Interview Question's--Sun IDM

Interview Question's--Sun IDM

What is Sun IDM and basic features?

What is Reconciliation and Active Synchronization?

How to Configure Active Sync and provision the user in AD?

Diference between Full and Incremental Reconcilaition?

Difference between Checkout Objet,check out view and Get object with example?

How to write customize adapter?

What is work Item?

Difference between Derivation,Default,Expansion and Valiadtaion tag?

How call User Form from workflow?

How to call workflow from form?

What is approval workflow,can you explain it with example?

Can you explain the different situation of reconcilation?

Difference between Unassigned and Unmatched situation?

Difference Between Confirmation and Correlation rule?

What is the baseContext of a Form used with Work Item(s)?

Differnece between Adapter and Connector?

What is identity template?

What is difference between <contains> and <containsall> tag?

How to call Java class from Xpress languange?

How many ways to data load in Sun IDM?

What is Bulk refresh?

What is SPMl and How to configure SPML?

What is difference between xprees language and XMl language?

What is the difference between an application server and a Web server?

What is password Sync and How it is configure?

What is difference between Form and Process mapping?

How can I get the session?

What is difference between Select and Multiselect class in Form?

How do I associate a Workflow TaskDefinition with a User Form?

How do I trace workflow?

How can I get a list of all Users?

What is resultlimit in workflow and how can define?

What actually sends the email in workflow?

What is ExposedVariable, EditableVariables syntax?

How to exclude the resoucre for password synchronization?

What is difference between List and Map?

How many interfaces in Sun IDM

What is self registartion and How it can enable?

What is Roles and Rules?

Diffrence between Business Role,Application Role,Asset Role and IT role?

Identity & access management product's

Vendor	Product
CA	CA Identity Manager
	CA Role & Compliance Manager
	CA SiteMinder
	CA SOA Security Manager
	CA Federation Manager
	CA Embedded Entitlements Manager
	CA Single Sign-On
	CA Directory
	CA Access Control
Courion	AccountCourier
	RoleCourier
	ComplianceCourier
	PasswordCourier
	CertificateCourier
Hitachi ID Systems	Hitachi ID Management Suite
IBM	Tivoli Identity Manager
	Tivoli Federated Identity Manager
	Tivoli Security Policy Manager
	Tivoli Access Manager for Enterprise Single Sign-On
	Tivoli Directory Server
	Tivoli Directory Integrator
	Tivoli Compliance Insight Manager
	Tivoli Security Information and Event Manager
	Tivoli Access Manager for e-business
Sun Microsystems(Now Oracle)	Sun Identity Manager(Oracle Waveset)
	Sun Role Manager(OA)
	Sun Compliance Manager
	Sun OpenSSO Enterprise(Oracle Open SSO)
	Sun Directory Server Enterprise Edition(ODSEE)
Microsoft	Active Directory Domain Services
	Active Directory Federation Services
	Active Directory Lightweight Directory Services
	Active Directory Certificate Services
	Forefront Identity Manager
	Intelligent Application Gateway
SAP	SAP NetWeaver Identity Management
	SAP BusinessObjects Access Control application
Novell	Compliance Management Platform
	Identity Manager and Roles Based Provisioning Module
	Designer for Identity Manager
	Access Manager
	eDirectory
Oracle	Oracle Identity Manager
	Oracle Access Manager
	Oracle Identity Federation
	Oracle Internet Directory
	Oracle Virtual Directory

Creating a button field that performs like a link field.

Is it possible to create a button field on my userform that acts like a link
field?

ANSWER:

<!-- Link field to google -->
 
          <Field name='testLink'>
            <Display class='Link'>
              <Property name='name' value='Google'/>
              <Property name='URL' value='http://www.google.com'/>
            </Display>
          </Field>
 

<!-- Corresponding button field -->

          <Field name='testLinkButton'>
            <Display class='Button'>
              <Property name='value' value='Google'/>
              <Property name='onClick' value='javascript:
location.href=&#039;http://www.google.com&#039;;return true;'/>
            </Display>
          </Field>

How to specify the workflow to be run and arguments to a workflow from a userform.

How can I specify a specific workflow that should be executed from within a userform?

I would also like to know how to pass in arguments to the specified workflow from
within a userform.

ANSWER:

To specify execution of a specific workflow, from within a userform, you would use
the following syntax:

<Field name='viewOptions.Process'>
  <Expansion>
    <!-- Name of custom workflow goes here -->
    <s>My Custom Create User</s>
  </Expansion>
</Field>

To pass specific arguments into a workflow, you would use the following syntax:

      <!-- The following goes into your userform.
           The variable name after processInputs. can be whatever you desire -->
      <Field name='processInputs.isUserValid'>
        <Expansion>
          <s>true</s>
        </Expansion>
      </Field>

      <!-- The following gets put at the top of the workflow that you
           are passing the argument into -->
      <Variable name='isUserValid' input='true'>
        <Comments>
          Passed from my active sync form
        </Comments>
      </Variable>

Once passed in, the argument can be referenced within the workflow.

