Within the Remediation Tracking document, that mentions is how to use OIA once configured, though no step on how to configure it in the first place. Here's how to configure and use the remediation tracking.

There's two approaches for the remediation, closed-loop and open-looped remediation. The configuration addressed within the oracle documentation only presented the approach as closed-loop remediation only. The difference is that closed-loop is typically integrated within a provisioning server, open-loop remediation typically includes an additional step outside the realms of an electronic data exchange.

This step is open-loop remediation where OIA would be used to revoke access, then you import the differential data within a data file. Start by altering a couple of .xml files

Within the WEB-INF/Scheduling Context.xml

Line 183...

< ref bean="certificationRemediationJob"/>

Line 223...

<ref bean="certificationRemediationTrigger"/>

Within the WEB-INF/Jobs.xml

Line 942...

<bean id="certificationRemediationTrigger" class="org.springframework.scheduling.quartz.CronTriggerBean">
<property name="jobDetail">
<ref bean="certificationRemediationJob"/>
</property>
<property name="cronExpression">
<value>0 0/2 * * * ?</value>
</property>
</bean>

Bounce the WLS server then log into OIA. Then go to the following:
Identity Warehouse -- Resources -- Select Provisioning Mode -- Select Manual

Then go to Administration --> Revoke and Remediation --> Display Remediation Instructions
Then click on the following:

• Perform Closed loop Remediation
• Certification Completion Date

Note: This step is under the assumption that you already have the resources configured. I created a resource called FAKE along with 3 accounts.

There's two ways to use remediation tracking:

• Account Revoke
• Attribute Revoke

There's two ways to use the account remediation process:

• Account Maintenance
• Include 'suspended' within account feed

Here is the example of my data feed:

"C0000200","Group1,Group2,Group3","FAKE","FAKE",0
"D0000200","Group1,Group2","FAKE","FAKE",0
"C0000300","Group1,Group2,Group3","FAKE","FAKE",0

You're now ready to start testing out the remediation process. The first example is showing that the account is revoked. Make sure you setup the certification and then click 'revoke' on the account only, which subsequently means that the access will be revoked. It is important that the account is revoked because the remediation will monitor the account level, not the entitlements

You can now click on the remediation tracking and see the remediation tracking for that specific configuration.

Here is the example of my data feed of the remediated access:

"C0000200","Group1,Group2,Group3","FAKE","FAKE",1
"D0000200","Group1,Group2","FAKE","FAKE",0
"C0000300","Group1,Group2,Group3","FAKE","FAKE",0

Note: The suspended value is now 1

Here is the example of my data feed of the remediated access:

"C0000200","Group1,Group2,Group3","FAKE","FAKE",0
"D0000200","Group2","FAKE","FAKE",0
"C0000300","Group1,Group2,Group3","FAKE","FAKE",0

Note: You can now see that Group1 has been removed from the data feed

Now import the account again and it will update the 'lastupdated' timestamp on the accounts table. Because of this, it will check any differential when the account maintenance is executed.

About the author