Role Membership Rules using OIM apis

Roles is one of the important concept in OIM. Roles are used to create and manage the records of a collection of users to whom want to permit access to common functionality, such as access rights, roles, or permissions.

Role Membership rules determine which users can be assigned or removed as direct membership to or from the role. OIM provides functionality to create role membership rule through UI using Identity Self Service console. But one of the weakness while creating rule through self service console is that, only five operators are available for conditions in role membership rule =, !=, Starts with, Ends with, Contains and IN.

But what if requirement is to use other than these five operators like DOES_NOT_CONTAIN, DOES_NOT_BEGIN_WITH, DOES_NOT_ENDS_WITH, NOT_IN, LESS_THAN, GREATER_THAN, GREATER_EQUAL, LESS_EQUAL etc.

Yes its possible in OIM through SearchRule api. Following code is the example of the same.

public class CreateMembershipRule {
    private RoleManager roleManager = null;
 
    public static void main(String[] arg) throws Exception {
        CreateMembershipRule objCreateMembershipRule = new CreateMembershipRule();
        oimClient = objCreateMembershipRule.connectToOim();
        roleManager = oimClient.getService(RoleManager.class);
objCreateMembershipRule.createRoleMemRule();
    }

    public void createRoleMemRule(){
        SearchRule userMembershipRule1 = new SearchRule("Telephone Number", "127",       SearchRule.Operator.DOES_NOT_CONTAIN);
        SearchRule userMembershipRule2 = new SearchRule("Telephone Number","", SearchRule.Operator.NOT_EQUAL);
        SearchRule combinedRule = new SearchRule(userMembershipRule1, userMembershipRule2, SearchRule.Operator.AND);
SearchRule userMembershipRule3 = new SearchRule("Last Name","BOR", SearchRule.Operator.DOES_NOT_CONTAIN);
SearchRule mainRule = new SearchRule(combinedRule, userMembershipRule3, SearchRule.Operator.AND);

        roleManager.createRoleMembershipRule(mainRule,"ROLE_NAME"); 
    }

    private OIMClient connectToOim() {
   String oimUserName = "xelsysadm";
   String oimPassword = "**********";
   String oimURL = "t3://<HostName>:14000";
   String oimInitialContextFactory = "weblogic.jndi.WLInitialContextFactory";
   String wlsAuthConfig = "authwl.conf";
   String oimAppSrvType = "wls";
            java.util.Hashtable<String, String> env = new java.util.Hashtable<String, String>();
            env.put(oracle.iam.platform.OIMClient.JAVA_NAMING_FACTORY_INITIAL,         oimInitialContextFactory);
            env.put(oracle.iam.platform.OIMClient.JAVA_NAMING_PROVIDER_URL, oimURL);
            System.setProperty("java.security.auth.login.config",wlsAuthConfig);
    System.setProperty("OIM.AppServerType", oimAppSrvType);
    System.setProperty("APPSERVER_TYPE", oimAppSrvType);
    OIMClient oimclient = new oracle.iam.platform.OIMClient(env);
   try {
   oimclient.login(oimUserName, oimPassword.toCharArray());
   System.out.println("Successfully connected to OIM");
   } catch (LoginException e) {
            System.out.println("Exception in OIMClient.connectToOim()" + e.getMessage());                               e.printStackTrace();
   }
return oimclient;
    }
}

Role membership rule will look like this

orclIsEnabled attribute value remained blank when new account provisioned or enabled existing account on OID through OIM.

OID (Oracle Internet Directory) is an LDAP directory that uses an Oracle Database for storage. The information in the directory is available to different clients, such as single sign-on solutions, email clients, and database applications.
OID has provided multiple out the box attributes cn, givenname, manager, orclIsEnabled etc. orclIsEnabled is the attribute for status of the user in OID. which shows whether user is enabled or disabaled in OID.

OIM provided out of the box connector to perform CRUD operations on OID. When account provisioned on OID through OIM, OID connector manages to pick required attributes values from OIM to OID which include orclIsEnabled attribute too, which is nothing but the status.

But one of the confusion with orclIsEnabled attribute is that, when new account provisioned or enabled existing account on OID, value of orclIsEnabled should be enabled but connector kept it blank and when account get disabaled connector put disabled in orclIsEnabled attribute. It means blank value of orclIsEnabled shows OID account is in enabled state.


When OID account is Enabled:

When OID account is Disabled:

: