Random Password Generator

A lot of places we need to create and apply Random Password upon granting a resource or creation of OIM user via code. Here is a code that would generate one and will also allow you to specify the length of random password.

================================
RandomPasswordGenerator.java
================================

import java.util.Random;

public class RandomPasswordGenerator {

public static int DEFAULT_PASSWORD_LENGTH=8;
public static char[] Special_Character = {'!','@','#','$','%','^','&','*','(',')' };
public static char getSpecialCharacter(){
Random rand = new Random();
int randInt = rand.nextInt(10);
return Special_Character[randInt];
}

public static String getPassword(int n) {
if(n <=8 ){
n=DEFAULT_PASSWORD_LENGTH;
}
char[] pw = new char[n];
int c = 'A';
int r1 = 0;
int i=0;
String tempString = new String();
while(i< n){
r1 = (int)(Math.random() * 4);
l1: switch(r1) {
case 0: c = '0' + (int)(Math.random() * 10); break l1;
case 1: c = 'a' + (int)(Math.random() * 26); break l1;
case 2: c = 'A' + (int)(Math.random() * 26); break l1;
case 3: c = getSpecialCharacter(); break;
}

char c1 = (char)c;
boolean isExisting = false;
l2: for(int j=0; j < i; j++){
if(c1 == pw[j]){
isExisting = true;
break l2;
}
}
if(!isExisting){
pw[i] = (char)c;
i++;
}

}
return new String(pw);
}
public static void main(String args[]){
System.out.println(RandomPasswordGenerator.getPassword(8));
}
}

===============================
Output would be something like:
===============================
&3FVZfxb

ACF2 Connector Details

Clarity on ACF2 Connector
==========================
Please note: Port numbers are configurable.

Pioneer & Voyager are installed on ACF2.
ldap gateway sits on OIM.

Usually, 5190 is the port on the OIM server in which the ldap gateway listens on. Voyager points to the OIM server on port 5190. PIONEER is the listener on the mainframe, the default port is 5790 (Typically 5790 unless it is reserved for another service).


Few Data Types Explored
=========================

1. TOD - String Time-of-day attribute (This is an internal MF format. It's the value returned by the TIME macro) (http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.zsecure.doc/ckrbzz1902.html)


2. PACKED - Date Field (PACKED is a MF format -- basically, it's a number, but rather than being stored in binary, it's stored in a format where each nibble is one digit and the last nibble denotes the sign.

Example: x''01234C' would be 1234 (positive)) http://webster.cs.ucr.edu/AoA/Windows/HTML/DataRepresentationa7.html


3. HEX - String (hexidecimal data)

4. TIMEBIN - String (TIMEBIN is a fullword; that's 4 bytes and it's the number of .01 secs since midnight.)

5. CHEN - CHEN is character (but encrypted)

For other attributes, refer http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=/com.ibm.zsecure.doc/ckrbzz1902.html

Searching Jar Files in Unix / Linux

Lot of times we get the following errors:
Exception in thread "main" java.lang.NoClassDefFoundError: server

And we just don't know which jar file is missing from the classpath. And we need to know the correct jar file name(s) to fix the problem. So, here I create a shell script that would allow you to search through all the jar files by specifying a specific keyword. You may modify this script to search in all files (*) or whatever your criteria may be. This script works recursively for all sub-folders as well. So, you can keep this script on the root level of search and simply execute it.

=====================================
searchjars.sh
=====================================


#!/bin/sh

if [ $# -ne 1 ];
then
echo "Usage: ./searchjars.sh <keyword>"
exit
fi

LOOK_FOR="$1"

for i in `find . -name "*jar"`
do
#echo "Looking in $i ..."
jar tvf $i | grep $LOOK_FOR > /dev/null
if [ $? == 0 ]
then
echo "==> Found \"$LOOK_FOR\" in $i"
fi
done


After saving this file, don't forget to give the execute permissions to this script.

[jboss@lin01 xlclient]$chmod +x searchjars.sh

Now you are ready to execute as follows:

If you don't specify any value, the script shows you the usage command:
[jboss@lin01 xlclient]$ ./searchjars.sh
Usage: ./searchjars.sh <keyword>

When you specify the value to be searched, you will see the files that have that value in it.
[jboss@lin01 xlclient]$ ./searchjars.sh server
==> Found "server" in ./java/lib/rt.jar
==> Found "server" in ./ext/jdbcpool-0.99.jar
==> Found "server" in ./ext/nexaweb-nfc-api.jar
==> Found "server" in ./ext/jai_core.jar
==> Found "server" in ./ext/javagroups-all.jar
==> Found "server" in ./ext/jbossall-client.jar
==> Found "server" in ./ext/jboss-client.jar
==> Found "server" in ./ext/nexaweb-common.jar
==> Found "server" in ./ext/soap.jar
==> Found "server" in ./lib/xlVO.jar
==> Found "server" in ./lib/XellerateClient.jar
[jboss@lin01 xlclient]$

If you need to see what files are being looked at, uncomment (remove the #) the following line in the script:
#echo "Looking in $i ..."

Oracle Support on VMWare / Virtualized environment

Oracle does not support Oracle Products installed on VMware as Oracle has not certified any of its products on VMware virtualized environments.

If the issue does not occur in a non-virtual deployment, you will be referred to work with VM Product Company.

