Quantcast
Channel: Software Communities : Popular Discussions - Dell One Identity Manager
Viewing all 845 articles
Browse latest View live

Web Designer - Retireve the value of a list box

$
0
0

Hi all,

I have a really silly question : How can I retieve the selected value of a list box ?

2013-11-29 18_31_50-kltdev-cli - clt-quest-dev - Connexion Bureau à distance.png

I tried to use the Identifier, assuming that it contains the value of the elected row but it didn't work .

Can you please help me ?

Thanks for your help,

Regards,

Steph.


SAP Clients connection via SNC instead of username password

$
0
0

Hi to all,

 

We have currently over aprox. 50 SAP systems with over 280 SAP clients connected to the Q1IM. Currently we are using username and password authentication, meaning we have on each client a user account and an individual password to maintain. This makes the maintenance time intensive.

 

Now we want to switch to SNC mode to reduce the effort for the password handling and a more reliable authentication procedure.

 

Has anybody experience with this change or knows a good documentation for this ?

Any experience to share?

 

Thanks a lot for every useful hint.

 

CU

 

Wolfgang

Web Designer - create a collection from a query

$
0
0

Hi all,

 

I tried hard but I didn't manager to simply create a collection with 3 columns (2 comming from person table and the third one defaulted to false).

 

I tried to create a collection with Data query data source but I don't understand how it works then I tried with a collection with Custom Schema collection data source and tried to insert datas in it but it still didn't work.

 

Could you please help me I juste want to use this statement "select distinct title,customproperty02 from person" to created a collection with 3 columns 2 comming from the request one defaulted to "False".

 

Thank you for your help,

 

regards,

Steph.

Getting the current decision for PersonWantsOrg

$
0
0

Is there an easy way to get the current decision to be made for a PersonWantsOrg request via SQL?  I'm trying to put together a view so that you can see the current decision that's being waited on for open requests.

QuickConnect DB configuration

$
0
0

Experts,

 

Seeking your input for the below issue we are facing at a customer deployment:

 

Quick Connect works fine when pointing to the SQL server instance. But when configured to point to a DB listener, the connection timesout within 5 - 7mins. No errors in the log file.

 

From talking to the DBA, they prescribe a ConnectionString like below when pointing to a DB listener:

 

<transientCartConfiguration ConnectionString="Data Source=Server01.production.online.XXXXX.com;Initial Catalog=TransientCart_EXXXX;Persist Security Info=True;User ID=xxxxxxxx;Password=xxxxxxx;MultiSubnetFailover=True; Connection Timeout=36"

     ConnectionId="SqlServer" IsCartSummaryThreaded="true" NumberOfRetries="5" MillisecondsBetweenRetries="2000"/>

 

Question is how do we specify options like (MultiSubnetFailover=True) in QuickConnect for DB connections?

 

Thanks

Sundar

How to hide Job Server log entires

$
0
0

Hi All,

        I have configured job servers to show only WARNING messages.  Now log files are capturing following messages only while running AD sync job:

 

x><s>2014-01-23 10:07:28 -06:00 - VI.JobService.JobComponents.SQLComponent - f074ffe4-46c0-4bcf-8e3b-1c78f3a93ca6: Successful

<x><s>2014-01-23 10:08:58 -06:00 - VI.JobService.JobComponents.ScriptComponent - d1e28d3e-0e26-4a4d-9abb-004db03c6556: Successful

 

 

Currently we have more than 100K users in AD, log files are filled with SQL Component and ScriptComponent messages.  How can we ignore these messages into Job Server Log file?

 

Version: Q1IM 6.1

 

 

thanks

Rob.

UserPrincipalName required error

$
0
0

Hi All,

            While running AD sync job, system recorded "UserPrincipalName required field' error job server log files.

 

As per Active Directory schema UserPrincipalName is Optional attribute, so some of the users in my client data doesn't have UPN value.  How can i load these users into Q1IM?  I have noticed, while creating new AD user from Q1IM, system auto generated UPN value. So newly created users won't have this issue.  How can i overcome for existing users?  In Q1IM UPN is not required field.

 

 

Version: Q1IM 6.1

 

 

 

thanks

Rob

How to archive Log file

$
0
0

Hi All,

        I have configured a Data Import Process, it will run daily twice and updates data in Q1IM.  In my process I have given value Like:

 

LogFileName = C:\Temp\SomeJobImport.log.

 

Is there a way in Q1IM to configure to archive this log file size after 1MB?

Version: Q1IM 6.1

 

 

Solution:

1. Run windows program (Curstom developed windows) to Archieve 'SomeJobImport.log' file whenever it reaches more than 1MB. 

 

Apart from above solution, is Q1IM provides any configuration for this?

 

thanks

Rob.


Permissions for a System user and its source (SQL/Report wanted)

$
0
0

Hi,

searching for a SQL or report which's shows for a System user the assigned permissions groups (including inheritance)  and further the access permission granted in the tables (fields).

