Set pre-defined Challenge Questions for use with Lost Password Management

In COREid, when configuring an attribute with the Semantic Type of Challenge, the only option for Display Type is Single-line Text. In order to set pre-defined challenge questions:

1. Change the Semantic Type back to None


2. Set the Display Type to Selection Menu, and add an option for each of the pre-defined questions


3. Through an LDAP browser or LDAP import tool, locate the attribute definition (obattr=[attribute name],obclass=[user object class],o=Oblix,[COREid Configuration Container]) and add the value ObSChallenge for the attribute obsemantictype


4. Restart the Identity Server

Pre-defining challenge questions can increase security by forcing users to answer only approved questions (as opposed to creating their own in free-form text). This allows administrators to select questions that the answers can not be easily obtained through social engineering or questions with common answers. Since the user's password can be reset by correctly answering to a displayed question, a weak challenge response is more of a security risk than a weak password.

IdXml SOAP Envelope Parsing Dot NET

More on Dot NET parsing for IdXml. It finally occurred to me that I could add namespace definitions to my hearts content to parse any doc (with multiple namespaces defined).

XmlDocument xml = new XmlDocument();
xml.LoadXml(someXmlString);
XmlNamespaceManager ns = new XmlNamespaceManager(xml.NameTable);
ns.AddNamespace("default", "http://www.oblix.com/");
attrNodes=xml.SelectNodes("/default:ObEventParams/default:ObParamList[@name='WfAttribute']/default:ObParam", ns);

OAM Identity and AJAX - A 'Light Services' Approach

You just can't turn around without hitting your head on some 'AJAX' these days. And, as it turns out, there are some pretty good reasons (here and here) for it. Assuming that you agree that there are real benefits associated with this new web tactic, lets take some time to look at what we can achieve by applying it to the OAM Identity System.

At Nulli, we've said it before and we'll say it again: There was some seriously good thinking going on at Oblix back in the day. While Microsoft was inventing the XMLHTTPRequest, the folks at Oblix we discussing the bold option of using (the very new) XSLT 1.0 to deliver an HTML user interface derived from the XML output of the Identity Server; a way to bring the directory service to the web in two short hops.

Now, chances are, if you are an Oblix / OAM customer that has made good use of the Identity System, you grimaced as you read 'XSLT'. And, in all fairness, it is true to say that the architectural decisions that Oblix made did have the result of pushing customers into technologies (namely XSL development) that they may not have chosen for themselves.

OIM Pre-populate Not Working

My colleague added a GTC resource to a user today but none of the pre-populate values got set.  Clicking the pre-populate button did not set the values either. Upon further inspection there were no pre-populate definitions set for the form.

We reverted to an older project and imported only the form definitions.  Once this was successful we tried adding the GTC resource to another user.  It still did not auto pre-populate the values but the pre-populate button itself worked.

We fired up the design console and went to Process Management > Process Definition and searched for the form. Checked the Auto Pre-populate check box on the process definition and saved it.  When we retested adding the GTC resource to another user it worked this time.

OIM Server in Admin Mode

Starting the OIM server goes to Running mode, it only starts in Admin mode.  The logs contain an error indicating there was a problem creating a connection pool.

<Dec 31, 2012 11:00:14 AM MDT> <Warning> <JDBC> <BEA-001129> <Received exception while creating connection for pool "xxxxxxxxx": ORA-01034: ORACLE not availableORA-27101: shared memory realm does not exist

The xxxxxxxxx in the error matches the name of one of the data sources exactly.  Upon  closer inspection the Data Source did not belong.  It applied to the OIM cluster and that is why OIM started in admin mode.  Removing the offending Data Source from Weblogic and restarting the OIM managed service rectified the problem.

The origin of the Data Source is unknown; it was likely created erroneously.

OIM EventHandler Export WLST

I was just trying to export some EventHandlers prior to applying an Oracle bundle patch and encountered the following error:

WLSTException: MDS-01160: Expecting absolute document reference. Reference " /metadata/iam-features-OIMMigration/EventHandlers.xml" is a relative reference to the document.MDS-91009: Operation "exportMetadata" failure. Use dumpStack() to view the full stacktrace. 

The reference in the error looked pretty absolute to me but upon further inspection of the metadata_files property there was a space after the comma.  I removed all of the spaces from the line and re-ran weblogicExportMetadata.sh; and voila no more error.

Nulli Gives Back to the Community – Floods Can’t Dampen Our Spirit!

On June 21, 2013, Southern Alberta was hit with devastating floods – the impacts both financially and emotionally will be felt for years.  Despite being a relatively small team, the flooding has impacted all of us at Nulli.  Some of our colleagues were temporarily evacuated from their homes, seeking shelter with colleagues, friends or neighbours until the dangers had passed.  Others had to stay evacuated until waters subsided, power was restored and cleaning out of contaminated belongings could be completed.  Yet others have family and friends who have had their homes and possessions completely destroyed and live day-to-day while they wait on flood policy and recovery decisions to determine their next steps for getting themselves into a home.

Flooded Neighbourhood - Sunnyside

The magnitude of the destruction is overwhelming and it is hard to comprehend the amount of resources that will be required to rebuild.  For many, the decision to rebuild or move out of flood prone areas will be uncertain for weeks to come as government guidelines and other factors come to fruition.

During these challenging times, Nulli has encouraged employees to give of their time wherever they can and to take time away from work to do so.  Our team has definitely been helping out in a multitude of ways.  Bringing their sweat labour, shovels, pumps, generators, fans, pressure washers, wrecking bars and bottomless energy, the Nulli team has placed their hearts on the line for anyone in need of a hand.  Everyone wants to help and everyone wants to make a difference.  When speaking of the volunteer support being offered by the Nulli team, a colleague recently stated, “I’m proud to be a part of Nulli, we have demonstrated our commitment to each other and to the community that we share so well”.

Nulli Team in High River

This has been a significant learning experience for all of us whether we have been impacted directly or indirectly; some of us have learned how to help while others have learned how to accept help.  The experience has been enormously rewarding on both a personal and community scale.  It’s been humbling to witness the wonderful things that people are capable of when faced with adversity and to support them in the process.

Nulli honours its’ commitment to community, its' values and lives up to its’ namesake 

– of truly being ‘Second to None’.