To use a SOA composite as an approval process, it must adhere to certain standards. These standards ensure that the request service is able to instantiate and manage such composites correctly. These standards are:

• The following attributes are mandatory for BPEL process:

  • RequestID of type String

  • RequestModel of type String

  • RequestTarget of type String

  • URL of type String

  • RequesterDetails of XML Element

  • BeneficiaryDetails of XML Element

  • ObjectDetails of XML Element

  • OtherDetails of XML Element

  The RequestID, RequestModel, RequestTarget, and URL attributes are always set with valid values for all types of requests.

  RequesterDetails is an XML element. This element is filled up with valid values for all requests that requires authentication. Requester details is empty for the requests of type Self-Register User because the requester is anonymous user.

  BeneficiaryDetails is an XML element. This element is filled up with valid values for all requests that have a beneficiary, for example, Provision Resource and Assign Roles. This is filled up only if the request is associated with single beneficiary. If the request is associated with multiple beneficiaries, then BeneficiaryDetails is empty. BeneficiaryDetails element always has valid value for simple requests and child requests that have a beneficiary. Therefore, it is recommended to use this XML element in SOA composites that are used as approval processes at the operational level of approval. This is because at the operational level of approval, the request is associated with only one beneficiary.

  ObjectDetails is an XML element. This element is filled up with valid values for all requests that are associated with the Resource entity. This is filled up only if the request is associated with single resource. If the request is associated with multiple resources, then ObjectDetails is empty. The ObjectDetails element always has valid value for simple and child requests that are associated with resource. Therefore, it is recommended to use this XML element in SOA composites that are used as approval processes at the operational level of approval. This is because at the operational level of approval, the request is associated with only one resource.

• All the attributes that are mandatory for the BPEL process are referred from RequestDetails.xsd and ApprovalProcess.xsd. These files are present in the template SOA composite, which must not de modified or deleted.

1. Run the following commands:

   cd OIM_HOME/workflows/new-workflow
   ant -f new_project.xml
   

2. Enter the JDeveloper application name when the following prompt is displayed:

   Please enter application name

3. Enter the JDeveloper project name when the following prompt is displayed:

   Please enter project name

4. Enter the name of the ADF binding service for the composite when the following prompt is displayed:

   Please enter the service name for the composite. This needs to be unique across applications

   The new application is created in the OIM_HOME/workflows/new-workflow/process-template/ directory. You can open the new application in JDeveloper for modification.

   Human task in the template SOA composite is configured to send notifications to the assignee of the human task. In the custom composite that is created, the notification message can be modified based on the requirement. All the notifications to be sent to the approver must be configured in the SOA composite.

   Human task in the template SOA composite is configured to be assigned to the SYSTEM ADMINISTRATORS role.

1. Login to Oracle Identity System Administration.
2. Click Sandboxes to access sandbox management, create a sandbox, and activate it. SeeManaging Sandboxesfor information about sandboxes and how to create, activate, and publish sandboxes.
3. Under Configuration, click Application Instances. Click Create on the toolbar to open the Create Application Instance page.
4. Enter Name and Display Name as FinApp.
5. Select the Disconnected option to specify a disconnected application instance.
6. Click Save, and then click OK to confirm creation of the FinApp application instance.

1. Open the FinApp application instance details page, and click the Organizations tab.
2. Click Assign. In the Select Organizations dialog box, select one or more organizations to publish the application instance to.
3. Select the Hierarchy option if you want the application instance to be published to the organization and its child organizations.
4. Click OK.

1. Under System Management, click Scheduler.
2. Search for the Entitlement List scheduled job, and click Run Now.
3. Under Configuration, click Application Instances, and navigate to the FinApp application instance.
4. Click the Entitlements tab, and verify that the entitlements are displayed, as shown in Figure 13-2:

   Figure 13-2 Entitlements List

   
   Description of "Figure 13-2 Entitlements List"
5. Select an entitlement, and verify that it is published to the same organizations as the application instance, as shown in Figure 13-3:

   Figure 13-3 Entitlement Availability to Organizations

   
   Description of "Figure 13-3 Entitlement Availability to Organizations"
6. Edit one or more entitlements, and enter a business friendly description. If required, modify the display name as well.

