uid)){
                System.out.println(rs.getStringValue("Process Instance.Task Information.Target User")+ 
				" :: "+rs.getStringValue("Process Definition.Tasks.Task Name")+ " :: done");
                provAPI.retryTask(rs.getLongValue("Process Instance.Task Details.Key"));
                break;
            }
        }
    }
}

Adding or Removing child record in OIM using API.

In this blog you can find, how to add or remove child record in OIM accounts using API. In this example I used AD connectors, but it is applicable to any connectors.

Adding child record:

private String APP_INSTANCE_NAME = "ActiveDirectory";
private String CHILD_TABLE_FIELD_NAME = "UD_ADUSRC_GROUPNAME";
private String CHILD_TABLE_NAME = "UD_ADUSRC";

/**
* userLogin: USR_LOGIN value
* accountName: account login name e.g. UD_ADUSER_UID for AD account
* childRecords: String contains List of child data with comma separated.
*/
public void addChildRecord(String userLogin,String accountName, String childRecords) {

    try {
        ProvisioningService provAPI = oimClient.getService(ProvisioningService.class);
        Account acc = null;
        List accList = provAPI.getAccountsProvisionedToUser(getUserKeybyUserLogin(userLogin));
        for (Account account : accList){
            if (account.getAccountDescriptiveField().equalsIgnoreCase(accountName) && 
                account.getAppInstance().getApplicationInstanceName().equalsIgnoreCase(APP_INSTANCE_NAME) &&
                (account.getAccountStatus().equalsIgnoreCase("Provisioned") ||
                account.getAccountStatus().equalsIgnoreCase("Enabled") || 
                 account.getAccountStatus().equalsIgnoreCase("Disabled"))){
                     
                     acc = provAPI.getAccountDetails(Long.parseLong(account.getAccountID()));
                 }
        }
        
        System.out.println("App :: " + acc.getAppInstance().getApplicationInstanceName());
        AccountData accData = acc.getAccountData();
        ArrayList childArray = new ArrayList();

        String[] childRecordList = childRecords.split(",");
        for (int k = 0; k < childRecordList.length; k++) {
            ChildTableRecord newChild = new ChildTableRecord();
            Map val1 = new HashMap();
            val1.put(CHILD_TABLE_FIELD_NAME,childRecordList[k].toString());
            newChild.setChildData(val1);
            newChild.setAction(ChildTableRecord.ACTION.Add);
            childArray.add(newChild);
        }
        System.out.println("childArray size :: " + childArray.size());
        Map> childData = new HashMap>();
        childData.put(CHILD_TABLE_NAME, childArray);
        accData.setChildData(childData);
        acc.setAccountData(accData);
        provAPI.modify(acc);
        System.out.println(" ===== Account Name :: " + acc.getAccountDescriptiveField() + " updated");

    } catch (Exception e) {
        e.printStackTrace();
    }
}

Removing child records

private String APP_INSTANCE_NAME = "ActiveDirectory";
private String CHILD_TABLE_FIELD_NAME = "UD_ADUSRC_GROUPNAME";
private String CHILD_TABLE_NAME = "UD_ADUSRC";

/**
* userLogin: USR_LOGIN value
* accountName: account login name e.g. UD_ADUSER_UID for AD account
* childRecords: String contains List of child data with comma separated.
*/
public void deleteChildRecord(String userLogin,String accountName, String childRecords) {

    try {
        ProvisioningService provAPI = oimClient.getService(ProvisioningService.class);
        Account acc = null;
        List accList = provAPI.getAccountsProvisionedToUser(getUserKeybyUserLogin(userLogin));
        for (Account account : accList){
            if (account.getAccountDescriptiveField().equalsIgnoreCase(accountName) && 
                account.getAppInstance().getApplicationInstanceName().equalsIgnoreCase(APP_INSTANCE_NAME) &&
                (account.getAccountStatus().equalsIgnoreCase("Provisioned") ||
                account.getAccountStatus().equalsIgnoreCase("Enabled") || 
                 account.getAccountStatus().equalsIgnoreCase("Disabled"))){
                     
