How to Change Session Timeout for OIM11g

You can change the session timeout by directly editing the web.xml

file in both the self-service application archive (oracle.iam.console.identity.self-service.ear) and the sysadmin application archive (oracle.iam.console.identity.sysadmin.ear) and then redeploying the applications . The change will require restart of OIM Manage Servers. 

 

Here are the location of files:

       /opt/idm/product/IAM11GR2/Oracle_IAM1/server/apps/oracle.iam.console.identity.sysadmin.ear

 

·     /opt/idm/product/IAM11GR2/Oracle_IAM1/server/apps/oracle.iam.console.identity.self-service.ear

The session timeout configuration is as below in web.xml

/identity console

15

/syadmin console

35

Change the value in the web.xml, recreate and redeploy the ear file.

Reference:

http://www.oracle.com/technetwork/articles/idm/fraz-oim-session-timeout-2120987.html

How to Identify the database session locking the tables

You can use the below command to find if any session has created lock on any database object:

Note: You need to have sys password to identify sessions which are causing the lock on tables and to kill those sessions.

select c.owner,c.object_name,c.object_type,b.sid,b.serial#,b.status,b.osuser,b.machine from

v$locked_object a ,v$session b,dba_objects c

where b.sid = a.session_id and a.object_id = c.object_id and c.owner='<>;

if above query returns any output, please use the below query to kill the session:

ALTER SYSTEM KILL SESSION 'SID,SERIAL';

Use the SID and SERIAL returned by the above query and execute the query.

I have used this query before running the OIM Bulk Load Utility.

How to take & read the JVM Thread Dump for OIM Servers

Each Java Application has its own thread dump. A thread dump is a snapshot of the state of all threads that are part of the process. The state of each thread is presented with a so called stack trace, which shows the contents of a thread’s stack. Some of the threads belong to the Java application you are running, while others are JVM internal threads.

A thread dump reveals information about an application’s thread activity that can help you diagnose problems and better optimize application and JVM performance.

The latest versions of JRockit include a utility called "jrcmd" which can be used to grab information from running JVMs as well as control the behaviour of the JVM. For example, it can be used to create thread stack dumps, print the heap usage, get the commandline used to start the JVM, enable the management console and a few other things.

In the most basic incarnation, jrcmd lists the currently running JVMs on the system. For example,

$./jrcmd

7693 weblogic.Server

13369 weblogic.NodeManager -v

7551 weblogic.Server

9420

Note: Please set the JAVA_HOME & PATH environment variables before running this utility.

The first number is the process id of the process followed by the name of the main class and any command line parameters.

The first number is the process id of the process followed by the name of the main class and any command line parameters.

./jrcmd 19570 print_threads >>thread.txt

Note: Here 19570 is the PID for oim_server2 in PROD.

19570:

===== FULL THREAD DUMP ===============

Wed Aug 27 08:55:58 2014

Oracle JRockit(R) R28.2.5-20-152429-1.6.0_37-20120927-1915-linux-x86_64

"Main Thread" id=1 idx=0x4 tid=19571 prio=5 alive, waiting, native_blocked

    -- Waiting for notification on: weblogic/t3/srvr/T3Srvr@0x12fc20ff0[fat lock]

"[STUCK] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'" id=15 idx=0x68 tid=24579 prio=1 alive, blocked, native_blocked, daemon

A thread that has the name STUCK in it’s name has been identified as not being returned to the thread pool for a configured amount of time, which defaults to 10 minutes.

