Configuration lookup, denoted as Lookup.CONNECTOR_NAME.Configuration, is the top level entry that refers to subordinate lookups for reconciliation and provisioning. The configuration lookup has the structure shown in Table 7-1:

This lookup contains the following keys:

• Before Create Action Language: This key if present in the Lookup.CONNECTOR_NAME.UM.Configuration, which informs ICF that there is a script whose language is the value of this key. The value of this key (Groovy/cmd ) informs the language of the script that needs to be executed by ICF before create operation.

• Before Create Action File: This key if present in the Lookup.CONNECTOR_NAME.UM.Configuration, informs ICF that a script represented by the value of this key needs to be executed by ICF before create action. This script must be accessible to Oracle Identity Manager Server.

• Before Create Action Target: This key if present in the Lookup.CONNECTOR_NAME.UM.Configuration, informs ICF that script as defined by previous two keys must be executed either on resource or on connector. Depending on this configuration the ICF API runScriptOnConnector or runScriptOnResource will be executed.

Table 7-2 describes the User Management lookup configuration.

The Java class performing transformation needs to have a method with the signature public Object transform(HashMap arg0, HashMap arg1, String arg2) implemented. ICF would look for this method with the exact signature.

Transform java class template is as follows:

public class MyTransformer implements oracle.iam.connectors.common.transform.Transformation {
  public Object transform(java.util.HashMap hmUserDetails, java.util.HashMap hmEntitlementDetails, String sField) {
    String sFirstName= (String)hmUserDetails.get("First Name");
    String sLastName= (String)hmUserDetails.get("Last Name");
    String sFullName=sFirstName+"."+sLastName;
    return sFullName;
  }
}

The name of lookup storing the Recon Transformation Lookup is defined in Main Configuration Lookup (Lookup.CONNECTOR_NAME.Configuration) as shown in Table 7-3.

The Java class performing validation needs to have a method with the signature public boolean validate (HashMap arg0, HashMap arg1, String arg2) implemented. ICF would look for this method with the exact signature.

The validation Java class template is as follows:

public class MyValidator implements oracle.iam.connectors.common.validate.Validator { 
  public boolean validate(java.util.HashMap hmUserDetails, java.util.HashMap hmEntitlementDetails,String sField) throws oracle.iam.connectors.common.ConnectorException {
    boolean isValid = false;
    // validation code goes HERE
    return isValid;
  }
}

The name of lookup storing the Recon Validation Lookup is defined in main configuration lookup (Lookup.CONNECTOR_NAME.Configuration) as shown in Table 7-4.

For example, trusted reconciliation requires a set of attributes from the connector to have a non-empty value. However, not all resources can supply all of these attribute types, so you need to provide some default values. Table 7-5 lists all required attributes for reconciliation, and possible default values for them.

If connector can supply all attributes needed in reconciliation, then this table becomes optional.

These are:

• Single valued attributes: simple string key + value pairs.

• Multivalued attributes (Child tables in Oracle Identity Manager): These are further divided by the depth of hierarchy:

  • Simple multivalued attributes: represent records of data stored in child table, see second row in Table 7-7.

  • Complex multivalued attributes: multiple levels of embedded objects, see last row in Table 7-7.

    Table 7-7 Provisioning Lookup Attributes

    Key	Value	Description
    Form Field Label	ConnectorAttributeName	This is a basic mapping type, simple Form Label Name to single value Connector Attribute Name
    Child Form Name>~<Child Form Field Label	ConnectorAttributeName	This maps child form field to multivalued ConnectorAttributeName
    Child Form Name>~<Child Form Field Label	ConnectorAttributeName>~<EmbeddedObjectClass>~<EmbeddedAttributeName	This maps child form field to EmbeddedAttribute of the embedded object, which object class is EmbeddedObjectClass and it is included in ConnectorAttributeName

In this case, you need to fill in the OBJECT_TYPE in the following examples:

• Main Configuration Lookup Lookup.CONNECTOR_NAME.Configuration

  Key	Value	Description
  objectType Configuration Lookup	Lookup.<ConnectorName>.<objectType>.ProvAttrMap
  Group Configuration Lookup	Lookup.LDAP.Group.ProvAttrMap	Example for LDAP Group

• Provisioning Lookup Lookup.CONNECTOR_NAME.OBJECT_TYPE.ProvAttrMap

  Key	Value	Description
  FORM_FIELD_LABEL_ON_THE_PROCESS_FORM	Target system attribute name	Attribute mapping between Oracle Identity Manager and the connector.

The following table lists the optional lookups for provisioning.

The following is a validation java class template:

public class MyValidator implements oracle.iam.connectors.common.validate.Validator { 
  public boolean validate(java.util.HashMap hmUserDetails, java.util.HashMap hmEntitlementDetails,String sField) throws oracle.iam.connectors.common.ConnectorException {
    boolean isValid = false;
    // validation code goes HERE
    return isValid;
  }
}

The name of lookup storing the Recon Validation Lookup is defined in Main Configuration Lookup (Lookup.CONNECTOR_NAME.Configuration).

Oracle Identity Manager form field of type lookup stores a set of predefined values. These values originate from the connector's search query. The Code Key Attribute is the form field's name, and the Decode Attribute is the name of attribute on the target system (also called Connector).

Internally, this task invokes a search operation on the connector for the given Object Type that is translated to ICF Object Class eventually.

Table 7-15 lists the filter syntax that you can use and the corresponding description and sample values.