Popular Posts

Oracle Identity Manager Basics: Creating a Custom Adapter in OIM 11g
Identity Management
Oracle Identity Manager Basics: Creating a Custom Adapter in OIM 11g The purpose of this entry is to explain how to create a custom adapter in OIM.  The adapter will write to an external file.&n...
Getting Started with OAuth2Client on iOS
Custom Solutions
In creating a proof-of-concept iOS app that uses OAuth2 to consume the Google APIs, I began with the OAuth2Client project by the folks at nxtbgthng GmbH. This project is one of oldest and most ac...
Externalizing Authorization from Applications using Oracle Entitlements Server
Identity Management
Typically in a private cloud scenario you might have a data center with a hardware grid hosting a middle-ware platform so let's take the next step: You have the departmental application owners bu...


  • Home
    Home This is where you can find all the blog posts throughout the site.
  • Categories
    Categories Displays a list of categories from this blog.
  • Tags
    Tags Displays a list of tags that has been used in the blog.
  • Bloggers
    Bloggers Search for your favorite blogger from this site.
  • Login
Recent blog posts

Posted by on in IDMWorks
When implementing a new IDM product there is one thing that should never be skipped - training.   Oftentimes training gets overlooked during scheduling or is cut out due to budget concerns.  It happens.  When you are coordinating resources and scheduling, most project managers focus on development, testing and implementation times, so training is not considered and gets left out.   Training can also get cut out of financial concerns.  True, funds are finite.  Companies and departments have budgets that they have to operate within and training costs extra.  This means that if training will add a few thousand dollars to...
Hits: 94
The SSLPeerUnverifiedException arises when a client is trying to access a service on a secured webserver. It indicates that the peer's identity has not been verified.  When You'll See It: You’re likely to come across this error if you use the integration activity while developing your workflows in designer.  What To Check: When you get this error, this is one way you can quickly identify the root cause: Depending on the webserver (in my case, it was jboss) you can enable SSL debugging and restart the webserver. When you re-run the workflow, you’ll get additional information around the exception. E.g. “The...
Hits: 115

Posted by on in Identity Management
Now that the holidays are over, it’s a good time to reflect on the IDM impact of paid holidays or large percentages of workforces taking vacation time all at once.  Although day-to-day work may stand still for a few days, time does not.  Many companies today have security policies that require passwords to be changed every so many days, so holidays and periods of lengthy absences can cause issues to arise.  When a large portion or even all of the workforce is out of the office for an extended period of time, a significant percentage will find that their passwords have...
Hits: 157

