OIM API for adding process task and retry failed task

 In this blog you can find how to add new process task and retry any failed/rejected tasks using API.

Adding new process task:

/*******************************************************************************************
 * @param orcKey
 * @param taskKey
 * @throws Exception
 * Adding new process task.
 * SQL Query to find Task: Task Key (MIL_KEY) select mil_key,mil_name from mil where mil_name='User Principal Name Updated' 
 * and tos_key in (select tos_key from tos where tos_instance_src_field like 'UD_ADUSER.%');
 */
public void addTask (long orcKey, long taskKey)throws Exception{
    tcProvisioningOperationsIntf provAPI = oimClient.getService(tcProvisioningOperationsIntf.class);
    System.out.println("Added :::"+provAPI.addProcessTaskInstance(taskKey, orcKey)+" For ORC_KEY :: "+orcKey);
}

Retry failed/rejected task

/**
 *********************************************************************************************
 * @param ro
 * @param taskName
 * @param taskStatus
 * @throws Exception
 * Retrying Rejected task
 */
public void retryTask (String ro, String taskName, String taskStatus, String uid)throws Exception{
    tcProvisioningOperationsIntf provAPI = oimClient.getService(tcProvisioningOperationsIntf.class);
    
    Map filter = new HashMap();
    filter.put("Objects.Name", ro);
    filter.put("Process Definition.Tasks.Task Name", taskName);
    
    String taskStatus1[] = new String[] {taskStatus};
    Thor.API.tcResultSet rs = provAPI.findAllOpenProvisioningTasks(filter, taskStatus1);
    
    if (rs != null && rs.getTotalRowCount() > 0){
        System.out.println("Total Count :: "+rs.getTotalRowCount());
        for (int i=0; i< rs.getTotalRowCount(); i++){
            rs.goToRow(i);
            if (rs.getStringValue("Process Instance.Task Information.Target User").equalsIgnoreCase(uid)){
                System.out.println(rs.getStringValue("Process Instance.Task Information.Target User")+ 
				" :: "+rs.getStringValue("Process Definition.Tasks.Task Name")+ " :: done");
                provAPI.retryTask(rs.getLongValue("Process Instance.Task Details.Key"));
                break;
            }
        }
    }
}

Adding or Removing child record in OIM using API.

In this blog you can find, how to add or remove child record in OIM accounts using API. In this example I used AD connectors, but it is applicable to any connectors.

Adding child record:

private String APP_INSTANCE_NAME = "ActiveDirectory";
private String CHILD_TABLE_FIELD_NAME = "UD_ADUSRC_GROUPNAME";
private String CHILD_TABLE_NAME = "UD_ADUSRC";

/**
* userLogin: USR_LOGIN value
* accountName: account login name e.g. UD_ADUSER_UID for AD account
* childRecords: String contains List of child data with comma separated.
*/
public void addChildRecord(String userLogin,String accountName, String childRecords) {

    try {
        ProvisioningService provAPI = oimClient.getService(ProvisioningService.class);
        Account acc = null;
        List accList = provAPI.getAccountsProvisionedToUser(getUserKeybyUserLogin(userLogin));
        for (Account account : accList){
            if (account.getAccountDescriptiveField().equalsIgnoreCase(accountName) && 
                account.getAppInstance().getApplicationInstanceName().equalsIgnoreCase(APP_INSTANCE_NAME) &&
                (account.getAccountStatus().equalsIgnoreCase("Provisioned") ||
                account.getAccountStatus().equalsIgnoreCase("Enabled") || 
                 account.getAccountStatus().equalsIgnoreCase("Disabled"))){
                     
                     acc = provAPI.getAccountDetails(Long.parseLong(account.getAccountID()));
                 }
        }
        
        System.out.println("App :: " + acc.getAppInstance().getApplicationInstanceName());
        AccountData accData = acc.getAccountData();
        ArrayList childArray = new ArrayList();

        String[] childRecordList = childRecords.split(",");
        for (int k = 0; k < childRecordList.length; k++) {
            ChildTableRecord newChild = new ChildTableRecord();
            Map val1 = new HashMap();
            val1.put(CHILD_TABLE_FIELD_NAME,childRecordList[k].toString());
            newChild.setChildData(val1);
            newChild.setAction(ChildTableRecord.ACTION.Add);
            childArray.add(newChild);
        }
        System.out.println("childArray size :: " + childArray.size());
        Map> childData = new HashMap>();
        childData.put(CHILD_TABLE_NAME, childArray);
        accData.setChildData(childData);
        acc.setAccountData(accData);
        provAPI.modify(acc);
        System.out.println(" ===== Account Name :: " + acc.getAccountDescriptiveField() + " updated");

