Rajnish Bhatia has provided the community with an AWESOME resource. He’s listed out all the tables of OIM and what they correlate to. I have personally referenced this table a ton of times, and I know others have as well. I’m mirroring it here for data integrity.

Please go to his website (http://rajnishbhatia19.blogspot.com/2008/08/oim-tables-descriptions-9011.html) and check out his other articles.

Great stuff!

.: Adam

From Rajnish:

The following table lists the purpose of each table within OIM.

Note: Custom Tables are created for user defined Object / Process Forms.

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 8 – Configuration of Oracle Identity Manager 11g

This video tutorial will walk you though the configuration of Oracle Identity and Access Manager 11g. These tools include:

• Oracle Access Manager 11g
• Oracle Adaptive Access Manager 11g
• Oracle Identity Navigator 11g
• Oracle Identity Manager 11g
• Platform Security Services
• Authorization Policy Manager

Next >> Part 9 – WebLogic Server and Domain Start-up Options

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Part 7 – Installing Oracle Identity and Access Manager 11g

This video tutorial will walk you though the installation of Oracle Identity and Access Manager 11g. These tools include:

• Oracle Access Manager 11g
• Oracle Adaptive Access Manager 11g
• Oracle Identity Navigator 11g
• Oracle Identity Manager 11g
• Platform Security Services
• Authorization Policy Manager

You will need to download the 1.7GB Oracle Identity and Access Management (11.1.1.3.0) Generic Installer (ofm_iam_generic_11.1.1.3.0_disk1_1of1.zip).

Download Oracle Identity and Access Management

Next >> Part 8 – Configuration of Oracle Identity Manager 11g

The original source videos are available for download via Vimeo.com You’ll have to sign in to download them though. To get there, click on the “Vimeo” logo in the video.

If you have any questions, please post them below. I’m pretty tied up at the moment, but others will be able to help too!

Thanks!

.: Adam

Ok… after a ton of debating and drinking, I’ve finally come to a conclusion.

On what, you ask?

Well, over the past few weeks, I’ve been giving myself a crash-course on the new 11g stack for Oracle’s Identity Management Fusion Middleware. During this time, I finally figured out how to get everything installed (on Oracle Enterprise Linux 5 Update 3):

• Oracle Identity Manger 11g
• Oracle Access Manager 11g
• Oracle Adaptive Access Manager 11g
• Oracle Identity Federation 11g
• Oracle Internet Directory 11g
• Oracle Virtual Directory 11g
• Oracle HTTP Server
• Oracle Directory Integration Platform 11g
• Oracle WebLogic Server 11g
• Oracle Database 11gR2
• Oracle Identity Navigator 11g
• Oracle Authorization Policy Manager
• Oracle Platform Security Services

While doing this, I learned a lot…. srsly…

More importantly, I captured the whole process on video, and made video tutorials / guides on how to install and configure each product. Since it’s a video, you’ll also see a few mistakes that I made along the way, this way if the same happens in the future, the fixes are documented.

There are some documents out there, a few blogs with some high-level steps, and one guy I know is selling an eBook on the install process for about $100 (and it’s probably worth it!), so now my dilemma is two fold:

1. Should I make this information that’s worth more than gold available to others?

2. If so, how much should I charge?

Now back to the “I’ve made a decision” part:

1. Yes, I’m going to release these videos to the public.

2. I’m going to charge $1,000.

Hahahah… just kidding =)

I’ll be giving them away free, right here!

Once I get the write-up’s done, and the videos uploaded, I’ll starting posting the videos on my blog for everyone to use.

DONE!

1. Installing Oracle Enterprise Linux 5 Update 3 on VMWare
2. Installing and Configuring Oracle Database 11g Revision 2 (11gR2)
3. Installing WebLogic Server 11gR1 (10.3.3)
4. Executing and Configuring the Repository Creation Utility 11g
5. Installing, Patching, and Configuring Oracle Identity Management 11g
6. Installing and Patching the SOA Suite 11g
7. Installing Oracle Identity and Access Manager 11g
8. Configuration of Oracle Identity Manager 11g
9. WebLogic Server and Domain Start-up Options
10. Starting Oracle Database and Directories

Cheers!

.: Adam

It’s like trying to find a damn leprechaun…

Here’s the details on how to patch it: http://download.oracle.com/docs/html/E18749_01/download_readme.htm#BABFICJA

Here’s the link to download the Oracle Identity and Access Management 11.1.1.4 patch set: https://updates.oracle.com/download/11060972.html

And here’s how to download the Identity Management 11.1.1.4 patch set:

1. Go to Oracle’s eDelivery site: https://edelivery.oracle.com/

2. Select Product Pack: Oracle Fusion Middleware and your platform

3. Select Oracle Fusion Middleware 11g Media Pack

4. Scroll down and download the item: Oracle Identity Management 11g Patch Set 3 (11.1.1.4.0)

Sheesh, that’s a pain in the ass.

