IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Problem using WSOrganizationalContainerService (ISIM 6.0 FP25)

    Posted 03/28/21 04:24 AM
    Hi,

    We are using ISIM web services quite a lot for user and role management and it works just fine. Now we need to control Organization Structure using WS as well and this is where we are failing. We are unable to create or modify any OU using web services. We are, however, able to delete it using WS. All our effort ends with an error CTGIMS009E You do not have the authority to perform this operation.

    Here are the conditions:

    Running clean install ISIM 6.0 with FP0025 (does not work on another ISIM with an older FP, neither)
    Using SoapUI for our tests
    Using ITIM manager account (so ACIs would not be resolved)
    All hidden attributes were removed during my tests, no change (https://www.ibm.com/support/pages/node/625743)
    6 hours of useless googling and debugging…

    Attached trace.log with the stack trace and also my request. The second file is just for info, I believe I have tried all available attributes combination for both createOU and modifyOU.

    Anyone having better luck in utilizing WSOrganizationalContainerService? I know I can modify LDAP objects directly but in this case, it is important to use a "clean" solution.

    Thanks,
    Pavel Koza

    ------------------------------
    Pavel Koza
    ------------------------------

    Attachment(s)

    txt
    modifyContainer.txt   2 KB 1 version
    log
    trace.log   12 KB 1 version


  • 2.  RE: Problem using WSOrganizationalContainerService (ISIM 6.0 FP25)

    Posted 03/28/21 09:34 AM
    Hi Pavel...

    I don't see any files attached...but here is what I've used to successfully create an OU against my ISIM 6 SOAP WS's, using SoapUI.

    <soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ser="http://services.ws.itim.ibm.com" xmlns:mod="http://model.ws.itim.ibm.com">
   <soapenv:Header/>
   <soapenv:Body>
      <ser:createContainer>
         <ser:session>
            <mod:clientSession>9pcLxA46kGwfuWFEh4hyXlJc5/nmxwTJrcKYLNlAC7wA7YLm3OlI7VA6XLmVmj9QPaAzUYww9oVk8EKa7ME7e5Zo5QJh06uqd0p0skD8vPzsALy8/1KSYL+a4CJ7I9f4hCbui4K/sPGPkiskMr7Z1KSwe6mR+SiwmYs6g2kTnDWnqqt6HrguFLIqkzzuy4VV75m+bWI8bOKwMbNkhEv4ydxj9adNVJZckK0F2DUInA3CdCkXGfxn1y7QbSCk2EefQOtev4PBb8UxmI74Us1OnoBGgBapjCk3EuQLMI/I72XpaBahKAEn8vhz93+WiHK7YUWe89uMTQQInDntOI7Lwqw5hnKCHt9DdDe78m6DKlMGJF8rXCR9iUlvywag/qu6ZQyqp8gfOK0UWiEa352YfJyPcrVJvWpi6CxudhrcGnAyA9mZmg+BqL3+tWQZAyb2PAIBRht2XX/giWnIr7waXQdNTSjsFr2id+doupCeWvujcMJnF0/KuAnerkwFmokdoVTNxW44Yz58luikVKPe/2msfzeKZj6yqC2ShQO6lKcuzfivTCCoT/iY5F2Hqxah47zHoYX3p3oU9Bs3oSz/AmyZHgN7gAVGaNeJxAOdoPs=</mod:clientSession>
            <mod:enforceChallengeResponse>?</mod:enforceChallengeResponse>
            <!--Optional:-->
            <mod:locale>
               <!--Optional:-->
               <mod:country>?</mod:country>
               <!--Optional:-->
               <mod:variant>?</mod:variant>
               <mod:language>?</mod:language>
            </mod:locale>
            <mod:sessionID>3208962761617959626</mod:sessionID>
         </ser:session>
         <ser:parent>
            <mod:attributes>
               <!--Zero or more repetitions:-->
               <ser:item>
                  <mod:name>?</mod:name>
                  <mod:operation>?</mod:operation>
                  <mod:values>
                     <!--Zero or more repetitions:-->
                     <ser:item>?</ser:item>
                  </mod:values>
                  <!--Optional:-->
                  <mod:isEncoded>false</mod:isEncoded>
               </ser:item>
            </mod:attributes>
            <mod:select>?</mod:select>
            <mod:name>?</mod:name>
            <mod:itimDN>erglobalid=00000000000000000000,ou=org,dc=com</mod:itimDN>
            <mod:children>
               <!--Zero or more repetitions:-->
               <ser:item/>
            </mod:children>
            <mod:parentDN>?</mod:parentDN>
            <mod:profileName>?</mod:profileName>
            <mod:supervisorDN>?</mod:supervisorDN>
         </ser:parent>
         <ser:newContainer>
            <mod:attributes>
               <!--Zero or more repetitions:-->
               <ser:item>
                  <mod:name>ou</mod:name>
                  <mod:operation>0</mod:operation>
                  <mod:values>
                     <!--Zero or more repetitions:-->
                     <ser:item>SOAPTESTOU</ser:item>
                  </mod:values>
                  <!--Optional:-->
                  <mod:isEncoded>false</mod:isEncoded>
               </ser:item>
            </mod:attributes>
            <mod:select>?</mod:select>
            <mod:name>?</mod:name>
            <mod:itimDN>?</mod:itimDN>
            <mod:children>
               <!--Zero or more repetitions:-->
               <ser:item/>
            </mod:children>
            <mod:parentDN>erglobalid=00000000000000000000,ou=org,DC=COM</mod:parentDN>
            <mod:profileName>organizationalunit</mod:profileName>
            <mod:supervisorDN>?</mod:supervisorDN>
         </ser:newContainer>
      </ser:createContainer>
   </soapenv:Body>
</soapenv:Envelope>​


    ------------------------------
    Grey Thrasher
    IBM
    ------------------------------



  • 3.  RE: Problem using WSOrganizationalContainerService (ISIM 6.0 FP25)

    Posted 03/28/21 11:45 AM

    Thank you very much, this worked!

     

    BR,

    Pavel

     




    Original Message


Related Content