 

Thanks a lot for any help / suggestions.

 

Cu

 

Wolfgang

Web Designer: "There is no cursor with index 1..."

$
0
0

Hi All,

 

I´m trying to add a column into "Vi_Roles_RolesAndEntitlements" (already copy it into a new one) and I would like to edit an specific attribute. These are the steps:

 

- Add new Collection called: ADSGroupTemp

- Load Collection with values from ADSGroup

 

Please view images attached.

When I try to compile, I get "There is no cursor with index 1 defined on the collection ADSGroupTemp"

How could I defined an index for that collection?

 

Thanks in advanced.

 

Regards.

 

ofonseca

Screen Shot 2014-01-28 at 7.07.13 PM.png

Screen Shot 2014-01-28 at 7.08.03 PM.png

Optimizing LDAP Sync

$
0
0

Hello everybody,

 

we're just setting up a new Q1IM installation in our corporation. One essential part is a synchronisation between our existing LDAP directory and Q1IM.

 

The LDAP directory is a Sun/Oracle Directory Server Version 11.1.1.5.1

 

We have to sync more than 100k user accounts every day.

In Q1IM we configured a LDAP domain using the LDAPNovell provider.

 

Before we can even think about going live, we have to get an agreement with the team responsible for the LDAP directory. They need a detailled list of the data exchange sequence during the sync process, i.e. search requests and how each account is fetched. To get this information, I've set up an LDAP proxy, so I can see exactly what Q1IM is doing during a full sync.

 

In that log I can see two issues that have to be resolved, otherwise we cannot go live:

 

  1. During a FullSync, Q1IM is retrieving the complete LDAP schema twice. It seems that the process step "Check Namespace LDAP" is fetching the LDAP schema (why is it doing that?) and then the actual Full Sync is doing the same again.
    Even though this doesn't cause any performance issue right away, I will have a hard time explaining to the LDAP team why we're doing this. Especially since that will also happen each time any change is provisioned to an LDAP account, which will caus a lot of unnecessary load in production.
    I found this thread: http://communities.quest.com/message/92108#92108 where this problem has already been discussed. Unfortunately, the solution doesn't work for us. I've made a copy of the VI_LDAP_Domain_FullSync process chain and edited both the "Check Namespace LDAP" step and the "FullSync" step to include the SchemaValidation attribute set to False as described in the thread. Is this attribut even recognized by the LDAPNovell provider, or is it meant for the ADSI provider only?
  2. Even more problematic, however, is the fact that Q1IM fetches ALL attributes it can find in the schema for each account, no matter whether they are actually mapped or not. We have defined a very distinctive list of attributes we'd like to fetch for each account and we created a mapping for these in Q1IM. Also, we only have the permission to read these attributes in this specific use case.
    Unfortunately, as you can see in the LDAP log, Q1IM always reads all attributes, some of them containing binary data. This will not only slow down the sync considerably, but we won't get an agreement to go live like this, because the LDAP team will not let us fetch attributes we don't have a read permission for. They will set their ACLs accordingly, but they won't accept that we're explicitly asking for attributes we don't have a read permission for (as this would also clutter their logs).

 

I don't understand why Q1IM is fetching the schema all the time, even though it's already stored in the LDAP domain object. And I would like to know if there's a way to limit the list of attributes that are read for each account during the sync.

 

Thanks & best regards, Martin

VI_CommonSearch by using multiple Formtypes

$
0
0

Hi there,

 

i've got a problem by the use of the component VI_Common_Search.

 

The Situation is as follows:

 

For different Object-Edit-Modules we use either Formtype1 (std.) or Formtype2.

 

Now we Navigate to the modules via the VI_Common_Search from the start page. (Formtype1)

 

In case of the use of the standard-FormType by the Edit-Form everything is fine, but if the created module does use another formtype the VI_Common_Search component is initialized a second time in the session module.

 

The problem is that an end user now sees (or not) the search input in dependence of the current module. Also the search does work or not in dependence of the current module.

   

I don't know how to supress this behavior or to get the VI_CommonSearch / VI_UserNavigation initialized just one time by using different form types.

 

Any Ideas?

 

Best regards,

 

Martin

Webdesigner: Popups are opened two times by rapid clicks

$
0
0

Hi there,

 

In different modules, end-users have the problem that a popup is opened twice. The user then sees only the grayed out modal screen.

 

By clicking the escape key, a user can continue working. However, that is not nice.

 

So, Is it possible by default to implement the buttons that they will be locked when you initiate the first action.

 

I think this is the only way to prevent the client from excecuting the button-related actions multiple times?

 

Regards,

 

Martin

AD provisioning

$
0
0

Hi,

 

i am loooking for a user guide document to perfomr provisioning to AD, Exchagne and SAP.

