Reconciliation of target

Similar Questions

• Issue of reconciliation of target

  My requirement is that I have to perform * target * reconciliation.
  I had a target system which reconciles the IOM data, suppose if the account is it in the target system and the same account isn't here by IOM in this case I need to create an account to IOM. is it possible to create the user account in the IOM?
  
  Please provide your suggestion
  
  Published by: user11150369 on Sep 4, 2009 09:38

  It is not the reconciliation of target. He trusted reconciliation in IOM

  http://download.Oracle.com/docs/CD/E11223_01/doc.910/e11217/processes.htm#sthref78

• How to upgrade the IOM user profile fields after the reconciliation of target user AD

  Hello

  I have a problem of set-aside. When I'm changing the values of the attributes of the user in Active Directory and then I run Active Directory target user Recon, AD in IOM account attributes are updated only but I would like to update the attributes in the IOM user profile too. Please, how can I do?

  Thank you.

  Milan

  You can create a personalized card which is your AD attributes flow into the user profile and add it as a response to the task 'receipt of update of reconciliation. "

  Use the UserManager api to update the user's profile.

• Reconciliation of the EBS target does not work for the payments.

  Hi all

  I use OIM 11 g 2 and Oracle EBS user Managment 9.1.0.7.0 connector.
  I want to link the user's responsibilities in EBS your child to IOM. I tried to use the Scheduler ""eBusiness UM target user reconciliation resource ' but the execution of this work is just creating the EBS account for the user at the IOM. " I can see the user's responsibilities in the details information of the EBS account, which was created by the work of reconciliation of target, but I don't see them as the user rights

  How can I achieve this?

  Any help is appreciated.

  Thank you and best regards,

  Thank you for your help. I solved this problem with the use of assignments of rights enforcement after the work MU target resource user reconciliation eBusiness

• The difference between targeted source vs trust reconciliation?

  Hello!
  
  Can someone explain to me in one "for the fate of the mannequins in a way" or "for example" what is the difference between
  Trusted source reconciliation and reconciliation of targeted resources?
  
  I found this explanation on the Oracle, but I still do not understand the difference:
  Reconciliation of targeted resources:
  occurs when the audit criteria make up the demand for resources or change access real insurance of resources put into service or lack thereof in a query ad hoc bases.
  
  Reconciliation of reliable source:
  occurs when the audit criteria is close to a main point of truth, validation of the status of the access of resources against the policy of the company.
  
  Thank you very much

  http://download.Oracle.com/docs/CD/E11223_01/doc.910/e11217/processes.htm#sthref78

  Confidence:

  In this case if no match is found then it will create the user to IOM.
  Suppose that the user with Userid JMD1 is at AD but not with IOM. When we execute AD Trusted Recon, then it will search JMD1 in IOM. If it does not find any user with username JMD1 in IOM then it will create the user to IOM.

  Target:

  It cannot create a user of IOM, but it can make the link between IOM and the AD users.

  You can check this link in the resources of any user profile.

  Assume that JMD1 is in AD, but not with IOM. When we run target Recon for AD. Then he will not find any user with username JMD1 in IOM so he won't do anything. This is called the orphan account.

  Now JMD1 resided at the IOM as well as in the AD. Then it will create a link between IOM and the AD users. Just go to IOM JMD1 resource profile. You can see that ANNOUNCEMENT will be in the State enabled for this user. He manages the account not the identity.

• SSH reconciliation issue after application BP4 for OIM11g

  Hi all
  
  I am facing a problem trying to reconcile users between OIM11g and a resource target SSH. In particulare, all worked well before asking the BP4 OIM11g. I have a custom rule of reconciliation that serves as a Mapper betweek custom field of a user called SSH, in which I enter specific target account to reconcile, and the Users.UserLogin of the SSH form field. The rule is expressly defined, via the console design, like "SSH is equal to Users.UserLogin. Now when I run the reconciliation of target user SSH for the specific host, OIM11g creates all the events of reconciliation but does not bind the target accounts IDM users (not related to any user).
  
  Does anyone know how can I fix this problem? Read the newspaper it seems to be without a single error.
  