Posted by on in Identity Management
It's holiday season again and for many companies that means a reduced workforce with a lot of personnel taking lots of time off to spend with family and/or travel.  For most this is an annual time of celebration and relaxation, but for others, like a help desk or IT person, it means the calm before the storm.  All too often the return from the holidays heralds in a flood of calls and support tickets for users that have forgotten passwords, had passwords expire over the holiday break or accounts being locked for too many failed login attempts.  For those that support...
Hits: 193
Recently I encountered an unusual scenario; after submitting a workflow successfully the approver was unable to access the request.  The request showed up in the approver's task list but upon clicking the request the approval preview failed to load.  Instead of showing the fields and data to be approved the UI simple showed three red words, "Provisioning application error." The approver could still perform the standard functions for claim, release and reassign but going through the various actions had no impact on the error. A quick look in the server.log file for the user application the following error was found: 2014-12-03...
Hits: 297
Are you maximizing your Aveksa/IMG investment by extending it to your most important compliance applications and providing automated provisioning and real-time data? Using RACF as an example, the current Aveksa/IMG connector provides RACF data using a File and FTP approach, which can be a slow and arduous and does not provide provisioning capabilities. We recognized that some organizations need a more robust RACF integration for Aveksa/IMG so we developed connectors for integration with provisioning capabilities like: ADD ALT CONNECT & REMOVE PASSWORD ALIAS PERMIT Our solution leverages Aveksa’s included LDAP Adapter for easy of deployment by an organization's engineers without them having...
Hits: 325
While working on a deployment of OIM 11gR2PS2 I recently had an issue where a lookup I had migrated from Dev to QA didn't look correct in QA.  Some of the values were missing from the lookup.  I knew I had imported the lookup, but either someone edited the lookup or I imported something incorrectly and I wanted to know which.   Everything else imported correctly, except for this one lookup.  In order to be figure out what happened, I went through the tables that store information about deployment manager and was able to see what was deployed and when.  The...
Hits: 407
If your client makes use of the out of the box admin roles in OIM 11gR2PS2, then you have no doubt run into a situation in which you need to grant additional authorization to a role. This can be done by extending the domain to include Oracle Entitlement Server and creating a new authorization policy. Oracle has a good note for extending your domain, located here http://docs.oracle.com/cd/E27559_01/install.1112/e27301/oim.htm#CDDJFEFA Recently, my client has requested that users in the admin HelpDesk role be able to modify an extranet lockout UDF on the user form but they did not want to grant blanket modify user authorization...
Hits: 481
Recently at a client we were seeing intermittent Authentication errors with the following in the logs: Caused by: javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User xelsysadm javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User xelsysadm denied         at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:261)   We were not seeing the issues regularly, only during periods of high activity.   As a result of not being able to replicate the issue reliably, we had problems understanding what was going on. The user existed in the Identity Store (LDAP), was seen in the Weblogic Users section, and was viewable in OIM.  Sometimes the user would work and sometimes it would not.  We could not reliably define...
Hits: 538
Odds are if you have worked with drivers in the Novell/NetIQ Identity Management (IDM) product you have see the following error at least once: "Code(-9010) An exception occurred: novell.jclient.JCException: createEntry -613 ERR_SYNTAX_VIOLATION" This error can cause untold amounts of frustration for developers and support technicians who attempt to determine the cause of the error.  While the error does a great job of telling you why a transaction did not succeed, a syntax violation error as indicated in the message, it does not do a very good job of describing what syntax violation was encountered.  In fact, there are at least three...
Hits: 384
While recently working with NetIQ IDM 4.02 and NetIQ eDirectory 8.8.7 IR 7, we had an issue arise and wanted to pass along the solution. When deleting an object which has been verified to have an association, all drivers in a driver set have a delete event generated that does not have an association on it.  This causes events that are triggered by this to not function as designed. This is a sample of what the delete event looks like for this issue: <nds dtdversion="4.0" ndsversion="8.x">   <source>     <product edition="Standard" version="">DirXML</product>     <contact>Novell, Inc.</contact>   </source>   <input>...
Hits: 366
I was introduced to this method of investigating Event Handlers using Enterprise Manager by a colleague.  The only other time I've seen it referenced was a quick reference in some of the OIM Developer documentation.  I've found this useful when beginning the Event Handler debug process. The basic premise of this method is to utilize Enterprise Manager to handle querying the MBean for the User and Operation.  I'll walk you through how to access the functionality (the screenshots are 11gR2 PS2 but the steps are applicable to any version of OIM 11gR2).  Open the Enterprise Manager that is associated with the Admin Server...
Hits: 981

One of the new features in OAM 11g R2 PS2 ( is called Persistent Login also known as Remember Me. Basically this means that OAM will have the option to remember a user’s session for some defined period of time so even if they close their browser, they’ll be able to log back in again without providing credentials. 

This is a common feature you see on many websites, but up until this point, in OAM 11g this feature was not available. It was possible with custom code but it was not out-of-the-box. Now with PS2, this is an out-of-the-box feature. In this blog post we will give you some pointers on configuring this new feature, with special emphasis on a few key points you won’t find in the Oracle documentation.

