How to Change Session Timeout for OIM11g

You can change the session timeout by directly editing the web.xml

file in both the self-service application archive (oracle.iam.console.identity.self-service.ear) and the sysadmin application archive (oracle.iam.console.identity.sysadmin.ear) and then redeploying the applications . The change will require restart of OIM Manage Servers. 

 

Here are the location of files:

       /opt/idm/product/IAM11GR2/Oracle_IAM1/server/apps/oracle.iam.console.identity.sysadmin.ear

 

·     /opt/idm/product/IAM11GR2/Oracle_IAM1/server/apps/oracle.iam.console.identity.self-service.ear

The session timeout configuration is as below in web.xml

/identity console

15

/syadmin console

35

Change the value in the web.xml, recreate and redeploy the ear file.

Reference:

http://www.oracle.com/technetwork/articles/idm/fraz-oim-session-timeout-2120987.html

OIM11gR2 : Common Bulk Load Issues

Based on my experience with OIM Bulk Load Utility, below are the common issues/error one might encounter and how to solve/fix them:

 

Bulk Load Utility Does Not Handle Account Load With Employee Number In Recon Rule

 

When running the account data bulk load for one of the resource which has reconciliation rule based on Employee Number, the load failed with the following error
 Exception in thread "main" java.sql.SQLException: ORA-00904: "null": invalid identifier
ORA-06512: at "DEV_OIM.OIM_BLKLD_PKG_ACCOUNT_LOAD", line 1562
ORA-06512: at line 1
  at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:74)
  at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:131)
  at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:204)
  at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:455)
  ......

 

Solution:

 

This is a known  Bug# 17357095 and is fixed in OIM 11g R2 PS1 BP07 as per oracle. However, what i noticed that in some of the environment, the issue got resolved after applying patch and in some environment, the issue persists even after applying patch. So, as a workaround, I added the UserID/Login field was added in the Process Form, Resource Object and reconciliation rule was build using the UserID/Login. The field User ID was set with property Visible as false. Also, while generating the input account data file, I make sure that it contains use the UserID/Login field.

 

Bulk Load Utility throwing Null Pointer Exception while Trying To Load Account Data

 

When trying to bulk load account data with privileges and roles, having the following error after inputting the table space name to be used for creating temp tables :

 

Exception in thread "main" java.lang.NullPointerException
at bulkload.AccountLoad.createTmpTableNames(AccountLoad.java:857)
at bulkload.AccountLoad.inputCSV(AccountLoad.java:502)
at bulkload.AccountLoad.showSubMenu(AccountLoad.java:138)
at bulkload.AccountLoad.main(AccountLoad.java:1160)

Don't see any other error in the log file, and the utility just stops.

 

Solution:

 

The issue is encountered when the column in the input file doesn’t start with UD_ prefix.  For example, the file with below header will see this issue. So, review your file header and fix the column name and retry the bulk load.

 

Bulk Load Of Account Data When Child Tables Need Not Be Populated

 

While using OIM Bulk Load utility for Loading Account Data( For examplefor OID User (UD_OID_USR) resource which doesn’t have any data in the child table UD_OID_GRP), specifying an input file for just the parent table does not work. The oim bulk loader forces the user to pass file names for the child tables as well. Output from the bulk loader is as below:

 

**********************************
Select the input for account load:
**********************************
1) DB Table
2) CSV File
3) Exit

Enter your option (1, 2 or 3):
2

 

Enter the resource object name:
OID User

 

Enter the comma separated CSV file names (parent CSV followed by child CSVs):
UD_OID_USR.csv

 

ERROR ==> The number of CSV files provided as input does not match with the number of account tables.

Exiting Utility ....

 

Solution:

 

Even if there is no data in the child table, you have to create files for both the parent & child tables and specify them during the bulk load utility.

 

Bulk Load Utility throwing ORA-01502 index or partition of such index is in unusable state

 

While loading the user/account data in OIM using bulk load utility, below error is encountered:

 

Exception in thread "main" java.sql.SQLException: ORA-01502: index 'HA_OIM.IDX_OIU_ORC_KEY' or partition of such index is in unusable state
ORA-06512: at "HA_OIM.OIM_SP_MANAGEENTITLEMENT", line 81
ORA-06512: at "HA_OIM.UD_PSHCM_R_ENT_TRG", line 4
ORA-04088: error during execution of trigger 'HA_OIM.UD_PSHCM_R_ENT_TRG'
ORA-06512: at "HA_OIM.OIM_BLKLD_PKG_ACCOUNT_LOAD", line 1847
ORA-06512: at line 1

 

Solution: 

 

Bulk Load Utility tries to access an index or index partition i.e., 'HA_OIM.IDX_OIU_ORC_KEY' that has been marked unusable.

