Lab 10 Approval Workflow Self Reg
Lab 10 Approval Workflow Self Reg
Contents
Lab 10: Workflow customization: Self Registration Approval .......................................................................... 1
1. Introduction ............................................................................................................................................. 1
2. Contents.................................................................................................................................................... 3
1. Introduction
Note: The content of this lab was taken from Oracle by Example material and adapted to this workshop. To access original content,
access http://otn.oracle.com/obe.
Note: All users, roles and organization are already created. For all tasks related to this, check Appendix A at the end of this
In this lab, we will cover how to create custom SOA workflows (composites) using a helper utility and JDeveloper tool. These
workflows will be developed in JDeveloper and then deployed to OIM SOA Server. To use the custom workflows, they will also be
The high level activities involved to create, deploy and register a custom composite can be broken up into 4 areas:
SelfRegistrationApproval
This sample illustrates Self-Register User approval scenario. The task at request level of approval should be assigned to SYSTEM
ADMINISTRATORS role. The task at operation level of approval should be assigned to Organization administrators depending on
At operation level of approval, the approvers need to be the administrators of the organization to which the user is registered.
2
For this scenario, the custom approval process will be used for all Self-Register User type requests at Operation level of approval.
By default, Self-Register User tasks are assigned to xelsysadm at operation level of approval. As per the scenario, all the Self-
Register User tasks at request level must be assigned to SYSTEM ADMINISTRATORS role; and all the Self-Register User tasks at
operation level must be assigned to the administrator of that organization to which the user is assigned during Request level of
approval.
For request level of approval, we can use the DefaultRoleApproval composite that is shipped along with OIM.
2. Contents
You will perform the following procedure for this lab:
OIM 11g Workshop - Lab 4.a
Acronyms
MWH_HOME /odrive/oracle/oim11g_MWH
OIM_ORACLE_HOME /odrive/oracle/oim11g_MWH/Oracle_IDM1
4
2.1.Create Composite Project using Ant
Purpose
Oracle Identity Manager 11gR1 release provides a helper utility for creating custom SOA composites. This utility creates a template
SOA project that adheres to all the necessary standards. This module shows how to create a custom composite project using Ant
Steps
2.1.1. Open a Command prompt window on your VM image HOST machine.
Application->Accessories->Terminal
2.1.2. Set up the environment before you create your custom composite project. To set up the environment, you need to set:
PATH variable to include bin directories under JAVA_HOME and ANT_HOME variables.
export ANT_HOME=/odrive/oracle/oim11g_MWH/modules/org.apache.ant_1.7.1
export PATH=$JAVA_HOME/bin:$ANT_HOME/bin:$PATH
cd /odrive/oracle/oim11g_MWH/Oracle_IDM1/server/workflows/new-workflow
OIM 11g Workshop - Lab 4.a
cd /odrive/oracle/oim11g_MWH/Oracle_IDM1/server/workflows/new-workflow
mkdir libs
cp /odrive/oracle/oim11g_MWH/Oracle_IDM1/server/client/oimclient.jar ./libs
cp /odrive/oracle/oim11g_MWH/oracle_common/modules/oracle.jps_11.1.1/jps-api.jar ./libs
composite project, run the following ant command from this directory - "ant -f new_project.xml"
6
You will use the following answers for the script:
Once the script has executed, it creates the composite project directories for you to proceed with customization. The application
2.1.4. For this "SelfRegistrationApprovalApp" custom composite, we will need to use the "oimclient.jar" and ‚jps-api.jar‛ files to be
included in our project. These jar files will be used to invoke OIM API and CSF (Credential Store Framework) API calls from our
custom composite. The "oimclient.jar" file is available on server side, under "$OIM_ORACLE_HOME/server/client" directory,
‚/odrive/oracle/oim11g_MWH /oracle_common/modules/oracle.jps_11.1.1‛.
You’ll copy "oimclient.jar" and ‚jps-api.jar‛ files to under the composite project's SCA-INF/lib directory. In our case, these jar files
template\SelfRegistrationApprovalApp\SelfRegistrationApproval\SCA-INF\lib" directory.
<copy todir="process-template/${application.name}/${project.name}/SCA-INF/lib">
<fileset file="libs/*.jar" />
</copy>
2.1.5. The composite project created in previous step can now be opened in JDeveloper installed locally on the VM host machine.