  Thank you very much.
  
  Kind regards
  Giuseppe.
  
  Published by: Giuseppe on November 14, 2012 14:35

  Hey, Giuseppe.

  There is an open bug related to this issue: Bug 14493217 and note ID 1494023.1

  PLS, go to metalink and check it out.

  I hope this helps.
  Leoncio Thiago.

• AD locked status reconciliation

  Is it possible to reconcile the account locked AD status?
  
  Thank you

  Hello

  AD locked status may have to IOM help AD trust reconciliation or reconciliation AD target.
  1 AD recon trust-> brings a locked status as long as TimeStamp, here you need a customization to analyse the value "1".
  2. in target Recon-> works very well for the State locked and unlocked (analysis of connector STANDARD here the timestamp value '1' for the locked state).

  Kind regards
  Raghav.

• How are the changes/updates on the attributes target system are reconciled?

  Hello
  
  How are the changes/updates on the attributes target system reconciled within IOM automatically? Suppose if the userpassword in OID is changed via external SSO application by the user. How these changes at the end of the target system can be reconciled in IOM? Annex which task should be scheduled for the same? I understand that we can configure reconciliation the target system. But suppose that happens if a another example; a group of groups are removed from the OID; How these changes will be reconciled within the IOM? It is done in real time?
  
  Response to most early would be really useful.
  
  Thank you
  -oidm.

  The only changes that are made in time real are push systems. For example, Peoplesoft has an Integration Broker that when a change occurs, the events is pushed to the listener that then creates the recon event to IOM. Synchronization of Active Directory password is also a push system where the domain controller has a dll that is triggered when the password is changed to push to the IOM.

  Other targets are reonconciled to an interval defined in your task scheduler. Most of the targets have some form of variable change so that only the entries that are updated in the target are reconned in. Values such as passwords should not be reconciled however because they will be in clear text in the recon Manager and in the database.

  As for your example, it does not really have that IOM criteria. IOM does not manage the OID groups to a group level, it manages the permissions of the user level. So if you continue to run the recon OID group Lookup on an interval of schedueld, it would update the list of choices that is used to define the groups available on the child table. Then when the recon is run agaisnt these OID of the user that have been changed (assuming that a change to a membership in a group is an update to the user, which is not in Active Directory) and then you would get their current list of groups they have right to.

  -Kevin

• Notification of OIM(11gR2) after the update of mail electronics id

  Hello

  I need to implement a use case in the IOM as follows.

  IOM has a target of integrated resources - Say Resource1. When the email identification function is updated in IOM it will get spread to the Resourc1 and and if the email is updated to Resource1, it will get reconciled with IOM. And we have another system that was not integrated with IOM say Resource2. Our requirement is to send an e-mail notification to privΘ Resource2 when ever users e-mail update event occurs to the IOM. What was the best way to implement this usecase. As far as I understood that this could be implemented using event handlers. I have here any other approach/design to address this usecase.

  I mean using the console design approach.

  Satyendra-

  The " ", "send a Notification to the task of Admin resources" should get called on the success of the 'receipt of update of reconciliation' task. "

  Adapter of the process task (send a Notification to the task of Admin resources), you can read the value of the former emai E-mail/news(using old box, just give a try) or you can compare the user E-mail profile & form Email Id of process (within your code) and trigger the update the user's profile.

  The post below also had same type of requirement:

  Re: How to upgrade the IOM user profile fields after reconciliation of target user AD

  Or to avoid any confusion, just use the cleaner the handler approach to notification of the trigger.

  ~ J

• Exception in the reconciliation of the target

  Hi Experts,

  Everything by making reconciliation target through a recon Planner personalized, I saw the exception.