For details, look on oracle metalink (https://metalink.oracle.com) for the following document:

Support Position for Oracle Products Running on VMWare Virtualized Environments

Doc ID: Note:249212.1 Type: ANNOUNCEMENT
Last Revision Date: 16-NOV-2007 Status: PUBLISHED

Finding OIM Task Key in a Process Definition

Finding OIM Task Key in a Process Definition in OIM 9.1 is possible through a new API:

Thor.API.Operations.TaskDefinitionOperationsIntf --> getTaskDetails()

Finding an OIM Task Key in a Process Definition in PRE- OIM 9.1 releases can be achieved using the following sql:

String sql = "SELECT m.mil_key FROM mil m, pkg p, tos t WHERE m.mil_name = '" + taskName + "' AND m.TOS_KEY = t.TOS_KEY AND t.PKG_KEY = p.PKG_KEY AND p.pkg_name='"+ processname + "'";

Update Active Directory Password with Code

import java.util.*;
import javax.naming.*;
import javax.naming.directory.*;
import javax.naming.*;
import javax.naming.directory.*;
import javax.naming.ldap.*;
import java.util.*;
import java.security.*;

public class ADUpdatePwd

{

private DirContext ldapContext;

private String baseName = ",ou=People,dc=bhatiacorp,dc=com";

private String serverIP = "127.0.0.1";

public void updatePassword(String username, String password) {
try {
String quotedPassword = "\"" + password + "\"";
char unicodePwd[] = quotedPassword.toCharArray();
byte pwdArray[] = new byte[unicodePwd.length * 2];
for (int i = 0; i < unicodePwd.length; i++) {
pwdArray[i * 2 + 1] = (byte) (unicodePwd[i] >>> 8);
pwdArray[i * 2 + 0] = (byte) (unicodePwd[i] & 0xff);
}

ModificationItem[] mods = new ModificationItem[1];
mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, new BasicAttribute("UnicodePwd", pwdArray));
ldapContext.modifyAttributes("cn=" + username + baseName, mods);
} catch (Exception e) {
System.out.println("ADUpdatePwd :: Update Password Error :: " + e);

}
}

private void setContext(String ldaphost, String ldapport, String adminID, String adminpassword, boolean useSSL) {
String providerurl = ldaphost + ":" + ldapport;
if (ldapport == "") {
ldapport = "636";
}
try {
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, providerurl);
if (useSSL == true) {
// if SSL is used - use can use ssl enabled ldaphost
// eg. "ldaps://localhost:636"
// else
// eg. "ldap://localhost:636"
env.put(Context.SECURITY_PROTOCOL, "ssl");
}
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, adminID);
env.put(Context.SECURITY_CREDENTIALS, adminpassword);
ldapContext = new InitialDirContext(env);
} catch (Exception ex) {
ex.printStackTrace();
}
}


public ADUpdatePwd() {
try {
setContext("ldaps://serverIP", "636", "CN=Administrator"+baseName, "p@ssw0rd1~", true);
} catch (Exception e) {
System.out.println("ADUpdatePwd :: Error :: " + e);
e.printStackTrace();

}
}

public static void main(String[] args) {
try {
/*
* Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider()); the keystore that holds trusted root certificates
* System.setProperty("javax.net.ssl.trustStore", "c:\\myCaCerts.jks");
* System.setProperty("javax.net.debug","all");
*/

ADUpdatePwd c = new ADUpdatePwd();
c.updatePassword("Bhatiar", "p@ssw0rd3");
} catch (Exception ex) {
ex.printStackTrace();
}
}
}

OIM Tables Descriptions (9.0.1.1)

The following table lists the purpose of each table within OIM.

Note: Custom Tables are created for user defined Object / Process Forms.