8
Checkpoint
This completes the creation of custom composite project using Ant tool. The project is now ready to be customized in JDeveloper.
Purpose
This module shows how to open the custom composite project created in previous step using JDeveloper and then customizing the
composite.
Steps
2.2.1. "Click on File > Open and select the file /odrive/oracle/oim11g_MWH/Oracle_IDM1/server/workflows/new-workflow/process-
template/SelfRegistrationApprovalApp/SelfRegistrationApprovalApp.jws".
OIM 11g Workshop - Lab 4.a
2.2.2. You might see a JDeveloper warning message about migrating the project to a new format when you open the project in JDeveloper.
Click Yes to migrate the files. Click OK to proceed with opening the project.
2.2.3. Make sure you are working with the right project if you have multiple projects in your JDeveloper environment that you created in
the past.
10
2.2.4. Under the "SelfRegistrationApproval", you will see folder structure as shown in the above image file. Open the "composite.xml"
file by selecting it and using right click of mouse button to open it.
OIM 11g Workshop - Lab 4.a
12
2.2.6. Define a property bpel.preference.oimurl at the following location in composite.xml
<component name="ApprovalProcess">
<implementation.bpel src="ApprovalProcess.bpel"/>
<property name="bpel.preference.oimurl">t3://oim_host:oim_port </property>
</component>
Note: Use the value as the code above(oim_host:oim_port). You will set those values later.
OIM 11g Workshop - Lab 4.a
This property will store OIM‟s url which will be used later in Java Embedding activity in the composite to login to OIM using
OIMClient. Adding this property in composite.xml will allow us to change its value at runtime (from EM console) rather than hard
coding it. For this sample we will set the actual value of oimurl at the time of testing the composite.
2.2.7. Open ApprovalProcess.bpel. Switch to design view. Click on ‚(x)‛ inside the approval process to see variables in this approval
process.
2.2.8. Click on ‚+‛ to add a variable. Give name as oimurl, choose type as ‚Simple Type‛ and set it to String. This variable will read OIM
url from the property mentioned in step above (2.2.6) and it can be used in Java code.
2.2.9. Add another variable orgadmin, choose type as ‚Simple Type‛ and set it to String. This variable will be used in Java Embedding
Activity to store the Organization Administrators, the value for which can be obtained using OIM APIs.
14
OIM 11g Workshop - Lab 4.a
2.2.10.From the components palette -> BPEL 1.1 -> BPEL Constructs, drag and drop Assign activity after receive input activity (see Figure
2.2.11.Double click on Assign_oimurl activity. Click on ‚+‛ sign and select Copy Operation. Create Copy Operation dialog will open
16
2.2.12.Click on Expression icon and drag it to the oimurl variable in the right part of the window. Expression builder dialog will open.
Under Functions header, select ‘BPEL XPath Extension Function’ from the drop down. Select ‘getPreference’ and click on Insert
Into Expression. Pass ‘oimurl’ as argument to this function and click OK. This will read the value of ‘bpel.preference.oimurl’
2.2.14.From the components palette -> BPEL 1.1 -> Oracle Extensions, drag and drop Java Embedding activity after Assign_oimurl
18
2.2.15.Double click on GetOrgAdmin activity. Write java code here to get Organization Admin using OIM APIs. The java code can be
2.2.16.Click OK.
2.2.18.Select Data from left pane. Click ‚+‛ sign and select ‚Add string parameter‛. Give parameter name as OrganizationAdmin. The
organization administrators obtained using OIM APIs in step 2.2.15 will be passed as string payload to the human task.
Go back to ApprovalProcess.bpel. Double click on the Approval_Task1 human task node. You will see the following window:
20
Select orgadmin variable in the Task Parameters window and click OK.
2.2.20. Double click on Stage1.Participant1. Edit Participant Type dialog will appear.. Provide the following values:
Value: Click on Expression builder (‚…‛) button in value column. Select task:task
task:payloadtask:OrganizationAdmin.
22
2.2.21.Save your work.
