OIM11g: Searching & retrieve Authorization Policy Data using APIs

Here is the sample code to search and retrieve "Role Management" type Authorization Policy Data:

import java.util.ArrayList;
import java.util.Hashtable;
import java.util.List;
import oracle.iam.authzpolicydefn.api.Action;
import oracle.iam.authzpolicydefn.api.AuthzPolicyConstants.AuthzPolicyAttributes;
import oracle.iam.authzpolicydefn.api.Feature;
import oracle.iam.authzpolicydefn.api.PolicyDefinitionService;
import oracle.iam.authzpolicydefn.vo.AuthzPolicy;
import oracle.iam.authzpolicydefn.vo.RoleDataConstraint;
import oracle.iam.identity.vo.Identity;
import oracle.iam.platform.OIMClient;
import oracle.iam.platform.entitymgr.vo.SearchCriteria;

 public void getPolicyDetails(String policyName) {
  try {
   PolicyDefinitionService policyService = oimClient.getService(PolicyDefinitionService.class);
   SearchCriteria criteria = new SearchCriteria(AuthzPolicyAttributes.NAME.getId(),policyName,SearchCriteria.Operator.EQUAL);
   List policies = policyService.search(criteria);
   for (AuthzPolicy policy : policies) {

// Returns Display Name of Policy
    System.out.println(" Policy Name : " + policy.getDisplayName()); 

//Returns Description of the Policy
    System.out.println(" Description : " + policy.getDescription());   

//Returns the Enabled Permissions
    List actions = policy.getActions();
    for(Action action: actions) {
     System.out.println(action.getDisplayName());
    }
  
    //Returns Type of Policy i.e., Role Management
    Feature features = policy.getFeature();
    System.out.println(" Entity Name : " + features.getDisplayName());
  
    //Returns the Assignment i.e., roles that are added to the Policy
    ArrayList userList = policy.getRoleAssignees();
  for(Identity id: userList) {
   System.out.println(" Assign by Role : " + id.getAttribute("Role Name"));
  }

// Data Constraints i.e., Returns the Role Name attached with Policy
 RoleDataConstraint rDataConstraint = (RoleDataConstraint) policy.getDataSecurity();
 ArrayList roles = rDataConstraint.getRoles();
 for(Identity role: roles) {
  System.out.println(role.getAttribute("Role Name"));
 }
}
}
  } catch (Exception e) {
   e.printStackTrace();
  }
 }
}

Note: The APIs used above are not documented by Oracle.

OIM: Code to get Recon Event Data given a Recon Event Key

Here is a sample code to get the Recon Event Information & Recon Target Attibute given a Recon Event Key

 public void getReconEventData() {
  try {
   ReconOperationsService reconOpService = oimClient.getService(ReconOperationsService.class);
   EventMgmtService eventService = oimClient.getService(EventMgmtService.class);
   ReconSearchCriteria criteria = new ReconSearchCriteria() ;
   Vector order = new Vector();
   order.add(EventConstants.RECON_EVENT_KEY);
   boolean ascOrderFlag = true;
   Object reKey = 2901; // Recon Event Key
   criteria.addExpression(EventConstants.RECON_EVENT_KEY, reKey, ReconSearchCriteria.Operator.EQUAL);
   List output = eventService.search(criteria,order, ascOrderFlag, 0, 100);
  
   for(ReconEvent event: output) {
    System.out.println(" Profile Name " + event.getProfileName());
    System.out.println(" Key Fields " + event.getReKeyField());
    System.out.println(" Resource Name " + event.getResourceName());
    System.out.println(" Current Status " + event.getReStatus());
    System.out.println(" Entity " + event.getReEntityType());
    System.out.println(" Date and Time " + event.getReModify());
    System.out.println(" Job ID " + event.getRjKey());
    System.out.println(" Linked By " + event.getLinkSource()); 
    ReconEventData eventData = eventService.getReconEventData(event);
    List reconAttributes = eventData.getSingleValuedAttrs();
    System.out.println(reconAttributes.size());
    for(ReconTargetAttribute reconAttribute: reconAttributes) {
     System.out.print(reconAttribute.getOimMappedFieldDescription()+" - ");
     System.out.println(reconAttribute.getStringVal());
    }
   }

References:

http://docs.oracle.com/cd/E14571_01/apirefs.1111/e17334/oracle/iam/reconciliation/api/ReconOperationsService.html
http://docs.oracle.com/cd/E17904_01/apirefs.1111/e17334/
http://docs.oracle.com/cd/E17904_01/apirefs.1111/e17334/oracle/iam/reconciliation/vo/ReconSearchCriteria.html#addExpression_java_lang_String__java_lang_Object__oracle_iam_reconciliation_vo_ReconSearchCriteria_Operator_http://docs.oracle.com/cd/E17904_01/apirefs.1111/e17334/oracle/iam/reconciliation/vo/ReconTargetAttribute.html