Print Memory Usage

./jrcmd 6259 print_memusage

6259:

Total mapped                  6847396KB           (reserved=1206632KB)

-              Java heap      4194304KB           (reserved=0KB)

-              GC tables       140300KB

-          Thread stacks        63828KB           (#threads=198)

-          Compiled code      1048576KB           (used=63385KB)

-               Internal         1480KB

-                     OS       367452KB

-                  Other       491296KB

-            Classblocks        28416KB           (malloced=28323KB #70508)

-        Java class data       510720KB           (malloced=509750KB #327854 in 70508 classes)

- Native memory tracking         1024KB           (malloced=240KB #10)

Print JVM State

./jrcmd 6259 print_vm_state

6259:

Uptime       : 0 days, 01:20:55 on Wed Aug 27 10:30:06 2014

Version      : Oracle JRockit(R) R28.2.5-20-152429-1.6.0_37-20120927-1915-linux-x86_64

CPU          : Intel Core i7 (HT) SSE SSE2 SSE3 SSSE3 SSE4.1 SSE4.2 Core Intel64

Number CPUs  : 16

Tot Phys Mem : 76155084800 (72627 MB)

OS version   : Red Hat Enterprise Linux Server release 5.7 (Tikanga)

Linux version 2.6.32-300.41.2.el5uek (mockbuild@ca-build56.us.oracle.com) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-50)) #1 SMP Tue May 7 21:19:44 PDT 2013 (x86_64)

Thread System: Linux NPTL

LibC release : 2.5-stable

Java locking : Lazy unlocking enabled (class banning) (transfer banning)

State        : JVM is running

LD_ASSUME_KERNEL:

LD_PRELOAD   :

StackOverFlow: 0 StackOverFlowErrors have occured

OutOfMemory  : 0 OutOfMemoryErrors have occured

C Heap       : Good; no memory allocations have failed

GC Strategy  : Mode: throughput, with strategy: genparpar (basic strategy: genparpar)

GC Status    : OC currently running, in phase: cleanup. This is OC#63.

             : YC is not running. Last finished YC was YC#729.

YC Promotion : Last YC successfully promoted all objects

YC History   : Ran 12 YCs before OC#59.

             : Ran 14 YCs before OC#60.

             : Ran 12 YCs before OC#61.

             : Ran 14 YCs before OC#62.

             : Ran 13 YCs before OC#63.

Heap         : 0x100000000 - 0x200000000  (Size: 4096 MB)

Compaction   : 0x1c0000000 - 0x1e0000000  (Current compaction type: external)

Allocation   : TLA-min: 2048, TLA-preferred: 65536 TLA-waste limit: 2048

NurseryList  : 0x118278e50 - 0x192d34590

KeepArea     : 0x178bed9a0 - 0x192d34590

KA Markers   : [ 0x1606298a0,  0x178bed9a0 , 0x192d34590 ]

Forbidden A  : (none)

Previous KA  : (none)

Previous FA  : (none)

CompRefs     : References are compressed, with heap base 0x0 and shift 3.

You can also use weblogic console to view the no. of threads which are in STUCK, HOGGING, STANDBY,ACTIVE state.

Known Limitations of jrcmd:

In order to issue diagnostic commands to a process, you must run jrcmd with the same user as the one running the Java process.

 How to Read Thread Dumps

29156:

// The thread dump starts with the date and time of the dump, and the version number of the JRockit JVM used

===== FULL THREAD DUMP ===============

Thu Sep  4 16:10:17 2014

Oracle JRockit(R) R28.2.5-20-152429-1.6.0_37-20120927-1915-linux-x86_64

//There is a thread information line, followed by information about locks and a trace of the thread’s stack at the moment of the thread dump.

// The main thread is running thread (alive), its either in executing JVM internal code and is currently waiting for an object to be released (waiting). Virtually, all the threads in thread dump will be alive.

"Main Thread" id=1 idx=0x4 tid=29157 prio=5 alive, waiting, native_blocked

    -- Waiting for notification on: weblogic/t3/srvr/T3Srvr@0x127aeec50[fat lock]

    at jrockit/vm/Threads.waitForNotifySignal(JLjava/lang/Object;)Z(Native Method)

    at java/lang/Object.wait(J)V(Native Method)

    at java/lang/Object.wait(Object.java:485)

    at weblogic/t3/srvr/T3Srvr.waitForDeath(T3Srvr.java:981)

    ^-- Lock released while waiting: weblogic/t3/srvr/T3Srvr@0x127aeec50[fat lock]

    at weblogic/t3/srvr/T3Srvr.run(T3Srvr.java:490)

    at weblogic/Server.main(Server.java:71)

    at jrockit/vm/RNI.c2java(JJJJJ)V(Native Method)

    -- end of trace

// JVM Internal threads. All these threads are daemon.          