  Thor.API.Exceptions.tcAPIException: An exception occurred: oracle.iam.platform.utils.SuperRuntimeException: error in XL_SP_RECONEVALUATEACCOUNT while no. 1223 processing error event occurred in XL_SP_RECONUSERMATCH during the event processing N° 1223 ORA-01747: invalid column, table.column, or user.table.column specification

  at weblogic.rjvm.ResponseImpl.unmarshalReturn(ResponseImpl.java:237)

  at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:348)

  at weblogic.rmi.cluster.ClusterableRemoteRef.invoke(ClusterableRemoteRef.java:259)

  at oracle.iam.reconciliation.api.ReconOperationsService_emc07d_ReconOperationsServiceRemoteImpl_1036_WLStub.processReconciliationEventx (unknown Source)

  at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)

  at sun.reflect.NativeMethodAccessorImpl.invoke (unknown Source)

  at sun.reflect.DelegatingMethodAccessorImpl.invoke (unknown Source)

  at java.lang.reflect.Method.invoke (unknown Source)

  at weblogic.ejb.container.internal.RemoteBusinessIntfProxy.invoke(RemoteBusinessIntfProxy.java:85)

  to com.sun.proxy. $Proxy2.processReconciliationEventx (unknown Source)

  at oracle.iam.reconciliation.api.ReconOperationsServiceDelegate.processReconciliationEvent (unknown Source)

  at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)

  at sun.reflect.NativeMethodAccessorImpl.invoke (unknown Source)

  at sun.reflect.DelegatingMethodAccessorImpl.invoke (unknown Source)

  at java.lang.reflect.Method.invoke (unknown Source)

  to Thor.API.Base.SecurityInvocationHandler$ 1.run(SecurityInvocationHandler.java:68)

  at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)

  at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)

  at weblogic.security.Security.runAs(Security.java:41)

  at Thor.API.Security.LoginHandler.weblogicLoginSession.runAs (weblogicLoginSession.java:52)

  at Thor.API.Base.SecurityInvocationHandler.invoke (SecurityInvocationHandler.java:79)

  to com.sun.proxy. $Proxy3.processReconciliationEvent (unknown Source)

  at com.scb.scheduler.recon.SLTargetRecon.performRecon(SLTargetRecon.java:281)

  at com.scb.scheduler.recon.SLTargetRecon.execute(SLTargetRecon.java:105)

  at com.scb.scheduler.recon.SLTargetRecon.main(SLTargetRecon.java:553)

  But to my surprise it worked very well just a week back. And the exception is thrown only when the account is not provisioned for the user. But when the user is already having the account process match happens successfully.

  Here is the history of events-

  Looking to the wrong procedure. This is "XL_SP_RECONUSERMATCH". Not "XL_SP_RECON_USR_MATCH".

• IOM - how to reconciliation of the block expiry orphan user events target?

  Hello Experts,

  We use IOM v11.1.3, and we need to stop reconciliation events generated for SAP ECC users orphans, if their 'valid date' has been exceeded in the target system.

  If a SAP user is expired, is longer necessary reconciliation attempt.

  Any suggestion?

  Thank you
  AT

  I found a better article Configuration data during the reconciliation, and provisioning Validation where additional (and fundamental) stages is explained as:

  • You can search and open research definition "Lookup.SAP.UM.Configuration".
  • Set the value of the 'Validation use for Recon' entry to yes .

  It solved my problem!

  Best regards

  AT

• OIM 11g - reconciliation of the status of resource target

  Hello
  
  
  We work closely with IOM 11.1.1.5.2 and DBUM 9.1.0.4 and MSAD 9.1.1.7.
  Commissioning and reconciliation seem to work fine, but we found that the State of the resource is not be compared on the console of the IOM.
  
  For example, if supply us a user with an account of Oracle database, then lock the account on the database, when we run the reconciliation, the event is generated and finished with 'update succeeded', we go to the UD_DB_ORA_U table and find that the UD_DB_ORA_U_LOCK field has a value "BLOCKED." , then if we check the newspapers, we can see that the connector is properly mapping the State of resources with purpose of IOM status:
  
