Populating Request Attributes by Using the Prepopulate Plug-in

There are many requirements when we want to populate User form, Resource form with some predefined values or depending on some business logic. OIM provides Prepopulate plugins which can be used to populate the values on these different forms.
Prepopulate plug-ins can be used when the same logic is to be executed for both UI and API request creation, and can also be used when a UI interaction is not required.

Here I have taken the use case of prepopulating Organization field depend on logged in user's Organization. For e.g I have user who belongs to organization Finance and whenever this user will try to Create the new user, create user form will open with Organization value prefilled as Finance.

1. To achieve this goal we have to write the java class which will implement the oracle.iam.request.plugins.PrePopulationAdapter interface. The following is an example code:



package com.plugin;
import java.io.Serializable;
import Thor.API.tcResultSet;
import Thor.API.Operations.tcUserOperationsIntf;
import oracle.iam.identity.usermgmt.api.UserManager;
import oracle.iam.identity.usermgmt.vo.User;
import oracle.iam.platform.Platform;
import oracle.iam.request.exception.RequestServiceException;
import oracle.iam.request.plugins.PrePopulationAdapter;
import oracle.iam.request.vo.RequestData;

public class PrePopulateOrganization implements PrePopulationAdapter {
 String className = this.getClass().getName();


 public Serializable prepopulate(RequestData requestData)
   throws RequestServiceException {
  String methodName = "/plugins prepopulate()";
 
  String reqrOrgKey = null;
  tcUserOperationsIntf userOppsIntf = null;
  try {
   userOppsIntf = (tcUserOperationsIntf) Platform
     .getService(tcUserOperationsIntf.class);
   tcResultSet result = userOppsIntf.getSelfProfile();
   UserManager usrmgr = Platform.getService(UserManager.class);
   result.goToRow(0);
   String requesterID = result.getStringValue("Users.Key");
   User usr = usrmgr.getDetails(requesterID, null, false);
   reqrOrgKey = usr.getOrganizationKey();
                
  } catch (Exception e) {
   e.printStackTrace();
   throw new RequestServiceException(e.getMessage());
  } finally {
   if (userOppsIntf != null) {
    userOppsIntf.close();
   }
  }


  return reqrOrgKey;
 }
}


2. Compile the above code and create a jar file.
3. Then you need to create plugin.xml.

<?xml version="1.0" encoding="UTF-8"?>
<oimplugins xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<plugins pluginpoint="oracle.iam.request.plugins.PrePopulationAdapter"> 
    <plugin pluginclass= "com.plugin.PrePopulateOrganization" version="1.0" name="PrePopulateOrganization"> 
          <metadata name="PrePopulationAdapater"> 
                   <value>CreateUserDataSet::Organization</value> 
          </metadata> 
    </plugin>
</plugins>
</oimplugins>

The metadata tag contains a value child node. This value child node must contain the pairs of FormName::AttributeName. Pair indicates a form attribute that will be populated by the prepopulate plug-in. In this example, such attribute is Organization in the CreateUserDataSet form. Same way you can populate the values on Application instance resource form.


4. The JAR file created above must be added to a ZIP file in the lib directory. The ZIP file must contain in the root path a XML file declaring the plug-in. This plugin zip is similar as we create for Schedulers/Eventhandler etc..

5. Register the plugin zip in OIM and as a result whenever you will open the Create user page, Organization will be populated with logged in users Organization.

OUD 11.1.2.2 failed to start with Checksum invalid error.

OUD uses embedded Berkley DB to store the data. All these data is saved in file system.
There are many chances in which this DB can corrupt. To avoid this data corruption you can plan the periodic data backup using OUD backup utility or ldif backup.

If in case your OUD instance got corrupted becasue of any reason then OUD startup script will fail to start the OUD instance with the sample error shown below.

category=CORE severity=NOTICE msgID=458891 msg=The Directory Server has sent an alert notification generated by class org.opends.server.core.DirectoryServer (alert type org.opends.server.Dire
ctoryServerShutdown, alert ID 458893): The Directory Server has started the shutdown process. The shutdown was initiated by an instance of class org.opends.server.core.DirectoryServer and the reason provided for the sh
utdown was An error occurred while trying to start the Directory Server: An error occurred while trying to initialize a workflow element from class org.opends.server.workflowelement.localbackend.DBLocalBackendWorkflowEl
ement with the information in configuration entry cn=userRoot,cn=Workflow Elements,cn=config: org.opends.server.types.InitializationException: An error occurred while trying to initialize a backend loaded from class org
.opends.server.backends.jeb.BackendImpl with the information in configuration entry cn=userRoot,cn=Workflow Elements,cn=config: The database environment could not be opened: (JE 5.0.86) /u01/app/oracle/admin/OUD_Instanc
es/OUD1/OUD/db/userRoot com.sleepycat.je.log.ChecksumException: Incomplete log entry header, size=0 lsn=0xb4/0x1c290aa LOG_CHECKSUM: Checksum invalid on read, log is likely invalid. Environment is invalid and must be clo
sed. fetchTarget of 0xb4/0x1c290aa parent IN=3 IN class=com.sleepycat.je.tree.BIN lastFullVersion=0xb5/0x42ea62 lastLoggedVersion=0xb5/0xb69382 parent.getDirty()=true state=0 (BackendImpl.java:1959 BackendImpl.java:366 L
ocalBackendWorkflowElement.java:500 LocalBackendWorkflowElement.java:396 DBLocalBackendWorkflowElement.java:61 NativeMethodAccessorImpl.java:-2 NativeMethodAccessorImpl.java:57 DelegatingMethodAccessorImpl.java:43 Method
.java:606 WorkflowElementConfigManager.java:420 WorkflowElementConfigManager.java:362 WorkflowElementConfigManager.java:144 DirectoryServer.java:10297 WorkflowElementConfigManager.java:117 DirectoryServer.java:2629 Direc
toryServer.java:1600 DirectoryServer.java:9930). This backend will be disabled. This workflow element will be disabled.

