OIM EL Expressions

 Here are the few available EL expression that we can use in OIM UI. We can use this EL to customize self-service UI.

Category	Usage	EL [Expression Language]
User	Get the current user’s attribute value by passing the attribute name	#{oimcontext.currentUser['ATTRIBUTE_NAME']}
User	Similarly get the value for a UDF	#{oimcontext.currentUser['UDF_NAME']}
User	Gets the roles assigned to current user. Returns list of RoleEntity objects. It is a Java Bean having name, description, key, and displayName properties	#{oimcontext.currentUser.roles}
User	Return true if user is a system administrator	#{oimcontext.currentUser.roles['SYSTEM ADMINISTRATORS'] ne null}
User	Returns true if user is assigned with admin role 'OrclOIMSystemAdministrator'	#{oimcontext.currentUser.adminRoles['OrclOIMSystemAdministrator'] ne null}
User	Returns user key	#{oimcontext.currentUser.usr_key}
User	Returns user key	#{oimcontext.currentUser['usr_key']}
User	Returns user login	#{oimcontext.currentUser['User Login']}
Request	Returns current operation. Possible values: CREATE/MODIFY	#{pageFlowScope.requestFormContext.operation}
Request	Returns true if the current operation is Modify	#{pageFlowScope.requestFormContext.operation eq 'MODIFY'}
Request	Return the current action type. Possible values: APPROVAL/ FULFILL/ REQUEST/ VIEW/ SUMMARY. On all approval pages/ approver view the value is APPROVAL For Manual fulfillment page the value is FULFILL	#{pageFlowScope.requestFormContext.actionType}
Request	Returns true if the action type is Request i.e. the user is about to submit the request	#{pageFlowScope.requestFormContext.actionType eq 'REQUEST'}
Request	Returns true if the request is bulk	#{pageFlowScope.requestFormContext.bulk}
Request	Returns beneficiaries user ids[user login values]	#{pageFlowScope.requestFormContext.beneficiaryIds}
Request	Returns keys for cart items	#{pageFlowScope.requestFormContext.cartItemIds}
Request	Returns the type of item added to request. Possible values: ROLE/ ENTITLEMENT/ APP_INSTANCE/ USER.	#{pageFlowScope.requestFormContext.requestEntityType}
Request	Returns true if added item is Application Instance	#{pageFlowScope.requestFormContext.requestEntityType eq 'APP_INSTANCE'}
Request	Returns application instance key for the item added	#{pageFlowScope.requestFormContext.requestEntitySubType}
Request	Returns provisioned instance key for a modify type request	#{pageFlowScope.requestFormContext.instanceKey}
General	Invoke a method present on backing bean	#{backingBean.<Bean Name>.<bean method>}
General	To show a field disabled on all FULFILL and APPROVAL pages	disabled="#{pageFlowScope.requestFormContext.actionType}

OIM UI Customization using ADF - Adding custom tile application

I have prepared a series of video tutorials on OIM UI customization using ADF, where I have demonstrated how we can add a new tile application on OIM self service page.

If you follow the step by step process, as demonstrated in this tutorials, you will be able to integrate your own web application into OIM self service page as a new dashboard tile.

#1: Environment setup
#2: Adding Custom Tile Application (Part 1)
#3: Adding Custom Tile Application (Part 2)
#4: Adding Custom Tile Application (Part 3)
#5: Adding Custom Tile Application (Part 4)

More videos are on the way. Please Like & Subscribe my channel, so that you will get notification once I upload new videos.

Managing Service Account in OIM 11gR2 PS3

Service Account concept was highly used during 9i version of OIM. In 11gR2 PS3 service account options are there from UI there is no option to move the Service Account to different users. here are the API sample for converting an OIM account to a Service Account and move the same to other user.

1. First Java Code: is to mark an account to Service Account
2. Second Java Code: is to get whether an account is Service Account or not.
3. Third Java Code: is to transfer a Service Account to other user.