OIM 11g Workshop - Lab 4.a
Checkpoint
This completes the customization of custom composite project "SelfRegistrationApproval". From this point, you can proceed to
Purpose
This module shows how to compile and deploy the custom composite to the OIM SOA Server. We will use JDeveloper to compile
There are 2 way to deploy a composite to Weblogic Server: Using command line or wizard. In this section you will:
Steps
Set Weblogic Server properties prior to deploy composites
Before deploying the SOA composite, we need to set the BpelcClasspath property in the System MBean Browser of Oracle
24
2.3.2. Expand Weblogic Domain from the left pane. Right click on oim11g_domain System MBeans Browser
2.3.4. Under Attributes column click on BpelcClasspath. Provide full path for oimclient.jar and jps-api.jar. These files are located at
<OIM_ORACLE_HOME>/server/client/oimclient.jar
<MWH_HOME>/oracle_common/modules/oracle.jps_11.1.1/jps-api.jar
OIM 11g Workshop - Lab 4.a
In our environment:
/odrive/oracle/oim11g_MWH/Oracle_IDM1/server/client/oimclient.jar:/odrive/oracle/oim11g_MWH/oracl
e_common/modules/oracle.jps_11.1.1/jps-api.jar
Note: Replace OIM_ORACLE_HOME and MWH_HOME with corresponding full paths. The paths should be separated by a colon
2.3.5. Create a deployable jar file for the workflow by right click on the project. A popup wizard will appear which will guide you
26
2.3.6. Select Deploy to SAR , then click Next.
OIM 11g Workshop - Lab 4.a
28
OIM 11g Workshop - Lab 4.a
2.3.7. Create directory (mkdir) /odrive/dummydata/wflow. Copy the final output SCA jar file from <project directory>/deploy , at VM
host image, to /odrive/dummydata/wflow, where OIM is installed. Use WinSCP for this operation.
2.3.8. Open a session to OIM Server using Putty. Login as oracle user.
[oracle@orclfmw~]$cd /odrive/oracle/oim11g_MWH/Oracle_SOA1/bin
source /odrive/oracle/oim11g_MWH/wlserver_10.3/server/bin/setWLSEnv.sh
2.3.12.At this time you can verify that the custom composite has been properly deployed to your OIM SOA Server. You can check this by
opening a browser and accessing "http://host:port/soa-infra" URL. In our example, this URL is
"http://orclfmw.example.com:7001/soa-infra". When you see HTTP basic authentication window, enter weblogic/abcd1234 as a
credentials to access the URL. You should be able to see your custom composite if it has deployed successfully. If you do not see it,
please go back to the previous steps and check the compile, build and deployment logs.
OIM 11g Workshop - Lab 4.a
2.3.13.Right click on SelfRegistrationApproval project and click Deploy SelfRegistrationApproval. A popup wizard will appear which
will guide you through the deployment of composite to Oracle SOA server.
2.3.14.In Deployment Action step, select Deploy to Application Server. Click Next
2.3.15.In Deployment Configuration step, check ‚Overwrite any existing composite with same revision ID‛ option. Click Next.
32
2.3.16.In Select Server step, select the connection to your application server. If connection does not exist, create a new connection by
clicking on + sign, ‚Create Application Server Connection‛ popup will come up.
OIM 11g Workshop - Lab 4.a
2.3.17. In ‚Create Application Server Connection‛ popup, provide a name for connection and click Next.
2.3.19.Give hostname and port for Admin server and also enter weblogic domain in Configuration step. Click Next.
34
2.3.20.Click on Test connection. If all tests are successful, click Finish.
2.3.21.Click Next.
OIM 11g Workshop - Lab 4.a
36
2.3.23.Check compiler and deployment logs in JDeveloper for any errors.
Checkpoint
This completes the deployment of custom composite project "SelfRegistrationApproval" to our SOA server. Next section illustrates
38
Purpose
This module shows how to register the custom composite with OIM Server. We will register the "SelfRegistrationApproval" custom
composite with our OIM server. The composite cannot be invoked from OIM till the time it is registered in OIM Server and hence
Steps
2.4.1. Open a Terminal window on your Oracle Identity Manager server machine. You can use Putty or access VM image (guest). All steps
source /odrive/oracle/oim11g_MWH/wlserver_10.3/server/bin/setWLSEnv.sh
cd /odrive/oracle/oim11g_MWH/Oracle_IDM1/server/workflows/registration
2.4.4. The first step is to create a composite properties file. We will create this file under the
"/odrive/oracle/oim11g_MWH/Oracle_IDM1/server/workflows/registration". You may review the other properties file that are
available in this directory for the default workflows that ship with the product.
