Creating a custom report for OIM 10g

The step-by-step guide on how to construct custom reports from within OIM 10g.
September 24, 2012
OIM-10g

The Goal

The goal here is to create a custom report containing a list of all the identities and the resource information. In this case, the resource is called MY_USERS_GTC.

Within this report, I want to present the following values:

  • username
  • first name
  • lastname
  • Resource Name
  • E-mail
  • resource status

Note: Normally I would have not consider pulling the 'email address' from the resource as it's not from a non trusted resource, unlike HR. I could not be bothered in changing it so for the purpose of this blog, lets pretend is something like 'access level' or 'access rights'.

The report will be called 'UsersWithMYUSERSGTCResource'

In order to create a new report within OIM 10g, you will be required to provide the following:
  • a .SQL file containing a modified store procedure
  • XML file containing the reporting details
  • Modification of the xlWebAdmin.properties file


Step 1: Connect to the database

https://technicalconfessions.com/images/postimages/postimages/_69_2_Connect to the OIM database.png

In this example, I have decided to use the Oracle freeware product, SQL Developer. You need to create a new connection. Enter in your Oracle property values and test the connection by clicking connect.


Step 2: Locating the Xelsysadm user

https://technicalconfessions.com/images/postimages/postimages/_69_3_select xelsysadm user from within sqldeveloper.png

As you may already know, the assignment of the tables, views, stored procedures etc are assigned to individual identities. In my case, I have assigned the OIM schema to the 'xelsysadm' user. Unless you have changed the user, the default is xelsysadm.

You need to expand out the user xelsysadm, then expand out the procedures.


Step 3: Locate the 'XL_SP_USERRESOURCEACCESS' file

https://technicalconfessions.com/images/postimages/postimages/_69_4_select a pre-defined stored procedure.png

To use as a template for creating new reports, locate the XL_SP_USERRESOURCEACCESS store procedure. Double click on this and a new window will display on the right. This is almost identical to the report that you will be creating, though we will need to make some alterations.

As you have the store procedure open, click on file and click save as.... Now find a suitable location to save this new file and call it 'Default_Store_Procedure_for_Reports.sql'. Once you've done that, click OK.

https://technicalconfessions.com/images/postimages/postimages/_69_5_saving a store procedure within SQL developer.png

Step 4: Modify the SQL statement

https://technicalconfessions.com/images/postimages/postimages/_69_6_Results from SQL Query.png

In order to create a report, you must first construct a SQL DDL Query, which will contain all the information from the database.

This is the SQL query that I will be using:

select distinct usr.usr_login AS "User_Login",
usr.usr_first_name AS "First_Name",
usr.usr_last_name AS "Last_Name",
obj.obj_name AS "Resource_Name",
UD_MY_USERS.UD_MY_USERS_EMAIL AS "E-mail"
FROM xelsysadm.usr,
xelsysadm.obi,
xelsysadm.obj,
xelsysadm.oiu,
xelsysadm.ost,
xelsysadm.orc,
xelsysadm.UD_MY_USERS
WHERE
obi.obj_key = obj.obj_key
AND obi.obi_key = oiu.obi_key
AND oiu.usr_key = usr.usr_key
AND ost.ost_key = oiu.ost_key
AND oiu.orc_key = orc.orc_key
AND orc.orc_key = xelsysadm.UD_MY_USERS.orc_key
AND obj.obj_name= 'MY_USERS_GTC'


You will probably need to change the object name and the values you are pulling


Step 5: Altering the Store procedure

Now you have the default file that you saved and the SQL query, you will need to start manipulating the store procedure file by doing the following:

  • 1. Change the procedure name (Step 6)
  • 2. Removing/Adding parameters (Step 7 + 8)
  • 3. Removing/Adding the IF statements (Step 9)
  • 4. Include SQL query in SP (Step 10)
  • 5. Alter the xlWebAdmin.properties (Step 11)

Step 6: 'XL_SP_USERRESOURCEACCESS' alteration

There are a few changes that you need to do there, you start off by changing the stored procedure name into something else.

On line 2, change the store procedure name...

PROCEDURE XL_SP_UserResourceAccess (

To...

PROCEDURE XL_SP_DR_NEWRESOURCE (


On line 327, change the store procedure name...

END XL_SP_UserResourceAccess;

To...

END XL_SP_DR_NEWRESOURCE (


Step 7: Remove any unnecessary parameters

The first 12 parameters within the store procedure (upto strudfcolumnvaluelist_in) are mandatory parameters.
For the meanwhile, remove all the values that you will not be needing:

struserlogin_in IN VARCHAR2,
strfirstname_in IN VARCHAR2,
strmiddlename_in IN VARCHAR2,
strlastname_in IN VARCHAR2,
struseremail_in IN VARCHAR2,
strorgname_in IN VARCHAR2,
strusergroup_in IN VARCHAR2,
strmgrfirstname_in IN VARCHAR2,
strmgrlastname_in IN VARCHAR2,
struserstatus_in IN VARCHAR2,
struseremptype_in IN VARCHAR2


Step 8: Include the necessary parameters

https://technicalconfessions.com/images/postimages/postimages/_69_10_inserting new procedure values.png

As I mentioned before, I will be wanting to display the following values within the search query:

  • username
  • first name
  • lastname
  • resource status
  • E-mail
When creating the report, which is a later step, I will be using the imported values into the report. I am also allowing the user to enter in any of the values as part of the query

I will be using the standard report naming convention. for reports, it's str_in. Call the field name whatever you want, as long as it's similar to the original import field.