    } catch (Exception e) {
        e.printStackTrace();
    }
}

Removing child records

private String APP_INSTANCE_NAME = "ActiveDirectory";
private String CHILD_TABLE_FIELD_NAME = "UD_ADUSRC_GROUPNAME";
private String CHILD_TABLE_NAME = "UD_ADUSRC";

/**
* userLogin: USR_LOGIN value
* accountName: account login name e.g. UD_ADUSER_UID for AD account
* childRecords: String contains List of child data with comma separated.
*/
public void deleteChildRecord(String userLogin,String accountName, String childRecords) {

    try {
        ProvisioningService provAPI = oimClient.getService(ProvisioningService.class);
        Account acc = null;
        List accList = provAPI.getAccountsProvisionedToUser(getUserKeybyUserLogin(userLogin));
        for (Account account : accList){
            if (account.getAccountDescriptiveField().equalsIgnoreCase(accountName) && 
                account.getAppInstance().getApplicationInstanceName().equalsIgnoreCase(APP_INSTANCE_NAME) &&
                (account.getAccountStatus().equalsIgnoreCase("Provisioned") ||
                account.getAccountStatus().equalsIgnoreCase("Enabled") || 
                 account.getAccountStatus().equalsIgnoreCase("Disabled"))){
                     
                     acc = provAPI.getAccountDetails(Long.parseLong(account.getAccountID()));
                 }
        }
        System.out.println("App instance :: " + acc.getAppInstance().getApplicationInstanceName());
        AccountData accData = acc.getAccountData();
        ArrayList childRecArray = null;
        Map> childDataMap = accData.getChildData();
        for (Map.Entry> entry : childDataMap.entrySet()){
            if (entry.getKey().equalsIgnoreCase(CHILD_TABLE_NAME)){
                childRecArray = entry.getValue();
            }
        }
        String[] childRecordList = childRecords.split(",");
        ArrayList childArray = new ArrayList();
        for (String childRecordToDelete : childRecordList) {
            String row_key = null;
            for (ChildTableRecord childRecord : childRecArray) {
                Map childValMap = childRecord.getChildData();
                if (childValMap.get(CHILD_TABLE_FIELD_NAME).toString().equalsIgnoreCase(childRecordToDelete)) {
                    row_key = childValMap.get(CHILD_TABLE_NAME+"_KEY").toString();
                    System.out.println("row_key to be deleted :: " + row_key);
                }
            }

            if (row_key != null) {
                ChildTableRecord newChild = new ChildTableRecord();
                Map val1 = new HashMap();
                val1.put(CHILD_TABLE_FIELD_NAME, childRecordToDelete);
                newChild.setChildData(val1);
                newChild.setAction(ChildTableRecord.ACTION.Delete);
                newChild.setRowKey(row_key);
                childArray.add(newChild);
            }
        }
        
        if (childArray.size() > 0){
            System.out.println("childArray size :: " + childArray.size());
            Map> childData = new HashMap>();
            childData.put(CHILD_TABLE_NAME, childArray);
            accData.setChildData(childData);
            acc.setAccountData(accData);
            provAPI.modify(acc);
            System.out.println(" ===== Account Name :: " +acc.getAccountDescriptiveField() + ": updated");
        }else{
            System.out.println(" ===== Account Name :: " +acc.getAccountDescriptiveField() + ": No data to delete");
        }
    } catch (Exception e) {
        e.printStackTrace();
    }
}

private String getUserKeybyUserLogin(String userLogin) throws Exception {
    UserManager userAPI =
        (UserManager)oimClient.getService(UserManager.class);
    Set retAttrs = new HashSet();
    User userDetails = userAPI.getDetails(userLogin, retAttrs, true);
    return userDetails.getEntityId();
}

Using GuardedString in OIM custom code.

It was observed in several cases, where we write custom java code for OIM (adapter, event handler, UI code , scheduler etc) with password as string value. If we store the password as java.lang.String, it is kept in memory as a clear text password and stays in memory at least until it is garbage collected. Code reviewer will always reject such code, if they find any password as java.lang.String.