How to use and configure timeouts in workflows

How do you set up approval escalations in workflow?

ANSWER:

A manual action has an attribute called timeout. This value is defined in
minutes if it is a positive number, or seconds if it is a negative number. 
For example, a timeout of two minutes could be represented as either timeout='2'
or timeout='-120'. After setting the action and timeout, you will need to define
the transitions from this activity to the next. You can evaluate the
WF_ACTION_TIMEOUT variable to see if it is true and if so transition to an
escalation activity. 

The following is an example of the create user workflow that has been modified
to call an 'escalate' activity if a timeout value is reached. If the timeout is
not reached, then the results of the APPROVED variable are evaluated which
decides whether to transition to the approved or rejected activity. 

    <Activity name='Wait'> 

      <ManualAction name='approve' timeout='180'> 
        <Owner name='$(APPROVER)'/> 
        <Variable name='APPROVAL' value='false'/> 
        <Return from='APPROVAL' to='APPROVED'/> 
        <FormRef> 
          <ObjectRef type='UserForm' id='#ID#UserForm:ApprovalForm'/> 
        </FormRef> 
        <ReportTitle> 
          <concat> 
            <s>Awaiting approval from \n</s> 
            <ref>APPROVER</ref> 
          </concat> 
        </ReportTitle> 
      </ManualAction> 

      <Transition to='Escalate'> 
        <eq> 
          <ref>WF_ACTION_TIMEOUT</ref> 
          <s>true</s> 
        </eq> 
      </Transition> 

      <Transition to='Approved'> 
        <eq><ref>APPROVED</ref><s>true</s></eq> 
      </Transition> 

      <Transition to='Rejected'/> 

    </Activity>

How to override the default resultLimit value within a workflow.

We have a use case where based on certain user actions within a workflow the
results of task instance should be indefinitely retained or deleted. I can set
the resultOption at the TaskDefinition level but it will always delete or retain
the instance. 

Is there a programmatic way of setting the resultOptions value (to either delete
or wait) within the workflow?

ANSWER:

You can set the resultLimit option for the TaskInstance by using the following
workflow Action:

 <Action application='SET_RESULT_LIMIT'>
   <Argument name='limit' value='0'/>
 </Action>

Set the limit in seconds that a task instance is allowed to live after the task
has completed.

A limit of zero means that the TaskInstance will be deleted immediately after
the task is complete. 

A limit of -1 means that the TaskInstance will never be automatically deleted,
though it may be manually deleted by the user.

How to exclude special characters from passwords via policy. Sun Idm

How can I create a password policy that stipulates a password should not contain
special characters, such as: 

Password should not contains following symbols : / \ ? [ ] | < > = , ? *

ANSWER:

The way to accomplish this is to add these characters, one per line, in the
"Must Not Contain Words" multi-line text box: 

/ 
\ 
? 
[ 
] 
| 
< 
> 
= 
, 
? 
*

How to limit the number of database connections Sun IDM

What controls the number of database connections made between the Identity
Manager product and how would one go about "limiting" them?

ANSWER:

By default, the number of concurrent JDBC connections is unlimited. The Identity
Manager repository will request as many connections as it needs to serve each
concurrent repository request. 

Database connections can be controlled by these means: 
  
- Identity Manager (not limited by default) 
- Application server datasource configuration (If you are using a datasource). 
- Database itself. 
  
To limit the number of connections in the Identity Manager product, you could
set the maxConcurrentConnections property in the RepositoryConfiguration object.


Setting this value to a positive integer limits the number of concurrent
connections. The Repository will never exceed a configured limit N. Instead,
every thread N+1 will block *prior* to obtaining JDBC connection until one of
the previously outstanding connections is closed. 

By default, this property is set to 0, which means "do not limit" the number of
connections.

Note that when a resource adapter makes connections to the same back-end database 
instance that the repository uses, these adapter connections are not affected by 
RepositoryConfiguration settings.

Reconcile hanging at 99% complete

My full recon operation starts normally.

Then the following status report stays the same for hours:
Full reconcilation in progress: reconciling accounts (99%)

The task results object reports timings of ~6800sec of "processing" yet finishTime-
startTime = 78751sec (x11 as long).

The recon configuration does not use any post recon workflow.

What else could cause a recon to run smoothly until the post-processing/cleanup?

ANSWER:

There are a few things you can do:

  -  Look at debug/Show_Reconciler.jsp page when it reaches this state. This 
     provides a window into the workings of the reconciler; you'll be able to see 
     what the threads are working on.

