OIM : Terminations and Future Deletes

In this post, I will talk about a very common business requirement where in the business needs the user the user to be kept in disabled state and want to retain all user's accesses and data for certain grace number of days after his termination and delete the user only the after that grace period is over.
This post will cover how it can be achieved in OIM.

Well by default, If the User's End Date (for termination date) is reached.
OOTB Scheduled Job "Disable/Delete User After End Date" will delete the user because
"XL.UserDeleteDelayPeriod" is set to 0.

You can set this value to number of days you want to retain the user data and accesses.

Lets say you set it to 365 days.
So what will happen next is user will always go into Disabled State first and will remain so for next 365 days.

Once the 365 Days is over.

Another scheduled job "Delayed Delete User" does the job of finding the all the disabled users and checking if the grace period is over and deleting them.

This whole scenario invloves

2 Scheduled Jobs
"Disable/Delete User After End Date"
"Delayed Delete User"

1 System Property
"XL.UserDeleteDelayPeriod" = "Period to Delay User Delete"

2 USR DATE COLUMN
USR_END_DATE
USR_AUTOMATICALLY_DELETE_ON

Whole thing can be directly tested by just playing with DB and setting the values directly and running those jobs.

OHS 12c - Adding Self Generated Custom Cert in OHS 12c

In this post, I will cover the steps required to generate and add self signed certs in OHS.

My OHS 12c is installed at

/app/oracle/deepakdubeyfusion

mkdir /var/oracle/deepakdubeywallets/

cd /var/oracle/deepakdubeywallets/

export JAVA_HOME=/app/oracle/deepakdubeyjava/jdk1.7.0_40/

/app/oracle/deepakdubeyfusion/oracle_common/bin/orapki wallet create -wallet /var/oracle/deepakdubeywallets/test1 -auto_login -pwd Welcome1

/app/oracle/deepakdubeyfusion/oracle_common/bin/orapki wallet add -wallet /var/oracle/deepakdubeywallets/test1 -dn cn=hostname.domainname.com -keysize 2048 -self_signed -validity 3650

/app/oracle/deepakdubeyfusion/oracle_common/bin/orapki wallet display -wallet /var/oracle/deepakdubeywallets/test1

then

in ssl.conf file add this line

uncomment the existing SSLWallet

  SSLWallet "/var/oracle/deepakdubeywallets/test1"

restart the ohs server

OIM 11G R2 PS2 (11.1.2.2.0) Publishing Role to an Organization using OIM API

In this post, I will talk about the API which lets you publish a role or an app instance to a particular organization.

public void addPublication(String roleKey, String orgKeyIntValue) {
        EntityPublicationService eps = Platform
                .getService(EntityPublicationService.class);

        EntityPublication ep = new EntityPublication(roleKey,
                PolicyConstants.Resources.ROLE, Long.parseLong(orgKeyIntValue),
                true);

        List<EntityPublication> epl = new ArrayList<EntityPublication>();

        epl.add(ep);

        eps.addEntityPublications(epl);

    }





What the above will do is take a role and publish it to specific organization specified here by organization key.

Removing(Unpublishing) is far more complicated as you will have to get the publication ID

public void removePublication(String roleKey, String orgKey,
            String roleName, String newOrgKey) {
        HashMap hm = new HashMap();

        hm.put("STARTROW", 0);

        hm.put("ENDROW", 1);

        EntityPublicationSearchCriteria epsc = new EntityPublicationSearchCriteria();

        epsc.setRoleName(roleName);

        epsc.setEntityId(roleKey.toString());

        epsc.setEntityType(PolicyConstants.Resources.ROLE);

        epsc.setScopeId(orgKey);

        EntityPublicationService eps = Platform
                .getService(EntityPublicationService.class);

        List<EntityPublication> epl = eps.search(epsc, null);

        for (EntityPublication ep : epl) {

            Long pubId = ep.getEntityPublicationId();

            EntityPublication ep2 = new EntityPublication(roleKey,
                    PolicyConstants.Resources.ROLE, newOrgKey, true);

            ep2.setEntityPublicationId(pubId);

            epl.add(ep);

            eps.removeEntityPublications(epl, true);

        }

    }

OIM 11G R2 PS2 : RequestDataValidator Plugin

In this post, I will talk about a custom RequestDataValidator plugin which is used for custom validation of request data after submission. Please remember that it is used after request submission and not before or during the request submission.


