A couple of years ago I submitted a blog on the OIM 10g Terminology. It was a little lightweight though now I've pulled together the OIM technologies. Hope this helps
Applications, IT Resources, Resource Objects
This blog is to explain the OIM terminology. Let's start by saying that our intention is to create an Active Directory account to a user. In this scenario, the Active Directory is the Resource
An IT resource is the virtual representation of an application instance. So if you have Active Directory installed across multiple servers, 1 particular server (aka target system) of the application will be the IT resource. In OIM terms, the IT resource is just a storage of information regarding that particular application server (such as server name, IP address, admin username)
A resource Object (aka RO) is the virtual representation of an actual resource. OIM uses resource Objects to track which users have accounts in the resource
So if you have Active Directory Resource, with two servers called server1 IT Resource and server2 another IT Resource, you need to create a resource object within OIM so OIM knows which accounts are within each Active Directory servers
Types of Forms
Moving along, we come to OIM forms. There are only 2 different types of OIM forms - The Resource Object form (which is basically what just talked about) and the Process Form.
1. Resource Object Form
The Resource Object Form (aka Object Form, aka RO Form) is used to create and manage a resource object within OIM. A resource Object form is provided to the user for the user to then input the data when requesting for access. You cannot alter the user data on a Resource Object Form, you can only use them to submit a request to create the account.
2. Process Form
Now that you've used a resource object form to create the resource object, you now want to create the actual account on the actual target system. To do this, you use a Process Form. The process form contains all the information that is sent from OIM to the application in order to provision the user. The process form contains the data that is sent to the application to provision the account
Adapter
The definition of an 'adapter' is 'a device for connecting pieces of equipment that cannot be connected directly'.
An abstract definition of OIM can be defined as a a program/framework which provides the building blocks to allow the integration of applications which could not otherwise be connected directly
So to integrate OIM with an particular application, such as a database for example, you develop some code; let's say some Java code. Within your Java class, you create java methods to perform a particular function... it's the java methods that are basically the OIM adapters.
The OIM adapters is basically OIM's unique way of using these Java methods to perform a particular functions.
There's 5 different 'adapters' within OIM
- 1. Process Task Adapter
- Example: If you wanted to create a user account on a resource.
- 2. Task Assignment Adapter
- Example: If you want to assign a task to a particular person/group
- 3. Pre populate Adapter (aka pre-pop adapter)
- Description: If you wanted to add additional data to the process form prior to pushing it out to the target system.
- Example: If a new user 'Daniel Redfern' joins the company, I want to create a new network account for him based on his name. I would run the pre-pop adapter by sending to the adapter his first and last name and it would return back 'DREDFERN' for example
- 4. Entity Adapter
- Description: When you wish to perform a 'before of after' operation on an Entity (such as roles, entitlements etc)
- Example: The 6 possible entity adapters are as follows
- 1. Before inserting data into Database (Pre Insert)
- 2. After inserting data into Database (Post Insert)
- 3. Before updating data into database (Pre Update)
- 4. After updating data into database (Post Update)
- 5. Before deleting data into database (Pre Delete)
- 6. After deleting data into database (Post Delete)
- 5. Rule Generator Adapter
- A rule generator, which incorporates business rules to the fields of either an Oracle Identity Manager form or a user-defined form (created using the Form Designer form), so these fields can be populated automatically and saved to the Oracle Identity Manager database.
Event Handler
It is similar as Entity Adapter but can be attached only on Pre Insert or Pre Update. Because Entity adapters cannot be used with USR transactions, they are often used with user management operations The main types of Event Handlers, pre-process (prior to the transaction), post-process (after the transaction), and validation (before the transaction and also prevents the transactions if the validation fails
Overall Summary
I constructed a simplistic diagram on all the interactions with the specific OIM components
About the author
Daniel is a Technical Manager with over 10 years of consulting expertise in the Identity and Access Management space.Daniel has built from scratch this blog as well as technicalconfessions.com
Follow Daniel on twitter @nervouswiggles
Comments
Other Posts
AS I was migrating my environment into an S3 environment, I wanted to leverage off the SES services that AWS provide, more specifically, to leverage the off the SMTP functionality by sending an email via PHP
Read More...
The WeMos D1 is a ESP8266 WiFi based board is an extension to the current out-of-the-box library that comes with the Arduino installation. Because of this, you need to import in the libraries as well as acknowledging the specific board. This process is highly confusion with a number of different individuals talking about a number of different ways to integrate.
Read More...
NameID element must be present as part of the Subject in the Response message, please enable it in the IDP configuration.
Read More...
For what I see, there's not too many supportive documentations out there that will demonstrate how provision AD group membership with the ICF connector using OpenIDM. The use of the special ldapGroups attribute is not explained anywhere in the Integrators guides to to the date of this blog. This quick blog identifies the tasks required to provision AD group membership from OpenIDM to AD using the LDAP ICF connector. However this doesn't really explain what ldapGroups actually does and there's no real worked example of how to go from an Assignment to ldapGroups to an assigned group in AD. I wrote up a wiki article for my own reference: AD group memberships automatically to users This is just my view, others may disagree, but I think the implementation experience could be improved with some more documentation and a more detailed example here.
Read More...
In the past, the similar error occurred though for the Oracle Identity Management solution. invalidcredentialexception remote framework key is invalid Because they all share the ICF connector framework, the error/solution would be the same.
Read More...
org.forgerock.script.exception.ScriptCompilationException: missing ; before statement
Read More...
ForgeRock IDM - org.forgerock.script.exception.ScriptCompilationException: missing ; before statement
Read More...
When performing the attempt of a reconciliation from ForgeRock IDM to Active Directory, I would get the following error
Read More...
In the past, the similar error occurred though for the Oracle Identity Management solution. invalidcredentialexception remote framework key is invalid Because they all share the ICF connector framework, the error/solution would be the same.
Read More...
During the reconcilation from OpenIDM to the ICF google apps connector, the following error response would occur. ERROR Caused by com.google.api.client.auth.oauth2.TokenResponseException 400 Bad Request - invalid_grant
Read More...
Tags
Recent Posts
Monthly Activity
Group by date