  prepareTargetUsersRecordInOIMFormat: save the value: LOCKED
  prepareTargetUsersRecordInOIMFormat: map: {OPEN = enabled 1 = Disabled, YES = Disabled, 0 = active, EXPIRED & LOCKED = Disabled No. = Enabled, LOCKED = disabled}
  ...
  prepareTargetUsersRecordInOIMFormat: roValue: TEMPORARY_TABLESPACE_QUOTA
  prepareTargetUsersRecordInOIMFormat: Temp RO value: null
  prepareTargetUsersRecordInOIMFormat: reconData: [{default Tablespace = 27 ~ USERS, Authentication Type = PASSWORD, password = dummy, default Tablespace = 27 ~ USERS, Authentication Type = PASSWORD, password = dummy, Quota of Tablespace default = profile_name = 27 ~ USERS, resource = Oracle, user name is USPRUEBA65, temporary Tablespace = 27 ~ TEMP, account status is LOCKED, status = Disabled, Global DN =, privilege list is [], the list of roles = [{role Admin Option = number}] [{[{, role name =}], Quota of temporary Tablespace =}]
  prepareTargetUsersRecordInOIMFormat: COMPLETED
  
  But, even if reconciliation succeeded the administration shows console account status "Enabled" and when I check the table Ouedraogo, I see that the status of an object of the IOM is always enabled.
  
  
  I found a few discussions on this issue, the closest was this one: reconciliation for users deleted on the target resource accounts but all it doesn't seem to be a great help because all the tasks described are already carried out by the installation of the connector (at least in the msad and dbum connectors).
  
  This problem occurs both Active Directory and Oracle database users, maybe we missed something but based on the documentation for both connectors, we thought it was a STANDARD feature. Is there some setting of the connector or the property of the system, that we have to configure to make it work?
  
  Thank you.
  
  Published by: fmc on July 26, 2012 12:53

  It should work OOTB. No need to write an adapter for it.
  It works for me like OOTB waited.

  Don't see you not received update reconciliation task inserted into the details of the profile of the users of resources? You have changed the status of the object mapping task in this task? It must be set to NONE.

  Thank you
  Patricia

• problem in OIM 11 g target reconciliation

  Hello
  
  
  
  I developed target reconciliation schedule the task in OIM 11 g. At the time of planning the task running, I am getting following error
  
  
  
  oracle.iam.platform.utils.SuperRuntimeException: oracle.iam.platform.utils.SuperRuntimeException: orcKey is null to oracle.iam.reconciliation.impl.AccountHandler.provisionUsrAccount(AccountHandler.java:443) to oracle.iam.reconciliation.impl.AccountHandler.create(AccountHandler.java:305) to oracle.iam.reconciliation.impl.AccountHandler.applyRule(AccountHandler.java:229) to oracle.iam.reconciliation.impl.AccountHandler.process(AccountHandler.java:205) to oracle.iam.reconciliation.impl.ActionEngine.processEvent(ActionEngine.java:197) to oracle.iam.reconciliation.impl.ActionEngine.processEvent(ActionEngine.java:156) to oracle.iam.reconciliation.impl.ActionEngine.execute(ActionEngine.java:94) to oracle.iam.reconciliation.impl.ActionTask.execute(ActionTask.java:72) to oracle.iam.platform.async.impl.TaskExecutor.executeUnmanagedTask(TaskExecutor.java:100) at oracle.iam.platform.async.impl.TaskExecutor.execute(TaskExecutor.java:70) at oracle.iam.platform.async.messaging.MessageReceiver.onMessage(MessageReceiver.java:68) at sun.reflect.GeneratedMethodAccessor728.invoke (unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at com.bea.core.repackaged.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:310) at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:182) at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed) ReflectiveMethodInvocation.java:149) at com.bea.core.repackaged.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:89) at com.bea.core.repackaged.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:171) at com.bea.core.repackaged.springframework.aop.support.DelegatingIntroductionInterceptor.doProceed (Delegat
  