After executing the third java code, the service account will be completely moved to a new target user.

OIM PS3 Automated Testing Using Selenium

OIM's UI functionalities can be tested by automation tool like Selenium. There are lot of test cases we need to perform on OIM UI, after doing some developments or implementation (just to verify whether all existing functionalities are working fine). Some time it is very painful job to perform all per-defined test cases again and again. Using Selenium, all the UI based pre-defined test cases can be executed automatically with out any human intervention, and this way we can achieve automated testing on OIM, which is faster than manual testing, efficient and error free.

this blog will give an example of how we can build Selenium test script for OIM.

Selenium test script works on web element of an web page, like button, link etc. If we can identify those element, then it is not a very difficult job to build a test script for a scenario.

for example, I need to perform the below scenario on OIM PS3

************ As Requester ************************
 1. Login to OIM identity console as requester.
 2. Go to catalog and search for a disconnected application "".
 3. Click on Add To cart and checkout.
 4. Fill the application form.
 5. Provide business justification and submit the request.
 6. Logout from the OIM Identity console.

**************** As Approver *********************
 7. Login to OIM identity console as approver.
 8. Go to Pending Approval and search for the requested id generated by requester.
 9. Select the request and approve the same.
10. Logout from OIM Identity console.

**************** As Implementer *******************
11. Login to OIM Identity console as implementer.
12. Go to Pending Fulfillment and Search for the request id generated by requester.
13. Select the request and complete the same.
14. Now go to Track Request and verify the status of the request.

If I need to perform the automated testing of the above test scenario, I have to convert each and every steps with selenium methods. for example I if need to click a button or enter text into a text field, I need to first get the XPath or Element id of those components. Then using those details selenium can identify those element in  browser and perform action (like click or enter data).

in my case //*[@id=\"pt1:_pt_it1::content\"] is the XPath representation of User Login field of OIM login page. similarly //*[@id=\"pt1:_pt_cb1\"] is for Submit button, and so on.

Now here is the full Java code for Selenium Test. For basic of Selenium and how to setup environment refer Selenium HQ

Please check the below video for how the actual testing looks like.

Please note, all the XPaths mentioned in the above code, may not be exactly same for you (before running the test, verify all the XPaths form chrome browser).

Reverse Engineering on OIM Event Handlers

If someone give me an OIM environment and ask to find out all the event handlers deployed on it and their associated class, it is not that easy process to find out. In this article, I am going to describe how one can find all the event handlers (User, Role etc.) and their qualified class name deployed on OIM (PS3).

Before we start, we need to understand where we generally use event handlers in OIM. It is used normally during any OIM events like create/modify/delete/disable/enable of users or assign/revoke role etc. where create, modify, delete, assign are kind of operation and user, role are entities.

In order to find out how many event handlers are there, follow the below steps:

1. Login to weblogic EM console and expand Identity and Access -> OIM -> oim(11.1.2.0.0)

2. Right click on it and select System MBean Browser.

3. Now naviage to oracle.iam -> server:oim -> Application:oim -> IAMAppDesignMBean

4. Click on ConfigQueryMBeanName

5. From right hand window, click on Operations

6. Click on the getEventHandlers.

7. In the parameter section put the parameter as below:

                  P1 --> Entity Type (user, role etc.)

                  P2 --> Operation (create, modify, delete etc.).

8. Once done click on Invoke.

9. It will display the result in the same page.

10. The output list contains all the event handlers’ doc available in the MDS.

11. It contains validation, pre-process, action, post process along with out of band handlers.

12. Each row contains 5 columns as below

              Stage: whether it is validation, pre-process, action or post process

              Order: Order number of the handlers.