TABLE NAME IN OIM	DESCRIPTION OF TABLE
AAD	List To Define The Administrators For Each Organization And Their Delegated Admin Privileges
AAP	Table for storing Resource - Organization level parameter Values
ACP	ACP - Link Table That Holds Reference To ACT And PKG Tables, Table That Defines The Objects (Resources) Allowed For A Particular Organization
ACS	Link Table for Account Table(ACT) and Server Table(SVR)
ACT	Defines information about all organizations created through Xellerate
ADJ	Contains the Java API information for the constructor with parameters and method name with parameters chosen for an adapter task of type JAVA, UTILITY, TAME,REMOTE, or XLAPI.
ADL	Contains the all of the necessary parameters for an adapter task of type IF, ELSE IF,FOR, WHILE, SET, and VARIABLE tasks. These type of tasks are known as LOGICTASKS
ADM	Data mapping between parameters input/output parameters and source/sink
ADP	Defines an adapter created through the Adapter Factory
ADS	Database,schema and procedure name selections which define a stored procedure adaptertask
ADT	Defines a task attached to an adapter
ADU	Contains the web service and method chosen for a task of the Adapter Factory
ADV	Adapter variable table contains variables that have been created for specific adapters.
AFM	Links an adapter with a form
AGS	Holds the definition of organization/contact groups
AOA	Contains the OpenAdapter property file for OpenAdapter
APA	To store attestation process administrators
APD	To store attestation Process definition
APT	To store the attestation tasks
ARS	Contains custom response codes for 'Process Task' Adapters only
ATD	To store entitlement details for each attestation task
ATP	Defines input and output parameters for the constructor and method of an adapter taskof type JAVA, UTILITY, TAME, REMOTE, and XLAPI
ATR	To store attestation requests
ATS	Stores which services or can be ordered by which organizations and which rates apply
AUD	Define the Auditors
AUD_JMS
CRT	Trusted Certificate Information
DAV	Stores the runtime data mappings for 'Entity' & 'Rule Generator' adapters. The data source being an Xellerate form or child table,or a user defined process form.
DEP	Dependencies among Tasks Within A Workflow Process
DOB	Data Resource definition consisting of the fully qualified class name of the dataobject
DVT	Defines the one to many relationship between Data Resources and Event Handlers (this includes adapters)
EIF	Export Import Files. Each row contains one single file used in export/import operation. For export there is only one file
EIH	Export Import History. Each row represents one Data Deployment Management session.
EIL	DB Based lock for export operation. Used to make sure only one user can import at atime. This is currently not managed through data objects
EIO	Export Import Objects. Each row represents one object exported/imported
EIS	Substitutions used during import process
EMD	Core --Email Definition Information Table That Holds The Email Template Definitions
ERR	Error codes
ESD	Encrypted columns not within the bounds of the SDK
EVT	Defines event handlers by providing a process and class name. In addition the scheduling time of when the event handler can execute is set to pre (insert, update, delete) or post (insert, update, delete)
FUG	List to define the administrators for each user defined object in the 'StructureUtility' form or for each user defined field in the 'User Defined FieldDefinition' form
GPG	List to define the (nested) group members of User Group in the 'User Group' form.
GPP	List to define the Administrators and their delegated admin rights over a User Group
GPY	Joins Properties (PTY) and Groups (UGP).
IEI	Table where all the imports and exports are defined
LAY	Table where the layouts are defined for the various imports and exports
LIT	Import/export table.
LKU	Lookup definition entries
LKV	Lookup values
LOB	Import/export table.
LOC	Holds information about locations
MAP	XML MapSchema Information
MAV	Stores the runtime data mappings for 'Process Task' adapters. The data source being a process form, Location, User, Organization, Process, IT Resource, orLiteral data.
MEV	E-mail notification events
MIL	Holds information about tasks of a process
MSG	Defines the user groups that have permission to set the status of a process task.
MST	Task Status And Object Status Information. Holds All The Task Status To Object Status Mappings
OBA	Object Authorizer Information
OBD	Object Dependencies
OBI	Object Instance Information
OBJ	Resource Object definition information.
ODF	Holds Object To Process Form Data Flow Mappings.
ODV	Object Events/Adapters Information
OIO	Object Instance Request Target Organization Information.
OIU	Object Instance Request Target User Information.
OOD	Object Instance Request Target Organization Dependency Information.
ORC	This Entity Holds The Detail On Each Order. This Could Be Considered The Items Section Of An Invoice. This Entity Is The Instance Of A Particular Process
ORD	Holds information that is necessary to complete an order regardless of a processbeing ordered
ORF	Resource Reconciliation Fields
ORR	Object Reconciliation Action Rules
OSH	Task Instance Assignment History
OSI	Holds information about tasks that are created for an order
OST	Object Status Information
OUD	Object Instance Request Target User Dependency Information. Holds The Dependency Between Different Resource Instances Provisioned To A User.
OUG	List to define the administrators for each Resource
PCQ	Holds the challenging questions and answers for a user
PDF	Package data flow table holds the data flow relationships between packages
PHO	Holds all communication addresses for this contact -- e.g., contact telephone numbers,fax numbers, e-mail, etc.
PKD	Package dependency table holds the dependency relationships between child packages of a parent package
PKG	Consists of names and system keys of service processes, which consist of a group ofservices from the TOS table. Defines a Process in Xellerate.
PKH	Package Hierarchy Table Holds The Parent-child Relationships Between Processes
