This section describes Bundle Patches and explains differences between Stack Patch Bundles, Bundle Patches, interim patches (also known as one-offs) and Patch Sets.

• Stack Patch Bundle

• Bundle Patch

• Interim Patch

• Patch Set

Stack Patch Bundle deploys the IDM product and dependent FMW patches using a tool. For more information about these patches, see Quarterly Stack Patch Bundles (Doc ID 2657920.1) at https://support.oracle.com.

A Bundle Patch is an official Oracle patch for an Oracle product. In a Bundle Patch release string, the fifth digit indicated the Bundle Patch number. Effective November 2015, the version numbering format has changed. The new format replaces the numeric fifth digit of the bundle version with a release date in the "YYMMDD" format where:

• YY is the last 2 digits of the year

• MM is the numeric month (2 digits)

• DD is the numeric day of the month (2 digits)

Each Bundle Patch includes the libraries and files that have been rebuilt to implement one or more fixes. All the fixes in the Bundle Patch have been tested and are certified to work with one another. Regression testing has also been performed to ensure backward compatibility with all components in the Bundle Patch.

Each Bundle Patch is cumulative: the latest Bundle Patch includes all fixes in earlier Bundle Patches for the same release and platform. Fixes delivered in Bundle Patches are rolled into the next release.

In contrast to a Bundle Patch, an interim patch addresses only one issue for a single component. Although each interim patch is an official Oracle patch, it is not a complete product distribution and does not include packages for every component. An interim patch includes only the libraries and files that have been rebuilt to implement a specific fix for a specific component.

Interim patch is also known as, security one-off, exception release, x-fix, PSE, MLR, or hotfix.

A Patch Set is a mechanism for delivering fully tested and integrated product fixes that can be applied to installed components of the same release. Patch Sets include all fixes available in previous Bundle Patches for the release. A Patch Set can also include new functionality. Each Patch Set includes the libraries and files that have been rebuilt to implement bug fixes (and new functions, if any). However, a patch set might not be a complete software distribution and might not include packages for every component on every platform.

All fixes in the Patch Set have been tested and are certified to work with one another on the specified platforms.

Oracle has certified the dependent Middleware component patches for Identity Management products and recommends that you apply these certified patches. For more information about these patches, see Certification of Underlying or Shared Component Patches for Identity Management Products (Doc ID 2627261.1) at https://support.oracle.com.

You must satisfy the following requirements before applying this Bundle Patch:

• Verify that you are applying this Bundle Patch to an Oracle Identity Governance 12.2.1.4.0 installation.

  Note:

  When installing OPatch, you might find that interim or one-off patches have already been installed.

• Download the latest version of OPatch. Oracle recommends using the latest version of OPatch to all customers. To learn more about OPatch and how to download the latest version, see Using OUI NextGen OPatch 13 for Oracle Fusion Middleware 12c (Doc ID 1587524.1) at https://support.oracle.com.

  You can access My Oracle Support at https://support.oracle.com.

• Verify the Oracle Universal Installer (OUI) Inventory. To apply patches, OPatch requires access to a valid OUI Inventory. To verify the OUI Inventory, ensure that ORACLE_HOME/OPatch path appears in your system PATH. For example:

  export PATH=$ORACLE_HOME/OPatch:$PATH 

  Then run the following command in OPatch inventory:

  opatch lsinventory

  If the command returns an error or you cannot verify the OUI Inventory, contact Oracle Support. You must confirm the OUI Inventory is valid before applying this Bundle Patch.

• Confirm the opatch and unzip executables exist and appear in your system PATH, as both are needed to apply this Bundle Patch. Execute the following commands:

  which opatch
  which unzip

  Both executables must appear in the environment variable PATH before applying this Bundle Patch.

• Ensure that there are no pending JMS messages in Oracle Identity Governance server. You can monitor JMS messages with WebLogic console.

Before applying the Bundle Patch, perform the following prerequisites:

• This patch process makes changes to Oracle Identity Governance database schema (such as adding/modifying data), Oracle Identity Governance Meta Data Store (MDS) database schema (such as adding/modifying data), domain configuration changes, and other binary changes in the file system under ORACLE_HOME on which Oracle Identity Governance is installed. It is mandatory to create a backup of the following:

  • Oracle Identity Governance, MDS, and Service-Oriented Architecture (SOA) database schemas. For example, the database schema can be DEV_OIM, DEV_MDS schemas used by Oracle Identity Governance. Simple export of the schemas is sufficient.

