OIM 12c Adding new attribute to the User forms

Requirenment was to add a new attribute to the user create and upadate form. I have followed the following articale docs.oracle.com/en/middleware/idm/identity-governance/12.2.1.4/omadm/configuring-custom-attributes.html#GUID-A636EEE1-5DF8-48A4-AD9F-ADCDADA4289B section 6.3 Other changes to consider Make sure you are using collect Entities and Corresponding Data Components and View Objects 1. I have make mistake using wrong "Corresponding Data Components" for the attribute. it has different components for each page. 2. Make sure to enable Auto Save option check box otherwise you will to modify other propert before Submit button shows up 3. in order for the attribute send the information to OUD, you have to add this attribute to a correct connector. 4. Values will not be send to a Target application untill you run a schedule task "Form Upgrade Job".

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

error Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target and ERROR_oracle.iam.application.impl_CE,SSLHE,SCPBE,VE_S_TRACE,EXC_MSG.html @@@ See: https://mos-cores.us.oracle.com/collectionviewer/viewer.php/sr/3-289550132201/.dx/mw/ECA_AFP_1535_16123_clusters/ERROR_oracle.iam.application.impl_CE,SSLHE,SCPBE,VE_S_TRACE,EXC_MSG.html Solution. Applicaiton Certificate in your keystore is expired. when OAM is trying to decrypt the request, it is getting error. Find a command sot see the keystore, you will find a cert with expiration date. replace the expired cert with the keytool import and test again. Application will work. here is the command to import a new cert into keystore keytool -import -alias serverwl -trustcacerts -file supportcert.pem -keystore client_store.jks -storepass example_password

weblogic error cvc-elt.4.2: Cannot resolve 'query:AttributeQueryDescriptorType' to a type definition for element 'md:RoleDescriptor'.

Error while loading metadata to weblogic and getting error cvc-elt.4.2: Cannot resolve 'query:AttributeQueryDescriptorType' to a type definition for element 'md:RoleDescriptor'. Solution: Weblogic does not support RoleDescriptor you have to remove the whole section and load the new file, it should work from oracle This is EXPECTED because WLS does not support element 'RoleDescriptor' in IDP xml file.

OAM 12c as Federation Proxy unable to forward SP request to IDP

Application sending request to SP <----> OAM 12c(as a federation proxy) <----> IDP(forgerock) issue is when application is sending the request to OAM, it was unable to forward the request to IDP for authentication. actions we took 1. Run commands to enable OAM as a federation proxy. 2. Integrated OAM with another IDP 3. Run commands to forward requests coming from Application to external IDP. 4. User trying to login to Application and request is going to Federation Proxy(OAM) but it is not being forwarded to External IDP. 5. OAM was not forwarding request to the External IDP, it was on OAM login screen instead of IDP login screen. Solution: Issue was IDP authentication scheme(IDPFederationScheme) was not showing up on OAM. We have to run commands to add this scheme. wlst> domainRuntime() wlst> listPartnerProfileAuthnMethods("sp-partner-profile", "sp") You will not see IDPFederationScheme Make sure it does not list IDPFederationScheme wlst> addSPPartnerProfileAuthnMethod("sp-partner-profile", "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport", IDPFederationScheme) wlst> listPartnerProfileAuthnMethods("sp-partner-profile", "sp") Make sure it now lists IDPFederationScheme

Okta error Cannot disable the following factors because they are enabled in the following policies: SOFT_TOKEN or in the Default Policy policy. Please disable the factor(s) in the appropriate policies and try again.

When you try to delete the MFA you are getting below error Cannot disable the following factors because they are enabled in the following policies: SOFT_TOKEN in the Default Policy policy. Please disable the factor(s) in the appropriate policies and try again. or below error Cannot disable the following factors because they are enabled in the following policies: OKTA_SOFT_TOKEN in the Default Policy policy. Please disable the factor(s) in the appropriate policies and try again. Solution: 1. go to Factor Enrollment 2. Edit the Policy( default of whatever Policy you have configured). 3. Select Disabled from the Effective Factors. 4. go back to the Factor Type and select Deactivate. you have disabled the MFA Options

Salesforce developer account error "We can't log you in because of an issue with single sign-on. Contact your Salesforce admin for help."

Senario we have created developer account on salesforce and integrated with Okta, once i try to login with new user which is also on the Salesforce side i am getting below error We can't log you in because of an issue with single sign-on. Contact your Salesforce admin for help. Solutions: 1. make sure the user you have create on salesforce side has right role. If role type is Org Proxy User, it will not work. Change the type to any other type like Identity, salesforce or others 2. make Sure SAML is enabled at SalesForce side 3. replace metadata on Salesforce side with Okta metadata -- it will remove any spaces

deleting Salesforce Single Sign one setting

Under Administration Setup - Security Controls - Single Sign-On Settings, I need to turn off Federated Single Sign-On Using SAML. However, whenever I disable the SAML Enabled checkbox and click [Save], I get the following error: Error: Your organization or community is currently using SAML as an authentication method, so you can’t disable it. Solution: 1. go to "Single Sign-On Settings" 2. Click "Edit" 3. Uncheck "SAML Enabled" from "Federated Single Sign-On Using SAML" section 4. Now Click on the the Provider and delete If you logged in with the user you will get above error 1. on Search bar search for "My Domain" and go all the way down to "Authentication Configuration" 2. Edit the section 3. from "Authentication Service" remove the Provider you want to remove. 4. now go ""SAML Single Sign on Settings" and delete the provider