GuardedString class can eliminate this problem by storing the password as characters in memory in an encrypted form. The encryption key will be a randomly-generated key. In their serialized form, Guarded String will be encrypted using a known default key. This is to provide a minimum level of protection regardless of the transport. For communications with the Remote Connector Framework it is recommended that deployments enable SSL for true encryption.

In this example I will explained how you can use Guarded String in OIM custom code.

GuardedString class is the member of  org.identityconnectors.common.security package and can be found in framework-1.3.2.jar. That means in your java project you have to import framework-1.3.2.jar as a library.


Below code sample describe how to store string password in GuardedString.

import org.identityconnectors.common.security.GuardedString;

String password = "abcd1234";
char[] passwordToChar = password.toCharArray();
GuardedString guardedPassword = new GuardedString(passwordToChar);


Below code sample describe how to get the password from GuardedString

          guardedPassword.access(new GuardedString.Accessor() {
                        @Override
                        public void access(char[] clearChars) {
                            System.out.println( "String password::::::::::::::::::::::::"+new String(clearChars)); //print the password.
                            
                        }
                    });
            retrivePassword.dispose(); // dispose the GuardedString after use.


it is always better to dispose the GuardedString after authentication operation is done using dispose() method.

OIM 11gR2 PS3 Revoke Requset using API

Revoke Application Instance request

public String createRevokeApplicationInstanceRequest(){

String requestKey="0";

RequestBeneficiaryEntity reqBenEnt = new RequestBeneficiaryEntity();

reqBenEnt.setRequestEntityType(oracle.iam.platform.utils.vo.OIMType.ApplicationInstance);

reqBenEnt.setEntitySubType("APP_INSTANCE_NAME"); //Application Instance Name as SubType

reqBenEnt.setOperation(RequestConstants.MODEL_REVOKE_ACCOUNT_OPERATION);

reqBenEnt.setEntityKey("ACCOUNT_ID"); //for AppInst it will be OIU key, for entitlement it will be ent_assign_key

List<RequestBeneficiaryEntityAttribute> reqBenEntAttrList = new ArrayList();

List<RequestBeneficiaryEntity> reqBenEntList = new ArrayList();

reqBenEntList.add(reqBenEnt);

//Create Beneficiary for the request

Beneficiary beneficiary = new Beneficiary();

beneficiary.setBeneficiaryKey("USR_KEY");

beneficiary.setBeneficiaryType(Beneficiary.USER_BENEFICIARY);

beneficiary.setTargetEntities(reqBenEntList);

List<Beneficiary> benList = new ArrayList<Beneficiary>();

benList.add(beneficiary);

//Create Request Data

RequestData reqData = new RequestData();

reqData.setBeneficiaries(benList);

reqData.setJustification("Business Justification");

OIMClient oimClientObjReq = OIMClientFactory.getOIMClient(requester);

RequestService reqAPI = (RequestService)oimClientObjReq.getService(RequestService.class);

try {

requestKey = reqAPI.submitRequest(reqData);

System.out.println(requestKey);

} catch (Exception rse) {

// TODO: Add catch code

rse.printStackTrace();

}

return requestKey;

}

Revoke Entitlement Request

public String createRevokeEntitlementRequest(){

String requestKey="0";

RequestBeneficiaryEntity reqBenEnt = new RequestBeneficiaryEntity();

reqBenEnt.setRequestEntityType(oracle.iam.platform.utils.vo.OIMType.Entitlement);

reqBenEnt.setEntitySubType("ENT_LIST_KEY");//it will be ent_list_key

reqBenEnt.setOperation(RequestConstants.MODEL_REVOKE_ENTITLEMENT_OPERATION);

reqBenEnt.setEntityKey("ENT_ASSIGN_KEY"); //It will be ent_assign_key which is entitlement instance key

List<RequestBeneficiaryEntityAttribute> reqBenEntAttrList = new ArrayList();

List<RequestBeneficiaryEntity> reqBenEntList = new ArrayList();

reqBenEntList.add(reqBenEnt);

//Create Beneficiary for the request

Beneficiary beneficiary = new Beneficiary();

beneficiary.setBeneficiaryKey("USR_KEY");

beneficiary.setBeneficiaryType(Beneficiary.USER_BENEFICIARY);

beneficiary.setTargetEntities(reqBenEntList);

