1. Use DOMAIN_HOME/bin/setStartupEnv.sh (Unix) or set OIMDomainEnv.cmd (Windows). If not, continue to use DOMAIN_HOME/bin/setStartupEnv.sh (Unix) or setStartupEnv.cmd (Windows) to change the heap size settings.
2. Change the value of the memory argument SERVER_MEM_ARGS_xxHotSpot for OIM-MGD_SVRS in DOMAIN_HOME/bin/setStartupEnv.sh (Unix) or setStartupEnv.cmd (Windows).
3. Restart all servers.

   If you are using the console to restart all the servers, then you must also restart the node manager.

1. Open the WebLogic Remote Console.
2. Click Services > Data Sources > Data Source Name and then click the Connection Pool tab.
3. Adjust the Initial Capacity and Maximum Capacity based on requirement.
4. Set the Inactive Connection Timeout parameter to 300.
5. Navigate to Advanced tab and set Seconds to Trust an Idle Pool Connection to 30.
6. Save and activate the changes.

   Note:

   Ensure that any increase in number of connections on the application server connection pools are compensated by database configuration changes. You might have to increase the MAX SESSIONS settings on Oracle Database.

1. Export the /db/oim-config.xml file from MDS as described in Exporting and Importing Configuration Files in Administering Oracle Identity Governance.
2. In the oim-config.xml file, replace the following:

   <ADPClassLoaderConfig adapterReloadingEnabled="true" loadingStyle="ParentFirst" reloadInterval="15" reloadingEnabled="true">
   

   With:

   <ADPClassLoaderConfig adapterReloadingEnabled="false" loadingStyle="ParentFirst" reloadInterval="15" reloadingEnabled="false">
   

3. Replace the following:

   <storeConfig reloadingEnabled="true" reloadingInterval="20"/>
   

   With:

   <storeConfig reloadingEnabled="false" reloadingInterval="20"/>
   

4. Save the oim-config.xml file and import it back to MDS.

1. In a text editor, open the setSOADomainEnv.sh or setSOADomainEnv.cmd file in the DOMAIN_HOME/bin/ directory.
2. Set the value of USER_MEM_ARGS similar to the following:

   Note:

   The values shown for USER_MEM_ARGS are examples. You can change the values based on your requirement.

   USER_MEM_ARGS="-Xms3048m -Xmx3048m -Xmn1648m -Xss256k -XX:PermSize=384m -XX:MaxPermSize=384m"
   

3. Set the value of JAVA_OPTIONS similar to the following:

   Note:

   The values shown for JAVA_OPTIONS are examples. You can change the values based on your requirement.

   JAVA_OPTIONS="-Xnoclassgc -XX:SurvivorRatio=8 -XX:TargetSurvivorRatio=90
    -XX:PermSize=350m -XX:MaxPermSize=350m -XX:+AggressiveOpts
    -XX:+UseParallelOldGC -XX:ParallelGCThreads=8 -XX:+PrintGCDetails
    -XX:+PrintGCTimeStamps -XX:+PrintGCDateStamps  -XX:ReservedCodeCacheSize=64m
    -XX:CICompilerCount=8 -XX:+AlwaysPreTouch -XX:+PrintReferenceGC
    -XX:+ParallelRefProcEnabled -XX:-UseAdaptiveSizePolicy
    -XX:+PrintAdaptiveSizePolicy -XX:+DisableExplicitGC"
   

4. Save and close the file.

• Tasks Tables
  
• Reconciliation Tables
  
• OIG Orchestration LOB Tables
  
• Audit Tables
  
• Redo-Log Files
  
• Keep Pool Changes
  

This section describes the tuning that needs to be applied on your target systems as well as Oracle Identity Governance Connectors.

Oracle Internet Directory

During a reconciliation run, all changes in the target system records are reconciled into Oracle Identity Governance. Depending on the number of records to be reconciled, this process may require a large amount of time. In addition, if the connection breaks during reconciliation, then the process would take longer to complete. It is recommended that "paged reconciliation" is configured to optimize performance.

To configure paged reconciliation, you must specify a value for the PageSize attribute of the user reconciliation scheduled task. The default value of 100 for PageSize suits for most of the scenarios.

SAP

It is recommended that you use a reconciliation batch size of 100.

Active Directory (11.1.1.5.0 and 11.1.1.6.0 Connector)

• Performance improvement patch

  • If you are using Active Directory 11.1.1.5.0, make sure that you apply patch # 15916848. You can download the patch from My Oracle Support. For patching instructions, refer to the Readme that is available with the patch.

  • If you are using Active Directory 11.1.1.6.0, download the patch # 15916848 from My Oracle Support. Import only the ReconAttributeMap.xml that is provided as part of the patch, using the deployment manager. You can ignore ActiveDirectory.Connector.dll provided in the patch, as it is updated in the 11.1.1.6.0 version itself. For patching instructions, refer to the Readme that is available with the patch.

• Configuring the reconciliation engine to skip the ignore event API

  The default behavior would be to first check to create a recon event or to ignore it for each of the user records returned by the connector. This process involves comparing the values of all the attributes of the user coming in from the connector against the values stored in the OIG database. To ignore this, open the lookup definition Lookup.Configuration.ActiveDirectory and add below entry.

  • Code Key: Ignore Event Disabled

  • Decode: true

  Note:

  You must evaluate the pros and cons of disabling the ignore event API call before you make the above changes.

• Batching

  If batching is used in the AD connector, then the result set needs to be sorted. Therefore, batching can be used when number of records to be reconciled is less than 10000. The recommended batch size is 500.

• Paging

  • When number of records to be reconciled is more than 10000, use the Page Size Configuration property present in Lookup.Configuration.ActiveDirectory and Lookup.Configuration.ActiveDirectory.Trusted.

  • If paging is configured to be used, then you must make sure that no value is specified for the scheduled task parameters - Batch Size, Batch Start, Number of Batches, Sort By, and Sort Direction.

  • Paging splits the entire result set of a query into smaller subsets called, appropriately enough, pages. In general, it is recommended to set this value to the maximum page size for simple searches. By setting the page size to the maximum value, you can minimize the network round trips necessary to retrieve each page, which tends to be more expensive operation for simple searches. If you specify a PageSize greater than the MaxPageSize of the target system, the Active Directory server ignores it and uses the MaxPageSize instead. No exception is generated in this case. In some cases, you might need to specify a smaller page size to avoid timeouts or overtaxing the server. Some queries are especially expensive. Therefore, limiting the number of results in a single page can help avoid this. For the Active Directory Connector, use the default value 1000 for the best performance.

• Filters

  It is recommended to use Filters and provide the value for the Search Base, if a specific set of records is to be retrieved from the target. Filter provided in the scheduled task is converted into LDAP query. The filters help narrow down the search, making the searching and processing of the data quicker. For more information about the filters, refer to the Active Directory Connector Documentation.

• For the reconciliation in the forest topology, you can use connector for reconciling the data from the complete forest (via Global Catalog Server) or you can use the connector for reconciling the data from the specific domain or domain controller. It is recommended to use the second approach whenever the data from the specific data center is to be reconciled, instead of using first option with search base.

  For example:

  Assume that there are 10 data centers in the Active Directory forest namely DC1, DC2, … , DC10. To reconcile data from an organization (tempOrg) which is present on DC2, you have use one of the following approaches:

  1. Use Global Catalog and provide the DN of the organization in the Search Base.

  2. Use DC2 and provide the DN of the organization in the Search Base.

  It is recommended to use the second approach for better performance.

Reconciliation uses matching algorithm to find if the user/account/role/organization for which the change is requested, already exists in OIG. The matching algorithm compares the data in set of columns in OIG with the data in target staging table columns. The columns that contain the matching rules are defined in the reconciliation profile and they are defined at run-time. To improve the performance of the matching operation, there must be correct indexes created on the matching rule columns.

To illustrate the recommended method of identifying the appropriate indexes, a sample Active Directory (AD) user profile present in the Meta Data Store (MDS) repository is taken as an example. This example covers the following:

• Selecting Indexes For Trusted Source Reconciliation

• Selecting Indexes For Target Source Reconciliation

• Selecting Indexes For Target Source Reconciliation With Multi-Valued Data

Selecting Indexes For Trusted Source Reconciliation

To select indexes based on the matching rule criteria in trusted source reconciliation, you must complete the following steps:

1. Open the Active Directory user profile file in a text editor. You can open Active Directory user profile using Validate Recon Profile test present in the diagnostic dashboard, or by using Validate Recon Profile MBean present in EM.

2. Search for ownerMatchingRuleWhereClause or matchingRule for all entities:

   ownerMatchingRuleWhereClause = (((UPPER(USR.USR_LOGIN)=UPPER(RA_ADUSER7.RECON_USERID5A729570)) OR (UPPER(USR.USR_UDF_OBGUID)=UPPER(RA_ADUSER7.RECON_OBJECTGUID))))

3. After identifying the columns constituting the matching rule in the profile, create the indexes accordingly.

   For example, following indexes are needed for matching rule in the above example.