  -  Turn on tracing. I'd suggest level 2 tracing on the following classes: 
     com.waveset.recon.ReconTask
     com.waveset.recon.Response

Slow performance seen during checkinView operation

QUESTION:

While looking into some possible performance issues using the
debug/Show_Timings.jsp page, one method we are spending time in is in the
com.waveset.ViewMaster.checkinView method. 

I've also noticed on this timings page that we are doing a lot of File I/O
operations. 

Are these two connected somehow?

ANSWER:

The performance of ViewMaster.checkinView is extremely variable. It depends on
the type of view you're using, the forms you're using, and the task that gets
launched. In general, checkinView will do the following things for all view
types. 
  
  1) run the Expansion expressions in the Form 
  2) do view-specific "refresh" processing 
  3) convert the view into one or more repository objects 
  4) launch a task, often a workflow task 
  
File I/O doesn't normally happen unless you are using a "local files"
configuration of the repository. If you are, then you may see I/O during steps 3
and 4. A local files repository is much slower than other configurations, it is
useful only for testing and demos. 
  
File I/O can also happen if you have one of the tracing options turned on.
Workflow and XPRESS trace in particular can really slow things down, check
Waveset.properties to see if any of these are set to true: 
  
  exception.trace 
  xpress.trace 
  form.trace 
  workflow.trace 
  workflow.consoleTrace 
  workflow.fileTrace 
  provisioner.trace 
  task.scheduler.trace 
  
Class and method trace enabled in the debug pages can also slow things down. 
  
If you are not using a local files repository, and do not have trace enabled,
then the only place file I/O should be happening is in your <Expansion>
expressions in step 1. Look at the Form and see if any of your Expansions invoke
custom Java classes that might do I/O or query a database. 
  
The view-specific "refresh" in step 2 is dependent on the view you are using.
Refreshing the WorkItem and Process views has practically no overhead.
Refreshing a User view is rather complicated. It generates a lot of garbage and
is not particularly efficient, but is usually not significant compared to the
overhead of accessing the repository and the resources. This may become more
significant if there are a lot of concurrent users. 
  
In step 3, we usually write at least one repository object. Depending on what
the underlying database is and the load on it, this may be fast or slow. Usually
it is relatively fast. 
  
Step 4 is where most of the variability in performance lies. The task is usually
run synchronously, meaning that it will execute to completion in the request
thread. For a User view workflow without approvals, this means we may do
provisioning which is usually the most expensive part of checking in the User
view. If there are approvals, we will execute up to the first approval and
suspend the task. This is usually relatively fast unless you have modified the
workflow to run database queries prior to approvals. 
  
Checking in a WorkItem view does not launch a process, so it should always be
fast. 
  
Checkin of a Process view will launch an arbitrary process, so performance is
dependent on what that process does. If the TaskDefinition has an execModeof
"async", then it will launch the task in the background and the checkin should
appear fast. If execMode is synchronous, the task will execute in the request
thread, if it is something like a report or resource scan it could take a long
time.

Oracle Waveset to Oracle Identity Manager Migration Guidelines

Oracle Waveset to Oracle Identity Manager Migration Guidelines-- This white paper published by Oracle on February'2011.As Sun Identity Manager(Now Oracle waveset) is acquired by Oracle they are palnning to migrate completetly Oracle waveset to OIM so that they can provide continous solution to all those client which are using SUN IDM.I have lot experience in Sun idm and I feel it is great product and not easy to migrate into OIM.

Below the steps which they would be follow---------

Contents

1. Introduction ....................................................................................................................................... 3

2. References .......................................................................................................................................... 3

3. Architecture Overview and Analysis .............................................................................................. 4

3.1 User Interface ................................................................................................................................. 6

3.2 Enterprise Identity Data Objects .................................................................................................. 6

3.3 Schema, Templates and Policy Objects ..................................................................................... 12

3.4 Administration and Authorization Objects .............................................................................. 15

3.5 Business Logic and Process Data Objects ................................................................................. 16

3.6 Audit and Compliance Data Objects ......................................................................................... 18

3.7 Server Data Objects ...................................................................................................................... 19

4. Conclusion ....................................................................................................................................... 20

1. Introduction

After the acquisition of Sun Microsystems by Oracle Corporation, Oracle has announced

that Oracle Identity Manager will be the strategic Identity Administration and

Provisioning product moving forward, with Oracle Waveset (formerly Sun Identity

Manager) going into ‘sustain and converge’ mode. All customers that have currently

deployed Oracle Waveset are encouraged to migrate to Oracle Identity Manager.

However, Oracle understands that customers may not be able to undertake such a

migration immediately. Project objectives and deadlines may force customers to postpone

a migration till a more suitable time. In the meantime, these customers will continue to

invest in their Waveset deployments, and are concerned about increasing their migration

burden in doing so.