Hits: 726

Posted by on in IDMWorks
Provisioning Microsoft Exchange accounts via NetIQ Identity Management (IDM) is a very common process.  With IDM 4.0 you can now provision mailboxes to Exchange 2013.  The big catch is that in order to provision to this version of Exchange you are required to go through the Windows PowerShell interface.  Following the NetIQ AD driver documentation for IDM 4.0 you will be able to easily get everything set up.  This means finding a server that you can install the following items: IDM 4.0 Remote Loader (configured for the AD driver) By default the remote loader and AD driver installed with the standard...
Hits: 705
In the past few months we have seen some cases where the out of the box Enterprise Manager (Fusion Middleware Control) ceases to function in an Identity Management deployment. In a recent example, we’ve seen this JSP error: A common troubleshooting step in this case is to remove the tmp directory from $DOMAIN_HOME/servers/AdminServer/, but in our experience this did not solve the issue. In the end, the solution was to redeploy the EM ear file along with all of its library dependencies. In this blog post, we will walk you through this process.  DISCLAIMER: Before attempting these steps, you should backup...
Hits: 406
CA IdentityMinder is a great application for managing identities and assigning roles and tasks.  All of these identities end up residing on some form of LDAP or a relational database with very specific schemas and "well known" attribute assignments. One of the most used well known attributes is "admin roles". It is supposed to be assigned to an attribute that is multi-valued, since people could have multiple roles.  For example, in my sample environment I used registeredAddress attribute to hold my admin roles. However, when dealing with these kind of attributes one has to pay close attention to the search criteria....
Hits: 470
In this post, we are going to walk through creating a custom managed beans to conditionally display OIM form field. The OIM UI customization use case:  Create a disconnected application instance – MainframeAccess in /sysadm, the MainframeAccessform will be created by default. Add 2 UDFs to the custom request form: 1. lookup field: RequestDataAccessTool, with values: ‘test1’,’test2’ and  ‘Other (Please List)’ 2. input text field: Other The UDF field: ‘Other’ will be displayed only when the value of ’Other (Please List)’ was selected from dropdown box RequestDataAccessTool.   Steps to create custom managed beans to show ‘Other’ field conditionally: 1. Create sandbox: MainframeDB2. Create...
Hits: 950
How many times have you loaded WinSCP, Eclipse, Apache Directory Studio, etc… on a fresh machine and have had an error popup saying the application can’t find java?   Below are simple directions on how to set JAVA_HOME and modify PATH to include JAVA. I’ll mention this now before you get copy-paste happy - the two paths are different, so pay attention to the paths in the examples. In Windows:       1. Click on the windows Start button       2. Right Click on Computer and select Properties       3. Click on Advanced System Settings       4. Under the Advanced tab, click...
Hits: 493
On Aug. 19th at 4:00 p.m. EST, Chad Cromwell, IDMWorks CTO, will present a brief webinar: Seamless Directory Integration & SCIM Provisioning.   The webinar will show how our IdentityForge suite of products, ForgeDS and ForgeIE, can help maintain and provision identities to on-premise target systems as well as cloud systems. During the webinar we will give a brief high-level overview of our products, our Identity Directory Store, and our Identity Gateway (Utilizing SCIM & LDAP). We will also demo these in action with a few of our target connectors: RACF, NonStop & ServiceNow. Register For Webinar Today    ...
Hits: 1907
Until recently, 2-factor strong authentication has usually had extra cost and complexity associated with it. In OAM 11g R2 PS2, Oracle has sought to eliminate a lot of this with the introduction of Oracle Mobile Authenticator (OMA). Support for OMA ships out of the box with PS2 and setup is fairly straightforward. This blog post will walk you through configuring OMA from start to finish, and we’ll also share some of the tips and tricks we learned along the way. At a high level, OMA requires that you configure the OAuth Service in OAM for secret key generation. Next, you will...
Configure OAuth Service
Hits: 1378


Contact Us

Please fill in all required fields.