To resolve this issue you need the working backup of the OUD instance which you can use for restore. But if you dont have the backup then you can take the below approach to resolve the startup issue. In this approach you will lose some of your data.

1. Navigate to OUD instance folder and take the full backup of db and changelogDb folders.
2. Navigate to the original db/userRoot folder.
3. Delete the latest .jdb file.
4. Now navigate to changelogDb folder and delete the latest .jdb file.
5. Now run the start-ds command and this time your OUD instance should start with no error.

Stuck Threads in OIM (11.1.2.2) server

In OIM-OAM-OUD (or any directory) integrated environment if you see stuck threads in OIM servers and in threads dump you see the below error, Then apply the oracle patch 19939451 on oracle_common folder of OIM middleware.

[ACTIVE] ExecuteThread: '37' for queue: 'weblogic.kernel.Default (self-tuning)'" daemon prio=10 tid=0x00007f2de401e000 nid=0x7de4 waiting on condition [0x00007f2de0986000]
   java.lang.Thread.State: WAITING (parking)
 at sun.misc.Unsafe.park(Native Method)
 - parking to wait for  <0x00000005ae41a948> (a java.util.concurrent.locks.ReentrantReadWriteLock$NonfairSync)
 at java.util.concurrent.locks.LockSupport.park(LockSupport.java:186)
 at java.util.concurrent.locks.AbstractQueuedSynchronizer.parkAndCheckInterrupt(AbstractQueuedSynchronizer.java:834)
 at java.util.concurrent.locks.AbstractQueuedSynchronizer.doAcquireShared(AbstractQueuedSynchronizer.java:964)
 at java.util.concurrent.locks.AbstractQueuedSynchronizer.acquireShared(AbstractQueuedSynchronizer.java:1282)
 at java.util.concurrent.locks.ReentrantReadWriteLock$ReadLock.lock(ReentrantReadWriteLock.java:731)
 at oracle.ods.virtualization.engine.backend.jndi.JNDIConnectionPool.getLdapContext(JNDIConnectionPool.java:272)
 at oracle.ods.virtualization.engine.backend.jndi.JNDIConnectionPool.checkOutContext(JNDIConnectionPool.java:226)
 at oracle.ods.virtualization.engine.backend.jndi.BackendJNDI.getLDAPContext(BackendJNDI.java:1068)
 at oracle.ods.virtualization.engine.backend.jndi.BackendJNDI.getConnection(BackendJNDI.java:969)
 at oracle.ods.virtualization.engine.backend.jndi.ConnectionHandle.getHolder(ConnectionHandle.java:445)
 at oracle.ods.virtualization.engine.backend.jndi.ConnectionHandle.search(ConnectionHandle.java:268)
 at oracle.ods.virtualization.engine.backend.jndi.JNDIEntrySet.initialize(JNDIEntrySet.java:221)
 at oracle.ods.virtualization.engine.backend.jndi.BackendJNDI.get(BackendJNDI.java:765)
 at oracle.ods.virtualization.engine.chain.Chain.nextGet(Chain.java:303)

How to use different attribute than OAM_REMOTE_USER for OAM SSO integration with third party application

By default OAM populates User Login value to OAM_REMOTE_USER attribute after authentication.

If there is any third party application is integrated with OAM for single sign on, then that application consumes OAM_REMOTE_USER attribute for further work.

There can be a possiblity of customer want to use the different attribute in downstream application than User Login. Below are the steps to achieve this :

1. Navigate to your Application Domain --> Open the Authorization Policy attached to your protected resources.
2. Open the Responses tab and add the parameter you want to pass to downstream application for their use.

For.e.g :

Name : OAM_ASSERT_ATTR
Type : Header
Value : $user.attr.mail

3. In the downstream application's Admin server create an OAMIdentityAsserter. In the Active Types select OAM_REMOTE_USER and OAM_IDENTITY_ASSERTION in common section.
4. Now in Provider Specific section provide the value OAM_ASSERT_ATTR as a SSOHeader Name.

OAM (11.1.2.2.6) LockoutAttempts allows extra fail attempt than configured in oam-config.xml

IF you have Webgate-OAM (11.1.2.2.6) configured with OUD (or any idstore) for user authentication. You have configured LockoutAttempts” in oam-config.xml to 3 or any count as per your requirement.

So In OAM you are allowing only 3 fail login attempts to the user so after that user will be lock. But the difference you will see in the data is as below :

1. User tried 3 fail login attempt he got locked oblockedon is also set with current time. Trycount is also set to 3.
2. Now after some time user has tried 4th fail attempt to login and his oblockedon got updated with current time and trycount is set to 4.
3. Again after some time try one more fail attempt no data will be modified.

This is the bug in OAM 11.1.2.2.6. Oracle bug

Bug 21224281 - OBLOGINTRYCOUNT AND OBLOCKEDON GET INCREMENTED PAST THE "LOCKOUTATTEMPTS" VALUE

This issue will be resolved in latest OAM patch.

How to delete custom attribute and all it's references including from database in OIM11gR2

1. Export the UDF sandbox.
2. Unzip the sandbox.
3. Search and remove the unwanted UDF's from all XML files from sandbox.
4. Zip the sandbox again.
5. Import the sandbox.
6. Publish the sandbox.
7. Open the user form from UI form designer. You will not able to see the deleted UDF in UI user form.
8. Take the MDS export command of User.xml and remove all the references of UDF from User.xml.
9. Import the User.xml again through MDS import command.
10. Try to create the same UDF now, OIM will allow you to create the UDF with same detail.