To that end, the objective of this whitepaper is to provide Oracle Waveset customers a

high level guidance on how to continue to invest in their current Waveset deployment in a

manner that is migration friendly. When Oracle releases the OW to OIM migration toolkit

it will be accompanied by a detailed documentation on how each of the low level

constructs in OW can be auto, partial or manually migrated to OIM.

As a general readiness guideline, customers are advised to upgrade their OW

deployments to the 8.1.x version prior to migration or use the OW in-place upgrade

scripts as an intermediate step during the migration process. This will allow OW

customers to upgrade to Identity Connector framework based connectors thereby enabling

them to leverage any new or updates to the connectors provided by Oracle.

2. References

• Oracle Waveset 8.0 documentation:

http://download.oracle.com/docs/cd/E19225-01/index.html

• Oracle Identity Manager 11g documentation :

http://download.oracle.com/docs/cd/E14571_01/im.htm#oim

3. Architecture Overview and Analysis

Both Oracle Waveset (OW) and Oracle Identity Manager (OIM) address a wide-range of

enterprise level user provisioning and administration needs. This section provide a quick

overview of the building blocks of each of these products, analyses and map each of the

product components in OW and OIM and also provide some of the special migration

considerations/guidelines for Waveset customers.

Figure 1: Oracle Waveset Component Architecture

Figure 2: Oracle Identity Manager Component Architecture

3.1 User Interface

OW follows the MVC architecture for its various interfaces, Admin Interface, User

Interface and Debug Interface (for troubleshooting and maintenance).

OIM follows Web 2.0 technology for its interfaces, Self Service Interface, Administrator

console and Advanced Administrator console. It uses Oracle JDeveloper as the IDE tool

for developing and deploying workflow objects etc.

Special Considerations

• As each product follows a completely different technology for its user interfaces, any

customizations done on the Oracle Waveset web module would have to re-evaluated

and if needed, implemented in OIM post migration.

3.2 Enterprise Identity Data Objects

a) Organization

In Waveset, Organizations enable logical and secure management of user accounts and

administrators and are used to limit access to resources, applications, roles and other

Waveset objects. The concept of Waveset organization directly maps to the OIM

organization constructs with the field/data visibility controlled by OIM’s Administrator

Roles capabilities and enforced using Oracle Entitlement Server based fine grained

authorization policies.

Special Considerations

• Attestation and Remediation Operations

OW supports definition of organization-level forms for attestation or remediation

operations. OIM supports these functions to be performed at a global level with the

attestation policy having the capability of supporting scoping based on organization,

users, roles and resources. Customers are advised to consider Oracle Identity

Analytics (OIA), Oracle’s strategic product for compliance and governance features,

which can address all attestation and remediation operations needed.

• User Member Rules

In OW, a user is statically associated with a single organization but user membership

to an organization can be dynamically specified using a rule based assignment. OIM

also allows a user to be statically associated with a single organization and uses the

OIM roles concept with auto-membership rules to associate users dynamically to

organizations.

• Default Organizations

OW defines three default organizations (“Top”, “All”, “End-user”) out of the box

whereas OIM supports a hierarchy based static Organization assignment with

“Xellerate Users” organization representing the default out of the box Organization.

For new organization definition, OW customers are advised to limit the usage of

“All” and “End-User” Organizations, instead define all capabilities within the “Top”

organization.

b) Role

A role is an OW object that allows resource access rights to be grouped and efficiently

assigned to users. The concept of an OW role maps directly to the concept of an OIM

role.

Special Considerations

• Role Types

In OW, roles are organized into four role types, Business Roles, IT Roles,

Applications and Assets. OIM roles supports role hierarchy and nesting definition,

role categories and the ability to define extended attributes on the role object all or

any of these can be used to address the role type categorization in OW.

• Role-Resource Associations

In OW, IT Roles/Application Roles can be associated with Resources and Resource

Entitlements. This defines which resources and entitlements within a resource will

get automatically provisioned to a user when they get assigned these roles.

Entitlements can be specified either as “Text” value or “XPRESS Rule” and setting

mechanism can be specified as “Default value”, “Set to value”, “Merge with value”,

etc.

IT Roles/Application Roles feature of OW corresponds to the Access Policy construct

in OIM. The entitlements for each of the resource in the access policy need to be predetermined

and specified during access policy definition. For this reason, customers

are advised to make use of the “Text” value functionality when defining entitlements

for a resource in the Role-Resource association definition.

• Contained Role Association Type

In OW, the Contained Role association type can be set to either “Required”,

“Conditional” or “Optional”. If the association type is set to “Conditional” an

XPRESS rule defines when the role containment should occur. In OIM, as Roles

definition needs a pre-determined list of access rights to be defined, customers are

advised to make use of the “Required” association type to the maximum extent

possible.