                     acc = provAPI.getAccountDetails(Long.parseLong(account.getAccountID()));
                 }
        }
        System.out.println("App instance :: " + acc.getAppInstance().getApplicationInstanceName());
        AccountData accData = acc.getAccountData();
        ArrayList childRecArray = null;
        Map> childDataMap = accData.getChildData();
        for (Map.Entry> entry : childDataMap.entrySet()){
            if (entry.getKey().equalsIgnoreCase(CHILD_TABLE_NAME)){
                childRecArray = entry.getValue();
            }
        }
        String[] childRecordList = childRecords.split(",");
        ArrayList childArray = new ArrayList();
        for (String childRecordToDelete : childRecordList) {
            String row_key = null;
            for (ChildTableRecord childRecord : childRecArray) {
                Map childValMap = childRecord.getChildData();
                if (childValMap.get(CHILD_TABLE_FIELD_NAME).toString().equalsIgnoreCase(childRecordToDelete)) {
                    row_key = childValMap.get(CHILD_TABLE_NAME+"_KEY").toString();
                    System.out.println("row_key to be deleted :: " + row_key);
                }
            }

            if (row_key != null) {
                ChildTableRecord newChild = new ChildTableRecord();
                Map val1 = new HashMap();
                val1.put(CHILD_TABLE_FIELD_NAME, childRecordToDelete);
                newChild.setChildData(val1);
                newChild.setAction(ChildTableRecord.ACTION.Delete);
                newChild.setRowKey(row_key);
                childArray.add(newChild);
            }
        }
        
        if (childArray.size() > 0){
            System.out.println("childArray size :: " + childArray.size());
            Map> childData = new HashMap>();
            childData.put(CHILD_TABLE_NAME, childArray);
            accData.setChildData(childData);
            acc.setAccountData(accData);
            provAPI.modify(acc);
            System.out.println(" ===== Account Name :: " +acc.getAccountDescriptiveField() + ": updated");
        }else{
            System.out.println(" ===== Account Name :: " +acc.getAccountDescriptiveField() + ": No data to delete");
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

private String getUserKeybyUserLogin(String userLogin) throws Exception {
    UserManager userAPI =
        (UserManager)oimClient.getService(UserManager.class);
    Set retAttrs = new HashSet();
    User userDetails = userAPI.getDetails(userLogin, retAttrs, true);
    return userDetails.getEntityId();
}

OIM EL Expressions

 Here are the few available EL expression that we can use in OIM UI. We can use this EL to customize self-service UI.

Category	Usage	EL [Expression Language]
User	Get the current user’s attribute value by passing the attribute name	#{oimcontext.currentUser['ATTRIBUTE_NAME']}
User	Similarly get the value for a UDF	#{oimcontext.currentUser['UDF_NAME']}
User	Gets the roles assigned to current user. Returns list of RoleEntity objects. It is a Java Bean having name, description, key, and displayName properties	#{oimcontext.currentUser.roles}
User	Return true if user is a system administrator	#{oimcontext.currentUser.roles['SYSTEM ADMINISTRATORS'] ne null}
User	Returns true if user is assigned with admin role 'OrclOIMSystemAdministrator'	#{oimcontext.currentUser.adminRoles['OrclOIMSystemAdministrator'] ne null}
User	Returns user key	#{oimcontext.currentUser.usr_key}
User	Returns user key	#{oimcontext.currentUser['usr_key']}
User	Returns user login	#{oimcontext.currentUser['User Login']}
Request	Returns current operation. Possible values: CREATE/MODIFY	#{pageFlowScope.requestFormContext.operation}
Request	Returns true if the current operation is Modify	#{pageFlowScope.requestFormContext.operation eq 'MODIFY'}
Request	Return the current action type. Possible values: APPROVAL/ FULFILL/ REQUEST/ VIEW/ SUMMARY. On all approval pages/ approver view the value is APPROVAL For Manual fulfillment page the value is FULFILL	#{pageFlowScope.requestFormContext.actionType}
Request	Returns true if the action type is Request i.e. the user is about to submit the request	#{pageFlowScope.requestFormContext.actionType eq 'REQUEST'}
Request	Returns true if the request is bulk	#{pageFlowScope.requestFormContext.bulk}
Request	Returns beneficiaries user ids[user login values]	#{pageFlowScope.requestFormContext.beneficiaryIds}
Request	Returns keys for cart items	#{pageFlowScope.requestFormContext.cartItemIds}
Request	Returns the type of item added to request. Possible values: ROLE/ ENTITLEMENT/ APP_INSTANCE/ USER.	#{pageFlowScope.requestFormContext.requestEntityType}
Request	Returns true if added item is Application Instance	#{pageFlowScope.requestFormContext.requestEntityType eq 'APP_INSTANCE'}
Request	Returns application instance key for the item added	#{pageFlowScope.requestFormContext.requestEntitySubType}
Request	Returns provisioned instance key for a modify type request	#{pageFlowScope.requestFormContext.instanceKey}
General	Invoke a method present on backing bean	#{backingBean.<Bean Name>.<bean method>}
General	To show a field disabled on all FULFILL and APPROVAL pages	disabled="#{pageFlowScope.requestFormContext.actionType}