           

"(Signal Handler)" id=2 idx=0x8 tid=29158 prio=5 alive, native_blocked, daemon

"(OC Main Thread)" id=3 idx=0xc tid=29159 prio=5 alive, native_waiting, daemon

"(GC Worker Thread 1)" id=? idx=0x10 tid=29160 prio=5 alive, daemon

"(GC Worker Thread 2)" id=? idx=0x14 tid=29161 prio=5 alive, daemon

"(GC Worker Thread 3)" id=? idx=0x18 tid=29162 prio=5 alive, daemon

Note: By default, the stack trace is not printed for JVM Internal threads.

Types of Lock

There are four types of Locks;

Fat Lock: A fat lock is a lock with history of contention (several threads try to take the lock simulatenously)

Thin Lock: A thin lock is a lock that doesn’t have any contention.

Recursive Lock: A recursive lock is when a thread takes several locks on an object without releasing it.

Lazy Lock: A Lazy Lock is a lock that’s not released when a critical section is exited.

Lock Chains:

Thread A and B form a chain when thread A holds lock on an object on which thread B is trying to take the lock.

OIM –OIA Integration Loggers

Please set the below loggers in OIM & OIA to troubleshoot any integration issue:

OIM

Logger Name	Logger Level
XELLERATE.SERVER	TRACE:32
XELLERATE.PREPAREDSTATEMENT	TRACE:32
XELLERATE.DATABASE'	TRACE:32
XELLERATE.SCHEDULER.TASK	TRACE:32

Note: Please use the /em console to enable the logging. No need to restart OIM after enabling the logging.

OIA

Logger Name	Logger Level
com.vaau.rbacx.iam	DEBUG
com.vaau.rbacx.iam.db.DBIAMSolution	DEBUG
com.vaau.rbacx.iam.db.dao.ibatis	DEBUG
com.vaau.rbacx.iam.util.oracle.oimapi	DEBUG
com.vaau.rbacx.scheduling.executor.iam.IAMJobExecutor	DEBUG

Note:  Make this change on each server and restart OIA.

Enterprise Manager (EM) throws with java.lang.NullPointerException after clicking oim(11.1.2.0.0)

if you launch Enterprise Manager (EM) & click on "Identity and Access" -> OIM -> oim(11.1.2.0.0) and see the following error occur:

ERROR

-----------------------

java.lang.NullPointerException at  oracle.sysman.emas.model.iam.oim.OIMHomeModel.fetchEventsHandlerData(OIMHomeModel.java:166) at oracle.sysman.emas.model.iam.oim.OIMHomeModel.initializeData(OIMHomeModel.java:86) at oracle.sysman.core.model.util.ModelUtil$EMObjectResetter.initOrResetEMObject(ModelUtil.java:319)

then, download and apply  patch 17375780 for Enterprise Manager (EM) 11.1.1.6.0

OIM11gR2 : Common Bulk Load Issues

Based on my experience with OIM Bulk Load Utility, below are the common issues/error one might encounter and how to solve/fix them:

 

Bulk Load Utility Does Not Handle Account Load With Employee Number In Recon Rule

 

When running the account data bulk load for one of the resource which has reconciliation rule based on Employee Number, the load failed with the following error
 Exception in thread "main" java.sql.SQLException: ORA-00904: "null": invalid identifier
ORA-06512: at "DEV_OIM.OIM_BLKLD_PKG_ACCOUNT_LOAD", line 1562
ORA-06512: at line 1
  at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:74)
  at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:131)
  at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:204)
  at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:455)
  ......