• Role Exclusions

In OW, role exclusion allows a form of SoD around roles. OIM does not have any

corresponding feature, and relies on the integration with OIA to provide this

capability. If the role exclusion implies a resource exclusion, this could be modeled

in the Access Policy using its “Deny” capability.

• Role Owners

In OW, role owners have the responsibility to approve changes to the role definition.

More than one user can be assigned as a role owner or the list of role owners can be

evaluated using an XPRESS rule.

Oracle’s strategic product for Role management, OIA, has all (and additional)

constructs that supports similar functionality. In OIM a single user can be designated

statically as the role owner and multiple owners can be represented using additional

user defined fields in the role object. Customers are advised to limit the usage of

XPRESS rules to evaluate the list of role owners to the extent possible in order to

have this construct a candidate for automated migration to OIM.

• Role Approvers

In OW, more than one user can be specified as the approver for handling role

assignment requests. It can also be specified using an XPRESS rule. In OIM, this list

of approvers can be modeled as an OIM role (with auto-membership rules) which

can be used in the creation of the role-assignment approval policy.

XPRESS rules that support certain dynamic approver determination based on

context may not map directly to the OIM role in the approval policy, and may

therefore require definition or usage of an existing workflow composite with

approver determination rules in OIM that accurately reflect the customer policies.

c) User

A user is an OW object that encapsulates a person of interest in the identity

administration and provisioning engine. The concept of an OW user maps directly to the

concept of an OIM user.

Special Considerations

• Organization Membership

In OW, a user is statically associated with a single organization but user membership

to an organization can be dynamically specified using a rule based assignment. OIM

also allows a user to be statically associated with a single organization and uses the

OIM roles concept with auto-membership rules to associate users dynamically to

organizations.

• Resource Exclusions

In OW, resource exclusion provides a way to specify resources that cannot/should

not be provisioned at a user level. OIM addresses resource exclusion at the Access

policy level that will get evaluated for each user belonging to the corresponding role

during the policy evaluation.

• Admin Roles and Capabilities

The OW User Admin Roles and Capabilities provides a way to define what an OW

user is authorized to do within the system. OIM provides this feature through its

embedded authorization engine (OES). Authorizations are defined at the Role level

in OIM and hence customers are advised to avoid defining authorization policies on

a per user basis in OIM.

• Controlled Organizations

The Controlled Organizations attribute in OW is used to specify organizations that

the user has rights to manage as an administrator. OIM addresses this functionality

using the role and authorization policy constructs. Every organization in OIM will

have an organization administrator role and any user added to this role will have

administration capabilities on that organization.

• User Form and View User Form

These forms allow OW to control what the organization administrator can view on a

user in that organization. This capability maps to the Authorization Policies for User

Management (with fine-grained attribute controls) construct in OIM. Customers are

advised to avoid usage of Forms at User Level rather define authorization policies at

a Role level as is done in OIM.

• Delegations

The OW Delegation concept allows the user to delegate certain system level

responsibilities to another user. This feature maps to the OIM Proxy feature. OW

stores information about current, new and past proxies as does OIM.

In OW the feature has some fine-grained capabilities that allow the user to select the

type of “Work Items” (e.g. Role Approval, Organization Approval, etc) and assign a

delegate for each of these Work Items. In OIM, a delegate/proxy user will have the

responsibility to perform all approval functions of the original user and hence

customers are advised to consider defining a single delegation for all Work Items,

avoid defining overlapping delegation and avoid usage of the “Forward Approvals

To” field in the User profile.

• Attestation and Remediation Operations

OW supports definition of user-level forms for attestation or remediation operations.

OIM supports these functions to be performed at a global level with the attestation

policy having the capability of supporting scoping based on organization, users,

roles and resources. Customers are advised to consider OIA, Oracle’s strategic

product for compliance and governance features, which can address all attestation

and remediation operations needed.

d) Resource

The heart of a provisioning system is its ability to manage accounts on target systems,

referred to as Resources in the conceptual architecture. Both OW and OIM have

comprehensive capabilities to manage resources, with features that map to each other.

Special Considerations

• Identity Templates

The Identity Template feature defines syntax for user accounts and is useful for

hierarchical namespaces. This may be used while specifying how to auto-generate

the value for account attributes (e.g. specifying the syntax of how to create the user

DN for an AD user account). OIM provides similar capability with the use of prepopulate

plug-ins that can be used to generate values for various account attributes.

• Resource Object versus Resource Instance Level Configurations

OW supports the ability to configure a number of provisioning features per resource

instance. This includes capabilities like Account Attributes, Account Features

Configuration (individual connector features/operations like Create, Update,

Rename, Disable, Enable can be disabled and an action can be configured if such an

operation is attempted for each resource instance), Identity System Parameters

(Retry Configuration), Password Policy and Approvers.