              Name: name of the event handlers

              Location: the document location in MDS

              Conditional: true or false

13. Now pick the appropriate one you need to check further. Normally you can find out from the name.

14. Copy the MDS doc location.

15. Now navigate to oracle.mds.lcm -> Server:oim -> Application: OIMAppMetadata -> MDSAppRuntime

16. Click on MDSAppRuntime and from the right hand panel click on Operations

17. Now click on the first exportMetadata link as mentioned in the picture.

18. In the parameter section we have to provide 2 parameters as below:

              toLocation: Location where file will be downloaded (in the server where OIM is installed)

              docs: name of the MDS doc. In order to enter the doc, click on the pencil icon and add the doc like below. You can add more than one doc at a time. Click OK.

19. Once all the parameters are given click on Invoke.

20. If invoke is successful then success message will be displayed.

21. After this operation, login to the host machine and go to the mentioned output location.

22. You can find the directory structure as per the doc name and the file as below

23. Open the file in editor mode and check the list of event handler defined. You can find the list of event handlers like below:

<action-handler orch-target="oracle.iam.platform.kernel.vo.EntityOrchestration" class="oracle.iam.identity.usermgmt.impl.handlers.custom.CustomPostProcessHandler" entity-type="User" operation="CREATE" name="CustomPostProcessHandler" stage="postprocess" sync="TRUE" order="2000000"/>

24. Now you can get your desired event handler and their associated class name.

Note: if you want to change some of the existing event handlers functionality, simply change the class name and re-import.

Adding Command Button in OIM PS3 (Managed Bean Concept)

Adding a new command button in oi pages requires UI level customization, where you need to create managed bean. Managed Bean is a regular java bean registered with JSF or in other word, it is a java bean managed by JSF framework. If we create our own managed bean, then we can build our own Expression Language. Let us define a scenario first.

Scenario: Customer requires a button in catalog search page. When clicked, some popup message will be displayed.

In order to develop a custom managed bean, follow the below steps.

Pre-Requisite

Copy the jdev.lib folder from [OIM_HOME]/server directory to you local machine.

Development

1. Open JDeveloper IDE (I am using 11.1.1.7)
2. Click on new and create "Fusion Web Application (ADF)".

3. Follow the steps and click next to complete the creation of new application.
4. You can see there are 2 projects created Model and ViewController
3. Right click on ViewController project and click on New.
4. Choose Java from the left pane and select Java Class from the right pane.

5. click OK and provide the class name (e.g. CustomEventListener)

6. Click OK to create the java file.
7. the entire work space would look like below

8. Right click on the ViewController project and click on Project Properties.
9. In the properties page select Libraries and Classpath
10. Click on Add Library and and select the path of jdev.lib where you copied the shared libraries,
11. Add all three shared libraries from jdev.lib.

12. Click OK to close the window.
13. Now open the CustomEventListener.java and write below code as sample


package view;

import javax.faces.application.FacesMessage;
import javax.faces.event.ActionEvent;
import oracle.iam.ui.platform.utils.FacesUtils;

public class CustomEventListener {
    public CustomEventListener() {
        super();
    }
    
    public void testButtonActionListener(ActionEvent e) {
        
        System.out.println("This is a custom event listener");
        String loggedinUser = FacesUtils.getValueFromELExpression("#{oimcontext.currentUser['User Login']}").toString();
        FacesUtils.addFacesInformationMessage("This is a test message: "+loggedinUser);
        System.out.println("Current Logged In user: "+loggedinUser);
    }
        
}

**** The above code get the current logged in user from the OIM available EL and display a popup message.

9. Save the file. You can write your own logic.
10. Expand Web Content -> Page Flows and open adfc-config.xml
11. Under the Managed Bean section , click on + icon and add a new managed bean like below

Name: CustomELBean
Class: view.CustomEventListener
Scope: backingBean

12. Save the configuration.
13. Now we have to create the deployment profile. To do that, right click on the ViewController project and choose Deployment.

14. Delete the existing profile and click on New to add a new one.
15. From the Archive Type select ADF Library Jar File and in the Name put name of the jar (e.g. adflibTestEventListener1). Click OK to create the profile.