POC	Stores values for the child tables of the Object/Process form of a resource being provisioned by an access policy
POF	Policy field table holds the field value pairs that constitute the definition of apolicy
POG	Join table between Policy and User Groups, Specifies the groups to whom an access policy will apply.
POL	Policy Table Holds A Policy, Defines An Access Policy In The System
POP	Policy Package Join Table Holds The Packages That A Particular Policy Orders For User, Defines Which Resources Will Be Provisioned Or Denied For A Particular Access Policy.
PRF	Process Reconciliation Field Mappings
PRO	Defines a process name, scheduling frequency, and priority. A process is made up of oneor more tasks
PTY	Client Properties Table
PUG	List to define The Administrators And Their Delegated Admin Rights For Each Process.
PWR	Table forPassword Rule Policies
PXD	Table that holds the list of all Proxies Defined
QUE	Administrative queues definition
QUM	Administrative queue members
RAV	Stores the runtime data mappings for 'Pre-populate' adapters. The data source being an Xellerate form or child table, or a user defined form
RCA	Reconciliation Event Organizations Matched
RCB	Reconciliation Event Invalid Data
RCD	Reconciliation Event Data
RCE	Reconciliation Events
RCH	Reconciliation Event Action History
RCM	Reconciliation Event Multi-Valued Attribute Data
RCP	Reconciliation Event Processes Matched
RCU	Reconciliation Event Users Matched
REP	Table that contains all information about reports in the system
REQ	This table holds request information
RES	This table is used to stored adapter resources entered by the user.
RGM	Table for Response Code Generated Milestones
RGP	Rules To Apply To A User Group, Defines The Auto-group Membership Rules Attached To AParticular Group.
RGS	Defines all known registries. These are used by Web Service tasks in an Adapter to communicate with a web service
RIO	Request Organizations Resolved Object Instances
RIU	Request Users Resolved Object Instances
RLO	This table contains directory URLs which are referenced by Adapter Factoryjar/class files.
RML	Rules To Apply To Task, Defines The Task Assignment Rules Attached To A Process Task.
ROP	Rules To Apply To An Object-process Pair, Defines The Process Determination Rules Attached To A Resource Object.
RPC	Reconciliation Event Process Child Table Matches
RPG	Link table between Group table and Report Table. Specifies which group has accessto which reports
RPP	Parameters passed to report.
RPT	Stores information related to the creation of reports
RPW	Rules To Apply To A Password Policy, Defines The Policy Determination Rules Attached To A Password Policy.
RQA	Request target organization information.
RQC	Request comment information
RQD	Contains self-registration request data for web admin.
RQE	Request administrative queues
RQH	Requeststatus history
RQO	Request object information.
RQU	Request object target user information
RQY	Request Organizations Requiring Resolution
RQZ	Request Users Requiring Resolution
RRE	Reconciliation User Matching Rule Elements
RRL	Reconciliation User Matching Rules
RRT	Reconciliation User Matching Rule Element Properties
RSC	Defines the All The Possible Response Code For A Process Task.
RUE	Defines the Elements In A Rule Definition.
RUG	List to define the administrators for each Request
RUL	Rule definitions
RVM	Holds Recovery Milestones
SCH	Holds specific information about an instance of a ask such as its status orscheduled dates
SDC	Column metadata.
SDH	Meta-Table Hierarchy.
SDK	User define data object meta data definition
SDL	SDK version labels
SDP	User defined column properties
SEL	Data Object Permissions For Groups On A Specified Data object
SIT	The SIT table contains information about sites. Sites are subsets of locations.
SPD	IT Resource parameter definition
SRE	Defines Which Pre-populate Rule Generator Will Run For A Field Of User Defined DataObject.
SRP	Should be replaced by the rate table from a billing system. Here it holdspecific rates for specific services.
SRS	IT Resource - IT Resource join
STA	Status Codes
SUG
SVD	IT Resource type definition
SVP	IT Resource property definition
SVR	IT Resource instance definition
SVS	IT Resource - Site Join
TAP	Holds parameter values for a task, which is an instantiation of Valid Task,i.e. value for parameter Company Name, etc.
TAS	Holds instances of Valid Task. Examples of Valid Tasks would be reports, imports, etc. Valid TaskParameters indicate what parameters can be assassigned to an instance of a task, i.e
TDV	Used by event manager/data objects, joins data objects, types of service, and events
TLG	Keeps logof SQL transactions.
TMP	Indicates which tasks are in a process. Tasks are defined in table; this way, one task can be in many processes.
TOD	To do list settings table.
TOS	Holds information about a process
TSA	Stores initialization params (name/value pairs) forscheduler tasks
TSK	Scheduler task definition information
UDP	User-defined field table
UGP	Defines a group of users
UHD	User Policy Profile History Details table
ULN	This table hold UHD allow / deny list
UNM	"UnDoMilestone" Feature
UPA
UPA_FIELDS	Stores changes only for user profile audit history in de-normalized format
UPA_GRP_MEMBERSHIP	Stores groups membership history in de-normalized format
UPA_RESOURCE	Stores user profile resource history in de-normalized format
UPA_USR	Stores user profile history in de-normalized format
UPD	User Policy Profile Details table
UPH	User Policy Profile History table
UPL	User-defined field table
UPP	User Policy Profile table
UPT	User-defined field table
UPY	Joins Properties (PTY) and User (USR) tables.
USG	This table stores which users are in which groups.
USR	Stores all information regarding a user.
UWP	Window sequence, nesting in CarrierBase explorer for each user group.
VTK	Defines automation task types such as reports, imports, and exports.
VTP	Valid Task Parameters. Indicates which parameters can be defined for an instance of a task.
WIN	Windows table: Windows keys, descriptions, and class names.
XSD	This table holds Xellerate System Data

