Custom Target Reconciliation

import Thor.API.Exceptions.tcAPIException;

import Thor.API.Operations.tcProvisioningOperationsIntf;

import Thor.API.Operations.tcUserOperationsIntf;

import com.bea.security.providers.xacml.entitlement.parser.Roles;

import java.io.BufferedReader;

import java.io.FileReader;

import java.io.IOException;

import java.util.ArrayList;

import java.util.Date;

import java.util.HashMap;

import java.util.Hashtable;

import java.util.Map;

import javax.security.auth.login.LoginException;

import oracle.iam.platform.OIMClient;

import oracle.iam.reconciliation.api.BatchAttributes;

import oracle.iam.reconciliation.api.EventAttributes;

import oracle.iam.reconciliation.api.InputData;

import oracle.iam.reconciliation.api.ReconOperationsService;

import oracle.iam.reconciliation.api.ReconciliationResult;

import oracle.iam.scheduler.vo.TaskSupport;

public class TestRecon extends TaskSupport {

static OIMClient client = null;

private tcUserOperationsIntf userOperation = null;

private tcProvisioningOperationsIntf provisionOperation = null;

private ReconOperationsService reconOperation;

private String fileName;

private String ItResource;

private String resourceObjName;

public OIMClient oimConnection() {

oracle.iam.platform.OIMClient oimClient = null;

try {

Hashtable<Object, Object> env = new Hashtable<Object, Object>();

env.put(OIMClient.JAVA_NAMING_FACTORY_INITIAL, weblogic.jndi.WLInitialContextFactory");

env.put(OIMClient.JAVA_NAMING_PROVIDER_URL, "t3://:14000");

System.setProperty("java.security.auth.login.config", "");

System.setProperty("OIM.AppServerType", "wls");

System.setProperty("APPSERVER_TYPE", "wls");

oimClient = new oracle.iam.platform.OIMClient(env);

oimClient.login("xelsysadm", "Welcome123".toCharArray());

} catch (LoginException e) {

e.printStackTrace();

} catch (Exception e) {

e.printStackTrace();

}

System.out.print("Successfully Connected with OIM ");

return oimClient;

}

public static void login() throws LoginException {

System.out.println("inside oim login....");

String ctxFactory = "weblogic.jndi.WLInitialContextFactory";

String serverURL = "t3://localhost:14000/identity";

System.setProperty("java.security.auth.login.config", "C:\\Users\\bprasad\\Desktop\\designconsole\\config\\authwl.conf");

System.setProperty("APPSERVER_TYPE", "wls");

String username = "XELSYSADM";

char[] password = "Welcome123".toCharArray();

Hashtable env = new Hashtable();

env.put(OIMClient.JAVA_NAMING_FACTORY_INITIAL, ctxFactory);

env.put(OIMClient.JAVA_NAMING_PROVIDER_URL, serverURL);

client = new OIMClient(env);

try {

System.out.println("Logging in");

client.login(username, password);

System.out.println("Login successful..");

} catch (Exception e) {

e.printStackTrace();

System.out.println("Login failed");

}

}

public TestRecon() {

}

public static void main(String[] args) throws LoginException {

// String fileName = "C:\\Users\\Downloads\\OIM\\projects\\workday\\sampleIn.csv";

String itresourceName = "FlatFileTrusted";

String resourceObj = "FlatFileTrusted User";

HashMap<String, String> map = null;

map = new HashMap<String, String>();

map.put("File Name", fileName);

map.put("ITResource Name", itresourceName);

map.put("Resource Object Name", resourceObj);

TestRecon dummyRecon = new TestRecon();

login();

dummyRecon.execute(map);

}

public void execute(HashMap hashMap) {

fileName = hashMap.get("File Name").toString();

ItResource = hashMap.get("ITResource Name").toString();

this.resourceObjName = hashMap.get("Resource Object Name").toString();

initialize();

// getReconData();

triggerRecon();

}

private void initialize() {

this.userOperation = ((tcUserOperationsIntf) client.getService(tcUserOperationsIntf.class));

this.provisionOperation = ((tcProvisioningOperationsIntf) client

.getService(tcProvisioningOperationsIntf.class));

reconOperation = ((ReconOperationsService) client.getService(ReconOperationsService.class));

}

public HashMap getAttributes() {

return null;

}

public void setAttributes() {

}

private void getReconData() {

String file = this.fileName;

BufferedReader reader = null;

try {

reader = new BufferedReader(new FileReader(file));

int headerFieldCount = 0;

String line = "";

while ((line = reader.readLine()) != null) {

this.data.add(line.split("\\,"));