16. Click OK to finish the process.
18. Now right click on the ViewController project and click deploy and select the adflibTestEventListener1 to JAR file.

19. Now your adf library jar is ready for the deployment.

Deploying the Artifacts

1. Copy the oracle.iam.ui.custom-dev-starter-pack.war from OIM_HOME/server/apps directory to your local machine.

2. copy the adflibTestEventListener1.jar from the project deploy folder and move the same to oracle.iam.ui.custom-dev-starter-pack.war\WEB-INF\lib

3. Replace the modified oracle.iam.ui.custom-dev-starter-pack.war to the OIM_HOME/server/apps directory.

4. Stop the OIM managed server.

5. Delete the cache, tmp and stage folders from the [DOMAIN_HOME]/servers/[OIM_MANAGED_SERVER_NAME] directory

6. Start the OIM managed server.

Testing

1. Login into identity self service console using System Administrator privileges.

2. Import the below sandbox.

Sandbox_button

3. Activate the sandbox.

4. Go to the Self-Service home page and open catalog page.

5. Once the catalog page is opened, you can see an Extra button named Test. Clicking that button display a popup message with the logged-in user ID.

Note: sandbox contain a commandButton with actionListener property added like below

FileName: sandbox_button.zip\oracle\iam\ui\catalog\pages\mdssys\cust\site\site\access-request-train.jspx.xml

<?xml version='1.0' encoding='UTF-8'?>
<mds:customization version="11.1.1.66.73" xmlns:mds="http://xmlns.oracle.com/mds" motype_local_name="root" motype_nsuri="http://java.sun.com/JSP/Page">
   <mds:insert after="pt_pgl3(xmlns(f=http://java.sun.com/jsf/core))/f:facet[@name='separator']" parent="pt_pgl3">
      <af:commandButton xmlns:af="http://xmlns.oracle.com/adf/faces/rich" id="cb1001" text="Test" actionListener="#{backingBeanScope.customELBean.testButtonActionListener}"/>
   </mds:insert>
</mds:customization>

OIM performance analysis using thread dump

In this article I am going to describe how we can analyse the OIM performance using java thread dump. In many situation we have observed that OIM performance is very poor and response time is quite long. There are many reasons behind this killing slowness and poor server response. Some observed reasons are highlighted below:

1. Re-Try task schedule job is running and queuing huge number of failed tasks.
2. Re-Try failed reconciliation events job running with huge number of failed event.
3. Some event handler is stuck and trying to connect external web service.
4. Some admin role (with huge number of members) taking unexpected time to open and hanged the system etc.

There can many other reason for the poor performance.

In Unix machine, when we run any service (like OIM, SOA etc), a process gets generated. That process ID contains lot of information that we can use to identify reason for poor performance. Me and my colleague Nicola (https://www.linkedin.com/in/nicola-scendoni) together we did some experiment and found a way to detect which processes are causing the issue.

Here I am explaining the steps we performed:

1. first we run ps -ef|grep wls to get the PID of OIM
2. Once we get the PID, we ran below command to get all the threads of OIM.

          top -H -p <PID>

as you can see, the command top displaying all the threads of OIM PID. From these individual threads, identify those which are taking more CPU and Memory. Copy the thread ids into a notepad.

3. Now we need to convert these thread IDs to its corresponding HEX value. In order to convert the decimal PID values to HEX run the below command

                      printf "%x\n" <THREAD ID>

4. Now we will get the thread dump of entire OIM process using JStack

                [JAVA_HOME]/bin/jstack [OIM PID] > /tmp/jstack_dump.txt

5. Open the thread dump /tmp/jstack_dump.txt and search the HEX value of the thread. This will give you the thread which is consuming lots of CPUs and MEMs.

6. Analyse the thread and its classes, and identify the process of OIM which is causing issue. Take the necessary action based on the identified process.


Hope, this blog will help you to identify causes of poor response time of OIM.

Cheers !!!!!!!!!!!!!!!