Example,
username within my report will be struserlogin_in
lastname within my report will be strlastname_in

So I need to include all the fields that can use for the search query

struserlogin_in IN VARCHAR2,
strfirstname_in IN VARCHAR2,
strlastname_in IN VARCHAR2,
strresourcestatus_in IN VARCHAR2,
strservicenewacclevel_in IN VARCHAR2


Step 9: Include/remove any IF statements

https://technicalconfessions.com/images/postimages/postimages/_69_11_including and removing if statements.png

Starting around the line 95 mark within the same file, you will need to remove any of the IF statements from step 5 and include any IF statements from step 6 Example, I am including an IF statement for 'strdatabase_in'
Review the form that is assigned to the resource object of interest. In this case, I am extracting information from the Oracle RO Resource. Form associated to that is called 'UD_DB_DR'
The field label value associated to this form that I wish to search for is called 'E-mail'. The name of this is called UD_DB_MY_USERS_Email.

Therefore, I will be using the structure of 'Form Designer.Column Property' to locate the value within the IF statement.

Example

IF strdatabase_in IS NOT NULL THEN
whereclause := whereclause
|| ' AND UPPER(UD_DB_DR.UD_MY_USERS_EMAIL) LIKE '
|| UPPER (''''||stremail_in||'''')
|| ' ';
END IF;


Make sure there are IF statements for all the additional field that you've added within step 6


Continue...

There are other steps required, which can be located within this blog,

'Creating custom reports part 2'.

About the author

Daniel is a Technical Manager with over 10 years of consulting expertise in the Identity and Access Management space.
Daniel has built from scratch this blog as well as technicalconfessions.com
Follow Daniel on twitter @nervouswiggles

Comments

Other Posts

AWS-PHP integration - Email not sent. SMTP Error: Could not authenticate.

phpsmtpaws

February 6, 2020
Created by: Daniel Redfern
AS I was migrating my environment into an S3 environment, I wanted to leverage off the SES services that AWS provide, more specifically, to leverage the off the SMTP functionality by sending an email via PHP
Read More...

SOLUTION: no headers files (.h) found in softwareserial - Arduino

Arduino

February 24, 2019
Created by: Daniel Redfern
The WeMos D1 is a ESP8266 WiFi based board is an extension to the current out-of-the-box library that comes with the Arduino installation. Because of this, you need to import in the libraries as well as acknowledging the specific board. This process is highly confusion with a number of different individuals talking about a number of different ways to integrate.
Read More...

NameID element must be present as part of the Subject in the Response message

ShibbolethSAML

August 7, 2018
Created by: Daniel Redfern
NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration.
Read More...

HOW TO provision AD group membership from OpenIDM

OpenIDMICFAD-connector

June 15, 2018
Created by: Daniel Redfern
For what I see, there's not too many supportive documentations out there that will demonstrate how provision AD group membership with the ICF connector using OpenIDM. The use of the special ldapGroups attribute is not explained anywhere in the Integrators guides to to the date of this blog. This quick blog identifies the tasks required to provision AD group membership from OpenIDM to AD using the LDAP ICF connector. However this doesn't really explain what ldapGroups actually does and there's no real worked example of how to go from an Assignment to ldapGroups to an assigned group in AD. I wrote up a wiki article for my own reference: AD group memberships automatically to users This is just my view, others may disagree, but I think the implementation experience could be improved with some more documentation and a more detailed example here.
Read More...

ForgeRock OpenIDM - InvalidCredentialException: Remote framework key is invalid

ICFIDMOpenIDMOpenICF

November 8, 2017
Created by: Daniel Redfern
In the past, the similar error occurred though for the Oracle Identity Management solution. invalidcredentialexception remote framework key is invalid Because they all share the ICF connector framework, the error/solution would be the same.
Read More...

org.forgerock.script.exception.ScriptCompilationException: missing ; before statement

IDMsync.confforgerockopenidm

November 8, 2017
Created by: Daniel Redfern
org.forgerock.script.exception.ScriptCompilationException: missing ; before statement
Read More...

ForgeRock IDM - org.forgerock.script.exception.ScriptCompilationException: missing ; before statemen

OpenIDMsync.confForgeRock

September 17, 2017
Created by: Daniel Redfern
ForgeRock IDM - org.forgerock.script.exception.ScriptCompilationException: missing ; before statement
Read More...

Caused by: org.forgerock.json.resource.BadRequestException: Target does not support attribute groups

OpenIDMForgeRockICFConnector

September 17, 2017
Created by: Daniel Redfern
When performing the attempt of a reconciliation from ForgeRock IDM to Active Directory, I would get the following error
Read More...

ForgeRock OpenIDM - InvalidCredentialException: Remote framework key is invalid

OpenIDMForgeRockICFConnectorAD

September 17, 2017
Created by: Daniel Redfern
In the past, the similar error occurred though for the Oracle Identity Management solution. invalidcredentialexception remote framework key is invalid Because they all share the ICF connector framework, the error/solution would be the same.
Read More...

ERROR Caused by com.google.api.client.auth.oauth2.TokenResponseException 400 Bad Request - invalid_g

OpenIDMIDMGoogleGoogle-AppsICFreconciliation

September 12, 2017
Created by: Daniel Redfern
During the reconcilation from OpenIDM to the ICF google apps connector, the following error response would occur. ERROR Caused by com.google.api.client.auth.oauth2.TokenResponseException 400 Bad Request - invalid_grant
Read More...