  • The ORACLE_HOME directory on which Oracle Identity Governance is installed, for example, /u01/Oracle/Middleware.

  • Oracle Identity Governance WebLogic Domain location, for example, /u01/Oracle/Middleware/user_projects/domains/IAMGovernanceDomain/.

  • The UNIX user applying the Bundle Patch must have read, write, and execute permissions on both ORACLE_HOME as well as WebLogic DOMAIN_HOME.

• If you have customized the event handler file metadata/iam-features-configservice/event-definition/EventHandlers.xml in your setup, then perform the following steps to ensure that the upgrade does not override any customization done to this file:

  1. Export the metadata/iam-features-configservice/event-definition/EventHandlers.xml file from MDS, and create a backup of this file.

  2. After upgrading and running all the post install steps, export the new metadata/iam-features-configservice/event-definition/EventHandlers.xml file, merge your customization to this new file, and import it back to MDS.

  Note:

  For more information on MDS Utilities, see MDS Utilities and User Modifiable Metadata Files.

Applying OIM BUNDLE PATCH 12.2.1.4.240705 is done in the following stages:

• Understanding the Process Sequence With an Example

• Stage 1: Patching the Oracle Binaries (OPatch Stage)

• Stage 2: Filling in the patch_oim_wls.profile File

• Stage 3: Patching the Oracle Identity Governance Managed Servers (patch_oim_wls Stage)

1. Shutdown the Oracle Identity Governance managed servers, the SOA managed servers and the Admin Server in this order.
2. Run 'opatch apply' on ORACLE_HOME_A. See Stage 1: Patching the Oracle Binaries (OPatch Stage) for more information.
3. Run 'opatch apply' on ORACLE_HOME_B. See Stage 1: Patching the Oracle Binaries (OPatch Stage) for more information.
4. Fill-in the patch_oim_wls.profile file and run patch_oim_wls on ORACLE_HOME_A with WebLogic Admin Server, oim_server1, and soa_server1 running. The rest of the servers on other nodes can be down.

   See Stage 2: Filling in the patch_oim_wls.profile File for information on filling in the patch_oim_wls.profile.

   See Stage 3: Patching the Oracle Identity Governance Managed Servers (patch_oim_wls Stage) for information about running patch_oim_wls.

5. Restart the managed servers on all the nodes.

1. Stop all Oracle Identity Governance managed servers, all SOA managed servers and the Admin Server in this order
2. Create a directory for storing the unzipped bundle patch. This document refers to this directory as PATCH_TOP.
3. Unzip the patch zip file in to the PATCH_TOP directory you created in step 2 by using the following command:

   unzip -d PATCH_TOP p36807639_122140_Generic.zip

   Note:

   On Windows, the unzip command has a limitation of 256 characters in the path name. If you encounter this issue, use an alternate ZIP utility, for example 7-Zip to unzip the zip file.

   Run the below command to unzip the file:

   "c:\Program Files\7-Zip\7z.exe" x p36807639_122140_Generic.zip
4. Move to the directory where the patch is located. For example:

   cd PATCH_TOP/36807639

5. Set the ORACLE_HOME directory in your system. For example:

   export ORACLE_HOME=/u01/Oracle/Middleware

6. Ensure that the OPatch executables are present in your system PATH. To update the PATH environment variable to include the path of Opatch directory, run the following command:

   export PATH=$ORACLE_HOME/OPatch:$PATH

7. Apply the bundle patch to the ORACLE_HOME using the following command for Oracle Identity Governance:

   opatch apply

   Note:

   If OPatch fails with error code 104, cannot find a valid oraInst.loc file to locate Central Inventory, include the -invPtrLoc argument, as follows:

   opatch apply -invPtrLoc ORACLE_HOME/oraInst.loc

   When OPatch starts, it will validate the patch and ensure there are no conflicts with the software already installed in the ORACLE_HOME. OPatch categorizes two types of conflicts:

   • Conflicts with a patch already applied to the ORACLE_HOME. In this case, stop the patch installation and contact Oracle Support.