   Table 12-5 Table Names and Columns to be Indexed

   Table Name	Column to be Indexed
   USR	UPPER(USR_LOGIN)
   USR	UPPER(USR.USR_UDF_OBGUID)
   RA_ADUSER7	UPPER(RECON_USERID5A729570)
   RA_ADUSER7	UPPER(RA_ADUSER7.RECON_OBJECTGUID)

   Note:

   • It is important that the indexes are created along with functions like UPPER, SUBSTR in the matching rule. In Table 12-5, UPPER is the function used on all columns.

   • Some of the columns and functions might have been indexed already. In Table 12-5, USR table should already have function-based index on UPPER(USR_LOGIN).

Selecting Indexes For Target Source Reconciliation

To select indexes based on the matching rule criteria in target resource reconciliation, you must complete the following steps:

1. Open the Active Directory user profile file in a text editor. You can open Active Directory user profile using Validate Recon Profile test present in the diagnostic dashboard, or by using Validate Recon profile MBean present in EM.

2. Search for account search tag <matchingruleWhereClause>:

   <matchingruleWhereClause>((UD_ADUSER.UD_ADUSER_OBJECTGUID=RA_ADUSER7.RECON_OBJECTGUID))</matchingruleWhereClause>

3. After identifying the columns constituting the matching rule in the profile, create the indexes accordingly.

   For example, following indexes are needed for matching rule in the above example.

   Table 12-6 Table Names and Columns to be Indexed

   Table Name	Column to be Indexed
   UD_ADUSER	UD_ADUSER_OBJECTGUID
   RA_ADUSER7	RECON_OBJECTGUID

   Note:

   • It is important that the indexes are created along with functions like UPPER, SUBSTR in the matching rule.

   • Some of the columns and functions might have been indexed already.

Selecting Indexes For Target Source Reconciliation With Multi-Valued Data

To select indexes based on the matching rule criteria in target resource reconciliation with multi-valued data, you must complete the following steps:

1. Open the Active Directory user profile file in a text editor. You can open Active Directory user profile using Validate Recon Profile test present in the diagnostic dashboard, or by using Validate Recon profile MBean present in EM.

2. For entitlements, search for the <matchingruleWhereClause> tag under <childreconeventdata>:

   <matchingruleWhereClause>((UD_ADUSRC.UD_ADUSRC_GROUPNAME=RA_UD_ADUSRC.RECON_MEMBEROF))</matchingruleWhereClause>

3. After identifying the columns constituting the matching rule in the profile, create the indexes accordingly. For example, following indexes are needed for matching rule in the above example.

   Table 12-7 Table Names and Columns to be Indexed

   Table Name	Column to be Indexed
   UD_ADUSRC	UD_ADUSRC_GROUPNAME
   RA_UD_ADUSRC	RECON_MEMBEROF

   Note:

   • It is important that the indexes are created along with functions like UPPER, SUBSTR in the matching rule.

   • Some of the columns and functions might have been indexed already.

Table 12-8 lists some of the important out-of-the-box event handlers that are invoked during post-processing of reconciliation.

You can find the rest of out-of-the-box and custom event handlers in DMS metric page of WebLogic Application Server. Use the following URL to go to the DMS metric page:

http://<servername>:<port>/dms

In this URL, port refers to the WebLogic Administration Server port. To log in, you must use the WebLogic admin credentials.

After you log into the DMS metric page, click on OIG_EventHandler to see the list of event handlers and their processing time metrics. You can use these metrics to identify event handlers that may need to be optimized.

1. Login to Oracle Identity System Administration.
2. On the left pane, under Configuration, click IT Resource. The Manage IT Resource page is displayed in a new window.
3. From the IT Resource Type list, select Directory Server, and then click Search.
4. For the Directory Server IT resource, click Edit. The Edit IT Resource Details and Parameters page is displayed.
5. Change the value of the following configuration parameters to 500:

   • Initial pool size: 500

   • Minimum pool size: 500

   • Maximum pool size: 500

6. Click Update.

• Increasing the LDAP Synchronization Batch Size
  
• Setting Configuration Parameters in OVD
  
• Setting Configuration Parameters in OID
  
• Setting Configuration Parameters in Identity Virtualization Library (libOVD)
  
• Setting Configuration Parameters in WebLogic Server and JDBC