Propagating User Attributes to User Resource Accounts

Tested On: Oracle Identity Manager 11.1.2.2.0
Description: Shows how to propagate attributes from OIM User Profile to user resource accounts.

Sample Scenario
OIM User Attribute: First Name
Active Directory Process Form Field: First Name
Whenever the First Name OIM User Attribute is modified, the changes will also be pushed down to the First Name attribute on Active Directory.
References: http://docs.oracle.com/cd/E40329_01/dev.1112/e27150/promgt.htm#OMDEV2509


Lookup.USR_PROCESS_TRIGGERS
This lookup defines a one to one relationship between a user attribute and a process task. Whenever a modification happens on a User Attribute that is defined in the Lookup.USR_PROCESS_TRIGGERS lookup definition, OIM triggers the associated process task on the user's resource accounts(s).

1. Log in to Design Console.

2. Expand Administration and double click Lookup Definition.

3. In the Code input box, type Lookup.USR_PROCESS_TRIGGERS, and then query for lookup definition by clicking the binocular icon.

4. Add an entry to the lookup definition, and then save. For the Code Key column, specify the column name from the USR table that is in the OIM Schema. For the Decode column, specify the name of the process task that is responsible for passing the user attribute to a specific process form field on a resource. For example:
Code Key: USR_MIDDLE_NAME
Decode: Change Middle Name

Create Process Task Adapter to Set Form Field with a User Attribute
Most out of the box connectors contain a process task adapter that passes a user attribute to a process form field (E.g. Active Directory 11.1.1.6.0 connector has the "ADIDC Return Text Value" process task adapter). You may skip this section if your connector contain such process task adapter or if you decide to reuse the same process task adapter from another connector.

1. On the left pane of Design Console, expand Development Tools, and double click Adapter Factory.

2. Specify the name of the adapter, adapter type as a Process Task, and description. For example,
Adapter Name: DBAT Return Text Value
Adapter Type: Process Task
Description: Returns the provided text as the adapter return value. This is a proxy adapter to be used by process tasks to set form fields

3. Then click the Save icon.

4. On the Adapter Factory form, navigate to Variable List tab, and then click Add.

5. Specify the Variable Name, Type, Description, and Map To as "Resolve at runtime" on the Edit a Variable form, and then save and close dialog box. For example:
Variable Name: textValue
Type: String
Description: Text to return.
Map To: Resolve at runtime

Note: This adapter variable will be set to a user attribute on the adapter process task instance.

6. On the Adapter Factory form, click Adapter Tasks tab, and then click Add.

7. On the Adapter Task Selection dialog box, select Logic Task: SET VARIABLE.

8. On the Edit Set Variable Task Parameters dialog form, specify the following information:
Variable Name: Adapter return value
Operand Type: Variable
Operand Qualifier: {ADAPTER_VAR_NAME}

Then click the Save icon, and close dialog box.

9. Click Build on the Adapter Factory form.

Create Process Task
Create a process task using the name you specified in Lookup.USR_PROCESS_TRIGGERS. For the new process task, you will use the adapter you created in the previous section, and then define the mapping to pass a specific user attribute onto a specific process form field.

1. Expand Process Management, and double click Process Definition.

2. Search for the name of your process definition for your target resource, and click Add on the Tasks tab.

3. On the Creating New Task dialog box, specify the following information in the General tab:
Task Name: {Decode value for attribute defined in Lookup.USR_PROCESS_TRIGGERS}
Description: Propagates the {USR_ATTRIBUTE} change performed on the OIM User profile to the {PROCESS_FORM_FIELD} field of the process form.
Task Properties: Conditional, Required for Completion, Allow Cancellation while Pending, and Allow Multiple Instances.

Then click the Save icon.

4. On the Integration tab, click Add.

5. On the Handler Selection popup, search for your adapter process task. Then save.

6. Set the adapter variables mapping. Set the adapter return variable to a process form field. Set your custom adapter variable to a user attribute.

Map To: Process Data
Qualifier: {Process Form Field}

Map To: User Definition
Qualifier: {User Attribute}

Note: The process task you created here only sets the process form field using the user attribute supplied. OIM will then call the corresponding "updated" process task for the process form field being updated in order to propagate the change to the target system. You can look at the Resource History to see the process tasks executed.

Update MDS for Resource Object
1. In design console, expand Resource Management, and double click Resource Objects.
2. Search for the resource object for your target system.
3. Navigate to the Object Reconciliation tab, and click the Create Reconciliation Profile button.