 

Solution:

 

This is a known  Bug# 17357095 and is fixed in OIM 11g R2 PS1 BP07 as per oracle. However, what i noticed that in some of the environment, the issue got resolved after applying patch and in some environment, the issue persists even after applying patch. So, as a workaround, I added the UserID/Login field was added in the Process Form, Resource Object and reconciliation rule was build using the UserID/Login. The field User ID was set with property Visible as false. Also, while generating the input account data file, I make sure that it contains use the UserID/Login field.

 

Bulk Load Utility throwing Null Pointer Exception while Trying To Load Account Data

 

When trying to bulk load account data with privileges and roles, having the following error after inputting the table space name to be used for creating temp tables :

 

Exception in thread "main" java.lang.NullPointerException
at bulkload.AccountLoad.createTmpTableNames(AccountLoad.java:857)
at bulkload.AccountLoad.inputCSV(AccountLoad.java:502)
at bulkload.AccountLoad.showSubMenu(AccountLoad.java:138)
at bulkload.AccountLoad.main(AccountLoad.java:1160)

Don't see any other error in the log file, and the utility just stops.

 

Solution:

 

The issue is encountered when the column in the input file doesn’t start with UD_ prefix.  For example, the file with below header will see this issue. So, review your file header and fix the column name and retry the bulk load.

 

Bulk Load Of Account Data When Child Tables Need Not Be Populated

 

While using OIM Bulk Load utility for Loading Account Data( For examplefor OID User (UD_OID_USR) resource which doesn’t have any data in the child table UD_OID_GRP), specifying an input file for just the parent table does not work. The oim bulk loader forces the user to pass file names for the child tables as well. Output from the bulk loader is as below:

 

**********************************
Select the input for account load:
**********************************
1) DB Table
2) CSV File
3) Exit

Enter your option (1, 2 or 3):
2

 

Enter the resource object name:
OID User

 

Enter the comma separated CSV file names (parent CSV followed by child CSVs):
UD_OID_USR.csv

 

ERROR ==> The number of CSV files provided as input does not match with the number of account tables.

Exiting Utility ....

 

Solution:

 

Even if there is no data in the child table, you have to create files for both the parent & child tables and specify them during the bulk load utility.

 

Bulk Load Utility throwing ORA-01502 index or partition of such index is in unusable state

 

While loading the user/account data in OIM using bulk load utility, below error is encountered:

 

Exception in thread "main" java.sql.SQLException: ORA-01502: index 'HA_OIM.IDX_OIU_ORC_KEY' or partition of such index is in unusable state
ORA-06512: at "HA_OIM.OIM_SP_MANAGEENTITLEMENT", line 81
ORA-06512: at "HA_OIM.UD_PSHCM_R_ENT_TRG", line 4
ORA-04088: error during execution of trigger 'HA_OIM.UD_PSHCM_R_ENT_TRG'
ORA-06512: at "HA_OIM.OIM_BLKLD_PKG_ACCOUNT_LOAD", line 1847
ORA-06512: at line 1

 

Solution: 

 

Bulk Load Utility tries to access an index or index partition i.e., 'HA_OIM.IDX_OIU_ORC_KEY' that has been marked unusable.

 

DROP the specified index, or REBUILD the specified index, or REBUILD the unusable index partition. Here are the queries DBA have been you using to do this:

Procedure to verify and Rebuild indexes:

 

1. Verify Indexes :
select * from dba_indexes  WHERE   status <> 'VALID' and owner in (‘HA_OIM’);

 

2. Create script to rebuild indexes online:
Spool rebuild_index.sql
SELECT 'alter index '||owner||'.'||index_name||'  rebuild online ;'  FROM DBA_INDEXES WHERE  owner='HA_OIM' and status <> 'VALID' ;
Spool off;

 

3. Rebuild indexes:
Start  rebuild_index.sql

Index rebuild for OIU Table:

 