   • Conflicts with subset patch already applied to the ORACLE_HOME. In this case, continue the install, as the new patch contains all the fixes from the existing patch in the ORACLE_HOME. The subset patch will automatically be rolled back prior to the installation of the new patch.

     Note:

     For clustered and multi-node installation of Oracle Identity Governance, this step must be run on all the ORACLE_HOME directories on which Oracle Identity Governance is installed.

8. Start all the servers in the OIG domain, which are the Admin Server, SOA Servers and Oracle Identity Governance Servers.

Using a text editor, edit the file patch_oim_wls.profile located in the ORACLE_HOME/idm/server/bin/ directory and change the values in the file to match your environment. The patch_oim_wls.profile file contains sample values.

Table 1-1 lists the information to be entered for the patch_oim_wls.profile file. This file is used in next stage of the bundle patch process.

1. Make sure that the WebLogic Admin Server, SOA Managed Servers, and Oracle Identity Governance Managed Server are running.
2. Set the following environment variables:

   For LINUX or Solaris, set the JAVA_HOME environment variable:

   export JAVA_HOME=<JAVA_HOME_PATH>
   export PATH=$JAVA_HOME/bin:$PATH

   For Microsoft Windows:

   set JAVA_HOME=<JAVA_HOME_PATH>
   set ANT_HOME=\PATH_TO_ANT_DIRECTORY\ant
   set ORACLE_HOME=%MW_HOME%\idm

   Note:

   Make sure to set the reference to JDK binaries in your PATH before running the patch_oim_wls.sh (on UNIX) or patch_oim_wls.bat (on Microsoft Windows) script. This JAVA_HOME must be of the same version that is being used to run the WebLogic servers. The JAVA_HOME version from /usr/bin/ or the default is usually old and must be avoided. You can verify the version by running the following command:

   java -version

3. Execute patch_oim_wls.sh (on UNIX) or patch_oim_wls.bat (on Microsoft Windows) to apply the configuration changes to the Oracle Identity Governance server. On Linux systems, you must run the script in a shell environment using the following command:

   sh patch_oim_wls.sh

   Note:

   For EDG implementations, this script must be run against the mserver domain directory rather than the server domain directory.

4. Delete the following directory from OIG domain home:

   $DOMAIN_HOME/servers/oim_server1/tmp/_WL_user/oracle.iam.console.identity.self-service.ear_V2.0

   Here, oim_server1 is the weblogic managed server used for OIG.

5. To verify that the patch_oim_wls script has completed successfully, check the ORACLE_HOME/idm/server/bin/patch_oim_wls_YYYY-MM-DD_hh-mm-ss.log log file.

   Note:

   On running the patch_oim_wls script, the $DOMAIN_HOME/servers/MANAGED_SERVER/security/boot.properties file might be deleted. If you use a script to start the Managed Server and use the boot.properties file to eliminate the need of entering the password in the script, then create a new boot.properties file.

   In an EDG environment, the boot.properties file is in MSERVER_HOME/servers/MANAGED_SERVER/security.

6. Stop and start WebLogic Admin Server, SOA Server, and Oracle Identity Governance Server.

   • Shutting down Oracle Identity Governance server might take a long time if it is done with force=false option. It is recommended that you force shutdown Oracle Identity Governance server.

   • The patch_oim_wls script is re-entrant and can be run again if a failure occurs.

Perform the following steps to apply the bundle patch to a new instance:

• Installing a New Oracle Identity Governance Instance with OIM BUNDLE PATCH 12.2.1.4.240705

• Updating Oracle Identity Governance Web Applications

• Prerequisites of Applying the Bundle Patch

1. Start the installation by referring to Installing Oracle Identity Governance Using Quickstart Installer of Installing and Configuring Oracle Identity and Access Management. Before creating the database schema, apply the patch by using Opatch, as described in Stage 1: Patching the Oracle Binaries (OPatch Stage). Then, continue with schema creation.

   Note:

   It is recommended that this step is performed before creating or extending the domain with Oracle Identity Governance.
2. Create the domain by launching the configuration wizard, as specified in Configuring the Domain of Installing and Configuring Oracle Identity and Access Management.
3. Run the offlineConfigManager command to perform post configuration tasks. See Running the Offline Configuration Command in Installing and Configuring Oracle Identity and Access Management.
4. Start the WebLogic Admin Server, SOA Server, and OIG server.
5. Verify that you are able to log in to Oracle Identity Self Service or Oracle Identity System Administration.
6. Login to Oracle Enterprise Manager Fusion Middleware Control, and invoke the OIMSOAIntegrationMBean to integrate OIG with SOA. See Integrating Oracle Identity Governance with Oracle SOA Suite in Installing and Configuring Oracle Identity and Access Management.