  < 11 April 2012 06:43:11 EDT > < error > < XELLERATE. SERVER > < BEA-000000 > < class/method: tcOrderItemInfo/eventPreInsert error: object process required data sheet are missing. >
  < 11 April 2012 06:43:11 EDT > < error > < XELLERATE. SERVER > < BEA-000000 > < class/method: tcDataObj/save error: failed to insert to the dataobject in the database >
  < 11 April 2012 06:43:11 EDT > < error > < XELLERATE. DATABASE > < BEA-000000 > < class/method: tcDataBase/rollbackTransaction some problems: Rollback performed
  java.lang.Exception: Rollback performed
  at com.thortech.xl.dataaccess.tcDataBase.rollbackTransaction(tcDataBase.java:578)
  at com.thortech.xl.dataobj.tcDataObj.rollback(tcDataObj.java:904)
  at com.thortech.xl.dataobj.tcDataObj.doRollback(tcDataObj.java:867)
  at com.thortech.xl.dataobj.tcDataObj.save(tcDataObj.java:538)
  at com.thortech.xl.dataobj.tcTableDataObj.save(tcTableDataObj.java:2906)
  at oracle.iam.reconciliation.impl.AccountAction.processReconData(AccountAction.java:249)
  at oracle.iam.reconciliation.impl.AccountAction.provisionUser(AccountAction.java:146)
  at oracle.iam.reconciliation.impl.AccountHandler.provisionUsrAccount(AccountHandler.java:432)
  at oracle.iam.reconciliation.impl.AccountHandler.create(AccountHandler.java:305)
  at oracle.iam.reconciliation.impl.AccountHandler.applyRule(AccountHandler.java:229)
  at oracle.iam.reconciliation.impl.AccountHandler.process(AccountHandler.java:205)
  at oracle.iam.reconciliation.impl.ActionEngine.processEvent(ActionEngine.java:197)
  at oracle.iam.reconciliation.impl.ActionEngine.processEvent(ActionEngine.java:156)
  at oracle.iam.reconciliation.impl.ActionEngine.execute(ActionEngine.java:94)
  
  Thanks and greetings
  
  Published by: 853559 on April 11, 2012 06:50

  Form data object data required process is missing

  Make sure your recon data are filling all your required fields on the form of process.

  -Kevin

• Reconciliation of the target of a WebService

  Hello experts,
  
  We would need to perform a reconciliation of the target of a web service, in order to create new users, remove and update the most common fields (name, surname, e-mail).
  Because we have seen that there is a web service that is already running in IOM (which we have reached throw IOM/spml-xsd/SPMLService?) (WSDL), we were wondering if operations we need are already available (just need to be called) or if we would need to develop something custom to catch requests.
  
  I read somewhere that the GTC connector may be able to manage web services applications. I think it's possible for commissioning, it would be possible for the reconciliation of too?
  
  If these operations are not available, which could be the best strategy to make IOM able to listen to the requests?
  
  Thank you!

  Reconciliation is not supported by us service. You can develop your own connector to make it work. See the discussion here and MOS discussion:
  Reconciliation of SAP to IOM by using Web services and SPML

  Kind regards
  GP

• Need help on the reconciliation of resource target

  Hi all
  
  I m having a target database Table Resource.Users is implemented successfully. Now, I need to write a program of reconciliation task which will read the user attributes and notfiy IDM Admin when there is data confilct.
  
  Suppose, I m having the AccessRole attribute on the target resource DB and userA is supplied by role_ to the AccessRole using IOM attribute. If someone spends AccessRole UserA attribute to RoleX of backend, an email should be turned to IDM Admin user during execution of reconciliation.
  
  Please guide me how to achieve this
  
  
  Kind regards
  Madhu

  There are a few options. If you use the ignoreEvent API for your reconciliation, then EACH recon even from your target that is created outside the initial charge indicates a change. Simple as that. You can also set your level of audit at the level of the resources form. This in fact the track changes via the check engine and write the form old and new values in the tables of the UPA as a result. To send an email and have data changed, it's excessive. You do as much checking of data. You will need to run the ignoreEvent API to see if it should be ignored, for children or parents of the data (this is the norm for recon events). If you can't find an event that should not be ignored, you would need to use the API to find updated instance in service of this user and all their data from parent and then also using new incoming data, compare all values. Then you will need to code your own custom email to send to an administrator. Requirements like that of an email for any change of irritate me because the data is stored if necessary to find out, why not use the product and write a report and not spam email from someone?

  -Kevin