List<Beneficiary> benList = new ArrayList<Beneficiary>();

benList.add(beneficiary);

//Create Request Data

RequestData reqData = new RequestData();

reqData.setBeneficiaries(benList);

reqData.setJustification("Business Justification");

OIMClient oimClientObjReq = OIMClientFactory.getOIMClient("REQUESTER_LOGIN_ID");

RequestService reqAPI = (RequestService)oimClientObjReq.getService(RequestService.class);

try {

requestKey = reqAPI.submitRequest(reqData);

System.out.println(requestKey);

} catch (Exception rse) {

// TODO: Add catch code

rse.printStackTrace();

}

return requestKey;

}

Revoke Role Request

For role revoke, it is almost same as Entitlement revoke request. Only changes required are as follows

reqBenEnt.setRequestEntityType(oracle.iam.platform.utils.vo.OIMType.Role);
reqBenEnt.setEntitySubType("ROLE_KEY");//it will be Role_key
reqBenEnt.setEntityKey("ROLE_KEY"); //It will be role_key
reqBenEnt.setOperation(RequestConstants.MODEL_REMOVE_ROLES_OPERATION);

OIM 11gR2 PS3 Provisioning Request using API

Provisioning request in OIM 11gR2 PS3 can be made for following:

1. Application Instance
2. Entitlements
3. Roles

Below are the API usage of all the request operations. You can use this sample methods and modify accordingly for bulk operations.

Application Instance Provisioning Request

/**

* Requesting Application Instance. This method

* can be further modified to use for bulk action.

* @param args

*/

private String createApplicationRequest() throws Exception{

RequestBeneficiaryEntity requestEntity = new RequestBeneficiaryEntity();

requestEntity.setRequestEntityType(oracle.iam.platform.utils.vo.OIMType.ApplicationInstance); //Type of the Request

requestEntity.setEntitySubType("APP_INSTANCE_NAME"); //Name of the Application Instance

requestEntity.setEntityKey("APP_INSTANCE_KEY"); //Application instance key

requestEntity.setOperation(RequestConstants.MODEL_PROVISION_APPLICATION_INSTANCE_OPERATION); //Request operation type.

/**

* here in each RequestBeneficiaryEntityAttribute object we will

* be setting the request data

* FIELD_1,FIELD_2,FIELD_3 are the request data set filed label name and the "value" is the corresponding value.

*/

List<RequestBeneficiaryEntityAttribute> attrs = new ArrayList<RequestBeneficiaryEntityAttribute>();

RequestBeneficiaryEntityAttribute attr;

attr = new RequestBeneficiaryEntityAttribute("FIELD_1", "value", RequestBeneficiaryEntityAttribute.TYPE.String);

attrs.add(attr);

attr = new RequestBeneficiaryEntityAttribute("FIELD_2", "value", RequestBeneficiaryEntityAttribute.TYPE.String);

attrs.add(attr);

attr = new RequestBeneficiaryEntityAttribute("FIELD_3", "value", RequestBeneficiaryEntityAttribute.TYPE.String);

attrs.add(attr);

//Continue setting RequestBeneficiaryEntity

requestEntity.setEntityData(attrs);

//Adding RequestBeneficiaryEntity to List

List<RequestBeneficiaryEntity> entities = new ArrayList<RequestBeneficiaryEntity>();

entities.add(requestEntity);

//creating new Beneficiary

Beneficiary beneficiary = new Beneficiary();

beneficiary.setBeneficiaryKey("USR_KEY"); //set BeneficiaryKey as User key

beneficiary.setBeneficiaryType(Beneficiary.USER_BENEFICIARY); //set the type as user

beneficiary.setTargetEntities(entities); //set target entities as list of RequestBeneficiaryEntity

//Adding Beneficiary to List

List<Beneficiary> beneficiaries = new ArrayList<Beneficiary>();

beneficiaries.add(beneficiary);

//Creating new RequestData and set the Beneficiaries with List of Beneficiaries

RequestData requestData = new RequestData();

requestData.setBeneficiaries(beneficiaries);

/**

* getRequesterConnection() is a seperate method to create OIM connection.