OIM UI Customization using ADF - Adding custom tile application

I have prepared a series of video tutorials on OIM UI customization using ADF, where I have demonstrated how we can add a new tile application on OIM self service page.

If you follow the step by step process, as demonstrated in this tutorials, you will be able to integrate your own web application into OIM self service page as a new dashboard tile.

#1: Environment setup
#2: Adding Custom Tile Application (Part 1)
#3: Adding Custom Tile Application (Part 2)
#4: Adding Custom Tile Application (Part 3)
#5: Adding Custom Tile Application (Part 4)

More videos are on the way. Please Like & Subscribe my channel, so that you will get notification once I upload new videos.

OIM Certification Entity Details using SQL

Using SQL query you can find the details of certification entity by providing certification id as input. There are 3 different queries for Application Instance, Entitlement and Role.

OIM does have certification APIs for getting the entity details from certification id like:

CertificationService -> getIDCEntitlementsByBatch
CertificationService -> getIDCRolesByBatch
CertificationService -> getIDCApplicationInstancesByBatch

But many occasion, these APIs create problem during execution.

Below are the sample queries, which can easily replace the above APIs:

----------------------------------- Entitlement Certification --------------------------------------
SELECT
cert_certs.id AS certification_id,
cert_certs.cert_name AS certificationname,
certs_ent_defn.attr_value AS attribute_value,
certd_ent_defn.glossary_def AS name,
          certd_ent_defn.entity_id AS entitlement_entity_id
FROM
certd_ent_defn certd_ent_defn
INNER JOIN cert_certs cert_certs
ON certd_ent_defn.cert_id = cert_certs.id
INNER JOIN certs_ent_defn certs_ent_defn
ON certd_ent_defn.attr_val_id = certs_ent_defn.id
WHERE
         cert_certs.id = [CERT_ID]

------------------------------------ Application Instance Certification ------------------------
SELECT
certd_app_inst.cert_id AS certification_id,
certs_app_inst.iam_endpoint_id AS applicationid,
certs_app_inst.endpoint_name AS application_name
FROM
certs_app_inst, certd_app_inst,
cert_certs 
WHERE
cert_certs.id = certd_app_inst.cert_id 
AND certs_app_inst.id = certd_app_inst.endpoint_id 
        AND cert_certs.id=[CERT_ID]

------------------------------------------ Role Certification --------------------------------------
SELECT
cert_certs.id AS certification_id,
certs_role.rolename,
certs_role.entity_display_name
FROM
certs_role, certd_role,
cert_certs 
WHERE
cert_certs.id = certd_role.cert_id 
AND certd_role.role_id = certs_role.id
AND  cert_certs.id = [CERT_ID]

Retrive Weblogic CSF credentials using Java and Jps API

WebLogic CSF (Credential Store Framework) holds security data of WebLogic domain like credential. A credential can hold user name and password combinations, tickets, or public key certificates.