• alter index HA_OIM.IDX_OIU_ORC_KEY REBUILD ONLINE ;
• alter index HA_OIM.IDX_OIU_USR_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_OBI_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_OST_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_APP_INSTANCE_KEY REBUILD ONLINE ;
• alter index  HA_OIM.FDX_OIU_ACCOUNT_TYPE REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_REQ_KEY REBUILD ONLINE ;
• alter index HA_OIM.IDX_USG_USR_KEY rebuild online ;
• alter index HA_OIM.IDX_USG_UGP_KEY_USG_PRIORITY rebuild online ;

 

Creating Indexes Online:

 

CREATE INDEX HA_OIM.IDX_OIU_ORC_KEY ON HA_OIM.OIU
(ORC_KEY)
LOGGING
TABLESPACE HA_OIM
PCTFREE    10
INITRANS   2
MAXTRANS   255
STORAGE    (
            INITIAL          64K
            NEXT             1M
            MINEXTENTS       1
            MAXEXTENTS       UNLIMITED
            PCTINCREASE      0
            BUFFER_POOL      DEFAULT
            FLASH_CACHE      DEFAULT
            CELL_FLASH_CACHE DEFAULT
           )
NOPARALLEL online;

Note: I faced this issue only in production environment and it seems to be coming for every bulk load operation I did. I also noticed this issue I try to rename the logs folder before the bulk load utility complete all its operation, I mean enabling and re-building indexes.

 

Addendum on this issue:

 

ORA-08104: this index object HA_OIM.IDX_OIU_ORC_KEY is being online built or rebuilt

 

Due to missing index on ORC_KEY, the below sql statement was causing performance issue on the data load operation:

 

SELECT OST.OST_KEY, OIU.OIU_KEY, OIU.USR_KEY
  FROM OST OST, OIU OIU
WHERE OIU.OST_KEY = OST.OST_KEY AND OIU.ORC_KEY = :B1

 

After the data load got complete for one of the resource, DBA ran the dbms_repair.online_index_clean function.

 

 

 

 

 

 

 

 

OIM11gR1: Query to find who has assigned what role to which user

You can use below query to find who has assigned what role to which user on what date:

select
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups.Group Name'']/NewValue') AS "Role Assigned",
usr.usr_login "Assigned To",
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups-Users.Created By Login'']/NewValue') AS "Assigned By",
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups-Users.Membership Type'']/NewValue') AS "Membership Type",
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups-Users.Creation Date'']/NewValue') AS "Assigned On"
from upa,(SELECT upa_key, xmltype(deltas) deltas FROM upa) upa_xml,usr where upa.upa_key = upa_xml.upa_key and usr.usr_key=upa.usr_key and
SRC LIKE '%CREATE.RoleUser%';

In 11gR2, the usg table contains the field usg_prov_by which contains the usr_key of the user who has assigned the role. You can use the below query:

select ugp_name as "Assigned Role", usr_login as "Assigned To", usg.usg_prov_by as "Assigned By" from usr,ugp,usg
where usr.usr_key=usg.usr_key and ugp.ugp_key=usg.ugp_key and ugp.ugp_name NOT IN ('ALL USERS','SYSTEM ADMINISTRATORS');

OIM11gR2: Bulk Load Bugs

If you have been using OIM Bulk Load Utility to load the accounts,users,roles and et al, a piece of advice, please make sure that you keep the input file name to less than 25 characters else you will see below error in the logs:

