Usefule link to play around with OID 11g

http://onlineappsdba.com/index.php/2010/12/14/how-to-add-custom-attributes-object-classes-in-oid-from-command-line-or-gui/

Enabling the schema manager in Active Directory

Another way to modify the schema is to edit the registry.

1. Start regedit.
2. Go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters registry entry.
3. Double-click Schema Update Allowed (of type REG_DWORD).
4. Set the value to 1.
5. Click OK.
6. Close the registry editor.

Ant build script to automate OIM build

<?xml version="1.0" encoding="UTF-8"?>
<project basedir="." name="Builder" default="BuildAll">
 <property name="debug" value="on"/>
 <property name="project.home" value=".."/>
 <property name="src.dir" value="${project.home}/source"/>
 <property name="WebApp.src.dir" value="${project.home}/xlWebApp"/>
 <property name="test.src.dir" value="${project.home}/testsource"/>
 <property name="XellerateFull.src.dir" value="${project.home}/XellerateFull"/>
 <property name="lib.dir" value="${project.home}/lib"/>
 <property name="build.dir" value="${project.home}/build"/>
 <property name="javadocs.dir" value="${build.dir}/javadocs"/>
 <property name="build.classes.dir" value="${build.dir}/classes"/>
 <property name="build.classes.dir.com" value="${build.dir}/classes/com"/>
 <property name="build.deploy.dir" value="${build.dir}/deploy"/>
 <property name="build.deploy.JavaTasks.dir" value="${build.deploy.dir}/JavaTasks"/>
 <property name="build.deploy.ScheduleTask.dir" value="${build.deploy.dir}/ScheduleTask"/>
 <property name="build.deploy.ThirdParty.dir" value="${build.deploy.dir}/ThirdParty"/>
 <property name="build.deploy.EventHandler.dir" value="${build.deploy.dir}/EventHandlers"/>
 <path id="project.class.path">
  <fileset dir="${lib.dir}">
       <include name="**/*.jar"/>
  </fileset>
 </path>
 <target description="Clean All" name="Clean">
  <delete dir="${build.classes.dir.com}" />
  <delete dir="${build.deploy.dir}"/>
  <delete dir="${javadocs.dir}"/>
 </target>

 <target description="Build Java Documentation." name="javadoc">
  <delete dir="${javadocs.dir}"/>
  <mkdir dir="${javadocs.dir}"/>
  <javadoc use="true" doctitle=" Documentation" windowtitle=" JavaDoc" private="true" sourcepath="${src.dir}" packagenames="com.*" destdir="${javadocs.dir}">
   <classpath refid="project.class.path"/>
  </javadoc>
 </target>
 <target name="Initialize" description="Initialize Build Directories" >
  <tstamp/>
  <mkdir dir="${build.deploy.dir}"/>
  <mkdir dir="${build.deploy.JavaTasks.dir}"/>
  <mkdir dir="${build.deploy.ScheduleTask.dir}"/>
  <mkdir dir="${build.deploy.ThirdParty.dir}"/>
  <mkdir dir="${build.deploy.EventHandler.dir}"/>
 </target>

 <target description="ScheduledTask" name="ScheduledTask" depends="Initialize">
  <javac debug="${debug}" deprecation="false" destdir="${build.classes.dir}" srcdir="${src.dir}">
   <classpath refid="project.class.path"/>
   <include name="**/com/xxx/scheduledtasks/**/*.java"/>
  </javac>
  <jar basedir="${build.classes.dir}" jarfile="${build.deploy.ScheduleTask.dir}/ScheduledTasks.jar" >
   <include name="**/com/xxx/scheduledtasks/**/*.class"/>
  </jar> 
 </target>

 <target description="JavaTasks" name="JavaTasks" depends="Initialize">
  <javac debug="${debug}" deprecation="false" destdir="${build.classes.dir}" srcdir="${src.dir}">
   <classpath refid="project.class.path"/>
   <include name="**/com/xxx/javatasks/**/*.java"/>
  </javac>
  <jar basedir="${build.classes.dir}" jarfile="${build.deploy.JavaTasks.dir}/JavaTasks.jar" >
   <include name="**/com/xxx/javatasks/**/*.class"/>
  </jar> 
 </target>

