Weblogic custom Webservice access issue

Issue::

The custom OIM webservice is deployed in OIM successfully.

On invoking the sebservice,it was not able to read the credential store created for the custom webservice.

Error::

, Cache-Hit: true, Permissions Cached: false, RESULT: false>
java.security.AccessControlException: access denied (oracle.security.jps.service.credstore.CredentialAccessPermission context=SYSTEM,mapName=OIM_WS,keyName=WS_CREDENTIALS read)
        at java.security.AccessControlContext.checkPermission(AccessControlContext.java:374)

Fix:

1.Login to EM console

2.Navigate to Weblogic domain

3.Navigate to IAM_DOMAIN-->SECURITY-->SYSTEM POLICIES

4.Add the Name, CodeBase and permission for the custom WebserviceCreated.

NAME::file:${domain.home}/servers/${weblogic.Name}/tmp/_WL_user/OIGDynamicWS/fo01e1/war/WEB-INF/lib/_wl_cls_gen.jar

RESOURCE::oracle.security.jps.service.credstore.CredentialAccessPermission
PERMISSIONCLASS::context=SYSTEM,mapName=OIM_WS,keyName=WS_CREDENTIALS

Query To update the ApplicationInstance to revoked

update OIU set OIU.OST_KEY=(select OST.OST_KEY from OST,OBJ where

OST.OBJ_KEY=OBJ.OBJ_KEY

AND OBJ.OBJ_NAME=(select OBJ_NAME from OBJ where OBJ_KEY =(select app.OBJECT_KEY from APP_INSTANCE app where APP_INSTANCE_DISPLAY_NAME='OUD'))

AND OST_STATUS='Revoked') where OIU.USR_KEY IN(select OIU.USR_KEY from OIU where

OIU.APP_INSTANCE_KEY=(select APP_INSTANCE_KEY from APP_INSTANCE where APP_INSTANCE_DISPLAY_NAME='OUD')

AND OIU.OST_KEY=(select OST.OST_KEY from OST,OBJ where

OST.OBJ_KEY=OBJ.OBJ_KEY

AND OBJ.OBJ_NAME=(select OBJ_NAME from OBJ where OBJ_KEY =(select app.OBJECT_KEY from APP_INSTANCE app where APP_INSTANCE_DISPLAY_NAME='OUD'))

AND OST_STATUS='Provisioned')) and OIU.APP_INSTANCE_KEY=(select APP_INSTANCE_KEY from APP_INSTANCE where APP_INSTANCE_DISPLAY_NAME='OUD');

Query to get the OIM process Task failure Count and its failure reason

select ml.MIL_NAME, ml.MIL_KEY,count(*) cnt

from MIL ml, OSI os, SCH sc

where

ml.MIL_KEY = os.MIL_KEY

and os.SCH_KEY = sc.SCH_KEY

and sc.SCH_STATUS = 'R'

and os.osi_retry_counter > 0

--and os.osi_retry_on >= sysdate - 15

group by ml.mil_name, ml.mil_key

order by cnt desc

Task failure reason

select ml.mil_name, ml.mil_key, os.orc_key,usr.usr_login,sc.sch_reason,count(*) cnt

from MIL ml, OSI os, SCH sc, oiu oiu, usr usr

where

 os.orc_key = oiu.orc_key

and oiu.usr_key=usr.usr_key

and  ml.MIL_KEY = '82'

and ml.MIL_KEY = os.MIL_KEY

and os.SCH_KEY = sc.SCH_KEY

and sc.sch_status = 'R'

group by ml.MIL_NAME, ml.MIL_KEY, os.orc_key,usr.usr_login,sc.sch_reason

order by cnt asc

OIM retry data query

SELECT * 
FROM OTI 
WHERE orc_key IN 
  (SELECT orc_key 
  FROM oiu 
  WHERE oiu_create      > sysdate -6 
  AND app_instance_key           IN ('12','13','11') 
  )

Query to update response code in Process task

In OIM,once a task is assigned to any user,its not possible to change the response in process task.

