If you have written Role membership rule in OIA 11.1.1.5 (PS1) after successful execution of rule you can see the Role membership in OIA for the users satisfying the rule condition. Your OIM integration is in place and you don't see this role membership getting propagated to OIM.
This is due to a bug in current OIA 11.1.1.5 (PS1) release which should have a fix in next patch release.
Here is the workaround for this bug
Open the mass-membership-modification-workflow.xml located in OIAHome\conf\workflows folder
Search for step id=5 section and append the following in that section
<function type="spring">
<arg name="bean.name">exportIAMRoleMembershipBatchFunction</arg>
<arg name="iamConnectionName">OIMServer</arg>
</function>
<arg name="bean.name">exportIAMRoleMembershipBatchFunction</arg>
<arg name="iamConnectionName">OIMServer</arg>
</function>
The final setting should look like this
<step id="5" name="Finish">
<meta name="role.status.key">1</meta>
<meta name="rolestatuslabel">Active</meta>
<meta name="isMandetory">true</meta>
<meta name="isEditable">false</meta>
<pre-functions>
<function type="spring">
<arg name="bean.name">updateRequestStatusFunction</arg>
<arg name="requestStatus">APPROVED</arg>
</function>
<function type="spring">
<arg name="bean.name">exportIAMRoleMembershipBatchFunction</arg>
<arg name="iamConnectionName">OIMServer</arg>
</function>
</pre-functions>
</step>
<meta name="role.status.key">1</meta>
<meta name="rolestatuslabel">Active</meta>
<meta name="isMandetory">true</meta>
<meta name="isEditable">false</meta>
<pre-functions>
<function type="spring">
<arg name="bean.name">updateRequestStatusFunction</arg>
<arg name="requestStatus">APPROVED</arg>
</function>
<function type="spring">
<arg name="bean.name">exportIAMRoleMembershipBatchFunction</arg>
<arg name="iamConnectionName">OIMServer</arg>
</function>
</pre-functions>
</step>
Here OIMServer is the name of the OIM Provisioing server connection in my environment. Replace this with your connection name.
Save the file, Restart OIA. Now try the rule based role membership again . You should see the update in OIM as well.
1 comment:
Hi,
In OIA : Identity warehouse -> Roles -> New Role -> Ownership tab - > Add Owners.
Here at Add Owners step I can see only users which are imported from OIM (global users / end user)
And if I assign end user as owner of a role -> role membership approval task still goes to rabcxadmin.
Can we select OIA users as a Role Owner?
Is there any way to log in in OIA using global user/end user?
Please help me to understand this scenario.
Post a Comment