 

DROP the specified index, or REBUILD the specified index, or REBUILD the unusable index partition. Here are the queries DBA have been you using to do this:

Procedure to verify and Rebuild indexes:

 

1. Verify Indexes :
select * from dba_indexes  WHERE   status <> 'VALID' and owner in (‘HA_OIM’);

 

2. Create script to rebuild indexes online:
Spool rebuild_index.sql
SELECT 'alter index '||owner||'.'||index_name||'  rebuild online ;'  FROM DBA_INDEXES WHERE  owner='HA_OIM' and status <> 'VALID' ;
Spool off;

 

3. Rebuild indexes:
Start  rebuild_index.sql

Index rebuild for OIU Table:

 

• alter index HA_OIM.IDX_OIU_ORC_KEY REBUILD ONLINE ;
• alter index HA_OIM.IDX_OIU_USR_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_OBI_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_OST_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_APP_INSTANCE_KEY REBUILD ONLINE ;
• alter index  HA_OIM.FDX_OIU_ACCOUNT_TYPE REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_REQ_KEY REBUILD ONLINE ;
• alter index HA_OIM.IDX_USG_USR_KEY rebuild online ;
• alter index HA_OIM.IDX_USG_UGP_KEY_USG_PRIORITY rebuild online ;

 

Creating Indexes Online:

 

CREATE INDEX HA_OIM.IDX_OIU_ORC_KEY ON HA_OIM.OIU
(ORC_KEY)
LOGGING
TABLESPACE HA_OIM
PCTFREE    10
INITRANS   2
MAXTRANS   255
STORAGE    (
            INITIAL          64K
            NEXT             1M
            MINEXTENTS       1
            MAXEXTENTS       UNLIMITED
            PCTINCREASE      0
            BUFFER_POOL      DEFAULT
            FLASH_CACHE      DEFAULT
            CELL_FLASH_CACHE DEFAULT
           )
NOPARALLEL online;

Note: I faced this issue only in production environment and it seems to be coming for every bulk load operation I did. I also noticed this issue I try to rename the logs folder before the bulk load utility complete all its operation, I mean enabling and re-building indexes.

 

Addendum on this issue:

 

ORA-08104: this index object HA_OIM.IDX_OIU_ORC_KEY is being online built or rebuilt

 

Due to missing index on ORC_KEY, the below sql statement was causing performance issue on the data load operation:

 

SELECT OST.OST_KEY, OIU.OIU_KEY, OIU.USR_KEY
  FROM OST OST, OIU OIU
WHERE OIU.OST_KEY = OST.OST_KEY AND OIU.ORC_KEY = :B1

 

After the data load got complete for one of the resource, DBA ran the dbms_repair.online_index_clean function.

 

 

 

 

 

 

 

 

OIM 11gR2: How to Roll back A Published Sandbox

 
If your OIM is messed after publishing your sandbox, then here is what you can try to fix the issue.
 
1. Login to Enterprise Manager

2. In Application Deployments select oracle.iam.console.identity.self-service.ear or oracle.iam.console.identity.sysadmin.ear link.

3. Right Click and select MDS Configuration (from the drop-down)

4. At the bottom of the screen choose "Runtime MBean Browser" (under the Advanced Configuration section)

5. The right side of the screen should refresh and then click on the "Operations" tab.

6. Scroll down and identify the MBean operation "listMetadataLabels" and invoke it (choose the one that takes no parameters).
Select the sandbox pre-create to which you want to restore and copy it to the clipboard.

For example the value you might copy might look something like - Creation_IdM_test_09:25:00

7. Now go back to Operations by clicking Return.

8. Find the MBean operation "promoteMetadataLabel" (the first one in the list)

9. Invoke the "promoteMetadataLabel" MBean operation and enter the value saved to the clipboard in step 6.

10. Restart OIM.
 
Now, if your issue is still not fixed, then I will recommend looking at /file/User.xml file to see if all UDFs are properly defined or not.
 
References:
 

OIM 11gR2: How to Roll back A Published Sandbox (Doc ID 1496179.1)

 

How To Solve "Error On Publishing A Sandbox" with the message "There Is A Concurrent "UPDATE" Operation On The Document ?

If you are seeing the below error while publishing your OIM sandbox, then you can try the workaround I am able to use successfully everytime:

Publish Sandbox Failed

Basically, here is 3 step I follow:

1. Export the sandbox to your local directory.
2. Delete the sandbox from OIM.
3. Import the Sandbox in OIM, activate it and hit the publish button.

While doing the impor, make sure that zip contains all the sandbox files. It shouldn't contain any top-level directory.

Obviously, this issue is legit if multiple users are working in OIM on the sandbox. However, I have also seen this issue when you make changes on /identity and /sysadmin console using the same sandbox and same user.

Customizing the OIM 11g R2 UI

This is the first part of series of blogs on UI Customization where I will be updating the tricks I used to customize the OIM UI:

If you want to display the fullname or any other attribute instead of default User Login, follow below steps:

1. Create and activate a sandbox.

2. Click on the Customize link at the top of the screen. On the top left corner, click on  View Source in the newly appeared menu bar.

3. Click on the "xelsysadm" and click Edit.

4. Scroll down on the Component Properties window to get to "Text" property. Click on drop down arrow and choose "Expression Builder" as the option. Enter below:

#{oimcontext.currentUser['Display Name']}

Note: You can use any variable here like Employee Number, SSN, Common Name etc.

5. Click Test and then Apply to see the changes.

You can also keyword like "Welcome" or "Hello" like

Welcome #{oimcontext.currentUser['Display Name']}

in the expression builder.

  

 

 

 

 

 

 

 

Oracle Identity Manager 11g R2 Basic Performance Tuning

Please refer the below blog for basic UI/Server performance tuning for OIM 11g R2:

https://blogs.oracle.com/fusionmiddleware/entry/oracle_identity_manager_11g_r2