WebLogic CSF has 2 different types
          1. Password - A password credential encapsulates a user name and a password
          2. Generic - A generic credential encapsulates any customized data or arbitrary token.

This CSF can also be used for storing credential of other applications like OIM, SOA etc. and can be used for authentication from customized applications. For example if some one wants to create an Web Service to call OIM or SOA APIs, person need to authenticate in OIM or SOA. In that scenario we can use WebLogic CSF to store and use the credential of OIM or SOA.

The below code snippet will describe how to get the credential from WebLogic CSF using java. This code can be used only from the WebLogic domain application.

private void getCredential() throws Exception{

/*

* Initializing JpsContext with current factory context.

* oracle.security.jps.JpsContext can be found under jps-api.jar

*/

oracle.security.jps.JpsContext ctx = oracle.security.jps.JpsContextFactory.getContextFactory().getContext();

final oracle.security.jps.service.credstore.CredentialStore cs = (oracle.security.jps.service.credstore.CredentialStore) ctx

.getServiceInstance(oracle.security.jps.service.credstore.CredentialStore.class);

/*

* Below section is for getting data from CSF of type Passsowrd
* "oracle.wsm.security" is Credential Map name
* "SOAAdmin" is the Password CSF key name

*/

oracle.security.jps.service.credstore.CredentialMap cmap = cs.getCredentialMap("oracle.wsm.security");

oracle.security.jps.service.credstore.Credential cred = cmap.getCredential("SOAAdmin");

if (cred instanceof oracle.security.jps.service.credstore.PasswordCredential) {

oracle.security.jps.service.credstore.PasswordCredential pcred =
(oracle.security.jps.service.credstore.PasswordCredential)cred;

char[] p = pcred.getPassword();

String UserName = pcred.getName();

String Password = new String(p);

System.out.println("UserName : " + UserName);

System.out.println("Password : " + Password);

}

/*

* Below section is for getting data from CSF of type Generic.
* "oracle.wsm.security" is Credential Map name
* "oimurl" is the custom Generic CSF key name
*/

oracle.security.jps.service.credstore.CredentialMap cmapURL = cs.getCredentialMap("oracle.wsm.security");

oracle.security.jps.service.credstore.Credential credURL = cmapURL.getCredential("oimurl");

if (credURL instanceof oracle.security.jps.service.credstore.GenericCredential){

oracle.security.jps.service.credstore.GenericCredential gcred = (oracle.security.jps.service.credstore.GenericCredential) credURL;

if (gcred.getCredential() instanceof Hashtable){

/*
*This hash table contains all the key value pair of generic CSF
*/

Hashtable result = (Hashtable) gcred.getCredential();

String URL = new String((char[]) result.get("oimurl"));

String confPath = new String((char[]) result.get("confPath"));

System.out.println("URL : "+URL);

System.out.println("confPath : "+confPath);

}

}

}

Decrypt user's password in OIM 11gR2 PS3

In OIM 11gR2 PS1 we were able to get the user's password in clear text using below java code

tcDataProvider dbProvider = new tcDataBaseClient();

String query = "select USR_LOGIN,USR_PASSWORD from USR where USR_LOGIN=UPPER('"+uid+"')";
tcDataSet dataSet = new tcDataSet();
dataSet.setQuery(dbProvider, query);
dataSet.executeQuery();System.out.println("Password:: "+dataSet.getString("USR_PASSWORD"));

Starting from OIM 11gR2 PS2 this process no longer applicable, even if you run the above code in PS2 or PS3 version, this will give you ********* instead of clear text password.

I have found a way to get the user's password in clear text in OIM 11gR2 PS3 version. Execute the below procedure to get the same

1. take an ITResource in OIM and update password in password field.

     In my case I choose ITResource "Directory Server" and update "Admin Password" field.