 

Please also share if there are any links or blogs to refer for the same.

 

Thanks

Displayvalue of old Integervalues

$
0
0

Hi,

 

I have a problem with the displayvalue of old integer values (e.g. 1 = Internal, 2 = Confidential).

 

The notation $xx_GroupAttributes[o].[Display]$  does not work here. (Original value: $xx_GroupAttributes[o]:Int$)

 

I know that there was a similar post in this month with the same problem at foreign key values - but this seems not to work here.

 

 

Best regards,

 

Joachim


ARPortal Caching Question

$
0
0

Q1IM experts,

 

At a customer site, we are seeing an issue maybe due to caching or configuration, wondering if you have seen it before or have any inputs. The steps we follow to reproduce are:

 

Import a new product into ITShop via custom import script

Search the product in Arportal and try to request it.

What we see is that the Request form for the new product does not show up.

 

In the manager, we verified that the product got assigned to the correct Service Item, Shelf etc and that the request properties is set at the Service item. All that looks good. We noticed that after a IIS restart, the form shows up fine for the new product.

 

In UAT environment, we have two ARPortal servers and it appears (still doing tests to confirm) that server02 is the only one having the issue. If the user lands in server 01, it seems to be fine.

 

FYI – We have set the Idle timeout for the App Pool to 0 in both the IIS servers so that the ARPortal never gets reloaded and cause delays to the user.

 

Question to you:

Is there any caching configuration parameter in ARPortal that can be tweaked?

How do you compare the IIS configs between the two servers?

 

Thanks

Which permission needed to stop DBScheduler processing?

$
0
0

Hello *,

 

do you know which permission is responsible for the "Stop DBScheduler in database" function in the "Emergency stop" window of JobQueueInfo?

 

I know the program functions Common_ShowDBSchedulerInfo and Common_StartDBScheduler, but something similar for stopping it does not seem to exists. Edit permissions on DialogDatabase.IsDBSchedulerDisabled don't seem to be sufficient. Process Orchestration Guide mentions "necessary administration permissions" without naming them.

 

Any hint will be appreciated.

 

cu,

Oliver

Password Generation, Its storage on IDM (encrypted) and Synchronization with Target system using QIM

$
0
0

     Scenario:

 

We want to manage the user password centrally for QIM connected systems such that when users are created in QIM their passwords are generated (through QIM), stored on QIM in a secured way and then synchronized with end systems. Solution should be able to store the encrypted passwords on QIM (in case a new target system gets added to the list, it should be able to retrieve the user password and synch it with the target system).

 

In the existing process, user records are planned to be created from HR into QIMusing scheduled dataImporter script.

 

Below is what we understand about QIM:

 

  1. "Central password" attribute on person table is not encrypted in the DB, hence we cannot store the generated password in the central password attribute (security risk) as the same password will be pushed to all the target systems.
  2. There is another attribute (Password OR DialogPassword) that stores user password in encrypted form (with a secret salt) and can be set while creating user on QIM. We can potentially use this attribute to store the central password but we would need a mechanism to decrypt it and push it to end systems

 

IDM requirements for password synch:

 

Typically IDM suites have a proprietary way of encrypting and storing the password on IDM system. This is not generally directly accessible to the developers, IDM tool accesses the APIs internally to decrypt the passwords to push to end systems (for security reasons). In our scenario if we decide to store the password in “Central password” attribute and choose to encrypt it we need below 2 things:

  1. a way to encrypt so that passwords cannot be decrypted by anyone except the APIs accessible only to the IDM tool.
  2. a way to decrypt the password through the APIs provided by the IDM tool.

 

Questions:

 

I am sure that this scenario has been faced by people while implementing Password Sync for connected systems. Just wanted to understand what is the recommended way of implementing password generation, storage on IDM (encrypting and decrypting) and synchronizing the password with the target systems. Primary concern here is maintaining the security of the central password as we need to keep it on QIM and decrypt it as needed for synchronization.

Display value of the Old foreign key

$
0
0

If I want the display value of a foreign-key object, I can do this easily using [d] notation, e.g. $UID_Department[d]$ from Person.

If I want the old value of the UID, I can do this easily using [o] notation, e.g. $UID_Department[o]$.

But how do I get the old object's display value?  It doesn't seem to accept $UID_Department[od]$, $UID_Department[o][d]$ or $FK(UID_Department[o]).UID_Department[d]$ all I end up with is the raw uid value.

Is there an easy way to do this, or do I need to explicitly open the object reference by the old UID to get it?

Thanks,

Neil.

Unable to view custom attrib with system user creds

$
0
0

Hi,

 

I am unable to view the custom attributes created with the system user which has been created as part of the installation.

 

I am also unavle to provide permission to the same user using the same creds.

 

Thanks,

Sunderson SJG

Viewing all 845 articles
Browse latest View live