}

} catch (Exception e) {

e.printStackTrace();

try {

reader.close();

} catch (IOException ioe) {

ioe.printStackTrace();

} catch (Exception e1) {

e1.printStackTrace();

}

} finally {

try {

reader.close();

} catch (IOException e) {

e.printStackTrace();

} catch (Exception e) {

e.printStackTrace();

}

}

}

private void triggerRecon() {

EventAttributes ea = new EventAttributes();

Map reconMap = new HashMap();

reconMap.put("User Login", "Magnus6142");

reconMap.put("First Name", "MagnusF");

reconMap.put("Last Name", "MagnusL");

reconMap.put("Organization", "Skillopedia");

reconMap.put("User Type ", "Employee");

reconMap.put("CPI", "112211");

reconMap.put("Employee Number", "2855");

reconMap.put("WorkdayStatus", "Active");

reconMap.put("status", "Active");

reconMap.put("Role", "EMP");

ea.setEventFinished(true);

ea.setActionDate(null);

long eventKey = reconOperation.createReconciliationEvent(this.resourceObjName, reconMap, ea);

try {

reconOperation.processReconciliationEvent(eventKey);

} catch (tcAPIException e) {

e.printStackTrace();

} catch (Exception e) {

e.printStackTrace();

}

}

}

How to fetch users from group?

private String[] getUsersFromGroup(String groupName){

String[] userLogins = null;

Set retAttrs = new HashSet();

RoleManager roleManager = null;

Role role = null;

try {

roleManager = Platfomr.getService(RoleManager.class);

role = roleManager.getDetails(RoleManagerConstants.ROLE_NAME, groupName, retAttrs);

String roleKey = role.getEntityId();

List <User> listOfUsers = roleManager.getRoleMembers(roleKey, true);

int size = listOfUsers.size();

for (int i = 0; i < size; i++){

User user =  listOfUsers.get(i);

String userLogin = user.getLogin();

userLogins = userLogin;

}

}catch(Exception e) {

e.printStackTrace();

}

return userLogins;

}

How to read values from lookup?

private HashMap<String, String> readLookupEntries(String lookupName){

HashMap<String, String> lookupEntryMap = new HashMap<String, String>();

tcLookupOperationsIntf  lookupOperationsIntf = Platform.getService(tcLookupOperationsIntf.class);

try {

tcResultSet resultSet =  lookupOperationsIntf.getLookupValues(lookupName);

for(int i = 0; resultSet.getRowCount(); i++){

resultSet.goToRow(i);

lookupEntryMap.put(resultSet.getStringValue("Lookup Definition.Lookup Code Information.Code Key"), resultSet.getStringValue("Lookup Definition.Lookup Code Information.Decode") );

}

catch(Exception e){

e.printStackTrace();

}

finally{

lookupOperationsIntf.close();

}

return lookupEntryMap;

How to get userLogin by using email?

Public String getUserLoginByEmail(String email){

Connection connection = null;

PreparedStatement pstatement = null;

ResultSet resultSet = null; 

String sql = "select * from usr where usr_mail = ? AND usr_status = 'Active' ";

try {

connection = Platform.getOperationalDS.getConnection();

pstatement = connection.prepareStatement(sql);

prepareStatement.setString(1,email);

resultSet = prepareStatement.executeQuery();

if (resultSet.next()){

String userLogin = resultSet.getString("user_Login");

}

catch(Exception ex){

ex.printStackTrace();

}

finally{

try{

if(connection != null) {

connection.close();

}

if(pStatement != null) {

pStatement.close();

}

if(resultSet != null) {

resultSet.close();

}

}

catch(Exception ex2) {

System.out.println("Exception is : "+ex2.getMessage());

}

return userLogin;

}

API's Syntax

Application :

Application hrApp = context.getObject(Application.class, "PeopleSoft");

Identity :

Identity identity = context.getObjectByName(Identity.class, identityName);

SailpointContext :

SailPointContext ctx = SailPointFactory.getCurrentContext();

Configuration :

Configuration config = ctx.getObject(Configuration.class,name);

Group Owner Rule (Status and Location)

import sailpoint.object.QueryOptions;

import sailpoint.object.Identity;

QueryOptions qo = new QueryOptions();

qo.addFilter(group.getFilter());

Iterator identities = context.search(Identity.class, qo);

// Find the employee with the lowest employee ID.