1. Under System Management, click Scheduler.
2. Search for the Catalog Synchronization scheduled job, and click Run Now.

1. Set the JAVA_HOME, ANT_HOME, and PATH environment variables by running the setDomainEnv.sh script in the DOMAIN_HOME/bin/ directory.
2. Navigate to OIM_ORACLE_HOME/server/workflows/new_workflow.
3. Run the following command:

   ant -f new_project.xml
   

4. Provide the Application Name as AddAccessApprovalApplication.
5. Provide the Project Name as AddAccessApproval.
6. Provide the Service Name as AddAccess.
7. Wait for the utility to finish generating the new JDeveloper Workspace containing the Composite. The workspace is generated in /server/workflows/new-workflow/process-template.
8. Copy the directory to a location accessible to JDeveloper.

1. Switch to Design view of the BPEL process.
2. Drag the Invoke activity from the Component Palette and drop it below the AssignRequestWSURL activity. Rename it to InvokeRequestDetailsOperation.
3. Right-click InvokeRequestDetailsOperation, and select Edit.
4. Select partner link from the Partner Link Chooser as RequestWSPartnerLink, and operation as getRequestDetails, as shown in Figure 13-5.

   Figure 13-5 Partner Link and Operation

   
   Description of "Figure 13-5 Partner Link and Operation"
5. Under the Variables section, click the plus (+) icon for the Input and Output fields to create the input and output variables. Name the input and output variables as requestDetails_InputVariable and requestDetails_OutputVariable respectively. Then click Apply and OK.
6. Drag and drop an assign activity, rename it to AssignRequestInput, and place it above the InvokeRequestDetailsOperation invoke activity, as shown in Figure 13-6.

   Figure 13-6 AssignRequestInput

   
   Description of "Figure 13-6 AssignRequestInput"
7. Right-click AssignRequestInput, and select Edit to map the input of the InvokeRequestDetailsOperation, as shown in Figure 13-7.

   Figure 13-7 Input Mapping

   
   Description of "Figure 13-7 Input Mapping"
8. Add an Invoke activity after the InvokeRequestDetailsOperation, as shown in Figure 13-8. Name the activity InvokeCatalogOperation.

   Figure 13-8 InvokeCatalogOperation

   
   Description of "Figure 13-8 InvokeCatalogOperation"
9. Edit the InvokeCatalogOperation, and configure it as shown in Figure 13-9.

   Figure 13-9 InvokeCatalogOperation Configuration

   
   Description of "Figure 13-9 InvokeCatalogOperation Configuration"
10. Add an Assign activity above InvokeCatalogOperation, as shown in Figure 13-10. Name the activity as AssignCatalogInput.

    Figure 13-10 AssignCatalogInput

    
    Description of "Figure 13-10 AssignCatalogInput"

    Note:

    The following attributes will be returned as custom attributes through the catalog detail method of the request web service:

    • APPROVER_USER_FIRSTNAME

    • APPROVER_USER_LASTNAME

    • APPROVER_USER_DISPLAYNAME

    • APPROVER_USER_EMAIL

    • CERTIFIER_USER_FIRSTNAME

    • CERTIFIER_USER_LASTNAME

    • CERTIFIER_USER_DISPLAYNAME

    • CERTIFIER_USER_EMAIL

    • FULFILLMENT_USER_FIRSTNAME

    • FULFILLMENT_USER_LASTNAME

    • FULFILLMENT_USER_DISPLAYNAME

    • FULFILLMENT_USER_EMAIL

11. Right-click and edit the assign activity to map the input to the InvokeCatalogOperation, as shown in Figure 13-11.

    Figure 13-11 InvokeCatalogOperation Input Mapping

    
    Description of "Figure 13-11 InvokeCatalogOperation Input Mapping"

This section describes how to configure the Human Task. It consists of the following topics:

• Configuring the Parallel Human Task

• Properties of the Parallel Approval Task

• Configuring the Serial Approval Task

• Properties of the Serial Approval Task

• Configuring the Default Approval Task

Configuring the Human Task and BPEL mappings involves:

• Configuring the Serial Approval Human Task

• Configuring the Parallel Human Task

• Configuring Auto Approval

1. Select File, Save All to save your work.
2. Right-click the project, and select Deploy, COMPOSITE_NAME, Deploy to Application server. Alternatively, you can deploy to SAR (SOA Archive ), and then deploy it by using Oracle Enterprise Manager.

   Note:

   • The default version is 1.0. You can also change the version, if you have existing composite instances running.

   • If you are redeploying the composite and you have added or removed one or more human tasks, then it is recommended to deploy with a different version.

1. Login to Oracle Identity System Administration.
2. On the left navigation pane, under Workflows, click Approval.
3. Create a workflow rule for the Bulk Provision Application Instance operation, and set it to auto approve. See Configuring Approval Workflow Rules in Administering Oracle Identity Governance for information about creating and managing workflow rules.
4. Create a workflow rule for the Provision Application Instance operation, and specify that the composite you deployed will be invoked.