Reference: Oracle DD

AD SSL Handshake / Certificate Expired Error

If you have a certificate in Active Directory that is manually generated and expired, your OIM connection might fail with SSL Handshake error or Certificate Expired Error. Even though you see the correct certificate in Active Directory, still you might recieve SSL Handshake Errors or Certificate Expired Errors. This happens mostly when its a manually generated certificate.

Here is the error that you might face:
java.security.cert.CertificateExpiredException: NotAfter: Thu Apr 17 13:56:25 EDT 2008
at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:268)
at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:564)
at sun.security.validator.SimpleValidator.engineValidate(SimpleValidator.java:123)
at sun.security.validator.Validator.validate(Validator.java:202)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(DashoA12275)
at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(DashoA12275)
at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.AppInputStream.read(DashoA12275)
at java.io.BufferedInputStream.fill(BufferedInputStream.java:183)
at java.io.BufferedInputStream.read1(BufferedInputStream.java:222)
at java.io.BufferedInputStream.read(BufferedInputStream.java:277)
at com.sun.jndi.ldap.Connection.run(Connection.java:784)

Alternatively, you might face the following issue:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found

Here is the solution for this:

WORKAROUND

To work around this issue, remove the expired (archived) certificate. To do this, follow these steps:1. Open the Microsoft Management Console (MMC) snap-in where you manage the certificate store on the IAS server. If you do not already have an MMC snap-in to view the certificate store from, create one. To do so:a. Click Start, click Run, type mmc in the Open box, and then click OK.
b. On the Console menu (the File menu in Windows Server 2003), click Add/Remove Snap-in, and then click Add.
c. In the Available Standalone Snap-ins list, click Certificates, click Add, click Computer account, click Next, and then click Finish.

Note You can also add the Certificates snap-in for the user account and for the service account to this MMC snap-in.
d. Click Close, and then click OK.

2. Under Console Root, click Certificates (Local Computer).
3. On the View menu, click Options.
4. Click to select the Archived certificates check box, and then click OK.
5. Expand Personal, and then click Certificates.
6. Right-click the expired (archived) digital certificate, click Delete, and then click Yes to confirm the removal of the expired certificate.
7. Quit the MMC snap-in. You do not have to restart the computer or any services to complete this procedure.
8. FYI - In our case, we had to restart the AD server to take the changes in effect. This did not fix the issue without restarting.

This is an excerpt from Microsoft's Website. Here are the links to solve this:

http://support.microsoft.com/kb/822406/

http://support.microsoft.com/kb/839514/

The other problem could be your new / renewed certificate was not imported in Java cacerts keystore of OIM server. Use the following to connect OIM with SSL based Active Directory. This is an excerpt from OIM documentation:

Installing Certificate Services

The connector requires Certificate Services to be running on the host computer. To install Certificate Services:
1.Insert the operating system installation media into the CD-ROM or DVD drive.
2.Click Start, Settings, and Control Panel.
3.Double-click Add/Remove Programs.
4.Click Add/Remove Windows Components.
5.Select Certificate Services.
6.Follow the instructions to start Certificate Services.

Enabling LDAPS

The target Microsoft Active Directory server must have LDAP over SSL (LDAPS) enabled. To enable LDAPS, generate a certificate as follows:
1.On the Active Directory Users and Computers console, right-click the domain node, and select Properties.
2.Click the Group Policy tab.
3.Select Default Domain Policy.
4.Click Edit.
5.Click Computer Configuration, Windows Settings, Security Settings, and Public Key Policies.
6.Right-click Automatic Certificate Request Settings, and then select New and Automatic Certificate Request. A wizard is started.
7.Use the wizard to add a policy with the Domain Controller template.
At the end of this procedure, the certificate is created and LDAP is enabled using SSL on port 636.


Setting Up the Microsoft Active Directory Certificate As a Trusted Certificate

If the Microsoft Active Directory certificate is not issued or certified by a certification authority (CA), then set it up as a trusted certificate. To do this, you first export the certificate and then import it into the keystore of the Oracle Identity Manager server as a trusted CA certificate.
Exporting the Microsoft Active Directory Certificate
To export the Microsoft Active Directory certificate:
1.Click Start, Programs, Administrative Tools, and Certification Authority.
2.Right-click the Certification Authority that you create, and then select Properties.
3.On the General tab, click View Certificate.
4.On the Details tab, click Copy To File.
5.Use the wizard to create a certificate (.cer) file using base-64 encoding.
Importing the Microsoft Active Directory Certificate
To import the Microsoft Active Directory certificate into the certificate store of the Oracle Identity Manager server:

Note:
In a clustered environment, you must perform this procedure on all the nodes of the cluster.

Note:
The user password cannot be set unless 128-bit SSL is used. In addition, the computer on which Microsoft Active Directory is installed must have Microsoft Windows 2000 Service Pack 2 (or later) or Microsoft Windows 2003 running on it.

Converting AD long dates to Java Date format

Environment : OIM 9.0.3, OIM Connector Pack 9.0.4.1, AD 2000

When you reconcile data from AD, the AD dates fail to link up OIM dates because of different format. The dates are stored in AD in long format and OIM uses normal Java Dates. So, here is the code that you can use to make this conversion.

import java.util.Date;
import java.util.TimeZone;
import java.text.SimpleDateFormat;
public class AD
{
public void converADdateToOIMdate(long ADdate){

long ADdate = Long.parseLong(String.valueOf(ADdate));
System.out.println("long value : "+ADdate);

// Filetime Epoch is 01 January, 1601
// java date Epoch is 01 January, 1970
// so take the number and subtract java Epoch:
long javaTime = ADdate - 0x19db1ded53e8000L;

// convert UNITS from (100 nano-seconds) to (milliseconds)
javaTime /= 10000;

// Date(long date)
// Allocates a Date object and initializes it to represent
// the specified number of milliseconds since the standard base
// time known as "the epoch", namely January 1, 1970, 00:00:00 GMT.
Date theDate = new Date(javaTime);


System.out.println("java DATE value : "+theDate);

SimpleDateFormat formatter = new SimpleDateFormat("MMMMM d, yyyy");
// change to GMT time:
//formatter .setTimeZone(TimeZone.getTimeZone("GMT"));

String newDateString = formatter.format(theDate);

System.out.println("Date changed format :" + newDateString);
}


public static void main(String[] args)
{
AD d=new AD();
d.converADdateToOIMdate(128568528000000000L);
// 9223372036854775807
// 127948319499226601

}
}

Importing Connector XML more than once

Sometimes there is a need to duplicate a resource object, IT Resource, Process Definitions, Forms, Adapters etc. So, the easiest way to do this to reimport the out of the box connector xml or export the connector xml from your environment if you have customizations on the connector. The following example lists the minimal changes that need to be done in order for this xml to be reimported successfully. I am using Unix SSH Connector to demonstrate what changes need to be done.