.: Adam

Because Oracle likes to make finding anything useful on their site damn near impossible, I’ve put together OracleIdentityManger.com with all the direct links that we need. You know, things like documentation, downloads, certification matrixes.

I just finished updating the pages with all the 11g info and I fixed a lot of the broken links to the 10g stuff as well (because oracle also doesn’t like to leave stuff in one place… ,making bookmarking impossible). So if you haven’t already, bookmark OracleIdentityManager.com =)

http://www.OracleIdentityManager.com

Next up: OracleAccessManager.com

Cheers!

.: Adam

So you want to upgrade your OIM environment, but you’ve come across your first roadblock: Where the hell do I get the patches?

If you try Google, you’ll get nada. You try Metalink, and you’re in a world of hurt. I’m pretty sure Oracle obfuscates their information on purpose. I’m not sure of the monetary gain on their part for this yet, but there has to be an angle to making a support system work so horribly.

To the meat!

You can find your upgrade path to all major point numbers and Bundle Patches here:

https://support.oracle.com/CSP/main/article?cmd=show&type=NOT&doctype=FAQ&id=883069.1

It also lists direct links to the downloads.

Later!

.: Adam

How many times have you gone to a clients site, and you ask a fairly simple question:

Me – “What version of OIM do you have installed and what version of connectors?”

Them – “The red one”

Me – *Face palm*

Determining what version of OIM installed is fairly straightforward. Just login to the OIM web console and click the About link at the top. You’ll see the version and the build number. Now if only figuring out which connector version was as easy. Is there a link to click somewhere? Nope. To guarantee that you have the right version number, you need to ssh to the box and go into the …/xellerate/ScheduleTask folder.

In there you’ll see all the Recon jar files for each connector installed. Explode these. Inside, you’ll need to open up the /META-INF/MANIFEST.MF file. Just use any text editor. It will show you all the gory details like this:

Manifest-Version: 1.0
Ant-Version: Apache Ant 1.6.2
Created-By: 1.4.2_12-b03 (Sun Microsystems Inc.)
Version: 9.1.0
Main-Class: com.thortech.xl.um.schedule.hostAccess.testUMBulkRecon
Class-Path: . ../lib/xlAPI.jar ../lib/xlRemoteManager.jar
../lib/xlScheduler.jar
../ThirdParty/csv.jar ../lib/xlLogger.jar
../lib/xlUtils.jar ../ext/log4j
-1.2.8.jar

And in the middle there is your installed version number =)

.: Adam

If you cannot log into the WebSphere Web Console with XELSYSADM and you see the above error in the Dmgr01 SystemOut.log file, here is the solution.

In the OIM transaction database you need to modify the password expire and warn dates to something in the future. Here are the SQL commands used:

update usr set usr_pwd_expire_date=’12-FEB-15′ WHERE USR_LOGIN=’XELSYSADM’;
update usr set usr_pwd_warn_date=’12-FEB-15′ WHERE USR_LOGIN=’XELSYSADM’;

commit the changes and then reset WebSphere (all nodes, and manager). You may have to kill the processes.

Another byproduct of the issue seemed to be hash dumps from the JMS queue causing the hard drive space to fill up. Scan the server for large files (especially log files) and remove them all before starting up WebSphere.

In a previous post, I uncovered how OIM talks with Active directory based on objectGUID values rather than samAccountName, or whatever else you may have setup in the Reconciliation Rules. This posed a problem for me, as I had 40K users with objectGUIDs from Production AD in a test environment. So obviously, none of the accounts were in sync between the two systems. Now, for the fix:

1. Rerun the Active Directory Target Reconciliation

This will resync them all for you. If the objectGUID is not an attribute that is on your recon list, make sure you add it. Also, you may need to clear out the lastReconTimestamp field on the AD IT Resource to make sure that you run the recon against all the users. This is the easiest way. Unfortunately for me, whomever installed this environment did not install / carry over the AD recon scheduled tasks. So this isn’t an option for me… What next?

2. Dump out a CSV of objectGUIDs and samAccountNames from AD, convert the objectGUIDs into a format that OIM recognizes, update the OIM database with the new objectGUIDs.