 <target description="EventHandlers" name="EventHandlers" depends="Initialize">
  <javac debug="${debug}" deprecation="false" destdir="${build.classes.dir}" srcdir="${src.dir}">
   <classpath refid="project.class.path"/>
   <include name="**/com/xxx/eventhandlers/**/*.java"/>
  </javac>
  <jar basedir="${build.classes.dir}" jarfile="${build.deploy.EventHandler.dir}/EventHandlers.jar" >
   <include name="**/com/xxx/eventhandlers/**/*.class"/>
  </jar> 
 </target>
 <target description="ThirdParty" name="ThirdParty" depends="Initialize">
  <javac debug="${debug}" deprecation="false" destdir="${build.classes.dir}" srcdir="${src.dir}">
   <classpath refid="project.class.path"/>
   <include name="**/com/xxx/utils/**/*.java"/>
  </javac>
  <jar basedir="${build.classes.dir}" jarfile="${build.deploy.ThirdParty.dir}/Util.jar" >
   <include name="**/com/xxx/utils/**/*.class"/>
  </jar> 
 </target>
 <target description="BuildAll" name="BuildAll" depends="Clean, Initialize, ScheduledTask, JavaTasks, EventHandlers, ThirdParty">
 </target>
</project>

Modifying the maxpagesize in active directory

By default, windows returns only a maximum of 1000 objects in response to a single LDAP query. This can be a limitation when you have more than 1000 objects in your Active Directory and you are running some kind of script that does a bulk import of objects (user accounts and/or computers) from Active Directory.

Some applications like Adobe Connect also require such bulk imports. If you find that the number of user accounts imported from Active Directory is exactly 1000 when you are sure there are more, its time to take a look at this.

The 1000-object limit is governed by the MaxPageSize LDAP administration limit, which is defined using NTDSUTIL. To increase the value:

1.Open Command Prompt on a domain controller, logged in as domain administrator.
2.Type NTDSUTIL and press ENTER.
3.In the ntdsutil: prompt, type ldap policies
4.In the ldap policy: prompt, type connections
5.In the server connections: prompt, type connect to server <FQDN of domain controller>
6.Once you are connected, type q to come back to the ldap policy: prompt.
7.If you type show values, you can see the current value for the administration limits, including the MaxPageSize limit.
8.To change the value to allow up to 30,000 objects to be returned in a single LDAP query, type set MaxPageSize to 30000
9.You can view your changes by typing Show Changes. Note that the new values appear in brackets, because you have not yet commited your changes.
10.To commit changes type commit changes

Ntdsutil Usage

Ntdsutil.exe is a command-line tool that provides management facilities for Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS). You can use the ntdsutil commands to perform database maintenance of AD DS, manage and control single master operations, and remove metadata left behind by domain controllers that were removed from the network without being properly uninstalled. This tool is intended for use by experienced administrators.
Ntdsutil.exe is built into Windows Server 2008 and Windows Server 2008 R2. It is available if you have the AD DS or the AD LDS server role installed. It is also available if you install the Active Directory Domain Services Tools that are part of the Remote Server Administration Tools (RSAT). For more information, see How to Administer Microsoft Windows Client and Server Computers Locally and Remotely (http://go.microsoft.com/fwlink/?LinkID=177813).
To use Ntdsutil.exe, you must run the ntdsutil command from an elevated command prompt. To open an elevated command prompt, click Start, right-click Command Prompt, and then click Run as administrator.