The folloing query can be used to update the response code via DB

select * from SCH;

select * from RSC where mil_key='19766';

select * from MIL where MIL_NAME='Create User' and tos_key='1673';

select * from TOS where PKG_KEY=(select PKG_KEY from PKG where PKG_NAME='Tesdsfdfgdgds');

select * from mil where mil_key='19766';

select * from tos;

select * from STA;

Query:

update RSC set sta_key='2' where RSC_DATA='OBJECT_ALREADY_EXISTS' and mil_key='19766';

JNDI Functionality Codes

package com.oim;

import java.io.IOException;
import java.util.ArrayList;
import java.util.Hashtable;
import javax.naming.Context;
import javax.naming.NamingEnumeration;
import javax.naming.NamingException;
import javax.naming.directory.Attribute;
import javax.naming.directory.Attributes;
import javax.naming.directory.BasicAttribute;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.naming.directory.ModificationItem;
import javax.naming.directory.SearchControls;
import javax.naming.directory.SearchResult;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;

public class LDAPConnection {

String LDAP ="";
String username ="";
String password = "";
LdapContext ctx = null;


public LDAPConnection(){
LDAP = "ldap://localhost:389/";
username = "CN=adminname,OU=accounts,DC=Eas";
password = "oim_user";
}

public LdapContext LDAPConn() {


Hashtable<String, String> env = new Hashtable<String, String>();

env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, username);
env.put(Context.SECURITY_CREDENTIALS, password);
env.put(Context.PROVIDER_URL, LDAP);


try {
ctx = new InitialLdapContext(env, null);
System.out.println("Connected to LDAP");
} catch (NamingException e) {
System.out.println("Problem connecting LDAP:"+e);
e.printStackTrace();
}
return ctx;
}

public void LDAPClose(){
if(ctx!=null){
try {
ctx.close();
System.out.println("LDAP Connection closed");
} catch (NamingException e) {
System.out.println("Problem closing LDAP:"+e);
e.printStackTrace();
}
}
}



public static String getString(Attributes attrs, String propertyName) {
String value = "";
if (null != attrs) {
Attribute attr = attrs.get(propertyName);
if (null != attr) {
value = String.valueOf(attr);
value = value.substring(value.indexOf(": ") + 2).trim();
}
}
return value;
}



/*public String getValues(LdapContext ctx, String username, String adBaseDN) {

String compareVal="";
NamingEnumeration<SearchResult> answer=null;
SearchControls searchCtls = new SearchControls();
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);

String returnedAtts[] = { "sAMAccountName","manager" };

searchCtls.setReturningAttributes(returnedAtts);

String filter = "(samaccountname=" + username + ")";

System.out.printlnfilter);

try {
answer = ctx.search(adBaseDN, filter,searchCtls);

if (answer.hasMoreElements()) {
SearchResult sr = answer.next();
Attributes attr = sr.getAttributes();

compareVal = getString(attr, returnedAtts[1]);
System.out.println"ComparedVal-->" + compareVal);
}



} catch (NamingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
return compareVal;
}
*/

public String checkIfUidNumberExists(LdapContext ctx, String username, String adBaseDN)
{
System.out.println("MPCSBulkLoadScheduler -> getDN Started..");
String getVal = "";
SearchControls searchCtls = new SearchControls();
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
searchCtls.setCountLimit(1);
searchCtls.setTimeLimit(0);
String returnedAtts[] = { "uidNumber" };

searchCtls.setReturningAttributes(returnedAtts);

String filter = "(sAMAccountName=" + username + ")";
// String filter = "(manager=" + username + ")";
System.out.println(filter);
NamingEnumeration<SearchResult> answer;
try {
answer = ctx.search(adBaseDN, filter,searchCtls);
if (answer.hasMoreElements()) {
SearchResult sr = answer.next();
Attributes attr = sr.getAttributes();
getVal = getString(attr, returnedAtts[0]);

System.out.println("GetDN-->" + getVal);
}
} catch (NamingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}

return getVal;



}

public String getDN(LdapContext ctx, String username, String adBaseDN)
throws NamingException, IOException {
System.out.println("MPCSBulkLoadScheduler -> getDN Started..");
String getDN = "";
SearchControls searchCtls = new SearchControls();
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);

String returnedAtts[] = {"distinguishedName"};

searchCtls.setReturningAttributes(returnedAtts);

