Watching $'s in JavaScript

Every time I write a script that uses repository constants, I always have trouble remembering how to pass their values properly.  Hopefully this posting will make me remember.

Both the "%" and "$" characters are used by JavaScript, so if the following code is encountered you will get an error:

var LDAP_SEARCHURL = "ldap://" + %$rep.LDAP_HOST% + ":" + %$rep.LDAP_PORT% + "/" + %$rep.LDAP_STARTING_POINT% + LDAP_SEARCH;

The dollar sign is used for calling a type of function and I believe the percent symbol is used for a mathematical operation. The solution is simple, just place the constants in quotes:

var LDAP_SEARCHURL = "ldap://" + "%$rep.LDAP_HOST%" + ":" + "%$rep.LDAP_PORT%" + "/" + "%$rep.LDAP_STARTING_POINT%" + LDAP_SEARCH;

It seems that IDM is smart enough to evaluate the value in the quotes and realize that the value is a repository constant and evaluate the value properly.

Fitting It Into the Schedule

This title applies to more than one aspect of my Identity Management life these days. I've been very busy which accounts for the lack of blog entries lately.  It's not that I don't have what to write about.  It's more about finding the time to do it.  

I was given an interesting challenge lately.  We have a number of tasks on the current project that only need to run once a month., which is not a frequency that is supported by the IDM scheduler. There's actually a few ways to handle this. Most of which revolve around finding the batch file that is created when job is first run and tying this into the scheduling utility of your choice.

However, I was really interested in finding a way that would work within the IDM framework. So I came up with this little script:

// Main function: scheduler

function scheduler(Par){

//Only run the task on a particular day of the month.

//Should only be called from the Initialization script of a maintenance job.

//Created by: Matt Pollicove 7/7/11

//NW IDM Functions used in this script:

//uStop();

//uGetPassSubject();

//uWarning();

//*****

//NOTE: Requires an external Job Constant called Runday that is set to the

//two digit day of the month that the task should be executed on or this value

//must be hard coded

//Parameters for the task.  Name of the pass/task and what the legal execution day is

var strJobName = uGetPassSubject();

var strRunOnThisDay = '%$runday%';

//What's today's date and what is the actual date.

var strDate = '%$ddm.date%';

var strToday = strDate.substring(3,5);

//Put it all together

if (strToday != strRunOnThisDay){

     uWarning(strJobName + " is not scheduleItd to run on " + strDate);

     uStop();

}         

}

As you can see, it's not terribly complicated, but let's break it down:

The task first grabs the name of the running task for informational purposes.  Then it goes out to find a local constant (feel free to make an adjustment so that it works with a repository or global constant) which holds the day of the month the task should run on.

Once we have this, we do basically the same day with the current date, by getting it from the system parameter %$ddm.date%, and retrieving the date part of the current month.

Then we can compare the two values. If they're equal go ahead, if not, we log a message (another thing that can be taken out if desired) and call uStop().

1. Now to use this functionality we need to do the following:
2. Copy/Paste the script listing above into a NW IDM script.
3. Create the RUNDAY constant.  Remember if you choose to create this as anything other than a job constant, you need to edit the script accordingly.
4. This script could be used in either a managed task (yellow folder section) or a work flow task (although I'm not sure why). But the script should be placed in the "Initialization script" entry on the source tab of the first pass in the job. When running as a managed task, it should be scheduled to run once every 24 hours.

That's about it.  Hope this works for you.  Please remember to share any edits or improvements.

The Tao of IDM

The best soldier does not attack. The superior fighter succeeds without violence. The greatest conqueror wins without struggle. The most successful manager leads without dictating. This is intelligent non aggressiveness. This is called the mastery of men. 

So why would I lead an Identity Management blog entry with a quote from the Tao Te Ching? Basically it sums up a recent issue I had in my current project.


As a part of this project, I am helping to get a young engineer familiar with IDM.  Working together we needed to create a query that would return only specific types of users for an IDM export Job.  I explained the basic process for executing the export and watched him work on various queries to return the correct users, while advising him about database structures and useful techniques. As an elaborate query began to take shape it was starting to look way too complicated.  I started thinking that there had to be a better way to accomplish our task.


Then I remembered that since we were doing a "To Database" task we could specify the Identity Store as the source and used the built in editor to build the correct query.  It took seconds to build and we quickly checked the query by doing a copy/paste to Microsoft SQL Server.  It worked perfectly and we were up and running.


Here's an example of the query that we created:

So what's the takeaway on this?  Look to see what the system can do rather than build something from the outside. At the very least, use the tools to build the query and then customize it (just remember that using an external query editor on the edited query make using the built in tool not work). 


And here's how easy it was to generate the query:

There's no need to reinvent the wheel

Time for a REST

Ok, now I really want to work with 7.2!

The REST interface is now available.  Using REST and JSON it is now possible for users to create their own interfaces.  Hopefully I'll be able to start learning more about this soon.

For more information look here: http://www.sdn.sap.com/irj/scn/weblogs?blog=/pub/wlg/24322

Warping Labels to Blank lines

Ahhh, to experience the joys of designing and implementing an Identity Management solution. It doesn't matter how many bugs you quash, what desired impossible functionality that you pull out of the hat, there's always that something more that's needed to make the project "Perfect." For me, as an old timer with MaXware Identity Center and now with SAP NetWeaver Identity Management, perfection lies in the user interface.

I love the fact that I don't have to know PHP to customize the UI with the migration to NetWeaver and that I can add in all kinds of neat things like tabs, lines and columns. However, I just wish that it would work a little better.

The biggest frustration I've had recently is how to get a blank line to appear in the UI. Sometimes a blank line just works better than putting in a horizontal line. Every now and then I would be able to get one to appear, but just not consistently. After a while, I began to determine some trends and after some testing I think I have the process down pat for including blank lines in the UI:

1. Create the label and put some text in it.
2. Apply the change. IDM Service restart via NetWeaver Administrator might be needed
3. Change the label text to some spaces.
4. Apply the change. IDM Service restart via NetWeaver Administrator might be needed

There you have it. I’ve found more often than not the first restart is not needed, but you just never know. As I’ve thought about what’s happening behind the scenes, my theory is that the system rejects a NULL value as a label, which is what you have when you create the label. After it’s been populated and then cleared, the value is no longer NULL. It is, however, empty and is represented that way in the UI. (Thanks also to my friends on the development team who commented on this as well)

To date, I’ve only been able to test this in NetWeaver Identity Management 7.1, SP5. I would be very interested to hear if this works in other 7.1 patch levels (it probably should) and in 7.2 (Can’t wait to get my hands on it!)

Personally, I think it would be better for all concerned if there was just a blank line object. Maybe next version…