LDAP Error Codes

Error Code	Error	Description
0	LDAP_SUCCESS	Indicates the requested client operation completed successfully.
1	LDAP_OPERATIONS_ERROR	Indicates an internal error. The server is unable to respond with a more specific error and is also unable to properly respond to a request. It does not indicate that the client has sent an erroneous message. In NDS 8.3x through NDS 7.xx, this was the default error for NDS errors that did not map to an LDAP error code. To conform to the new LDAP drafts, NDS 8.5 uses 80 (0x50) for such errors.
2	LDAP_PROTOCOL_ERROR	Indicates that the server has received an invalid or malformed request from the client.
3	LDAP_TIMELIMIT_EXCEEDED	Indicates that the operation's time limit specified by either the client or the server has been exceeded. On search operations, incomplete results are returned.
4	LDAP_SIZELIMIT_EXCEEDED	Indicates that in a search operation, the size limit specified by the client or the server has been exceeded. Incomplete results are returned.
5	LDAP_COMPARE_FALSE	Does not indicate an error condition. Indicates that the results of a compare operation are false.
6	LDAP_COMPARE_TRUE	Does not indicate an error condition. Indicates that the results of a compare operation are true.
7	LDAP_AUTH_METHOD_NOT_SUPPORTED	Indicates that during a bind operation the client requested an authentication method not supported by the LDAP server.
8	LDAP_STRONG_AUTH_REQUIRED	Indicates one of the following: In bind requests, the LDAP server accepts only strong authentication. In a client request, the client requested an operation such as delete that requires strong authentication. In an unsolicited notice of disconnection, the LDAP server discovers the security protecting the communication between the client and server has unexpectedly failed or been compromised.
9		Reserved.
10	LDAP_REFERRAL	Does not indicate an error condition. In LDAPv3, indicates that the server does not hold the target entry of the request, but that the servers in the referral field may.
11	LDAP_ADMINLIMIT_EXCEEDED	Indicates that an LDAP server limit set by an administrative authority has been exceeded.
12	LDAP_UNAVAILABLE_CRITICAL_EXTENSION	Indicates that the LDAP server was unable to satisfy a request because one or more critical extensions were not available. Either the server does not support the control or the control is not appropriate for the operation type.
13	LDAP_CONFIDENTIALITY_REQUIRED	Indicates that the session is not protected by a protocol such as Transport Layer Security (TLS), which provides session confidentiality.
14	LDAP_SASL_BIND_IN_PROGRESS	Does not indicate an error condition, but indicates that the server is ready for the next step in the process. The client must send the server the same SASL mechanism to continue the process.
15		Not used.
16	LDAP_NO_SUCH_ATTRIBUTE	Indicates that the attribute specified in the modify or compare operation does not exist in the entry.
17	LDAP_UNDEFINED_TYPE	Indicates that the attribute specified in the modify or add operation does not exist in the LDAP server's schema.
18	LDAP_INAPPROPRIATE_MATCHING	Indicates that the matching rule specified in the search filter does not match a rule defined for the attribute's syntax.
19	LDAP_CONSTRAINT_VIOLATION	Indicates that the attribute value specified in a modify, add, or modify DN operation violates constraints placed on the attribute. The constraint can be one of size or content (string only, no binary).
20	LDAP_TYPE_OR_VALUE_EXISTS	Indicates that the attribute value specified in a modify or add operation already exists as a value for that attribute.
21	LDAP_INVALID_SYNTAX	Indicates that the attribute value specified in an add, compare, or modify operation is an unrecognized or invalid syntax for the attribute.
22-31		Not used.
32	LDAP_NO_SUCH_OBJECT	Indicates the target object cannot be found. This code is not returned on following operations: Search operations that find the search base but cannot find any entries that match the search filter. Bind operations.
33	LDAP_ALIAS_PROBLEM	Indicates that an error occurred when an alias was dereferenced.
34	LDAP_INVALID_DN_SYNTAX	Indicates that the syntax of the DN is incorrect. (If the DN syntax is correct, but the LDAP server's structure rules do not permit the operation, the server returns LDAP_UNWILLING_TO_PERFORM.)
35	LDAP_IS_LEAF	Indicates that the specified operation cannot be performed on a leaf entry. (This code is not currently in the LDAP specifications, but is reserved for this constant.)
36	LDAP_ALIAS_DEREF_PROBLEM	Indicates that during a search operation, either the client does not have access rights to read the aliased object's name or dereferencing is not allowed.
37-47		Not used.
48	LDAP_INAPPROPRIATE_AUTH	Indicates that during a bind operation, the client is attempting to use an authentication method that the client cannot use correctly. For example, either of the following cause this error: The client returns simple credentials when strong credentials are required...OR...The client returns a DN and a password for a simple bind when the entry does not have a password defined.