ESSO PROVISIONING GATEWAY OIM CONNECTOR

Here are the patch details:

Patch 7187784: ESSO PROVISIONING GATEWAY VERSION 10.1.4.0.3 OIM CONNECTOR

Patch 14006614: PLACEHOLDER FOR PG OIM CONNECTOR 11.1.1.5.0

References:

https://forums.oracle.com/thread/2593060

OAM Bundle Patch Release History

For quick reference, refer the below doc for OAM Bundle Patch History:

Doc ID 736372.1
 

Reading OIM System Property in Custom Code

Here are the APIs to read/create/update System Property in OIM:


// You can use this API to only read the system property
tcPropertyOperationsIntf property = Platform.getService(tcPropertyOperationsIntf.class);
String pvalue = property.getPropertyValue("Property Name");
 

// You can use this API to read/create/update/delete the system property
SystemConfigurationService sc = Platform.getService(SystemConfigurationService.class);
SystemProperty sr = sc.getSystemProperty("Property Name");
String pvalue = sr.getPtyValue();


API Reference:

http://docs.oracle.com/cd/E27559_01/apirefs.1112/e28159/oracle/iam/conf/api/SystemConfigurationService.html

http://docs.oracle.com/cd/E23943_01/apirefs.1111/e17334/Thor/API/Operations/tcPropertyOperationsIntf.html
 

OIM: Audit handler failed

Here is the Error of the day:

Just saw it after restarting OIM Server in one of the environment:

Issue: oracle.iam.platform.async.TaskExecutionException: java.lang.Exception: Audit handler failed
        at com.thortech.xl.audit.engine.jms.XLAuditMessage.execute(XLAuditMessage.java:59)
        at oracle.iam.platform.async.impl.TaskExecutor.executeManagedTask(TaskExecutor.java:122)
        at oracle.iam.platform.async.impl.TaskExecutor.execute(TaskExecutor.java:69)
        at oracle.iam.platform.async.messaging.MessageReceiver.onMessage(MessageReceiver.java:68)
        at sun.reflect.GeneratedMethodAccessor644.invoke(Unknown Source)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke

Cause: Under Investigation

msExchVersion Attribute not supported by OIM Exchange Connector 11.1.1.6.0

While checking the forums, I came across this post where the author was trying to run the target reconciliation using msExchVersion attribute in search filter. The author has OIM 11g BP07 and was using OIM - Exchange Connector 11.1.1.6.0. The environment has multiple version of Exchange Servers i.e., 2007 & 2003.

Just for little background, Exchange 2007 introduced a new user attribute called msExchVersion that tracks the Exchange version a mailbox is created on. This may be useful if you want to manage mailboxes by Exchange version.
Exchange 2003 and earlier = ""
Exchange 2007  = "4535486012416"
Exchange 2010 = "44220983382016"
 
After reading the connector 11.1.1.6.0 documentation, I came to know that only specific attributes can be used in search filter for running limited reconciliation. (Refer Page 75). Here is the list:

The following attributes are supported in the filters:

• ArchiveQuota
• ProhibitSendQuota
• ArchiveWarningQuota
• Database
• IssueWarningQuota
• ProhibitSendQuota
• ProhibitSendReceiveQuota
• UseDatabaseQuotaDefaults
• ExternalEmailAddress
• DisplayName
• SimpleDisplayName
• EmailAddressPolicyEnabled
• HiddenFromAddressListsEnabled
• MaxSendSize
• MaxReceiveSize
• Name
• Alias
• PrimarySmtpAddress
• RecipientLimits
• RecipientType
• WhenChanged
• CustomAttribute1, CustomAttribute2, and so on up to CustomAttribute15

However, the 11.1.1.5.0 and 9.1.1.7 doesn't specifically mention any list of attributes that can be used in search filter in reconciliation task. So, I think in environment with mixed version of Exchange servers, these two version should be used. 
 
References:
 

• https://forums.oracle.com/thread/2586016
• Exchange Reconciliation For Environments With Mixed 2003 and 2007/2010 Servers (Doc ID 1463160.1)
• Patch 13778888: RELEASE VEHICLE FOR EXCHANGE CONNECTOR 11.1.1.5.0
• Patch 17198005: RELEASE VEHICLE FOR EXCHANGE CONNECTOR 11.1.1.6.0