<ns12:CustomAttribute Name="ApproverRolePhoneNumber">
    <ns5:Value>1234</ns5:Value>
</ns12:CustomAttribute>
<ns12:CustomAttribute Name="ApproverRoleEmailId">
   <ns5:Value>approver@example.com</ns5:Value>
</ns12:CustomAttribute>

bpws:getVariableData('catalogDetails','CatalogData','/ns22:CatalogData/ns22:CustomAttribute[@Name = string("ApproverRolePhoneNumber")]/ns24:Value')

1. Right-click the RequestApprovalTaskDetails project, and select New, Java Class. Provide the following values:

   Name: RequestApprovalDetailsStateBean

   Package: oracle.iam.ui.custom.view.backing

2. Click OK.
3. Add the following code to the managed bean:

   package oracle.iam.ui.custom.view.backing;
    
   import javax.el.ELContext;
   import javax.el.ExpressionFactory;
   import javax.el.ValueExpression;
    
   import javax.faces.application.Application;
   import javax.faces.context.FacesContext;
    
   import oracle.iam.ui.platform.model.config.ConstantsDefinition;
    
    
   public class RequestApprovalDetailsStateBean implements java.io.Serializable{
       public RequestApprovalDetailsStateBean() {
           super();
       }
       
       private String requestAction = ConstantsDefinition.REQUEST_ACTION_APPROVAL_UPDATE;
       private String requestType = ConstantsDefinition.REQUEST_TYPE_VIEW_DETAIL;
       
       public void setRequestAction(String requestAction) {
           this.requestAction = requestAction;
       }
    
       public String getRequestAction() {
           return requestAction;
       }
    
       public void setRequestType(String requestType) {
           this.requestType = requestType;
       }
    
       public String getRequestType() {
           return requestType;
       }
       
       public String getUserIds() {
           Object benefDisplayName = getValueFromELExpression("#{bindings.DisplayName.inputValue}");
           //benefDisplayName would be "None" if beneficiary does not exist
           if (benefDisplayName != null &&             !ConstantsDefinition.NONE_BENEF_DISPLAY_NAME.equalsIgnoreCase(benefDisplayName.toString()))
               return benefDisplayName.toString();
           
           Object requestTarget = getValueFromELExpression("#{bindings.RequestTarget.inputValue}");
           if (requestTarget != null)
               return requestTarget.toString();
           
           return "";
       }
       
       private Object getValueFromELExpression(String expression) {
           FacesContext facesContext = FacesContext.getCurrentInstance();
           Application app = facesContext.getApplication();
           ExpressionFactory elFactory = app.getExpressionFactory();
           ELContext elContext = facesContext.getELContext();
           ValueExpression valueExp =
               elFactory.createValueExpression(elContext, expression,
                                               Object.class);
           return valueExp.getValue(elContext);
       }
       
       
   }
   

4. Open request-approval-details-tf.xml in Overview mode. Select Managed Beans sections and register the managed bean with the following details:

   Name: requestApprovalDetailsStateBean

   Class: oracle.iam.ui.custom.view.backing.RequestApprovalDetailsStateBean

   Scope: pageFlow

1. Open request-approval-details.jspx.
2. From the Component Palette, add a panelStretchLayout to the page. In the Property Inspector, set TopHeght==auto for panelStretchLayout.
3. Go to Data controls in Application Navigator. Expand RequestApprovalTaskDetails_ApprovalTask, getTaskDetails, Return. Drag and drop Task from Data Controls on to the Top Facet of panelStretchLayout, as shown in Figure 13-36. From the context menu, select Human Task, Task Action. The Human task actions are added to the Top Facet.

   Figure 13-36 Dragging Task to the Top Facet

   
   Description of "Figure 13-36 Dragging Task to the Top Facet"
4. From the Component Palette, add a panelTabbed layout to the Center Facet of panelStretchLayout.
5. From the Component Palette, add two showdetailItem components to the panelTabbed layout. From property inspector, set the text name for these components as Request Information and Task Information.
6. Click the Request Information tab. From the property inspector, set attribute stretchChildren=first.
7. Add another panelStretchLayout in Request Information tab. Set attribute topHeight=auto for this panelStretchLayout. Figure 13-37 shows the Request Information and Task Information tabs.

   Figure 13-37 The panelTabbed Layout

   
   Description of "Figure 13-37 The panelTabbed Layout"

1. Go to Navigator Display Options, and select Show Libraries, shown in Figure 13-38. This will show OIM View Shared Library in the Application Navigator.