Lucky for me, I got to figure this one out on my own. =). Here’s how I did it:

First you need to dump out a CSV of all your users in active directory that you want OIM to be syncing up with (in my case, the test AD environment). There’s a tool that comes with AD called “csvde” that will handle this for you quite easily. If you’re using an LDAP browser and looking at a user record, the objectGUID will look something like this:

{FD3B2D30-0428-5348-941B-C405CC0341C2}

When you export the users into a CSV file, the objectGUIDs will look like this:

X’fd3b2d3004285348941bc405cc0341c2′

For my next trick, I needed to convert these into a format that OIM stores them at. If I look at this users objectGUID in the UD_ADUSER table, it will be this:

302d3bfd28044853941bc405cc0341c2

If you want to know how I did this, please read to the bottom. I’m going to skip over that part for now. For everyone else, I’ve made a simple command line utility called ADguid2OIM that will read in the CSV file of 2 colums and output them into a new CSV file with the OIM formatted guids. Woo hoo for you =). You can download ADguid2OIM here. I’m also making the source available (since it’s not the greatest, and you may want to customize it) at the bottom of this post too.

Now that you have the usernames and properly formatted objectGUIDs, you just have to update the OIM database repository with the new values. The table is UD_ADUSER and the field is US_ADUSER_OBJECTGUID. Just make sure that you have a backup of the database in case you mess it all up =).

Now with the correct GUID’s in place, all of your existing OIM users that are supposed to be already provisioned to AD will work correctly for updates! Yay!

I hope this helps someone else out, as I spent a good couple days figuring this all out and hitting my head against a wall a couple times =)

Take care!

.: Adam

For the techies…

Here’s how OIM is storing the AD objectGUIDs in it’s database:

AD objectGUID example: {FD3B2D30-0428-5348-941B-C405CC0341C2}

OIM stored version: 302d3bfd28044853941bc405cc0341c2

The first thing that I noticed is that the last half is the same (the last 2 chunks in the AD version: 941B-C405CC0341C2)

So that left us with just the first half. When you line them up and add the dashes to the OIM one, you may see what I saw:

AD:   FD3B2D30-0428-5348
OIM: 302d3bfd-2804-4853

You’ll notice that the 3 different sets essentially stay the same, but the HEX values are just written in reverse. Take a look at the last set: 5348 and 4853. Split this into the 2 HEX values, 53 and 48, then swap them, and you get 4853. You do the same with the second chunk: 0428=2804 and then with the first set, it’s the same pattern, it’s just that there’s now 4 hex pairs all in reverse: FD 3B 2D 30 = 30 2D 3B FD. String these all together and you get the OIM version of the AD objectGUID: 302d3bfd28044853941bc405cc0341c2. Why Oracle is messing with the value and scrambling it all up? I have no idea.

The little .net command app I wrote is pretty straight forward and could probably be coded better by someone that codes for a living, so I’m putting the source up here in case someone wants to improve on it:

Source Code for ADguid2OIM:

Sub Main()
Dim strOriginal As String = “”
Dim strUsername As String = “”
Dim strNew As String = “”
Dim arrChunks(3) As String
Dim arrPieces(3) As String
Dim strLine As String = “”

Dim oRead As StreamReader
Dim oWrite As StreamWriter

oRead = File.OpenText(“input.txt”)
oWrite = File.CreateText(“output.txt”)

oWrite.AutoFlush = True

strLine = Trim(oRead.ReadLine())

Do While Not strLine Is Nothing And strLine <> “”
Dim arrItems(1) As String

arrItems = Split(strLine, “,”)
strUsername = arrItems(0)
strOriginal = arrItems(1)

‘ Strip out the extranious characters
strOriginal = LCase(Replace(strOriginal, “-”, “”, 1, -1, 1))
strOriginal = Replace(strOriginal, “X’”, “”, 1, -1, 1)
strOriginal = Replace(strOriginal, “‘”, “”, 1, -1, 1)

arrChunks(0) = Left(strOriginal, 8 )
arrChunks(1) = Mid(strOriginal, 9, 4)
arrChunks(2) = Mid(strOriginal, 13, 4)
arrChunks(3) = Right(strOriginal, 16)

arrPieces(0) = Left(arrChunks(0), 2)
arrPieces(1) = Mid(arrChunks(0), 3, 2)
arrPieces(2) = Mid(arrChunks(0), 5, 2)
arrPieces(3) = Right(arrChunks(0), 2)
arrChunks(0) = arrPieces(3) & arrPieces(2) & arrPieces(1) & arrPieces(0)

arrPieces(0) = Left(arrChunks(1), 2)
arrPieces(1) = Right(arrChunks(1), 2)
arrChunks(1) = arrPieces(1) & arrPieces(0)

arrPieces(0) = Left(arrChunks(2), 2)
arrPieces(1) = Right(arrChunks(2), 2)
arrChunks(2) = arrPieces(1) & arrPieces(0)

strNew = arrChunks(0) & arrChunks(1) & arrChunks(2) & arrChunks(3)

oWrite.WriteLine(strUsername & “,” & strNew)

strLine = Trim(oRead.ReadLine())
Loop
oRead.Close()
oWrite.Close()

End Sub