Identity emp = null;

String empId = null;

Identity owner = null;

String ownerEmpId = null;

while (identities.hasNext()) {

  emp = identities.next();

  empId = emp.getAttribute("empId");

  if (empId != null && (ownerEmpId == null || empId.compareTo(ownerEmpId) < 0)) {

    owner = emp;

    ownerEmpId = empId;

  }

}

// When all of the employee IDs in the subgroup are null, default to spadmin.

if (owner == null) {

  return "spadmin";

}

return  owner;

WorkGroup and Capability

WorkGroup    :    It is also group of identities. These identities having some kind of special user capabilities (system admin, service account and manager etc.,)

# We can select / use workgroup while creating Application Definition (If you have requirement to assign multiple owners for the Application).

How to create WorkGroup    :

# Login to IIQ and navigate to setup

# Click on Groups and click on Workgroups

# Click on Create New Group

# Then provide the following information like Name, Owner, Group Email, Notification Setting, Capabilities and add the members.

# Click on save

# We can check this workgroup in debug page for xml view. (Login to debug page search for workgroup)

Groups and Populations

# Groups and populations are used to provide sets of identities to include in various activities. For example, the refresh task can be limited to a pre-defined set of identities, or a pre-defined set of identities can be certified.

# We will also be using rules to assign ownership to each group. 

# A rule is used to assign owners to groups generated from a group factory.

# Additionally, we want to use Advanced Analytics to define some populations based on specific criteria. Populations are similar to groups, except that they are driven off of multiple search criteria whereas Groups are statically defined based off a single Identity attribute.

Using Group Factories to Generate Groups    :-

# Navigate to Setup    --->    Groups and click on Create New Group and fill in the following fields    :

# Provide the following information

# Group Owner - Assign Manager    :    return group.getName();

# Click on save.

# Run the task    :    Refresh Groups.

Note    :-

These group themselves are not dynamic. You must run the Refresh Groups task

periodically to update them. Between runs of Refresh Groups, the groups themselves

remain static, but the membership is always based off a dynamic query. 

Generate Populations    :-

Populations can be generated off any of the data that is available via the Advanced Analytics feature

of IdentityIQ.

For our implementation, we want to generate two populations.

• Active Managers who are not Contractors in Asia-Pacific Region only
• All users who have Privileged accounts on any application
• All users who doesn't has Active Directory

1. Navigate to Intelligence --->    Advanced Analytics

2. Under the Identity Search tab, click Clear Search and enter the following search criteria    :

    a. Is Inactive: False

    b. Is Manager: True

    c. Region: Asia-Pacific

    d. Status: Employee

    e. Click Run Search

e. From the Result Options drop down menu, select Save Identities as Population

f. Name: Active Managers - Asia-Pacific

g. Click Save

Create another Population with the following criteria    :

    a. First click Refine Search, then click Clear Search to reset everything 

    b. Privileged Account: True 

    c. Click Run Search 

    d. You should see results showing all users with Privileged accounts 

    e. Save as a Population with the following name: Identities with Privileged Accounts

Create another Population with the following criteria    :

    a. First click Refine Search, then click Clear Search to reset everything 

    b. Click on Advance search    --> Application    is not equal to    Active directory

 

    c. Click Run Search 

    d. You should see results showing all users without Active directory account. 

    e. Save as a Population with the following name: Identities without AD Accounts

# Navigate to Setup    --->    Groups and select the Populations tab

    a. Confirm that you have three populations defined    :

Notes    :-

• By default, these populations are only visible to the user who created them. You can edit the populations and make them Public.
• Populations are dynamic queries, so every time you view a population, you are viewing its current members at that point in time.

SailPoint Administrator Console

How to Check Sailpoint physicial Installation system details like Hostname, CPU, Memory Percentage, Request Threads etc., ?

# Login to IIQ and Navigate to gear icon

# Click on Administrator console

# Click on environment (It's available at top most left side)

# To check the default services and configuration, click on settings option under Host Action

# The following are default available columns :

How to check Provisioning Transaction in SailPoint ?

# Login to IIQ and Navigate to gear icon

# Click on Administrator console

# Click on Provsioning

How to check Active, Scheduled and Completed Tasks in SailPoint?

# Login to IIQ and Navigate to gear icon

# Click on Administrator console

# Click on Tasks

LCM Provisioning

 # IdentityIQ has some default workflows    :

       Modify the variables of the default workflows to achieve the requirement

•    manage approval
•    whom to notify
•    email templates

LCM Provisioning    :

Key steps of the Workflow

1. Initialize

2. Approve

3. Provision

4. Notify

5. Finalize

Policy Rules

 # It's used to define a policy's actions

# Policies can have multiple rules

# Embedded with the Policy object or referenced from the Policy object

# Policy Violations are a result of these Rules

# e.g    :

Segregation of Duties for a given set of entitlements. Rule may state that you can't have Entitlement X with entitlement Y.