IAM Integrated Solutions: 2019

ORA-01436: CONNECT BY loop in user data

1) Error in Logs: java.sql.SQLException: ORA-01436: CONNECT BY loop in user data

Run the following query to check the cycle:

select parent_key, act_key, level, connect_by_iscycle
from act
connect by NOCYCLE prior act_key=parent_key;

In case that PARENT_KEY is equal with the ACT_KEY of an organization, that data should be corrected.

Scripts for OIM Cleanup tmp cache and startup the servers

Scripts for OIM Cleanup tmp cache and startup the servers

vi cleanup.sh
#!/bin/bash
#Admin Server Cleanup
cd /opt/oracle/apps/OIM_Config/domains/OIG_Domain/servers/AdminServer
tar -cf tmp-`date +%F`.tar tmp/
tar -cf cache-`date +%F`.tar cache/
rm -rf tmp/ cache/
find /opt/oracle/apps/OIM_Config/domains/OIG_Domain/servers/AdminServer -iname "*.tar" -type f ! -newermt `date +%Y%m%d -d "20 days ago"` -delete
echo Admin Cleaned

#OIM Managed Server Cleanup
cd /opt/oracle/apps/OIM_Config/domains/OIG_Domain/servers/oim_server1
tar -cf tmp-`date +%F`.tar tmp/
tar -cf cache-`date +%F`.tar cache/
rm -rf tmp/ cache/
find /opt/oracle/apps/OIM_Config/domains/OIG_Domain/servers/oim_server1 -iname "*.tar" -type f ! -newermt `date +%Y%m%d -d "20 days ago"` -delete
echo OIM Server1 cleaned

#SOA Managed Server Cleanup
cd /opt/oracle/apps/OIM_Config/domains/OIG_Domain/servers/soa_server1
tar -cf tmp-`date +%F`.tar tmp/
tar -cf cache-`date +%F`.tar cache/
rm -rf tmp/ cache/
find /opt/oracle/apps/OIM_Config/domains/OIG_Domain/servers/soa_server1 -iname "*.tar" -type f ! -newermt `date +%Y%m%d -d "20 days ago"` -delete
echo SOA Server1 cleaned

#Re-starting NodeManager
kill -9 $(lsof -t -i:5556)
cd /opt/oracle/apps/OIM_Config/domains/OIG_Domain/bin/
nohup ./startNodeManager.sh > node.out &
echo Starting Nodemanager Now

#Starting OIM Admin Server
cd /opt/oracle/apps/OIM_Config/domains/OIG_Domain/bin/
nohup ./startWebLogic.sh > admin.out &
echo Starting OIM Admin Server Now
#IF a schema validation error happens on ADMIN server start use below:
#nohup ./startWebLogic.sh -Dweblogic.configuration.schemaValidationEnabled=false > admin.out &

Update Process Form Version using sql query

As soon as we have any changes on Process Form the one has to upgrade the form version for all the existing provisioned user accounts in OIM System, to do so one can run the scheduled job: Form Upgrade Job ( This job takes longer time to run)

or run the following sql query, below is the example for AD.

update UD_ADUSER set UD_ADUSER_VERSION=(select sdk_active_version from sdk where sdk_name='UD_ADUSER');

steps to configure the pre-populate adapter

Steps to configure a pre-populate adapter on a process form field, which takes the value from the corresponding OIM User entity.

The example here is provided on AD connector form, for e-mail field. However, the same concept applies to any field and any process form.

steps to configure the pre-populate adapter are:

1) Go to Design Console and select Development Tools-> Form Designer from the tree on the left.

2) Select the Form Designer Table tab from the lower part of the window.

Double click the row number next to UD_ADUSER.
3) Go to the Pre-Populate tab on the Form Designer page.

4) Click the Add button then complete the form:
      - Field Name -> E Mail
      - Rule -> double click the field and select Default
      - Adapter -> double click the field and select ADIDC Populate Form Field.

5) Click the save button.
    Select the row shown in the Adapter variables Table and Click Map.
      - Map To -> User Definition
      - Qualifier -> Email Address

6) Save and close, save and close again the next window.
Now in the Pre-Populate table you should see the new Adapter for E-mail.

To hide Tab from End Users

To hide Tab from End User do the following steps

Click on the tab which needs to be hidden from end users

Click on edit and scroll down

Click on show component

Click on Expression Builder

Remove true and paste below EL(Expression Language)

#{oimcontext.currentUser.roles['SYSTEM ADMINISTRATORS'] != null}

Click on Test

After successful test click on ok

Click on apply and OK

Close customization window

Publish sandbox

The tab will be only visible to Administrators.

How to set the Session Timeout for Identity and Sysadmin Console in 11g R2 PS2

Set the Session Timeout for Identity and Sysadmin Console in 11g R2 PS2

1. Shut down all servers

2. Backup the following application EAR files

$ORACLE_HOME/server/apps/oracle.iam.console.identity.self-service.ear

$ORACLE_HOME/server/apps/oracle.iam.console.identity.sysadmin.ear

3. Modify the following application EAR files

$ORACLE_HOME/server/apps/oracle.iam.console.identity.self-service.ear

$ORACLE_HOME/server/apps/oracle.iam.console.identity.sysadmin.ear

4. Copy these files to a working/local machine and edit using 7zip or some other tool that deals with large ZIP files

5. Within these ear files only the web.xml needs to be modified.

Following is the full path to the web.xml files that need to change:

• oracle.iam.console.identity.self-service.ear/oracle.iam.console.identity.self-service.war/WEB-INF/web.xml

• oracle.iam.console.identity.sysadmin.ear/oracle.iam.console.identity.sysadmin.war/WEB-INF/web.xml

6. For both web.xml files, search for the session-timeout tag and place your desired value. The unit is in minutes.

Example in web.xml file

<session-config>

<session-timeout>60</session-timeout>

</session-config>

7. Start all servers

Update the LDAPRole.xml Metadata File

Update the LDAPRole.xml Metadata File in 11gR2PS2

Since we are referencing the CustomParentOU UDF in the LDAPContainerRules.xml file, we need to make sure that attribute is available to the process. We do that by adding the CustomParentOU attribute to the LDAPRole.xml metadata file.

Add the following attribute to the <entity-attributes> section of the /metadata/iam-features-ldap-sync/LDAPRole.xml file.

<type>string</type>

<required>false</required>

<MLS>false</MLS>

<searchable>false</searchable>

<attribute-group>Basic</attribute-group>

</attribute>

NOTE: Since metadata can be updated several different ways and at different times, it is possible that this value may already exist in the LDAPRole.xml file. If it already exists, then this step can be skipped.

If the file is updated and saved, then the managed OIM servers need to be restarted.

IAM Integrated Solutions