1. Start the installation by referring to Traditional Method of Installing and Configuring Oracle Identity and Access Management. Before creating the database schema, apply the patch by using Opatch, as described in Stage 1: Patching the Oracle Binaries (OPatch Stage). Then, continue with schema creation.

   Note:

   It is recommended that this step is performed before creating or extending the domain with Oracle Identity Governance.
2. Create the domain by launching the configuration wizard, as specified in Configuring the Domain of Installing and Configuring Oracle Identity and Access Management.
3. Run the offlineConfigManager command to perform post configuration tasks. For details, see Running the Offline Configuration Command in Installing and Configuring Oracle Identity and Access Management.
4. Start the WebLogic Admin Server, SOA Server, and OIG server.
5. Verify that you are able to log in to Oracle Identity Self Service or Oracle Identity System Administration.
6. Login to Oracle Enterprise Manager Fusion Middleware Control, and invoke the OIMSOAIntegrationMBean to integrate OIG with SOA. See Integrating Oracle Identity Governance with Oracle SOA Suite in Installing and Configuring Oracle Identity and Access Management.

After installing a new Oracle Identity Governance instance with Bundle Patch 12.2.1.4.240705, perform the following post installation configuration steps:

• Perform the following steps to seed the event handler for Application Onboarding:

  1. Go to, MW_HOME/idm/server/apps/oim.ear/APP-INF/lib/. 

  2. Locate BootStrapListener.jar. Copy the BootStrapListener.jar file to a temporary folder, for example temp_AoB. Extract the jar files and locate aob_adapters.xml file in the BootStrapListener.jar/scripts/ folder.

     Note:

     The jar file can be extracted using compression tool such as Zip,7–Zip or by using jar command jar -xvf .

  3. Copy the aob_adapters.xml file to a local folder.

  4. Using the Import option in Identity System Administration interface, import the aob_adapters.xml file into Oracle Identity Governance.

     For detailed steps for importing objects into Oracle Identity Governance, see Importing Deployments in Administering Oracle Identity Governance.

  5. Remove the temporary folder temp_AoB.

1. Stop Oracle Identity Governance Managed Server.
2. Login to WebLogic Administrative Console.
3. Click Lock & Edit.
4. Go to Deployments.
5. Select the oracle.iam.ui.view and oracle.iam.ui.model app, and click Update. Complete the steps of the wizard by clicking Next. Do not change anything.
6. Click Apply Changes.
7. Start Oracle Identity Governance Managed Server.

1. Perform the same verification steps and requirement checks that you made before applying the bundle patch. For example, backup the XML files and import them to a different location, verify the OUI Inventory and stop all services running from the ORACLE_HOME.
2. Move to the directory where the bundle patch was unzipped. For example:

   cd PATCH_TOP/36807639

3. Run OPatch as follows to remove the bundle patch:

   opatch rollback -id  36807639

4. Restore ORACLE_HOME and the WebLogic domain home.
5. Restore the Oracle Identity Governance database using the backup you created in Step 1 of Applying the Bundle Patch to an Existing Instance.

Track Request functionality will change after this Bundle Patch is applied.

When a user performs a search in Self Service tab, Track Requests page, and in the search result table, applies Show list option as For Reportees, all the requests raised by or for the logged in user and user's direct and indirect reportee are displayed.

As a fix for bug# 30978612 in the bundle patch, the new XL.APHarvesting.AllowAccountDataUpdate system property is available to update the account data with the policy defaults for the accounts linked to the access policies. This system property has the following details:

Name: XL.APHarvesting.AllowAccountDataUpdate

Keyword: XL.APHarvesting.AllowAccountDataUpdate

Default value: FALSE

When this system property is set to TRUE, the account data is updated with the policy defaults for the accounts linked to access policy. If set to FALSE or if the system property does not exist, the account data is not updated.