49	LDAP_INVALID_CREDENTIALS	Indicates that during a bind operation one of the following occurred: The client passed either an incorrect DN or password, or the password is incorrect because it has expired, intruder detection has locked the account, or another similar reason. This is equivalent to AD error code 52e.
49	ERROR_TOO_MANY_CONTEXT_IDS	Corresponds to data code 568. Indicates that during a log-on attempt, the user's security context accumulated too many security IDs. This is an issue with the specific LDAP user object/account which should be investigated by the LDAP administrator.
50	LDAP_INSUFFICIENT_ACCESS	Indicates that the caller does not have sufficient rights to perform the requested operation.
51	LDAP_BUSY	Indicates that the LDAP server is too busy to process the client request at this time but if the client waits and resubmits the request, the server may be able to process it then.
52	LDAP_UNAVAILABLE	Indicates that the LDAP server cannot process the client's bind request, usually because it is shutting down.
52e	AD_INVALID CREDENTIALS	Indicates an Active Directory (AD) AcceptSecurityContext error, which is returned when the username is valid but the combination of password and user credential is invalid.This is the AD equivalent of LDAP error code 49.
53	LDAP_UNWILLING_TO_PERFORM	Indicates that the LDAP server cannot process the request because of server-defined restrictions. This error is returned for the following reasons: The add entry request violates the server's structure rules...OR...The modify attribute request specifies attributes that users cannot modify...OR...Password restrictions prevent the action...OR...Connection restrictions prevent the action.
54	LDAP_LOOP_DETECT	Indicates that the client discovered an alias or referral loop, and is thus unable to complete this request.
55-63		Not used.
64	LDAP_NAMING_VIOLATION	Indicates that the add or modify DN operation violates the schema's structure rules. For example, The request places the entry subordinate to an alias. The request places the entry subordinate to a container that is forbidden by the containment rules. The RDN for the entry uses a forbidden attribute type.
65	LDAP_OBJECT_CLASS_VIOLATION	Indicates that the add, modify, or modify DN operation violates the object class rules for the entry. For example, the following types of request return this error: The add or modify operation tries to add an entry without a value for a required attribute. The add or modify operation tries to add an entry with a value for an attribute which the class definition does not contain. The modify operation tries to remove a required attribute without removing the auxiliary class that defines the attribute as required.
66	LDAP_NOT_ALLOWED_ON_NONLEAF	Indicates that the requested operation is permitted only on leaf entries. For example, the following types of requests return this error: The client requests a delete operation on a parent entry. The client request a modify DN operation on a parent entry.
67	LDAP_NOT_ALLOWED_ON_RDN	Indicates that the modify operation attempted to remove an attribute value that forms the entry's relative distinguished name.
68	LDAP_ALREADY_EXISTS	Indicates that the add operation attempted to add an entry that already exists, or that the modify operation attempted to rename an entry to the name of an entry that already exists.
69	LDAP_NO_OBJECT_CLASS_MODS	Indicates that the modify operation attempted to modify the structure rules of an object class.
70	LDAP_RESULTS_TOO_LARGE	Reserved for CLDAP.
71	LDAP_AFFECTS_MULTIPLE_DSAS	Indicates that the modify DN operation moves the entry from one LDAP server to another and requires more than one LDAP server.
72-79		Not used.
80	LDAP_OTHER	Indicates an unknown error condition. This is the default value for NDS error codes which do not map to other LDAP error codes.
525	USER NOT FOUND	Indicates an Active Directory (AD) AcceptSecurityContext data error that is returned when the username is invalid.
530	NOT_PERMITTED_TO_LOGON_AT_THIS_TIME	Indicates an Active Directory (AD) AcceptSecurityContext data error that is logon failure caused because the user is not permitted to log on at this time. Returns only when presented with a valid username and valid password credential.
531	RESTRICTED_TO_SPECIFIC_MACHINES	Indicates an Active Directory (AD) AcceptSecurityContext data error that is logon failure caused because the user is not permitted to log on from this computer. Returns only when presented with a valid username and valid password credential.
532	PASSWORD_EXPIRED	Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure. The specified account password has expired. Returns only when presented with valid username and password credential.
533	ACCOUNT_DISABLED	Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure. The account is currently disabled. Returns only when presented with valid username and password credential.
701	ACCOUNT_EXPIRED	Indicates an Active Directory (AD) AcceptSecurityContext data error that is a logon failure. The user's account has expired. Returns only when presented with valid username and password credential.
773	USER MUST RESET PASSWORD	Indicates an Active Directory (AD) AcceptSecurityContext data error. The user's password must be changed before logging on the first time. Returns only when presented with valid user-name and password credential.