   Figure 13-38 OIM View Shared Library

   
   Description of "Figure 13-38 OIM View Shared Library"
2. In the Application Navigator, expand OIM View Shared Library, WEB-INF/oracle/iam/ui/catalog/tfs. Drag and drop request-summary-information-tf.xml to the Top Facet of PanelStretchLayout added in step 7g. The Create context menu is displayed. Select Region.The Edit Task Flow Binding dialog box is displayed. You can provide parameters to the taskflow later. Therefore, click OK.
3. Similarly, drag and drop catalog-tf.xml to the Center Facet of PanelStretchLayout added in step 7g. The Create context menu is displayed. Select Region. The Edit Task Flow Binding dialog box is displayed. Click OK.
4. Click the Bindings tab at the bottom of the page to view the bindings. Click the plus (+) sign to add a binding in the following way:

   i) Enter the following and click OK:

   Category: Generic Bindings

   Item to be created: attributeValues

   ii) Click Add Datasource. Select RequestApprovalTaskDetails_ApprovalTask, getTaskDetails, Return, Task, Payload. Click OK.

   iii) Specify Attribute as RequestID, and click OK.

5. Under executables, select taskflow-requestsummaryinformationtf1. In the Property Inspector, add a taskflow parameter by clicking the plus (+) sign. Edit the value field, and update it with #{bindings.RequestID.inputValue}, as shown:

   ID=requestID, Value= #{bindings.RequestID.inputValue}

6. Click the plus (+) sign to add another binding. This binding will be referenced in RequestApprovalDetailsStateBean.

   i) Enter the following and click OK:

   Category: Generic Bindings

   Item to be created: attributeValues

   ii) Click Add Datasource. Select RequestApprovalTaskDetails_ApprovalTask, getTaskDetails, Return, Task, Payload, BeneficiaryDetails. Click OK.

   iii) Specify Attribute as DisplayName, and click OK.

7. Click the plus (+) sign to add another binding. This binding will be referenced in RequestApprovalDetailsStateBean.

   i) Enter the following and click OK:

   Category: Generic Bindings

   Item to be created: attributeValues

   ii) From the list, select datasource RequestApprovalTaskDetails_ApprovalTask, getTaskDetails, Return, Task, Payload.

   iii) Specifiy Attribute as RequestTarget, and click OK.

8. Select taskflow-catalogtf1 in Executables, click Edit on the top-right corner of Executables, and edit the values of the following in the Edit Task flow Binding dialog box:

   • Id=requestId, Value= #{bindings.RequestID.inputValue}

   • Id=requestType, Value=#{pageFlowScope.requestApprovalDetailsStateBean.requestType}

   • Id=requestAction, Value=#{pageFlowScope.requestApprovalDetailsStateBean.requestAction}

   • Id=userIds, Value=#{pageFlowScope.requestApprovalDetailsStateBean.userIds}

1. Switch to Design mode. Click the Task Information tab.
2. In the Application Navigator, go to Data Controls. Expand RequestApprovalTaskDetails_ApprovalTask, getTaskDetails, Return. Drag and drop Task in the Task Information tab. The Create context menu is displayed. Select Human Task, Complete Task without Payload, as shown in Figure 13-39.

   Figure 13-39 Task Details DataControl

   
   Description of "Figure 13-39 Task Details DataControl"
3. A panelHeader wrapped inside panelGroupLayout is added to the Task Information tab. Navigate to the panelHeader and delete the Toolbar Facet of the panelHeader. The task actions have already been in step 7c). In addition, task details, task history, comments, and attachments are also added to the Task Information tab.
4. Save your work.

1. Login to APM application as WebLogic user.
2. Navigate to Applications, OracleIdentityManager, Resource Types. Click Open.
3. Click New to create a new resource type. Provide following details, and then click Save.

   • Display Name: ADF Taskflows

   • Name: ADFTaskFlows

   • Actions: personalize, customize, grant, view. Click New to add each action.

   • Supports Resource Hierarchy: No

   • Resource Delimiter: Slash(/)

   • Evaluation Logic: Permission Class

   • Permission Class: oracle.adf.controller.security.TaskFlowPermission

   • Action Name Delimiter: Comma(,)

4. Navigate to Applications, OracleIdentityManager, Default Policy Domain, Resource Catalog, Resources. Click Open.
5. Click New to create a new resource. Provide the following values, and then click Save.

   • Resource Type: Select the resource type created in step 3.

   • Display Name: Provide a display name for your custom taskflow.