To enable updating the account data with the policy defaults for the accounts linked to the access policies, set the values of the XL.APHarvesting.AllowAccountDataUpdate, XL.AllowAPHarvesting, XL.APHarvestRequestAccount, XL.APHarvestDirectProvisionAccount, and XL.AllowAPBasedMultipleAccountProvisioning system properties to TRUE.

1. Before running the utility, perform the following steps
   1. Edit the oim_blkld_accounts.sh script, and add the following lines, and save the script.

      $MW_HOME/wlserver/server/lib/wlfullclient.jar
      $MW_HOME/oracle_common/modules/javax.management.j2ee.jar
      

   2. Generate wlfullclient.jar if it is not available in the MW_HOME/server/lib/ directory, and grant execute (755) permissions to the file.
2. Enter the MW_HOME directory or Press [Enter] to accept the default.
3. Enter the OIM_ORACLE_HOME directory or Press [Enter] to accept the default.
4. Enter the hostname on which OIG is running :

   It is mandatory that OIG is running on the same host.

5. Enter the port where OIG server is running :

   The default port is 14000.

6. Enter the path of OIM_HOME.
7. Enter the OIG system administrator user name.
8. Enter the OIG system administrator password.

If the bundle patch is applied after the OAM-OIG integration, then for the bug fix 31162758 to work, perform the following steps to map the Role attribute to the employeeType attribute:

1. Login to Oracle Identity Self Service.
2. Click the Manage tab, and then click the Applications box to open the Applications page.
3. Search for SSOTrusted-for-SSOTargetApp and open it.
4. Click the Schema tab.
5. Map Role to employeeType.
6. Save the changes.

If the bundle patch is applied to OIG before the integration with OAM, then the manual mapping of the attributes are not required.

1. Manually copy the contents of $PATCH_DIRECTORY/files/oracle.oim.server/12.2.1.4.0/oracle.oim.symbol/server/reports/oim_product_BIPReports_12c.zip/* directory to the $BI_DOMAIN_HOME/bidata/components/bipublisher/repository/Reports/ directory.
2. Restart the BI server.

For the bug fix 31605187 to work:

• If the bundle patch is applied after SSO integration, then the job parameter Incremental Recon Attribute value must be provided manually for the latest token value to get updated.

• If the bundle patch is applied before SSO integration, then manual steps are not required.

The following are the major enhancements in Oracle Identity Governance 12.2.1.4.240705:

• Refer to Default System Properties in Oracle Identity Governance for the new system property added.

The following are the major enhancements in Oracle Identity Governance 12.2.1.4.230408:

• To enhance the user experience, the UI option Manage Notification Template option is now available under the Oracle Identity Self Service which were earlier available under the System Administration section.

  For more information refer to Manage Notification Template.

• Admin users now have the capability to add, view or modify details for proxy users from the User Details page.

  For more information, see Managing Proxies.

• The option to disable the Close As Risk Accepted action is now available for any corresponding policy violation.

  For more information, see Creating Identity Audit Policies.

The following are the major enhancements in Oracle Identity Governance 12.2.1.4.221004:

• To enhance the user experience, the following UI options are now available under the Oracle Identity Self Service which were earlier available under the System Administration section.
  • Manage Scheduler
  • Manage System Properties

  For more information refer to Managing the Scheduler and Managing System Properties.

  Note:

  Refer to Scheduler and System Properties do not come up in the Integrated Environment.

• While configuring the Certification, you can now disable Accounts for the revoke action. For more information, see Configuring Certification Options

The following are the major enhancements in Oracle Identity Governance 12.2.1.4.211010:

• The Access Policy feature is enhanced to manage the evaluation of users in the Disabled status. See Evaluating Policies.
• The Account Chooser pop-up option is enhanced to display the Account Type along with the Account Name column while creating an Entitlement request. This helps users who access multiple accounts for the same application while requesting Entitlements.
• During certification to help reviewers for identifying the correct accounts, reviewers can use the Account Type option.
• The Resource History details of the Accounts section is enhanced to display the Entitlement Name and Request ID.
• Manual Fulfillment task, Accounts and Entitlement tabs under User Access UI are enhanced to display the Role Request ID.
• When users have entitlements provisioned outside of the Access Policies, a new option is provided which helps in keeping the account in the Active state. See Revoking or Disabling the Policy.
• The updateRoleGrant API of RoleManager is enhanced to start owner startDate and endDate attributes.
• The Reconciliation Jobs section of the Application Instance is enhanced with separate reconciliation jobs for defining and managing of the application instance during application on boarding. See Creating Application Instances.
• The Certification feature is enhanced to support mandatory certification comments on certify and non certify operations. The certification comments can also be mined from previous certifications and request justification. This helps the reviewer by providing better context about the access during certification. See About Pre-populate Certification Comments.