DESCRIPTION FOR OIM 9.1.0.0 DATABASE TABLES

DESCRIPTION FOR OIM 9.1.0.0 DATABASE TABLES
-------------------------------------------

"AAD" List To Define The Administrators For Each Organization And Their Delegated Admin Privileges
"AAP" Table for storing Resource - Organization level parameter Values
"ACP" Acp - Link Table That Holds Reference To Act And Pkg Tables, Table That Defines The Objects (Resources) Allowed For A Particular Organization
"ACS" Link Table for Account Table(ACT) and Server Table(SVR)
"ACT" Defines information about all organizations created through Xellerate
"ADJ" Contains the Java API information for the constructor with parameters and method name with parameters chosen for an adapter task of type JAVA, UTILITY, TAME, REMOTE, or XLAPI.
"ADL" Contains the all of the necessary parameters for an adapter task of type IF, ELSE IF, FOR, WHILE, SET, and VARIABLE tasks. These type of tasks are known as LOGIC TASKS
"ADM" Data mapping between parameters input/output parameters and source/sink
"ADP" Defines an adapter created through the Adapter Factory
"ADS" Database, schema and procedure name selections which define a stored procedure adapter task.
"ADT" Defines a task attached to an adapter
"ADU" Contains the web service and method chosen for a task of the Adapter Factory
"ADV" Adapter variable table contains variables that have been created for specific adapters.
"AFM" Links an adapter with a form
"AGS" Holds the definition of organization/contact groups.
"AOA" Contains the OpenAdapter property file for OpenAdapter
"ARS" Contains custom response codes for ''Process Task'' Adapters only.
"ATP" Defines input and output parameters for the constructor and method of an adapter task of type JAVA, UTILITY, TAME, REMOTE, and XLAPI
"ATS" Stores which services or can be ordered by which organizations and which rates apply.
"CIH" Holds connector specific installation history information
"CRT" Trusted Certificate Information
"DAV" Stores the runtime data mappings for ''Entity'' & ''Rule Generator'' adapters. The data source being an Xellerate form or child table, or a user defined process form.
"DEP" Dependencies Among Tasks Within A Workflow Process
"DOB" Data Resource definition consisting of the fully qualified class name of the data object.
"DVT" Defines the one to many relationship between Data Resources and Event Handlers (this includes adapters)
"EIH" Export Import History. Each row represents one Data Deployment Management session.
"EIO" Export Import Objects. Each row represents one object exported/imported.
"EIF" Export Import Files. Each row contains one single file used in export/import operation. For export there is only one file.
"EIL" DB Based lock for export operation. Used to make sure only one user can import at a time. This is currently not managed through dataobjects.
"EIS" Substitutions used during import process
"EMD" Core -- Email Definition Information Table That Holds The Email Template Definitions.
"ERR" Error codes.
"ESD" Encrypted columns not within the bounds of the SDK
"EVT" Defines event handlers by providing a the process and class name. In addition the scheduling time of when the event handler can execute is set to pre (insert, update, delete) or post (insert, update, delete)
"FUG" List to define the administrators for each user defined object in the ''Structure Utility'' form or for each user defined field in the ''User Defined Field Definition'' form.
"GPG" List to define the (nested)group members of User Group in the ''User Group'' form.
"GPP" List to define the Administrators and their delegated admin rights over a User Group.
"GPY" Joins Properties (PTY) and Groups (UGP).
"IEI" Table where all the imports and exports are defined.
"LAY" Table where the layouts are defined for the various imports and exports.
"LIT" Import/export table.
"LKU" Lookup definition entries
"LKV" Lookup values
"LOB" Import/export table.
"LOC" Holds information about locations
"MAP" XML MAP SCHEMA INFORMATION
"MAV" Stores the runtime data mappings for ''Process Task'' adapters. The data source being a process form, Location, User, Organization, Process, IT Resource, or Literal data.
"MEV" E-mail notification events
"MIL" Holds information about tasks of a process
"MSG" Defines the user groups that have permission to set the status of a process task.
"MST" Task Status And Object Status Information. Holds All The Task Status To Object Status Mappings
"OBA" OBJECT AUTHORIZER INFORMATION.
"OBD" OBJECT DEPENDENCIES.
"OBI" OBJECT INSTANCE INFORMATION.
"OBJ" Resource Object definition information.
"ODF" HOLDS OBJECT TO PROCESS FORM DATA FLOW MAPPINGS.
"ODV" OBJECT EVENTS/ADAPTERS INFORMATION.