In OIM, some of these configurations are defined at the resource object level, and so

configurations are applicable to all resource instances associated with that resource

object. If a customer needs the ability to define these configuration on a per resource

instance basis, they should consider defining each of these resource instances as its

own resource object instead of using the same (shared) resource object with multiple

IT resources.

• Organization Scope

OW allows the visibility of a resource instance to be scoped to a specific organization

or a set of organizations. In OIM, resources (not instances) can be scoped at the

Organization level rather than at a resource instance level. . If a customer needs the

ability to scope resources at a per resource instance basis, they should consider

defining each of these resource instances as its own resource object instead of using

the same (shared) resource object with multiple IT resources.

3.3 Schema, Templates and Policy Objects

a) IDM Schema Configuration

User and Role extended, query-able, and summary attributes are defined in the IDM

Schema Configuration object in OW. The OW User Extended Attributes directly maps to

the OIM User Configuration and Role User Defined Fields objects.

Special Considerations

• Multi-Valued Attributes

OW supports attributes to be specified as multi-valued for User, Role and Resource

entitlement entities while OIM supports multi-valued attributes for Resource

entitlements only. For existing multi-valued attributes in User and Role entities in

OW, the OW to OIM Migration tools that will be provided by Oracle will have the

capability of converting them to comma separated values and storing the value in a

single text field. As part of the migration solution, Oracle will be able to provide

samples that will address the customizations required for OIM LDAP synch,

reconciliation and provisioning of these single text field attribute to the

corresponding multi-valued attributes in the target systems.

b) Email Templates

OW and OIM use email templates to deliver information and requests for action to users

and approvers. OIM uses the Notification Service to perform all notification-related

operations including localization support.

Special Considerations

• Template Attributes

OW has a pre-determined set of variables that are allowed in the Email body

whereas OIM supports event sensitive variables to be defined during Email template

definition. For example, request data and beneficiary data variables are available for

Request based email templates. The migration tools will be able to migrate the Email

templates except for the dynamic variables which can be configured in OIM once

these templates are migrated to OIM.

c) Account and Account ID Policy

OW supports Identity System Account Policies (establish user, password and

authentication policy options and constraints) and Resource password and Account ID

policies (define length rules, character type rules and allowed words and attribute

values).

OIM supports support username generation and validation as a standard feature.

Customers have the flexibility to extend or create their customized plug-ins that defines

the rules by which valid and unique usernames are generated and validated.

Special Considerations

• OW Account Policy Attributes

Some of the OW Account Policy characteristics like Password provided by user/

generated, Reset option (permanent/temporary), Reset temporary password expires

in (Days/Weeks/Months), Reset notification option (immediate, email,

administrator), Password change or reset limit (Number of times in Days/Weeks/

Months) and Answer Quality Policy have no direct mapping with OIM constructs,

though many of these can be achieved using custom plug-ins and scheduled tasks in

OIM. Customers are advised to limit the use of Authentication Question Policies

(All, Any, Next, Random, Round Robin) in OW as OIM currently supports static

displays of all Challenge Q&A set at a system wide level.

• Account ID Policy Attributes

Some of the Account ID Policy characteristics in OW like Account Lock expiry time

for failed password and challenge question login, Max number of failed login

attempts for password, Max number of failed login attempts for challenge question

authentication and List of challenge questions are currently supported as a systemwide

setting in OIM.

• Organization Scope

OW allows the Account and Account ID policy to be scoped and specified at

organization and resource levels. In OIM this can be achieved by extending the plugins

available for Account and Account ID policy generation and validation.

d) Password Policy

Password policies establish limitations for passwords so that users provide strong

passwords for authentication. The OW Password Policy object maps to the OIM

Password Policy object. Both OIM and OW provide configurable password policy

mechanisms that can be assigned at organization and resource level.

Special Considerations

• Password Policy Attributes

Some of the OW Password Policy characteristics like Minimum number of character

type rules that must pass, Character rule – Max Sequential, Character rule – Min

Begin Alpha, Character rule – Min Begin Numeric, Character rule – Min

Embedded Numeric, Character rule – Max Embedded Spaces, Character rule – Max

Alpha, Character rule – Max Numeric, Character rule – Max Special, Character rule

– Max Uppercase, Character rule – Max Lowercase, Max number of similar

characters from previous passwords that cannot be reused and Must not contain

words have no direct mapping with OIM though each of these additional

characteristics can be enforced at the password validation stage by developing a

custom plug-in. Customers are advised to limit the usage of these characteristics to

the extent possible.

e) Reconciliation Policy

Reconciliation policies allow establishing a set of responses, by resource, for each

Reconciliation task. Within a policy, it allows selection of the server to run reconciliation,

determine how often and when reconciliation takes place, and set responses to each

situation encountered during reconciliation. It can also be configured to detect changes

made natively on the target systems to account attributes. OIM supports similar

functionality using the Scheduled Task and Reconciliation Rule constructs.