***************************************************************************************************
Processing File: Users_DisabledUntilStartDate.csv
---------------------------------------------------------
java.sql.SQLException: ORA-01400: cannot insert NULL into ("HA_OIM"."OIM_BLKLD_LOG"."LOAD_SOURCE")
ORA-06512: at "DEV_OIM.OIM_BLKLD_SP_LOG_MSG", line 21
ORA-06512: at "DEV_OIM.OIM_BLKLD_PKG_USR", line 1505
ORA-06502: PL/SQL: numeric or value error: character string buffer too small
ORA-06512: at line 1
        at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:445)
        at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:396)
        at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:879)
        at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:450)
        at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:192)
        at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:531)
        at oracle.jdbc.driver.T4CCallableStatement.doOall8(T4CCallableStatement.java:204)
        at oracle.jdbc.driver.T4CCallableStatement.executeForRows(T4CCallableStatement.java:1034)
        at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1329)
        at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3584)
        at oracle.jdbc.driver.OraclePreparedStatement.execute(OraclePreparedStatement.java:3685)
        at oracle.jdbc.driver.OracleCallableStatement.execute(OracleCallableStatement.java:4694)
        at oracle.jdbc.driver.OraclePreparedStatementWrapper.execute(OraclePreparedStatementWrapper.java:1088)
        at bulkload.UserLoad.processData(UserLoad.java:373)
        at bulkload.UserLoad.loopAllCSVs(UserLoad.java:264)
        at bulkload.UserLoad.inputCSV(UserLoad.java:172)
        at bulkload.UserLoad.showSubMenu(UserLoad.java:95)
        at bulkload.UserLoad.main(UserLoad.java:988)
---------------------------------------------------------

===============================================================================
Time taken in re-building indexes and enabling FK constraints
===============================================================================
Start time:      24-JUL-14 05.57.11.971759 PM
End Time:        24-JUL-14 05.57.35.589116 PM
Seeing this error in the logs, my first thought that something might be wrong with my input file but after rounds of verifying the column name and data, I decided to ask google about this error. I was lucky enough to find time some pointers quickly and finally figured it out that problem was with length of input file. After changing the file name to lo have less than 25 characters, the load went fine.

Below is the forum post that provided me pointers on this issue:

https://community.oracle.com/thread/1062129


 

How to Enable The Submit Button For Custom UDFs in OIM11gR2

Follow the below steps to enable the submit button:

• Export your sandbox that you have used to add the UDFs on Modify User Form.
• Extract the Sandbox zip file.
• Search for userModifyForm.jsff.xml and open it in edit mode. 
• For each UDF for which you want submit button to be enabled, add below properties in the ADF tag, :

valueChangeListener="#{pageFlowScope.cartDetailStateBean.attributeValueChangedListener}" autoSubmit="true"

For example:

AS-IS
  
      http://xmlns.oracle.com/adf/faces/rich

" value="#{bindings.JobTitle__c.inputValue}" label="#{bindings.JobTitle__c.hints.label}" required="#{bindings.JobTitle__c.hints.mandatory}" columns="#{bindings.JobTitle__c.hints.displayWidth}" maximumLength="#{bindings.JobTitle__c.hints.precision}" shortDesc="#{bindings.JobTitle__c.hints.tooltip}" id="dtrt_dc_2235532621">
         http://java.sun.com/jsf/core" binding="#{bindings.JobTitle__c.validator}"/>
     
    
TO-BE
  
      http://xmlns.oracle.com/adf/faces/rich
" value="#{bindings.JobTitle__c.inputValue}" label="#{bindings.JobTitle__c.hints.label}" required="#{bindings.JobTitle__c.hints.mandatory}" columns="#{bindings.JobTitle__c.hints.displayWidth}" maximumLength="#{bindings.JobTitle__c.hints.precision}" shortDesc="#{bindings.JobTitle__c.hints.tooltip}" valueChangeListener="#{pageFlowScope.cartDetailStateBean.attributeValueChangedListener}" autoSubmit="true" id="dtrt_dc_2235532621">
         http://java.sun.com/jsf/core" binding="#{bindings.JobTitle__c.validator}"/>
     
  

• Create the zip again. 
• Import the sandbox and activate the sandbox to verify the change.
• Once the change is verified, publish the sandbox.