*/

OIMClient oimClientObjReq = getRequesterConnection("REQUESTER_LOGIN_ID"); //create an OIM connection with requester's login

RequestService requestAPI = (RequestService)oimClientObjReq.getService(RequestService.class);

String requestId = requestAPI.submitRequest(requestData);

System.out.println("requestId: "+requestId);

return requestId;

}

Entitlement Provisioning Request

private String createEntitlementRequest() throws Exception{

/**

* Creating a new RequestBeneficiaryEntity object which

* will hold all the requested entitlement related data.

*/

RequestBeneficiaryEntity requestEntity = new RequestBeneficiaryEntity();

requestEntity.setRequestEntityType(oracle.iam.platform.utils.vo.OIMType.Entitlement); //Type of the Request

requestEntity.setEntitySubType("ENT_CODE"); //Name of the Entitlement

requestEntity.setEntityKey("ENT_LIST_KEY"); //Entitlement key

requestEntity.setOperation(RequestConstants.MODEL_PROVISION_ENTITLEMENT_OPERATION); //Request operation type.

//Adding RequestBeneficiaryEntity to List

List<RequestBeneficiaryEntity> entities = new ArrayList<RequestBeneficiaryEntity>();

entities.add(requestEntity);

//creating new Beneficiary

Beneficiary beneficiary = new Beneficiary();

beneficiary.setBeneficiaryKey("USR_KEY"); //set BeneficiaryKey as User key

beneficiary.setBeneficiaryType(Beneficiary.USER_BENEFICIARY); //set the type as user

beneficiary.setTargetEntities(entities); //set target entities as list of RequestBeneficiaryEntity

//Adding Beneficiary to List

List<Beneficiary> beneficiaries = new ArrayList<Beneficiary>();

beneficiaries.add(beneficiary);

//Creating new RequestData and set the Beneficiaries with List of Beneficiaries

RequestData requestData = new RequestData();

requestData.setBeneficiaries(beneficiaries);

/**

* getRequesterConnection() is a seperate method to create OIM connection.

*/

OIMClient oimClientObjReq = getRequesterConnection("REQUESTER_LOGIN_ID"); //create an OIM connection with requester's login

RequestService requestAPI = (RequestService)oimClientObjReq.getService(RequestService.class);

String requestId = requestAPI.submitRequest(requestData); //Return request ID

System.out.println("requestId: "+requestId);

return requestId;

}

Role Provisioning Request

private String createRoleRequest() throws Exception{

/**

* Creating a new RequestBeneficiaryEntity object which

* will hold all the requested Role related data.

*/

RequestBeneficiaryEntity requestEntity = new RequestBeneficiaryEntity();

requestEntity.setRequestEntityType(oracle.iam.platform.utils.vo.OIMType.Role); //Type of the Request

requestEntity.setEntitySubType("UGP_KEY"); //Name of the Role

requestEntity.setEntityKey("UGP_NAME"); //Role key

requestEntity.setOperation(RequestConstants.MODEL_ASSIGN_ROLES_OPERATION); //Request operation type.

//Adding RequestBeneficiaryEntity to List

List<RequestBeneficiaryEntity> entities = new ArrayList<RequestBeneficiaryEntity>();

entities.add(requestEntity);

//creating new Beneficiary

Beneficiary beneficiary = new Beneficiary();

beneficiary.setBeneficiaryKey("USR_KEY"); //set BeneficiaryKey as User key

beneficiary.setBeneficiaryType(Beneficiary.USER_BENEFICIARY); //set the type as user

beneficiary.setTargetEntities(entities); //set target entities as list of RequestBeneficiaryEntity

//Adding Beneficiary to List

List<Beneficiary> beneficiaries = new ArrayList<Beneficiary>();

beneficiaries.add(beneficiary);

//Creating new RequestData and set the Beneficiaries with List of Beneficiaries

RequestData requestData = new RequestData();

requestData.setBeneficiaries(beneficiaries);

/**

* getRequesterConnection() is a seperate method to create OIM connection.

*/

OIMClient oimClientObjReq = getRequesterConnection("REQUESTER_LOGIN_ID"); //create an OIM connection with requester's login

RequestService requestAPI = (RequestService)oimClientObjReq.getService(RequestService.class);

String requestId = requestAPI.submitRequest(requestData); //Return request ID

System.out.println("requestId: "+requestId);

return requestId;

}