The following are the major enhancements in Oracle Identity Governance 12.2.1.4.210708:

• To improve the reset password performance in Active Directory (AD) integration, a new system property is available which needs to be set to True and the certificate from the AD target needs to be imported. See the following topics:

  • Default System Properties in Oracle Identity Governance
  • Improving Reset Password Performance on AD Integration

IP Filter (IPF) related updates are not part of the Oracle Identity Governance bundle patch release. For instructions on how to download and applying the IPF one-off bundle patch, see My Oracle Support document ID 2383246.1.

This bundle patch is certified with Microsoft Internet Explorer 11. To use Oracle Identity Governance with Internet Explorer 11, download and apply ADF patch 29620828 from My Oracle Support web site at:

https://support.oracle.com

For information about this patch, see Tech Note OIG 12c certification with IE11 browser (Doc ID 2556385.1) at My Oracle Support web site at:

https://support.oracle.com

As a fix for bug# 27599841, you can link access policies to accounts created by request and to accounts that are provisioned directly.

To enable linking access policies to accounts created by request, set the values of XL.APHarvestRequestAccount, XL.AllowAPHarvesting, and XL.AllowAPBasedMultipleAccountProvisioning system properties to TRUE.

To enable linking access policies to accounts that are provisioned directly, set the values of XL.APHarvestDirectProvisionAccount, XL.AllowAPHarvesting, and XL.AllowAPBasedMultipleAccountProvisioning system properties to TRUE.

The following section lists the issues resolved in Release 12.2.1.4.240705:

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.240705
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.240415
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.231215
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.231030
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.230708
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.230408
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.221215
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.221004
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.220703
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.220413
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.220115
• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.211010

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.210708

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.210428

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.210112

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.201011

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.200624

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.200505

• Resolved Issues in OIM BUNDLE PATCH 12.2.1.4.200206

Known issues and their workarounds in Oracle Identity Governance Release 12.2.1.4.0 are described in the Oracle Identity Governance chapter of the Release Notes for Oracle Identity Management document. You can access the Release Notes document in the Oracle Identity Management Documentation library at the following URL:

https://docs.oracle.com/en/middleware/idm/suite/12.2.1.4/idmrn/index.html

This section describes the issues and workarounds in this BP release of Oracle Identity Governance:

• Restoring the Role Membership after Deletion
• Members Tab in Admin Role Freezes While Searching
• Revoke Multiple Entitlements Using Rest API
• Adding Missing ObjectClasses With OID
• Entitlement Type Not Available for Certification Reports

• Errors Related to the For Reportees Feature

• Identity Self Service and Identity System Administration are Inaccessible After Upgrading OPatch Version

• Revoking Membership Does Not Work

• Upgrade Assistant Fails With StringIndexOutOfBoundsException

• Error on Running Bulk Load on ATP-D Setup

Once a Role associated with a Rule is removed using OIM UI (condition associated with the rule is still satisfied), running the scheduled job: “Refresh Role Membership” will not restore the user.

Issue:

The Members tab in the Admin Role freezes while you are trying to search for users and add them.

Resolution:

When this issue appears, the ADF patch 34247006 is required to resolve this issue.

While revoking multiple entitlements, a request gets created automatically if you use the REST client such as POSTMAN.

To view the request, navigate to Pending Approvals. If you approve the request without visiting the Pending Approvals section, the entitlements gets revoked. Select the specific request which opens the Request Details page.

An error, ORA-00911: invalid character is displayed and the entitlements are removed from the cart.

As a workaround for the bug 33541821, while running OIGOAMIntegration.sh for adding the missing ObjectClasses with OID *only*, if you encounter the following error Context Initialization Error, then re-run the command and add the missing objectClasses.

In this patch, the feature Entitlement Type is introduced. The Certification UI and the Certification report does not display Entitlement Type details.