MDS-00010 DuplicateRefException Issue

When one of my team mate reported me an issue saying that they not able to modify and create user in OIM and are seeing the below exception every time they click on Create User/ Modify User link in OIM:

oracle.mds.exception.MDSRuntimeException: MDS-00010: DuplicateRefException. In document /oracle/iam/ui/runtime/form/view/pages/userCreateForm.jsff there are multiple elements with the same ID _xg_pfl0

My first impression was that I am the culprit and it’s due to some of the UDF changes I did few days back and made me curse the sandbox. I hate Sandbox. However, after ransacking all the sandboxes that I have imported in OIM and not able to find the ID _xg_pf in them. I didn't even saw the /oracle/iam/ui/runtime/form/view/pages folder. I started looking at the list of configuration changes made in the environment and found out that one of my team mate has accidentally installed Web Tier in the IAM middleware instead of IDM Middleware. Due to installation of web tier installation in IAM 11g R2 Middleware, some of the library files inside $MW_HOME/oracle_common got modified which caused this issue. I tried copying all the modified folders inside $MW_HOME/oracle_commons from another environment but that didn’t worked; the OIM Admin server didn’t get started.

Here are the list of sub-directories that got modified inside the $MW_HOME/oracle_common directory:

• bin
• modules
• common
• lib
• jlib

There were few files (I think 2) that were also modified but they were not environment specific.

I also found a note# 1615855.1 on MOS which confirms the same. However the notes tells you to run the opatch lsinventory command on $MW_HOME/oracle_common to find if any IDM component is installed in IAM but I didn’t see OUI inventory being modified. The note says the solution is to install the IDM and IAM components again but you know that’s stupid and not doable.  A file system restore has worked for us. You might need to do db restore also if you have made significant changes in database or MDS recently.

Here is the error snippet:

2013-12-04T15:41:29.938-04:00] [WLS_OIM1] [NOTIFICATION] [J2EE JSP-00008] [oracle.j2ee.jsp] [tid: [ACTIVE].ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'] [userId: xelsysadm] [ecid: 11d1def534ea1be0:67c0781c:142bf1864c8:-8000-0000000000000050,0] [APP: oracle.iam.console.identity.self-service.ear#V2.0] unable to dispatch JSP page: The following exception occurred:.[[

oracle.mds.exception.MDSRuntimeException: MDS-00010: DuplicateRefException. In document /oracle/iam/ui/runtime/form/view/pages/userCreateForm.jsff there are multiple elements with the same ID _xg_pfl0.

at oracle.mds.internal.melement.MDocument.insertMapNode(MDocument.java:2502)

at oracle.mds.internal.melement.MDocument.insertMapNode(MDocument.java:1194)

 

....

 

Cheers!

 

Various JMS Queues Used By OIM

OIM versions prior to 9.1 were using a single JMS queue named xlQueue for all the asynchronous operation like user requests (self registration and approval), reconciliation, attestation and auditing. Because all the process were using a single JMS queue, every aforementioned operations used to depend on each other. For example when reconciliation was running the queue xlQueue is filled with messages for reconciliation and request processing needs to wait till all the reconciliation was done. This was creating inter dependency between the modules of the application.

 

From OIM version 9.1 onwards, separate JMS queues for each asynchronous functionality were introduced.

 

Below are the details of the JMS queues used by OIM:

 

xlQueue

This queue is used to handle request (self registration and approval) related operations.

 

xlReconQueue

This queue is used to handle Reconciliation.

 

xlAuditQueue

This queue is used to handle Auditing.

 

xlAttestationQueue

This queue is used to handle Attestation.

 

xlProcessQueue

This queue is for future usage.

 

xlErrorQueue

This is the queue where the messages will end up after being tried 5 times.
For example, if the recon messages picked up by ReconMDBs fail during processing, they are tried for 5 times to process. If they still fail then the messages will be sent to this error queue.

Encryption Standard for OIM Database Key

OIM uses the AES -128 encryption standard in its Database key and to encrypt Answers for Challenge Response Security Questions for user account.

Note: It not possible to change Encryption method.

Exporting all of the MDS data for OIM 11g

If you want to export/backup all the MDS configuration files for OIM, then use the below WLST command:

 

Step1: Create a directory where you want all the configuration to be exported, for example MDSExport.

 

Step2: From the shell/command prompt, navigate to $MW_HOME/oracle_common/common/bin

 

Step3: Execute the wlst.sh/wlst.cmd and issue the connect() command.