"OIO" OBJECT INSTANCE REQUEST TARGET ORGANIZATION INFORMATION.
"OIU" OBJECT INSTANCE REQUEST TARGET USER INFORMATION.
"OOD" OBJECT INSTANCE REQUEST TARGET ORGANIZATION DEPENDENCY INFORMATION.
"ORC" This Entity Holds The Detail On Each Order. This Could Be Considered The Items Section Of An Invoice. This Entity Is The Instance Of A Particular Process
"ORD" Holds information that is necessary to complete an order regardless of a process being ordered
"ORF" Resource Reconciliation Fields
"ORR" OBJECT RECONCILIATION ACTION RULES
"OSH" Task Instance Assignment History
"OSI" Holds information about tasks that are created for an order
"OST" OBJECT STATUS INFORMATION.
"OTI" Holds specific information such as status or scheduled dates about an instance of a task which are in Pending(Provisioning/Approval tasks ) and Rejected (Provisioning tasks) status buckets
"OUD" Object Instance Request Target User Dependency Information. Holds The Dependency Between Different Resource Instances Provisioned To A User.
"OUG" List to define the administrators for each Resource Resource.
"PCQ" Holds the challenging questions and answers for a user
"PDF" PACKAGE DATA FLOW TABLE HOLDS THE DATA FLOW RELATIONSHIPS BETWEEN PACKAGES
"PHO" Holds all communication addresses for this contact -- e.g., contact telephone numbers, fax numbers, e-mail, etc.
"PKD" PACKAGE DEPENDENCY TABLE HOLDS THE DEPENDENCY RELATIONSHIPS BETWEEN CHILD PACKAGES OF A PARENT PACKAGE
"PKG" Consists of names and system keys of service processs, which consist of a group of services from the TOS table. Defines a Process in Xellerate.
"PKH" Package Hierarchy Table Holds The Parent-child Relationships Between Processes.
"POC" Stores values for the child tables of the Object/Process form of a resource being provisioned by an access policy
"POF" POLICY FIELD TABLE HOLDS THE FIELD VALUE PAIRS THAT CONSTITUTE THE DEFINITION OF A POLICY
"POG" Join table between Policy and User Groups, Specifies the groups to whom an access policy will apply.
"POL" Policy Table Holds A Policy, Defines An Access Policy In The System.
"POP" Policy Package Join Table Holds The Packages That A Particular Policy Orders For User, Defines Which Resources Will Be Provisioned Or Denied For A Particular Access Policy.
"PRF" Process Reconciliation Field Mappings
"PRO" Defines a process name, scheduling frequency, and priority. A process is made up of one or more tasks.
"PTY" Client Properties Table
"PUG" List To Define The Administrators And Their Delegated Admin Rights For Each Process.
"PWR" Table for Password Rule Policies
"PXD" Table that holds the list of all Proxies Defined
"QUE" ADMINISTRATIVE QUEUES DEFINITION
"QUG" ADMINISTRATIVE GROUP MEMBERS
"QUM" ADMINISTRATIVE QUEUE MEMBERS
"RAO" RESOURCE AUDIT OBJECTIVES INFORMATION.
"RAV" Stores the runtime data mappings for ''Pre-populater'' adapters. The data source being an Xellerate form or child table, or a user defined form.
"RCA" Reconciliation Event Organizations Matched
"RCB" Reconciliation Event Invalid Data
"RCD" Reconciliation Event Data
"RCE" Reconciliation Events
"RCH" Reconciliation Event Action History
"RCM" Reconciliation Event Multi-Valued Attribute Data
"RCP" Reconciliation Event Processes Matched
"RCU" Reconciliation Event Users Matched
"RCX" Exceptions found in Target data during Reconciliation
"REP" Table for storing report meta data. REP is Table that contains all information about reports in the system
"REP.REP_KEY" This is the primary key of the table
"REP.REP_NAME" The name of the report
"REP.REP_DESCRIPTION" Short description for each report, what each report does
"REP.REP_SP_NAME" Name of the stored procedure that will run for this report
"REP.REP_XML_META" The XML Meta data for the report
"REP.REP_DATA_LEVEL" Data level value for a row
"REP.REP_CREATE" Time stamp when the row was created
"REP.REP_CREATEBY" Key of the user who created the row
"REP.REP_UPDATE" Time stamp when the row was updated
"REP.REP_UPDATEBY" Key of the user who updated the row
"REP.REP_NOTE" Note Field
"REP.REP_ROWVER" Row version field
"REP.REP_CODE" The Report Code
"REP.REP_TYPE" Report Type
"REP.REP_DATASOURCE" Name of the data source against which the report should be run
"REP.REP_MAX_REP_SIZE" Maximum allowed size, in rows, for the report
"REP.REP_FILTER_COUNT" The number of filter drop down lists that should appear for the report
"REQ" THIS TABLE HOLDS REQUEST INFORMATION
"RES" This table is used to stored adapter resources entered by the user.
"RGM" Table for Response Code Generated Milestones
"RGP" Rules To Apply To A User Group, Defines The Auto-group Membership Rules Attached To A Particular Group.
