Unable to modify Disconnected Application Instance with non-Entitlement child data in OIM 11.1.2.3.0

Problem Description

When we create any disconnected application instance with child form in OIM 11gR2 PS1, we add the multivalued attribute into child dataset. This multivalued attribute hold the role data of the application. This can be set in 2 ways,


Either as Entitlement, where the role data will be visible in catalog as entitlement and can be added to child form directly using Modify Account option.


Or Only as Application Role, where role data will not be exposed as entitlements in catalog, and only option to add is to modify account.


if you go with the first option where role data are exposed as entitlements, then you have to select the Entitlement check box in the attribute configuration.

once you do that, automatically in the corresponding process definition 2 tasks are added for child data grant and revoke.

But if you choose the option 2, where child data are not exposed as entitlements, then no extra process task gets created in process definition. Only the form update task will be responsible for adding and removing child data in application instance.

Using option 2, when any one add a role through "Modify Account" process, "UD_[APP_NAME] Updated" task gets triggered and assign task for fulfillment.


In OIM 11.1.2.3.0 if you create disconnected application instance with 2nd option, then it will not work properly. When you add any role data in child table through "Modify Account" process, no process task gets triggered. As a result records get added in OIM database (child table), but no fulfillment task assigned to implementers.




Resolution (as of now)
Create the process task for each operation manually (insert, update, delete in child table), and map the adpMANUALPROVISIONING adapter.

DuplicateRefException in Disconnected Application Instance after upgrading OIM to PS3

After upgrading OIM to PS3 from previous version (like PS1 or R2 base version), we observed that the disconnected application instance's form doesn't work properly. Issue may happen with create form  and modify form.


If the issue is in create form, then you will not be able to raise request of it. Submit of request will throw exceptions.
If issue is with modify form then request can be created but approvers/fulfillment users will not be able to see the form data from request.


we noticed that the issue occurred on those disconnected applications where there are some hidden field in request dataset.


The error looks like below.


oracle.mds.exception.MDSRuntimeException: MDS-00010: DuplicateRefException. In document /oracle/iam/ui/runtime/form/view/pages/[APP_NAME]CreateForm.jsff there are multiple elements with the same ID _xg_0


oracle.mds.exception.MDSRuntimeException: MDS-00010: DuplicateRefException. In document /oracle/iam/ui/runtime/form/view/pages/[APP_NAME]ModifyForm.jsff there are multiple elements with the same ID _xg_0


Solution


1. Export the whole MDS of identity self service.

$OIM_HOME/common/bin/wlst.sh
connect('${WL_USER}','${WL_PASSWORD}','${ADMIN_URL_T3}');
exportMetadata(application='oracle.iam.console.identity.self-service.ear', server='${OIM_INSTANCE_NAME}', toLocation='/tmp/mds');


2. Go to the location where the MDS is exported /tmp/mds.
3. Now move to /oracle/iam/ui/runtime/form/view/pages/mdssys/cust/site/site/
4. Here you can see the create form and modify form's jsff files for all the application instances.
5. Open the create or modify jsff file in editor mode. You can see there are 2 <af: panelFormLayout> tags, which are under same <mds: insert> tag

6. Edit this form and put each <af: panelFormLayout>  under a separate <mds: insert> tag, like below.

7. Save the form do the same for all other application forms.


You can also use the below Unix command to perform the bulk update on all the forms.


Create Forms


find /tmp/mds/oracle/iam/ui/runtime/form/view/pages/mdssys/cust/site/site/ -name *CreateForm.jsff.xml -exec \
 sed  --in-place -e '/<\/af:panelFormLayout>/,/<panelFormLayout id="_xg_0"/s/<\/af:panelFormLayout>/<\/af:panelFormLayout>\n<\/mds:insert>\n<mds:insert parent="sdh1" position="last">/' {} \;


Modify Forms


find /tmp/mds/oracle/iam/ui/runtime/form/view/pages/mdssys/cust/site/site/ -name *ModifyForm.jsff.xml -exec \
 sed  --in-place -e '/<\/af:panelFormLayout>/,/<panelFormLayout id="_xg_0"/s/<\/af:panelFormLayout>/<\/af:panelFormLayout>\n<\/mds:insert>\n<mds:insert parent="sdh1" position="last">/' {} \;


Note: Change the id="_xg_0" or "_xg_1" according to your error message.


8. Zip the entire MDS.


cd /tmp/mds
zip -r ../mds.zip . >/dev/null


9. Upload the mds zip to OIM MDS repository


$OIM_HOME/common/bin/wlst.sh
connect('${WL_USER}','${WL_PASSWORD}','${ADMIN_URL_T3}');
importMetadata(application='oracle.iam.console.identity.self-service.ear', server='$OIM_INSTANCE_NAME', fromLocation='/tmp/mds.zip');


10. Restart the OIM servers.
11. Check all the Disconnected Application Instance form from OIM identity console.