Firstly, backup your OIM database. Even if you are on a VMWare, remember, Database export is always good.

Next, get a free tool like "xml notepad" from Microsoft or any other xml editor tool.

Open the xml with the editor and do the following:

1. Replace All the "SSH User" to "Linux02" (or choose whatever name you want).

2. Go to the Form Name node and replace it from "UD_SSH" to "UD_L02".

3. Delete objectDataDefinition node.

4. Just import and its all done.

5. Occasionally, if the import fails, do a reimport again. Delete the nodes from the selections in deployment manager which are already in the OIM from the first import (They come with a big X mark on the side).

Problem with AD Connector updating City, State with literal text

The Problem:
When a user is created in AD (using out of the box OIM connector 9041), all values for city, state etc change in AD to be literally "city", "state" etc. instead of correct values supplied via AD User Provisioning form (even with prepop).

The Resolution:
There is a task in AD called Set Exchange Related Properties in Exchange Provisioning Definition. This task has a literal value for all the AD fields like "city", "state". Either make this task conditional or map these values from Xellerate User City / State UDFs.

Getting your definitions straight

Reconciliation

Reconciliation involves duplicating in Oracle Identity Manager the creation of and modifications to user accounts on the target system. It is an automated process initiated by a scheduled task that you configure.

Types of Reconciliation
While configuring the connector, the target system can be designated as a Trusted Source or Target Resource (also known as Non-Trusted Source). Usually there is a parameter on your Scheduled Task (for eg., IsTrusted = True or False or something like TrustedSource=True or False) that differentiates or tells OIM how to consider the events associated with this scheduled job recon.

• Trusted Reconciliation
  If you designate the target system as a trusted source, then both newly created and modified user accounts are reconciled in Oracle Identity Manager.
  


• Non-Trusted Reconciliation
  If you designate the target system as a target resource or Non-Trusted Source, then only modified user accounts are reconciled in Oracle Identity Manager.
  

Provisioning

Provisioning involves creating or modifying a user's access rights on the target system through Oracle Identity Manager. You use the Oracle Identity Manager Administrative and User Console to perform provisioning operations.

AD Child Domain Referral Searches

If your ldp tool fails to find users / groups from other child / brother domains due to referral issues, use the following method to override the search criteria.

First create an account with Enterprise Admin rights over the full root domain. Once the rights are properly given, in ldp tool, set connection options to add LDAP_OPT_REFERRALS to 1 (after binding with this enterprise admin user) and then retry your search.

Add cross reference of trusted domain. You may use the following Microsoft support link as a reference:
http://support.microsoft.com/kb/241737

If you are coding, add this statement to make it work:
env.put( Context.REFERRAL, "follow" );

Here is the sample code:

import javax.naming.ldap.*;
import javax.naming.directory.*;
import javax.naming.*;
import javax.naming.directory.BasicAttributes;
import java.util.Properties;

public class test {
public static void main(String[] args) {

Properties env = new Properties();

env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://localhost:389");
env.put(Context.SECURITY_AUTHENTICATION,"simple");
env.put(Context.REFERRAL, "follow" );
env.put(Context.SECURITY_PRINCIPAL, "Rajnish");
env.put(Context.SECURITY_CREDENTIALS, "Bhatia01");

try {
LdapContext context = new InitialLdapContext(env, null);
String base = "DC=nj,DC=bhatiacorp,DC=com";
String filter = "(&(objectClass=group)(CN=rajadmin))";

SearchControls controls = new SearchControls();

String []strReturningAttr = {"member"};

controls.setReturningAttributes(strReturningAttr);
controls.setSearchScope(SearchControls.SUBTREE_SCOPE);

NamingEnumeration answer = context.search(base, filter, controls);
int totalResults = 0;
String strMember ;
BasicAttributes userattrs;

// ... process attributes ...
while (answer.hasMoreElements()) {
SearchResult sr = (SearchResult)answer.next();

System.out.println(">>>" + sr.getName());

//Print out the groups

Attributes attrs = sr.getAttributes();

if (attrs != null) {

try {
for (NamingEnumeration ae = attrs.getAll();ae.hasMore();) {
Attribute attr = (Attribute)ae.next();
System.out.println("Attribute: " + attr.getID());
for (NamingEnumeration e = attr.getAll();e.hasMore();totalResults++) {

strMember = (String) e.next();
System.out.println(" " + totalResults + ". " + strMember);
userattrs = (BasicAttributes)context.getAttributes(strMember);


}

}

}
catch (NamingException e) {
System.err.println("Problem listing membership: " + e);
}

}
}
System.out.println("TotalResults " + totalResults );
}
catch (NamingException e) {
System.out.println("Problem retrieving RootDSE: " + e);
}
}
}