"RGS" Defines all known registries. These are used by Web Service tasks in an Adapter to communicate with a web service.
"RIO" Request Organizations Resolved Object Instances
"RIU" Request Users Resolved Object Instances
"RLO" This table contains directory URLs which are referenced by Adapter Factory jar/class files.
"RML" Rules To Apply To Task, Defines The Task Assignment Rules Attached To A Process Task.
"ROP" Rules To Apply To An Object-process Pair, Defines The Process Determination Rules Attached To A Resource Object.
"RPC" Reconciliation Event Process Child Table Matches
"RPG" List To Define Access to Groups for particular Reports
"RPG" Link table between Group table and Report Table. Specifies which group has access to which reports
"RPG.REP_KEY" Report Key
"RPG.UGP_KEY" User Group Key
"RPG.RPG_DATA_LEVEL" Data level value for a row
"RPG.RPG_CREATE" Time stamp when the row was created
"RPG.RPG_CREATEBY" Key of the user who created the row
"RPG.RPG_UPDATE" Time stamp when the row was updated
"RPG.RPG_UPDATEBY" Key of the user who updated the row
"RPG.RPG_NOTE" Note Field
"RPG.RPG_ROWVER" Row version field
"RPP" Parameters passed to report.
"RPT" Stores information related to the creation of reports
"RPW" Rules To Apply To A Password Policy, Defines The Policy Determination Rules Attached To A Password Policy.
"RQA" REQUEST TARGET ORGANIZATION INFORMATION.
"RQC" REQUEST COMMMENT INFORMATION
"RQD" Contains self-registration request data for web admin.
"RQE" REQUEST ADMINISTRATIVE QUEUES
"RQH" REQUEST STATUS HISTORY
"RQO" REQUEST OBJECT INFORMATION.
"RQU" REQUEST OBJECT TARGET USER INFORMATION.
"RQY" Request Organizations Requiring Resolution
"RQZ" Request Users Requiring Resolution
"RRE" Reconciliation User Matching Rule Elements
"RRL" Reconciliation User Matching Rules
"RRT" Reconciliation User Matching Rule Element Properties
"RSC" Defines The All The Possible Response Code For A Process Task.
"RUE" Defines The Elements In A Rule Definition.
"RUG" List to define the administrators for each Request
"RUL" RULE DEFINITIONS
"RVM" Holds Recovery Milestones
"SCH" Holds specific information about an instance of a ask such as its status or scheduled dates
"SDC" Column metadata.
"SDH" Meta-Table Hierarchy.
"SDK" User define data object meta data definition
"SDL" SDK VERSION LABELS
"SDP" User defined column properties
"SEL" Data Object Permissions For Groups On A Specified Dataobject
"SIT" The SIT table contains information about sites. Sites are subsets of locations.
"SPD" IT Resource parameter definition
"SRE" Defines Which Pre-populate Rule Generator Will Run For A Field Of User Defined Data Object.
"SRP" Should be replaced by the rate table from a billing system. Here it hold specific rates for specific services.
"SRS" IT Resource - IT Resource join
"STA" Status Codes
"SVD" IT Resource type definition
"SVP" IT Resource property definition
"SVR" It Resource Instance Definition
"SVS" IT Resource - Site Join
"TAP" Holds parameter values for a task, which is an instantiation of ValidTask, i.e. value for parameter CompanyName, etc.
"TAS" Holds instances of ValidTask. Examples of ValidTasks would be reports, imports, etc. ValidTaskParameters indicate what parameters can be assassigned to an instance of a task, i.e.
"TDV" Used by event manager/data objects, joins data objects, types of service, and events.
"TLG" Keeps log of SQL transactions.
"TMP" Indicates which tasks are in a process. Tasks are defined in table; this way, one task can be in many processes.
"TOD" To do list settings table.
"TOS" Holds information about a process
"TSA" STORES INITIALIZATION PARAMS (NAME/VALUE PAIRS) FOR SCHEDULER TASKS
"TSK" SCHEDULER TASK DEFINITION INFORMATION
"TSH" Recording History of Task Execution in Scheduler
"UDP" User-defined field table
"UGP" Defines a group of users
"UHD" User Policy Profile History Details table
"ULN" THIS TABLE HOLD ULN TABLE VALUE
"UNM" "UnDo Milestone" Feature
"UPD" User Policy Profile Details table
"UPH" User Policy Profile History table
"UPL" User-defined field table
"UPP" User Policy Profile table
"UPT" User-defined field table
"UPY" Joins Properties (PTY) and User (USR) tables.
"USG" This table stores which users are in which groups.
"USR" Stores all information regarding a user.
"UWP" Window sequence, nesting in CarrierBase explorer for each user group.
"VTK" Defines automation task types such as reports, imports, and exports.
"VTP" Valid Task Parameters. Indicates which parameters can be defined for an instance of a task.
"WIN" Windows table" Windows keys, descriptions, and class names.
"XSD" This table holds Xellerate System Data
"TEMP_ORGANIZATION_USERS" Global Temporary table used in the Organization Structure report

