Sunday, October 9, 2016

Oracle Identity Manager (OIM) 11G R2 PS3 (11.1.2.3.0) - Developing Approval Workflows

Oracle Identity Manager (OIM) 11G R2 PS3 (11.1.2.3.0) - Developing Approval Workflows

Workflow Concepts

  • Request
  • Approval
  • Approval Workflow Policy
  • SOA Composite
  • Partner Link
  • BPEL process
  • IT provisioner
  • Request web service
  • Request callback
    • The request callback is a web service that is invoked by the SOA composite when an approval outcome (approve/ reject) has been received. When the request engine invokes a SOA composite for the purpose of approval, it suspends the request until the composite invokes the request callback and provides an approve or reject decision. This decision allows the request engine to proceed with fulfilling the request (if approved) or rejecting the request (if rejected).


  • Provisioning callback
    • The provisioning callback is a web service that is invoked as part of disconnected provisioning. When the IT provisioner or fulfillment user fulfills a disconnected provisioning request and marks the task as completed, the SOA composite invokes the provisioning callback and sends the provisioning status allowing the provisioning workflow to complete.


  • Request payload
    • The request engine invokes the SOA composite and passes it some basic information about the request, requester, and target user. This information is called the request payload.


  • Human Task
    • Human tasks provide workflow modeling that describes the tasks for users or groups to perform as part of an end-to-end business process flow.




Predefined SOA Composites

  1. DefaultRequestApproval
  2. DefaultOperationalApproval
  3. BeneficiaryManagerApproval
  4. DefaultRoleApproval
  5. RequesterManagerApproval
  6. DefaultSODApproval
  7. DisconnectedProvisioning
  8. ProvideInformation
  9. CertificationProcess
  10. CertificationOverseerProcess





Creating New SOA Composites

  • The following attributes are mandatory for BPEL process:


  1. RequestID of type String
  2. RequestModel of type String
  3. RequestTarget of type String
  4. URL of type String
  5. RequesterDetails of XML Element
  6. BeneficiaryDetails of XML Element
  7. ObjectDetails of XML Element
  8. OtherDetails of XML Element


  • ant -f new_project.xml



Developing Workflows: Vision Request Tutorial


Configuring Default Approval Composites for Single and Bulk Operations

  • You can configure the default composites by setting the DefaultRequestLevelComposite and DefaultOperationLevelComposite properties in the oim-config.xml file. You can edit these properties by using System MBean Browser in Oracle Enterprise Manager. The default values for these properties are default/DefaultRequestApproval!3.0 and default/DefaultOperationalApproval!3.0 respectively.


Creating and Deploying Custom Task Details Taskflow

  • Prerequisites for Developing Custom Task Details Taskflow
  • Developing Custom Task Details Taskflow
  • Developing Custom Task Details for Email Notification (Optional)
  • Deploying the Task Details Taskflow
  • Configuring Human Task and Taskflow Permissions
  • Testing the Custom Taskflow




Extending Request Management Operations

  • Running Custom Code Based on Request Status Change
    • Create a new plug-in class with name RequestFailedChangeEvent that implements the oracle.iam.request.plugins.StatusChangeEvent interface.
  • Validating Request Data
    • You can use the RequestDataValidator plug-in to add custom validation of request data after submission. The plug-in point for this is the oracle.iam.request.plugins.RequestDataValidator interface with public void validate(RequestData requesterData) method.
  • Prepopulation of an Attribute Value During Request Creation
    • Prepopulation plug-in is associated with an attribute reference or attribute in request dataset. This can be used to prepopulate an attribute value by running custom code during request creation. Requester can modify the value that is prepopulated if required.
    • The plug-in point for this is oracle.iam.request.plugins.PrePopulationAdapter with public Serializable prepopulate(RequestData requestData) method. Use this plug-in only for the following request types:
    • Provision Resource, Self-Request Resource, Create User, Self-Register User.



Enabling Auto-Approval for Self Registration Requests

  • Rules in approval workflow policies can be configured that determine whether a request should be auto-approved or a SOA composite should be invoked.



Hiding the Skip Current Assignment Option

  • Change the task actions from the SOA composer. For the Skip Current Assignment action, deselect all the checkboxes and save.
  • Change the task action by using JDeveloper. For the Skip Current Assignment action, deselect all the checkboxes. Then save and redeploy the composite.



Customizing Certification Oversight

  • Certification oversight can be customized to extend the levels of oversight or stop the oversight process when a certain title is reached. The certification composite contains customizable oversight logic that supports queries to Oracle Identity Manager to select a sequence of overseers based on any one or all of the following:
    • The primary reviewer
    • The current phase of certification
    • The management-hierarchy defined in Oracle Identity Manager



Customizing the Identity Audit Composite