I will provide below the sample implementation

You can attach the data validation anywhere you get the form or request data.

import java.util.Iterator;
import java.util.List;

import oracle.iam.request.exception.InvalidRequestDataException;
import oracle.iam.request.plugins.RequestDataValidator;
import oracle.iam.request.vo.Beneficiary;
import oracle.iam.request.vo.RequestBeneficiaryEntity;
import oracle.iam.request.vo.RequestBeneficiaryEntityAttribute;
import oracle.iam.request.vo.RequestData;


public class RequestDataValidatorPlugin implements RequestDataValidator{

    @Override
    public void validate(RequestData requestdata) throws InvalidRequestDataException {
        List<Beneficiary> beneficiaries = requestdata.getBeneficiaries();
        List<RequestBeneficiaryEntity> beneficiaryEntities = null; 
        List<RequestBeneficiaryEntityAttribute> beneficiaryEntityAttributes = null;
         for (Beneficiary beneficiary : beneficiaries){
             beneficiaryEntities = beneficiary.getTargetEntities();
             for (RequestBeneficiaryEntity beneficiaryEntity : beneficiaryEntities) {
                 beneficiaryEntityAttributes = beneficiaryEntity.getEntityData();
                 for (RequestBeneficiaryEntityAttribute requestBeneficiaryEntityAttribute : beneficiaryEntityAttributes){
                      System.out.println("requestBeneficiaryEntityAttribute.getName()--->"+requestBeneficiaryEntityAttribute.getName());
                      System.out.println("requestBeneficiaryEntityAttribute.getValue()--->"+requestBeneficiaryEntityAttribute.getValue());
                      if(requestBeneficiaryEntityAttribute.hasChild()){
                          List <RequestBeneficiaryEntityAttribute> childRequestBeneficiaryEntityAttributes = requestBeneficiaryEntityAttribute.getChildAttributes();
                          Iterator iterator = childRequestBeneficiaryEntityAttributes.iterator();
                          while(iterator.hasNext()){
                              RequestBeneficiaryEntityAttribute childAttribute =(RequestBeneficiaryEntityAttribute)iterator.next();
                              System.out.println("childAttribute.getName()--->"+childAttribute.getName());
                              System.out.println("childAttribute.getValue()--->"+childAttribute.getValue());
                             
                          }
                      }
                 }
             }
         }
       
    }

}

OIM 11G R2 PS2 : StatusChangeEvent Plug-in

In this post, I will talk about the StatusChangeEvent plugin which allows running of custom code during request status change.

This plugin can be used to look the request data and perform any necessary actions  based on the status of a request.

I will provide here some sample implementation and hook point on how to use it.

import java.util.Date;
import java.util.List;

import oracle.iam.identity.exception.NoSuchUserException;
import oracle.iam.identity.exception.UserLookupException;
import oracle.iam.identity.usermgmt.api.UserManager;
import oracle.iam.identity.usermgmt.vo.User;
import oracle.iam.platform.Platform;
import oracle.iam.platform.authz.exception.AccessDeniedException;
import oracle.iam.request.api.RequestService;
import oracle.iam.request.exception.NoRequestPermissionException;
import oracle.iam.request.exception.RequestServiceException;
import oracle.iam.request.plugins.StatusChangeEvent;
import oracle.iam.request.vo.Beneficiary;
import oracle.iam.request.vo.Request;

public class StatusChangeEventPlugin implements StatusChangeEvent {

    @Override
    public void followUpActions(String requestID) {

        try {
            RequestService requestService = Platform
                    .getService(RequestService.class);
            Request request = requestService.getBasicRequestData(requestID);
            Date exDate = request.getExecutionDate();
            String requestModelName = request.getRequestModelName();
            List<Beneficiary> beneficiaries = request.getBeneficiaries();
            UserManager userManager = Platform
                        .getService(UserManager.class);
            for (Beneficiary beneficiary : beneficiaries) {
                String usrKey = beneficiary.getBeneficiaryKey();// usr_key
               
                User user = userManager.getDetails(usrKey, null, false);
                Date date = user.getCreationDate();
                // Update Request
                request.setExecutionDate(date);
                request.setJustification("Justified by system");
            }
        } catch (RequestServiceException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (NoRequestPermissionException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (NoSuchUserException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (UserLookupException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (AccessDeniedException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }

    }

}