Creating a scheduled task in OIM

While writing a custom scheduled task we will have to extend the SchedulerBaseTask and overwrite the methods init and execute. In the init method we will initialize all the schedule task attributes and other global variables. In the execute method we will write the actual logic to handle the reconciliation. Use the following to implement the ignore event:

//ignore event API we will have to pass the resource obj name and the hashmap containing the mapping b/w the field name and value pairs. This is to ignore the parent form data.
if (!this.tcReconIntf.ignoreEvent(sObjectName, hmuserAttr))

After writing the custom code we will have to tell the OIM about this. Steps to do this:

1.In the resource object reconciliation tab we will have to add the attributes to be reconciled to the resource profile form.
2.Then we will have to map them in the process definition.
3.After the mapping is done we will have to export the jar and place it in the OIM_HOME/ScheduledTasks
4. Now create a scheduled task by giving the complete class name.
5. Add the required attributes in the task and then save it. In the tasks we usually add the IT resource name from which we pick the target connection details,recon Field Mapping lookup name,etc.
6.Save the task and run it.

Procedure to call a webservice from OIM

There are three steps for this:
 1.  From the wsdl file generate stubs automatically using eclipse or manually using the axis tools.
 2.  Now write the implementation class that will call the webservice.
 3. Now map the implementation class/method with the OIM adapter.

Attached are the screen shots for better understanding.

Right Click on the wsdl File --->Web Services--->Generate Client. After generating the client stubs it looks like the one below.

On finish you will get the source into the src folder as shown below:

Create a new class as follows :

Using the proxy class that is auto-generated call the required methods after initializing it.

Thats all it requires to call a webservice!!!!
Now this implementation class can be attached to the OIM adapter as usual.

Advantages of a cluster server setup

http://msdn.microsoft.com/en-us/library/ff649250.aspx

OIM 11G certified connectors

http://www.oracle.com/technetwork/middleware/ias/downloads/idm-certification-101401-083012.html#OIMCC

Creating an Email Definition

Creating an Email Definition

1.Expand Process Management
2.Give any name in the Name field.
3.Select the options
Provisioning related----for provisioning operations
Request related------for the request/approval flow
General------fr any general email
4.Select from and give in the user login
5.Give the subject line
6.Type in the text in the body. If any runtime variable is required like user login you can select user profile information under the Targets drop down and user login in the variables drop down.This automatically inserts a tag in the body. In the same way the process form information can also be selected.
7.Click save.


Attaching the Email definition with the process task

1. open any process task for which the status has to be sent to a user on its completion/rejection.
2. In the assignment tab click on add to add this new email definition and then selct the corresponding task status(C,P,R..etc).
3. Click on save.

Upgrade from OIM 9.1 to OIM 11G

http://download.oracle.com/docs/cd/E21764_01/upgrade.1111/e10129/upgrade_oim.htm#BAJJCHFA

No Class Def Found Error when deploying the OIM web service

I got this error when i deployed OIM SPML webservice. And i was able to resolve this by appending the JBOSS_CLASSPATH with E:\jboss-4.0.2\client\commons-discovery.jar;E:\oim\jboss-4.2.3.GA-jdk6\client\commons-logging.jar; in the jboss run.bat.