Special Considerations

• Reconciliation Policy Attributes

Some of the OW Reconciliation Policy characteristics like Account Confirmation

Rule, Per-account workflow, Error Limit, Maximum natively removed accounts and

Proxy Administrator to perform reconciliations have no direct mapping with

OIM and hence customers are advised to limit the usage of these characteristics

during Reconciliation policy definition.

3.4 Administration and Authorization Objects

a) Capabilities

Capabilities are groups of rights in the Waveset system. Capabilities represent

administrative job responsibilities, such as resetting passwords or administering user

accounts. Not all Waveset users need capabilities assigned. Only those users who will

perform one or more administrative actions through Waveset will require capabilities.

Capability definitions map to permissions/privileges present within OIM Authorization

Policies.

Special Considerations

• Supported Capabilities

Customers are advised to make use of the following User and Role Administration

capabilities in OW as these have a direct mapping to OIM and can be automatically

migrated to OIM. Create User, Update User, Bulk Update Users, Rename User,

View User, Unlock User, Bulk Unlock User, Disable User, Enable User, Bulk Enable

User, Bulk Disable User, Change Password Administrator, Reset Password

Administrator, Password Administrator, De-provision User, Delete IDM User, Bulk

Delete IDM User, Bulk Delete User, User Account Administrator, Account

Administrator, Bulk User Account Administrator, Bulk Account Administrator,

Change User Account Administrator, Change Account Administrator, Bulk Change

User Account Administrator, Bulk Change Account Administrator, End User

Administrator, Business Role Administrator, Role Administrator, View Business

Role and View Role.

b) Admin Roles

Oracle Waveset admin roles allows to define a unique set of capabilities for each set of

the organizations that are managed by an administrative user. An admin role is assigned

capabilities and controlled organizations, which can then be assigned to an

administrative user. Admin Roles in OW map to OIM roles and Authorization Policies.

Special Considerations

• Supported Capabilities

Customers are advised to limit the use of “Controlled Organizations Rule”,

“Capabilities Rule”, “Controlled Organizations User Form”, “Assigners”, “Objects to

include or exclude” and “Assign to Users Rule” during creation of new Admin Roles

as they don’t have a direct mapping with OIM Constructs.

3.5 Business Logic and Process Data Objects

a) Workflows

OW provides a workflow engine that performs orchestration of various OW operations.

In OW, Workflows mean any process by which work gets done. The workflow can be

initiated via a form submit, an SPML call, a WF services API call, reconciliation,

administrator driven activity etc.

OIM uses the human workflow process of Oracle SOA-BPEL suite for approval

workflows and a kernel level orchestration layer in the form of event handlers and plugins

to address all other provisioning workflow processing. It also does not rely on any

proprietary scripting language for setup, configuration, or process modeling rather

follows a standards based approach that is both configurable and customizable.

Since the two products differ completely in the way they execute workflows, it is

evident that migration of these constructs from OW to OIM may not be completely

migratable. To that effect, as part of the migration methodology, Oracle will provide

industry wide commonly used request approval workflow composites like Manager

Approval, Approval by Role, Entitlement or Resource Owner, Compliance Office

Approval, Approval by a Role/Person in a specific Job Code and/or Department,

Different Approval Paths based on criticality, risk or audit objective or role, resource or

entitlement, Serial/parallel/voting based approvals, Escalation Channels etc., in addition

to the out of the box workflow composites, to accelerate the migration process.

Special Considerations

Customers are advised to follow these general guidelines when defining additional

workflows in OW

• Separate UI (Forms) from Workflows. Workflow wizards are specific to OW and

may not be migratable.

• Separate Approval Tasks (or workflow sub tasks) from the overall workflow

process

• OW Fork-Join logic that are request-approval based may be migrated to BPEL

composites

• Consolidate Approval tasks in a single workflow (per scenario and not for the

entire deployment)

• In case of bulk requests (multiple entitlements or multiple accounts in a single

request), consider breaking them within the workflow.

• In case of uber workflows, consider using either a self-service request approach

or a RBAC approach.

b) User Forms

A Waveset form is an object associated with a page that contains rules about how the

browser should display user view attributes on that page. Forms can incorporate

business logic and are often used to manipulate view data before it is presented to the

user. Waveset forms map to OIM Process Forms and Request Data Sets.

Special Considerations

• Form Elements

Some of the OW specific Form Elements like Title Width, Defun, Defvar, Fieldref,

Include, Formref, Namespace and Form field elements like Options-Button, Options-

Action, Options-Library and Disable are very OW specific and have no direct

mapping with OIM constructs.