our example, we create the "SelfRegistrationApproval.props" file as shown in the screen shot below. Enter the "name" and
OIM 11g Workshop - Lab 4.a
"version" correctly as shown below. The "name" represents the name of the SOA composite that we created. The "version" of the
composite should be the version of the composite that you deployed previously and are now registering.
name = SelfRegistrationApproval
category = Approval
providerType = BPEL
serviceName = RequestApprovalService
domainName = default
version = 1.0
payLoadID = payload
operationID = process
listOfTasks = ApprovalTask
2.4.6. To register the composite, we will use the helper utility provided with OIM. We will register by running the ant command as
follows:
40
2.4.7. For the values asked in the helper, type:
Username: xelsysadm
Password:Abcd1234
Property file:SelfRegistrationApproval.props
2.4.8. Upon completion the of the ant register command, you should see "BUILD SUCCESSFUL" message similar to what is shown
below.
OIM 11g Workshop - Lab 4.a
The custom workflow is now available and ready for use in your OIM server. If there is a need to change the custom composite and
re-deploy it, first disable the composite in OIM Server using the ant tool. Change your custom composite and re-deploy the new
version of composite. Re-enable the composite using the ant tool. This completes the first workflow of this lab.
42
Purpose
This section will create all necessary approval policies to test the approval workflow we have create for Self Registration activity.
We will need two approval policies. One approval policy to assign Self-Register User tasks at request level to SYSTEM
ADMINISTRATORS role and another approval policy to assign tasks at operation level to Organization Administrators.
Steps
Create Approval Policy for Request Level
Entity Request
Condition Equals
2.5.10.Click on Save
Following are the steps to create approval policy for operation level approval.
2.5.18.Select the newly created composite (default/SelfRegistrationApproval!1.0) as Approval Process. Click Next
44
2.5.19.Provide a Rule name (SelfRegistrationRuleOL)
Entity Request
2.5.22.
2.5.23.Click on Save
2.5.26.Logout of OIM.
The next section will discuss how to test custom approval process
Purpose
In this section you will execute a Self Request activity so we can test the created composite. We will provide a valid OIM url for
Steps
Before invoking the SOA composite, we need to provide a valid OIM url for the property set in composite.xml of SOA composite.
We can set this value from EM console. Follow the steps below to achieve this.
2.6.2. Expand Weblogic Domain from the left pane. Right click on oim11g_domain System MBeans Browser
SCAComposite.SCAComponent ApprovalProcess.
2.6.4. Under Attributes column click on Properties Element_0. Provide valid OIM url for the ‚value‛ key (e.g. t3://10.177.255.135).
46
Now follow these steps for testing the approval process:
2.6.12.Click on Search Approval Tasks. Make sure you are able to see Self-Registration task with the same request ID.
2.6.13.Select the task row with the request number matching registration tracking request number and click Open task details.
2.6.16.Logout of OIM.
2.6.17. Login as Danny Crane (DCRANE/Abcd1234) - This user is a member of FINANCE_APPROVERS group. So he should be able to
2.6.18.Click on Search Approval Tasks. Make sure you are able to see Self-Registration task with the same request ID.
2.6.19.Click on Approve. The task should have been approved successfully and the user created in OIM.
2.6.20.Logout of OIM.
2.6.21.Click on Track Registration. Provide tracking id and click Submit. Verify that registration request status is completed.
3. Conclusion
Learnt how to create a custom composite using ant tool and JDeveloper tool
48
Product Features that you have learnt
You will also need to perform the following tasks from OIM Admin console:
50
Appendix B – Store credentials in CSF
4. Click on Create Map button. Provide name for map as ‚oracle.oim.sysadminMap‛. Click OK.
Key sysadmin
Type Password
Username SSCHMIDT
Password Abcd1234
6.Click OK.
OIM 11g Workshop - Lab 4.a
http://www.oracle.com/technetwork/developer-tools/jdev/overview/index.html
52
5. Find Oracle SOA Composite Editor, and choose build 11.1.1.3.0.25.57.
2. In Help menu, click Check for updates. The Check for updates appears. Click Next
3. Choose Install from file and select the downloaded software from previous section(