    

2. From SQL Developer run the below query to get the database field of that ITResource

       select spd.SPD_FIELD_NAME, svp.SVP_FIELD_VALUE from spd, svp where
        spd.spd_key = svp.spd_key and
        spd.svd_key = (select svd_key from svr where svr_name = 'Directory Server') and
        svp.svr_key = (select svr_key from svr where svr_name = 'Directory Server')

        Output

       

3. Find out the password field that you updated from sysadmin console. You can see the password is encrypted.

4. Now run below query to get the encrypted password of OIM user

     select USR_PASSWORD from USR where USR_LOGIN='XELSYSADM';

     Output: 3412:ElLNJh2hLSqX+OdI9CxS8Q==

5. Now copy the password of XELSYSADM and update the "Admin Password" field in ITResource from database table.

6. Now run the below method to get the password of XELSYSADM in clear text

public void getITResourceParameter() throws Exception {

final String methodName = "::getITResourceParameter::";

Map phAttributeList = new HashMap();

phAttributeList.put("IT Resources.Name", "Directory Server");

HashMap paramMap = new HashMap();

tcITResourceInstanceOperationsIntf ITResourceAPI = (tcITResourceInstanceOperationsIntf)oimClient.getService(tcITResourceInstanceOperationsIntf.class);

tcResultSet itresSet = ITResourceAPI.findITResourceInstances(phAttributeList);

itresSet.goToRow(0);

String ITResourceKey = itresSet.getStringValue("IT Resources.Key");

System.out.println("ITResourceKey::"+ITResourceKey);

tcResultSet paramValuesRS = ITResourceAPI.getITResourceInstanceParameters(Long.parseLong(ITResourceKey));

for(int j=0;j<paramValuesRS.getTotalRowCount();j++){

paramValuesRS.goToRow(j);

paramMap.put(paramValuesRS.getStringValue("IT Resources Type Parameter.Name"), paramValuesRS.getStringValue("IT Resources Type Parameter Value.Value"));

}

String adminPassword = (String) paramMap.get("Admin Password");

System.out.println("adminPassword ::"+adminPassword);

}

You can use any user instead of XELSYSADM to get their OIM password in clear text.

Explanation    
1. Even if in OIM PS3 version, they block the dataset API to get the password in clear text from USR table, but ITResource API still capable of getting ITResource password in clear text from database.

2. OIM still use single encryption mechanism to encrypt all of its password.

Now if you can replace the encrypted password from USR table to SVP table of ITResource, then you can use the ITResource API to get the password.

** Oracle still need to work on this to enhance the security of user's password.

Get Parrent and Child request details of OIM

The below code snippet will give u the details of the Parent and Child request details of a given request id.

public void getRequestDetails(String reqId) throws Exception{

OIMClient oimClientObj = getRequesterConnection("xelsysadm");

RequestService reqAPI = (RequestService)oimClientObj.getService(RequestService.class);

/**

* Get parent request details
*/

Request req = reqAPI.getBasicRequestData("34002");

Request pReq = req.getParentRequest();

System.out.println("Parent Request: "+pReq.getRequestID());

/**

* get the child request details
*/

pReq = reqAPI.getBasicRequestData(pReq.getRequestID());

List<Request> cReqs = pReq.getChildRequests();

System.out.println("Other Chlied request for entitlements");

for (int i=0; i<cReqs.size(); i++){

System.out.println(cReqs.get(i).getRequestID()+" : "+cReqs.get(i).getRequestModelName());

}

}
Output

Parrent Request: 34001

Other Chlied request for entitlements

34002 : Provision ApplicationInstance

34003 : Provision Entitlement

34004 : Assign Roles

Upload jar for ScduleTask or JavaTask in OIM 11gR2 PS3 using API

You can upload the ScheduleTask and JavaTask jar in OIM from your custom java applications. Here is the example of the same. similarly you also download, update and delete jar files from OIM database.




public void uploadJar() throws PlatformServiceException{
      
  PlatformUtilsService platformUtilsService = (PlatformUtilsService) oimClient.getService(PlatformUtilsService.class);
        JarElement jarElement = new JarElement();
        jarElement.setName("abcd.jar");
        jarElement.setPath("/tmp/abcd.jar");
        jarElement.setType("ScheduleTask");
       
        Set jarElementSet = new HashSet();
        jarElementSet.add(jarElement);
       
        platformUtilsService.uploadJars(jarElementSet );
        System.out.println("Finish uploading jar" );
    }