• Validation Logic

The implementation technology of performing validation on each of the form

elements differs in OW and OIM. In OIM, plug-in points are available to be

implemented to perform such functions.

c) Task Templates

Waveset Task Templates are used to maintain a collection of task (workflow) launch

parameters. Rather that requiring the user to enter those inputs every time the task is

launched, the inputs can be encapsulated in a Task Template object and stored. Though

OIM has no direct equivalent of Task Template feature, depending on the context, the

attributes present in the Waveset Task Templates can map to OIM Provisioning

Workflow or Request Approval Workflow.

Special Considerations

• The Oracle Pre-migration analysis tool can identify all task templates defined in the

OW deployment and based on these customers can migrate the attributes in these

task templates to the corresponding workflow composite in OIM.

3.6 Audit and Compliance Data Objects

a) Audit Policy

Waveset Audit Policies enable administrators to enforce preventive, detective and

corrective types of internal controls. OIM enforces such policies by integrating with

Oracle’s compliance and governance product, OIA. Any such audit policies created in

OW environment will need to be re-evaluated and implemented using the OIM-OIA

integration libraries.

b) Access Scans

Waveset provides a process for conducting access reviews that enable managers or other

responsible parties to review and verify user access privileges. Though this feature maps

to OIM’s Attestation function, customers are advised to consider usage of OIA which is

Oracle’s strategic product for all compliance requirements including attestation.

c) Report Definitions

Both OW and OIM products provide transactional and historical reports for compliance

needs. OIM has corresponding reports for most of the report that OW supports as of

today. OIM uses Oracle BI Publisher for reporting that provides a single reporting

environment to author, manage, and deliver the reports.

d) Audit Logging

The purpose of Waveset auditing is to record Who did What to Which Waveset objects,

and When did they do it. OW supports auditing Provisioner events, View Handler

events, Session events and Workflow events. Some of the identity data captured by OIM

includes user identity profile history, role membership history, user resource access, and

fine-grained entitlement history. OIM also captures data generated by its workflow,

policy, and reconciliation engines. By combining this data along with identity data,

customers have all the required data to address any identity and access-related audit

inquiry.

Special Considerations

• Audit Data

OW stores audit data in two tables, waveset.log (stores most of the audit event

details) and waveset.logattr (stores the IDs of the organizations to which each event

belongs). OIM stores audit data in normalized format within UPA* tables within its

database. As the two products follow different entity schema for data persistence,

customers are advised to follow a co-existence strategy so that reports for audit data

can be generated from both OW and OIM depending on the context.

3.7 Server Data Objects

a) Authentication Modules

OW uses pass-through authentication to grant user and administrator access through

one or more different passwords. Waveset manages authentication through the

implementation of Login applications (a collection of login module groups), Login

module groups (an ordered set of login modules) and Login modules (set authentication

for each assigned resource and specify one of several success requirements for

authentication). OIM uses LoginMapper plug-in point to override the default mapping

of JAAS user principal name to OIM username for SSO scenarios. This plug-in point can

be used to address pass-through authentication features similar to OW for

Administrator and User Interfaces. Authentication for other OW specific interfaces like

Business Process Editor, Service Provider Interface and IVR interface have no direct

correspondence to OIM authentication schemes.

b) OW Server Tasks

Waveset objects of the type TaskDefinition and RiskReportTask can be associated with a

schedule and invoked to run periodically. OIM also provides a Scheduler service to

provide the scheduling capabilities necessary for enterprise provisioning requirements.

Though the Server tasks configuration has some direct mapping with OIM constructs, it

is important to note that the implementation of business logic within these server tasks

differ in technology (XPRESS scripts vs Java) requiring some re-implementation in OIM

specific technology.

4. Conclusion

Though there are differences in the way OW and OIM addresses provisioning

requirements, it is evident from the above analysis that most of these functions have

corresponding or possibly better constructs in OIM. Oracle’s migration solution will

provide methodology, automation tools, assets (sample composites, event handlers etc)

and detailed documentation to ease the migration of these constructs from OW to OIM.

Customers can also benefit from additional proprietary assets that will be built on top of

Oracle’s migration toolkit by Oracle’s migration go-to Partners. As an immediate step,

customers are advised to make use of Oracle’s Pre-Migration Analysis tool that can

provide an insight into the complexities of their current OW environment and also enable

them to plan for the various activities that will be required for the actual migration project.

Based on these project planning metrics, customers can then decide to perform a

immediate cutover or decide to follow an iterative migration process with co-existence

strategies like having OIM for front office automation and OW for back office

provisioning fulfillment or vice versa.

Note: If any one required soft copy.Please share your email id,I will send you soft copy also.