String filter = "(samaccountname=" + username + ")";
// String filter = "(manager=" + username + ")";
System.out.println(filter);
NamingEnumeration<SearchResult> answer = ctx.search(adBaseDN, filter,searchCtls);

if (answer.hasMoreElements()) {
SearchResult sr = answer.next();
Attributes attr = sr.getAttributes();
getDN = getString(attr, returnedAtts[0]);
System.out.println(getDN);
}
if (getDN == null || getDN.equals(""))
getDN = "";
System.out.println("MPCSBulkLoadScheduler -> getDN End..");
return getDN;
}

public ArrayList<String> getDN1(LdapContext ctx, String username, String adBaseDN)
throws NamingException, IOException {
System.out.println("getDN Started..");
String getDN = "";
String getUID = "";
ArrayList<String> list =new ArrayList<String>();
SearchControls searchCtls = new SearchControls();
searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);

String returnedAtts[] = {"distinguishedName","uidNumber"};

searchCtls.setReturningAttributes(returnedAtts);

String filter = "(samaccountname=" + username + ")";
NamingEnumeration<SearchResult> answer = ctx.search(adBaseDN, filter,searchCtls);

if (answer.hasMoreElements()) {
SearchResult sr = answer.next();
Attributes attr = sr.getAttributes();
getDN = getString(attr, returnedAtts[0]);
getUID = getString(attr, returnedAtts[1]);

list.add(getDN);
list.add(getUID);

System.out.println("DN and uidNumber Value in AD:"+list);
System.out.println(list.get(0));
System.out.println(list.get(1));
}

System.out.println("getDN End..");
return list;
}

public void updateAttr(LdapContext ctx){


   ModificationItem[] mods = new ModificationItem[2];

   Attribute mod0 = new BasicAttribute("displayName", "retert");
   Attribute mod1 = new BasicAttribute("mail", "Aerwerrwe105@tt.com");

   mods[0] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, mod0);
   mods[1] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, mod1);

   try {
ctx.modifyAttributes("CN=cfsdfsdfsdfsf", mods);
System.out.println("Attribute Upadated");
} catch (NamingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}

  public void updateAttr(LdapContext ctx,String Userdn,String baseDN,String[] attributeValToUpdate){

int count=0;
Attribute mod =null;

String splitUpdateAttr="uid,gid,gec,unix,login";
String[] newVal = splitUpdateAttr.split(",");
for (String finale : newVal) {
count++;
}
System.out.println("No of attributes to Update:"+count);

ModificationItem[] mods = new ModificationItem[count];
int i=0;
for( i=0;i < count ;i++ ){

mod = new BasicAttribute(newVal[i],attributeValToUpdate[i]);
mods[i] = new ModificationItem(DirContext.REPLACE_ATTRIBUTE, mod);
System.out.println(""+mods[i]);
}
try {
System.out.println("Scheduler---"+"CN="+Userdn+",OU= Accounts,"+baseDN);
ctx.modifyAttributes("CN="+Userdn+",OU=Accounts,"+baseDN,mods);
System.out.println("Scheduler---Attribute Upadated");
} catch (NamingException e) {
System.out.println("Scheduler---NamingException:"+e);

e.printStackTrace();
}
}

public static void main(String[] args) {

LDAPConnection conn = new LDAPConnection();
LDAPConnection a = new LDAPConnection();


//conn.checkIfUidNumberExists(a.LDAPConn(), "AALBddfsdf", "DC=EfdfS,DC=Lm");
try {
// conn.getDN1(conn.LDAPConn(),"AMafdsfag","DC=EdasdS,DC=Lm");
conn.updateAttr(conn.LDAPConn(), "fsdfdsf", "OU= Accounts,DC=EdfdS,DC=LM", attributeValToUpdate)
} catch (NamingException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}

Clearing the OIM schedulers which is always running using DB triggers

Execute the below commands in OIm DB

1.update qrtz_triggers set next_fire_time=-1,TRIGGER_STATE='COMPLETE' where trigger_name='SCHEDULER_NAME';
2.delete qrtz_fired_triggers where trigger_name='SCHEDULER_NAME';
3.commit;