While searching requests in the Track Request window, when using the Organization Name search criteria together with the "For Reportees" option, at least one reportee should be associated with the Organization Name that was used:

IAM-2053037 : An error occurred while searching for the reportees as the organization name is
      invalid or not associated with any reportee (This is EXPECTED). Atleast 1 direct reportee
      should belong to the org name

The total number of direct reportees and indirect reportees must not exceed 1000. If the number of reportees (direct and indirect) exceeds the value of 1000, then the following error message is displayed:

“IAM-2053036 : An error occurred while searching for the reportees as the reportee size exceeded the limit 1,200. Please retry with other search criteria”

After upgrading the OPatch version from 13.9.2.0.0 to 13.9.4.0.0, Identity Self Service and Identity System Administration cannot be accessed because of a mismatch in the versions of the com.oracle.cie.com*.jar file.

For more information about this issue and a workaround, see Tech Note OIM 12c: OIM Consoles Do Not Come Up After Upgrading OPatch Version From 13.9.2.0.0 to 13.9.4.0.0 Due to com.oracle.cie.com*.jar (Doc ID 2535244.1) at the My Oracle Support web site at:

https://support.oracle.com

As part of the bug fix for 31605168, the entitlements are now updated with new role names, but the revoking of membership is not working.

Running the Upgrade Assistant for upgrading Oracle Identity Manager 11g Release 2 (11.1.2.3.0) to Oracle Identity Governance 12c (12.2.1.4) fails with the following error:

[2020-04-14T16:03:48.087-04:00] [Framework] [ERROR] [] [upgrade.Framework] [tid: XX] [ecid: XXXX] [[
  java.lang.StringIndexOutOfBoundsException: String index out of range: -19
  at java.lang.String.substring(String.java:1967)
  at oracle.iam.oimupgrade.mrua.OIMMRUA.readiness(OIMMRUA.java:345)
  at oracle.ias.update.plugin.Plugin.readiness(Plugin.java:595)
  at oracle.ias.update.plan.PlanStep.readiness(PlanStep.java:730)
  at oracle.ias.update.PhaseProcessor$ReadinessProcessor.runStepPhase(PhaseProcessor.java:873)
  at oracle.ias.update.PhaseProcessor.runStep(PhaseProcessor.java:369)
  at oracle.ias.update.PhaseProcessor$ExtendedRunnable.run(PhaseProcessor.java:1058)
  at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
  at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
  at java.lang.Thread.run(Thread.java:748)
]]

The issue takes place during the MDS backup. The cause of the error is the MDS JDBC URL used, which is in the form:

jdbc:oracle:thin:@(DESCRIPTION=(LOAD_BALANCE=on)(ADDRESS=(PROTOCOL=TCP)(HOST=xxxx)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=xxxx)
      (PORT=1521))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=xxxx)(FAILOVER_MODE=(TYPE=select)(METHOD=basic))))

The upgrade tool does not expect complex URLs with something before the address field.

To workaround this issue, remove (LOAD_BALANCE=ON) from the JDBC URL.

When you run the Bulk Load utility on ATP-D by using wallet, the utility exits with the following error:

./oim_blkld_usr_load.sh: line 260: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 311: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 336: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 361: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 386: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 411: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 436: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 462: /home/opc/db18c/bin/sqlplus: Permission denied
./oim_blkld_usr_load.sh: line 486: /home/opc/db18c/bin/sqlplus: Permission denied

To workaround this issue:

1. Log in to Oracle WebLogic Administration Console as an administrator.

2. Click Services, Datasources.

3. Select the oimOperationsDB datasource.

4. Click Connection Pool, and check the URL value. It is similar to the following:

   jdbc:oracle:thin:@(DESCRIPTION=(CONNECT_TIMEOUT=120)(RETRY_COUNT=20)(RETRY_DELAY=3)(TRANSPORT_CONNECT_TIMEOUT=3)(ADDRESS_LIST=(LOAD_BALANCE=on)(ADDRESS=(PROTOCOL=TCP)(HOST=abc.example.com)(PORT=1521)))
   (CONNECT_DATA=(SERVICE_NAME=db.example.com)))

5. Use the hostname, port, and service name from the URL value to run the Bulk Load utility.

For more information, see the following resources:

• Oracle Fusion Middleware Documentation

  This contains documentation for all Oracle Fusion Middleware 12c products.

• Oracle Technology Network

  This site contains additional documentation that is not included as part of the documentation libraries.

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.