Custom Sybase Connector for Non-Supported Versions

import java.sql.*; // JDBC
import com.sybase.jdbc2.*; // Sybase jConnect
import java.util.Properties; // Properties

public class ExtendedUserUtilities {
private static Connection getSybaseConnection( String machine,String port, String userID,String password ) {

Connection connection;
String url;
Properties properties;
connection = null;
url = "jdbc:sybase:Tds:" + machine + ":" + port;
properties = new Properties();
properties.put ( "user", userID );
properties.put ( "password", password );
try {
Class.forName ( "com.sybase.jdbc2.jdbc.SybDriver" ).newInstance();
connection = DriverManager.getConnection( url, properties );
connection.setAutoCommit( false ) ;
}
catch ( Exception exception ) {
System.out.println ( "Error: " + exception.getMessage() );
exception.printStackTrace();
}
System.out.println ( "Connection url: '" + url + "'" );
return connection;

}

public static void main(String[] args){
ExtendedUserUtilities e=new ExtendedUserUtilities("192.168.2.10", "3083", "bhatia_su", "bhatia123");
String Pwd = "Password";
String User = "bhatia01";
e.sybase_adduser(User, pwd,"cp", "g_cp", "Rajnish", "Bhatia");
// e.sybase_dropuser(User);
}

public String sybase_adduser(String user, String password, String database, String group, String firstname, String lastname){
String rtnval="Success";
Connection connection1 = getSybaseConnection( SybaseServer, Port, Admin, Pwd);
if ( connection1 != null ) {
System.out.println( "Connection to Sybase successful" );
} else {
System.out.println( "Connection to Sybase failed" );
}
try {

CallableStatement proc = connection1.prepareCall("{call sp_addlogin( ?, ?, ?, ?, ?) }");
connection1.setAutoCommit(true);
proc.setString( 1, user);
proc.setString( 2, password);
proc.setString( 3, database);
proc.setString( 4, null);
proc.setString( 5, firstname+" "+lastname);
proc.executeUpdate();
System.out.println( "Executed sp_addlogin : User "+user +" created with password " );

CallableStatement proc2 = connection1.prepareCall("{call "+database+".dbo.sp_adduser( ?, ? , ?) }");
proc2.setString( 1, user);
proc2.setString( 2, user);
proc2.setString( 3, group);
proc2.executeUpdate();
System.out.println( "Executed sp_adduser : User "+user +" added." );

} catch( Throwable e ) {
rtnval="Error";
e.printStackTrace();
}
return rtnval;
}

public String sybase_dropuser(String user){
String rtnval="Success";
Connection connection1 = getSybaseConnection( SybaseServer, Port, Admin, Pwd);
if ( connection1 != null ) {
System.out.println( "Connection to Sybase successful" );
} else {
System.out.println( "Connection to Sybase failed" );
}
try {

CallableStatement proc = connection1.prepareCall("{call databasename.dbo.sp_dropuser( ?) }");
connection1.setAutoCommit(true);
proc.setString( 1, user);

proc.executeUpdate();
System.out.println( "Executed sp_dropuser : User "+user +" dropped" );

CallableStatement proc2 = connection1.prepareCall("{call sp_droplogin( ?) }");
proc2.setString( 1, user);
proc2.executeUpdate();
System.out.println( "Executed sp_droplogin : User "+user +" dropped." );

} catch( Throwable e ) {
rtnval="Error";
e.printStackTrace();
}
return rtnval;
}
}

Add jconn2.jar Sybase driver to this code.

AD Move User to New OU

The Active Directory Connector by default creates users in CN=Users. Oftentimes, you need to move user to another ou based on some logic, for example based of location. So, here I present you with a code snippet that you can use to move user to another ou and attach it to create user "Success" response code in AD Provisioining process.

import javax.naming.*;
import javax.naming.directory.*;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.Hashtable;
import java.util.List;
import java.util.Map;
import Thor.API.Exceptions.tcAPIException;
import Thor.API.tcResultSet;
import Thor.API.tcUtilityFactory;
import Thor.API.Base.tcUtilityOperationsIntf;
import Thor.API.Operations.tcUserOperationsIntf;

import com.thortech.util.logging.Logger;
import java.util.Hashtable;
public class MoveUserToOU {
public Logger logger;

public String MoveUser2NewOU(String cn, String ADServer, String domain,String Location, String AdminID, String Password){
String rtnval="EXECUTION_SUCCESS";
if (Location.equalsIgnoreCase(""))
{
return rtnval;
}
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.SECURITY_PROTOCOL, "ssl");
env.put(Context.PROVIDER_URL, "ldaps://"+ADServer+":636/");
//AdminID="Administrator@bhatia.com"
env.put(Context.SECURITY_PRINCIPAL, AdminID);
//Password="Password1";
env.put(Context.SECURITY_CREDENTIALS, Password);
try {
DirContext ctx = new InitialDirContext(env);
String OldCN="CN="+cn+",OU=Users,OU=OTHR,"+domain;
logger.debug("Old CN:"+OldCN);
String NewCN="CN="+cn+",OU=Users,OU="+getNewOU(Location)+","+domain;
logger.debug("New CN:"+NewCN);
logger.debug("Starting Modify DN ");
ctx.rename(OldCN, NewCN);
logger.debug("Ended Modify DN with Success..."+rtnval);
//ctx.rename("CN=Rajnish Bhatia,OU=HR,dc=bhatia,dc=com", "CN=Rajnish Bhatia,OU=IT,dc=bhatia,dc=com");
//System.out.println(ctx.lookup("CN=Rajnish Bhatia,OU=IT,dc=bhatia,dc=com"));
ctx.close();
} catch (Exception e) {
logger.debug("Ended Modify DN with Error...");
rtnval="ERROR : "+e.getMessage();
e.printStackTrace();
}
return rtnval;
}