   • Name: Provide the name of the custom taskflow in the following format:

     TASKFLOW_DOCUMENT#TASKFLOW_ID
     

     For example:

     /WEB-INF/request-approval-details-tf.xml#request-approval-details-tf
     

   • Description: Provide a description for the custom taskflow.

   Note:

   For each custom taskflow, you must create a resource as mentioned in step 1(f). You can use the same resource type that you created in step 1(c) for all your custom taskflows.

6. Navigate to Applications, OracleIdentityManager, Default Policy Domain, Authorization Policies. Click Open.
7. Select Find By Principal, and click Search. If you want to add to a displayed existing policy, then select it and click Open. Otherwise, click New to create a policy.
8. Add name and principals for the new policy.
9. Click Add Targets (+) sign. The Search Targets dialog box is displayed.
10. Click the Resources tab. Provide the resource type as defined in step 5, and then click Search.
11. Select the resource created in step 5. Click Add Selected.
12. Click Add Targets. The resource is added to the Targets table.
13. Expand the resource that you added to the table. Select the permissions you want to apply to the taskflow. When finished, click Apply.

1. Login to Oracle Enterprise Manager as WebLogic user.
2. Navigate to Farm_IAM_DOMAIN, SOA, soa_infra (SOA_SERVER), default, DefaultRequestApproval [4.0].
3. Click Component Metrics, Approval Task.
4. Click the Administration tab.
5. Modify the URI in the existing entry to point to the custom taskflow, as shown:

   • Application Name: ANY_NAME

   • Host Name: OIM_SERVER_HOSTNAME

   • HTTP Port: OIM_HTTP_PORT

   • HTTPS Port: OIM_HTTPS_PORT (Optional)

   • URI: /identity/faces/adf.task-flow?_id=request-approval-details-tf&_document=WEB-INF/oracle/iam/ui/custom/request-approval-details-tf.xml

   Note:

   The URI is of the following format:

   /identity/faces/adf.task-flow?_id=TASKFLOW_ID&_document=TASKFLOW_DOCUMENT

You can use the RequestDataValidator plug-in to add custom validation of request data after submission. The plug-in point for this is the oracle.iam.request.plugins.RequestDataValidator interface with public void validate(RequestData requesterData) method.

You can define the dataset validators and prepopulation adatpers associated with the given plug-in. The request datasets associated with the plug-ins can be defined at the time of plug-in registration. The plugin.xml file is used to define the association between plug-ins and dataset validator or prepopulation adapters. The <metadata> node attached with the <plugins> element is used to define the association between data validators and prepopulation adapters.

The following example shows how the plug-ins can be associated with data validators and prepopulation adapters.

<?xml version="1.0" encoding="UTF-8"?>
<oimplugins xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <plugins pluginpoint="oracle.iam.request.plugins.RequestDataValidator">
     <plugin pluginclass= "oracle.iam.plugin.appinst.ApplicationInstanceDataValidator" version="1.0" name="AppInstDataValidator">
     <metadata name="DataValidator">
      <value>AppInstanceDataSet|ADAppDataSet|EBSDataSet</value>
   </metadata>
      </plugin>
  </plugins>
</oimplugins>

In this example, the following line of code indicates defining metadata xml element to indicate that the plug-in is associated with request data validator datasets:

<metadata name="DataValidator">

Note that Attribute name="DataValidator" in the metadata element indicates plug-in associated with request data validators.

Defining the names of the datasets to be associated with the current plug-in is indicated by the following line:

<value>AppInstanceDataSet|ADAppDataSet|EBSDataSet</value>

<plugin pluginclass= "oracle.iam.plugin.appinst.ADUserDataValidator" version="1.0" name="ADUserDataValidator">
<metadata name="DataValidator">
<value>ADUserAPACDataSet</value>
</metadata>
</plugin>

1. Edit plugin.xml of the ADUserDataValidator.
2. In the <metadata> <value> subtag, add the name of the new request dataset separated by a delimiter. For example:

   <value>ADUserAPACDataSet|ADUserEMEADataSet</value>
   

3. Re-register the data-validator plug-in.

Entitlement data provided as part of Provision Entitlement and Modify Entitlement request can be validated by creating a dataset validator plug-in and specifying the following in the plug-in metadata (plugin.xml):

<metadata name="DataValidator">
      <value>EBSForm.UD_EBS_RESP</value>
</metadata>

Here, EBSForm is the name of the form associated with the application instance on which the account is provisioned, and UD_EBS_RESP is the name of the child form corresponding to the entitlement. UD_EBS_RESP identifies the entitlement type.