 

Step4: Provide the weblogic username, password and URL to Admin Server.

 

Step5: Execute the exportMetadata command providing at least the following arguments: application, server and toLocation.

 

For example, exportMetadata(‘OIMMedata’,’oim_server1’,’<<Full Path to MDSExport’)

 

Step6: You should see a list of the files exported, at that point you can issue the disconnect() command followed by the exit() command.

 

you can also save the above commands in a .py file, let’s say MDSExport.py and it can be executed directly without entering the credentails and URL everytime.

 

MDSExport.py

 

connect('weblogic',<<PASSWORD>>,'t3://<<server:7001>>)
exportMetadata(application='OIMMetadata', server='oim_server1', toLocation=<<Full Path to MDSExport’)
disconnect()
exit()

 

Now, you can simply run the below command:

./wlst.sh MDSExport.py

 

Note: You cannot export all the configuration files using Deployment Manager (DM) and also, DM doesn’t have version control.

OIM 11gR2: How to Roll back A Published Sandbox

 
If your OIM is messed after publishing your sandbox, then here is what you can try to fix the issue.
 
1. Login to Enterprise Manager

2. In Application Deployments select oracle.iam.console.identity.self-service.ear or oracle.iam.console.identity.sysadmin.ear link.

3. Right Click and select MDS Configuration (from the drop-down)

4. At the bottom of the screen choose "Runtime MBean Browser" (under the Advanced Configuration section)

5. The right side of the screen should refresh and then click on the "Operations" tab.

6. Scroll down and identify the MBean operation "listMetadataLabels" and invoke it (choose the one that takes no parameters).
Select the sandbox pre-create to which you want to restore and copy it to the clipboard.

For example the value you might copy might look something like - Creation_IdM_test_09:25:00

7. Now go back to Operations by clicking Return.

8. Find the MBean operation "promoteMetadataLabel" (the first one in the list)

9. Invoke the "promoteMetadataLabel" MBean operation and enter the value saved to the clipboard in step 6.

10. Restart OIM.
 
Now, if your issue is still not fixed, then I will recommend looking at /file/User.xml file to see if all UDFs are properly defined or not.
 
References:
 

OIM 11gR2: How to Roll back A Published Sandbox (Doc ID 1496179.1)

 

OIM Database Schema Documentation

If you are looking for OIM Database schema documenation, here is the DocID you should refer:
 
Master Note for Oracle Identity Manager 11g (11.1.X) Database Schema Documentation (Doc ID 1541870.1)

• OIM 11.1.1.3.0 version: Document 1164914.1 - OIM 11.1.1.3.0 Data Dictionary
• OIM 11.1.2.0 version: Document 1476552.1 - Oracle Identity Manager 11gR2 (11.1.2.0) Database Schema Documentation
• OIM 11.1.2.1 version: Document 1541858.1 - Oracle Identity Manager 11gR2PS1 (11.1.2.1) Database Schema Documentation
• OIM 11.1.2.2 version: Document 1612983.1 - Oracle Identity Manager 11gR2PS2 (11.1.2.2) Database Schema Documentation

 

Customizing the OIM 11g R2 UI

This is the first part of series of blogs on UI Customization where I will be updating the tricks I used to customize the OIM UI:

If you want to display the fullname or any other attribute instead of default User Login, follow below steps:

1. Create and activate a sandbox.

2. Click on the Customize link at the top of the screen. On the top left corner, click on  View Source in the newly appeared menu bar.

3. Click on the "xelsysadm" and click Edit.

4. Scroll down on the Component Properties window to get to "Text" property. Click on drop down arrow and choose "Expression Builder" as the option. Enter below:

#{oimcontext.currentUser['Display Name']}

Note: You can use any variable here like Employee Number, SSN, Common Name etc.

5. Click Test and then Apply to see the changes.

You can also keyword like "Welcome" or "Hello" like

Welcome #{oimcontext.currentUser['Display Name']}

in the expression builder.