public String getNewOU(String Location) {
String NewOU="";
if(Location.equalsIgnoreCase("CA"))
NewOU="CA";
else
if(Location.equalsIgnoreCase("TN"))
NewOU="TN";
else
if(Location.equalsIgnoreCase("NJ"))
NewOU="NJ";
else
if(Location.equalsIgnoreCase("TX"))
NewOU="TX";
return NewOU;
}
}

Active Directory SSL Test

You may use this code to test the SSL connection with your AD server.

=====================================================
ADSSLConnectionTest.java
=====================================================

import java.util.*;
import javax.naming.*;
import javax.naming.directory.*;
public class ADSSLConnectionTest
{

private DirContext getContext(String ldaphost, String ldapport, String adminID, String adminpassword, boolean useSSL)
{
DirContext ctx=null;
String providerurl=ldaphost+":"+ldapport;
if(ldapport=="")
{
ldapport="636";
}
try {
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY ,"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL ,providerurl);
if(useSSL==true)
{
// if SSL is used - use can use ssl enabled ldaphost
// eg. "ldaps://localhost:636"
// else
// eg. "ldap://localhost:636"
env.put(Context.SECURITY_PROTOCOL, "ssl");
}
env.put(Context.SECURITY_AUTHENTICATION ,"simple");
env.put(Context.SECURITY_PRINCIPAL ,adminID);
env.put(Context.SECURITY_CREDENTIALS ,adminpassword);
ctx = new InitialDirContext(env);
}
catch(Exception ex)
{
ex.printStackTrace();
}
return ctx;
}

public DirContext getContext()
{
DirContext ctx=null;
try {
ctx=getContext("ldaps://localhost","636","CN=Rajnish Bhatia,DC=bhatia,DC=com","Password1",true);
System.out.println("Connected with SSL");
}
catch(Exception ex)
{
System.out.println("NOT Connected with SSL");
ex.printStackTrace();
}
return ctx;
}

public static void main(String[] args) {
try
{
ADSSLConnectionTest c = new ADSSLConnectionTest();
c.getContext();
}catch(Exception ex)
{
ex.printStackTrace();
}
}
}

Compile and run with your credentials as following:

C:\>javac ADSSLConnectionTest.java

C:\>java ADSSLConnectionTest

=============================
Notes
=============================

1. If you have issues, make sure your SSL Certificate is in proper java store such as C:\j2sdk1.4.2_13\jre\lib\security. Make sure you are adding the certificate to the correct (& in path) java cacerts keystore.

2. You may also test by telnet to the server - telnet localhost 636

3. You may list the keystore values as follows:
C:\j2sdk1.4.2_13\jre\lib\security>keytool -list -v -storepass changeit -keystore cacerts

This is how it looks:


*******************************************
*******************************************


Alias name: someclass3g3ca
Creation date: Jun 15, 2004
Entry type: trustedCertEntry

Owner: CN=Some Authority, OU="(c)
1999 Bhatia, Inc. - For authorized use only", OU=Bhatia Trust Network, O="Bhatia, Inc.", C=US
Issuer: CN=Some Authority, OU="(c)
1999 Bhatia, Inc. - For authorized use only", OU=Bhatia Trust Network, O="Bhatia, Inc.", C=US
Serial number: 9b7e0649a33e62b9d5ee90487129ef53
Valid from: Thu Sep 30 20:00:00 EDT 1999 until: Wed Jul 16 19:59:59 EDT 2036
Certificate fingerprints:
MD5: CD:68:B6:A7:C7:C4:CE:75:E0:1D:2F:57:44:61:92:09
SHA1: 13:2D:0D:45:53:4B:69:97:CD:B2:D6:C3:39:E2:55:76:60:9B:5C:C6


*******************************************
*******************************************

Alias name: corp9
Creation date: Mar 17, 2008
Entry type: trustedCertEntry

Owner: CN=srvr-corp9.nj.bhatia.com
Issuer: CN=SRVR-RAS-DC, DC=bhatia, DC=com
Serial number: 2714a16c000000000013
Valid from: Mon Jan 28 12:14:58 CST 2008 until: Tue Jan 27 12:14:58 CST 2009
Certificate fingerprints:
MD5: CD:48:B6:A7:C7:C4:CE:75:E0:1D:2F:57:44:61:92:09
SHA1: 12:1D:0D:45:52:4B:64:97:CD:B2:D6:C3:39:E2:55:76:60:9B:5C:C6


*******************************************
*******************************************

4. Then, make sure your ADITResource in OIM - The server is srvr-corp9.nj.bhatia.com (as per your keystore).

5. For specific ldap error codes, look at the following url:
http://www.directory-info.com/LDAP/LDAPErrorCodes.html