Source: projects/identity-management/knowledge-base/oim-consolidated-knowledge-map.md

> Source: projects/identity-management/knowledge-base/oim-consolidated-knowledge-map.md

One Identity Manager Consolidated Knowledge Map

This page is the human-readable entry point for the One Identity Manager research in this workspace. It connects the findings from:

• live sandbox database research on OneIM V10;
• decompiled local application assemblies under F:/Claude/agent-tools/oim;
• the Web Portal/API Server project at C:/Dev/IdentityManager.Imx;
• MDK/SDK and shipped SQL files under C:/Dev/OneIdentityManager.10.0 and C:/Dev/OneIM10.0.0-MDK/MDK;
• local training documents and vendor release/configuration material.

Use this page as a map. Use the linked evidence notes for exact procedure text, query output, and generated indexes.

Source Priority

OneIM Processing Stack

Web Portal / Manager / API client
  -> API Server generated endpoint or object-layer call
  -> Object layer entity/customizer method or event
  -> DB write, object save, process generation, or method side effect
  -> SQL triggers and shipped procedures
  -> DBQueue task and/or JobQueue process
  -> Job Service / Database Agent Service
  -> target-system provisioning, recalculation, approval, notification, or sync side effect

The main research result is that OneIM work rarely belongs to just one layer. A visible action, such as submitting a cart, approving a request, publishing a group to IT Shop, or moving a product node, crosses multiple layers.

Core Runtime Concepts

Action-to-Method Map

This table is the practical bridge from "what action happened" to "what method/event/table is involved".

HandleObject Jobs from SQL

SQL cannot directly execute the object-layer logic that handles templates, customizer methods, scripts, and process generation. The QBM_PJobCreate* procedures are the bridge.

HOCallMethod

QBM_PJobCreate_HOCallMethod, _B, and _L create HandleObject CallMethod jobs.

Runtime behavior from VI.DB.dll:

1. Read ObjectType, MethodName, WhereClause, Param1, Param2, and additional numbered parameters.

2. Load matching entities through the object layer.

3. Resolve the named method by name/parameter count or typed signature.

4. Convert string job parameters to target .NET types where possible.

5. Load object/entity parameters by object key when needed.

6. Invoke the method and save if required by method behavior or explicit job parameters.

Important methods observed in shipped SQL/decompile evidence:

Rule: a method name existing is not enough. Check target table, row state, method enablement, parameter shape, and process context.

HOFireEvent

QBM_PJobCreate_HOFireEvent, _B, and _L create HandleObject FireEvent jobs.

Runtime behavior from VI.DB.dll:

1. Read ObjectType, Eventname, WhereClause, optional StartTime, and event parameters.

2. Load matching entities read-only.

3. Generate object-layer process chains for each entity/event.

4. Add __StartTime if supplied.

5. Commit generated job chains.

The event generator looks for generated event code like Event_<EventName>. So QBMEvent is discovery metadata, but execution also needs active JobEventGen, active JobChain, and generated event code.

Common event families:

DBQueue Processing

DBQueue is the database-side recalculation and post-processing framework. In V10/9.3+, the Database Agent Service controls processing and slot distribution.

Important version boundary:

• 9.3 revised Database Agent Service processing.
• Older training-slide assumptions about SQL Server Agent jobs and old slot-agent control must be treated as historical unless confirmed in V10.
• V10 still uses DialogDBQueue, QBMDBQueueCurrent, QBMDBQueueTask, QBMDBQueueTaskDepend, and QBMDBQueuePond.

Live V10 procedure signatures:

Usage footprint in V10 sandbox:

Negative slot numbers in V10 include more than older notes. Examples:

IT Shop Structure

ITShopOrg is not a base table. It is a view over BaseTree filtered by UID_OrgRoot='QER-V-ITShopOrg'.

Important constraints:

• Triggers validate that IT Shop nodes belong to the correct UID_OrgRoot.
• BO below BO is not the right model in this sandbox; use service categories and product metadata for grouping.
• AccProductInBaseTree exists but was empty in the sandbox. Actual product node availability was proven through BaseTree PR nodes and BaseTreeHas<EntitlementType> relations.

Making an Entitlement Requestable

The proven sandbox pattern for direct entitlement tables such as ADSGroup and LDAPGroup is:

Entitlement row exists from sync
  -> create/link AccProduct
  -> set entitlement.UID_AccProduct
  -> set entitlement.IsForITShop = 1
  -> keep IsITShopOnly depending on assignment policy
  -> insert BaseTreeHas<EntitlementType> link to a BO shelf
  -> DBQueue/ShoppingRack creates PR product node
  -> BaseTreeHas<EntitlementType> gains PR-node link too

For the sandbox AD and LDAP seeds, we intentionally used IsITShopOnly = 0 so direct assignment and IT Shop request paths can both be compared.

AD Group Publication Result

LDAP Group Publication Result

LDAP shelves:

Web Portal and API Server Findings

The Web Portal project under C:/Dev/IdentityManager.Imx/imxweb is an Angular/Nx frontend workspace. The backend API Server implementation is deployed separately; the frontend uses generated API clients.

Important generated endpoint correlations:

Confirmed runtime paths:

The controlled cart-submit trace proved:

• POST /portal/cartitem creates a cart item.
• POST /portal/cart/submit/{uidcart} validates and submits the cart.
• On success, cart item is consumed and PersonWantsOrg is inserted.
• The request receives a GenProcID.
• DialogProcess and JobQueue rows are created.
• Immediate JobQueue evidence showed VI.JobService.JobComponents.HandleObjectComponent / CallMethod.

Decompiled Method and Event Surface

Full decompile/index coverage:

High-value customizer findings:

Database Relation Index

The decompile index was joined with live DB metadata. The generated evidence index now connects:

• DialogMethod -> DialogObjectHasMethod -> DialogObject -> DialogTable;
• QBMEvent -> JobEventGen -> JobChain;
• SQL modules and triggers referencing QBM_PJobCreate*;
• extracted HOCallMethod and HOFireEvent calls;
• QBM_PDBQueueInsert_Single / _Bulk call sites;
• DBQueue task IDs linked to QBMDBQueueTask where the task is literal;
• Angular service/component usage -> generated API endpoints -> inferred DB/object concepts.

Relation counts:

Practical Troubleshooting Patterns

A product does not show in Web Portal

Check in this order:

1. Entitlement row exists and is not marked for deletion.

2. IsForITShop = 1.

3. UID_AccProduct points to a valid AccProduct.

4. AccProduct.IsInActive = 0.

5. AccProduct.IsToHideFromITShop = 0.

6. Entitlement has a BO shelf link in BaseTreeHas<type>.

7. Corresponding ITShopOrgHas<type> view sees the relation.

8. PR product node exists under the BO shelf.

9. There is also a PR-node BaseTreeHas<type> link after processing.

10. DBQueue has no stuck ShoppingRack/ProductNode tasks.

11. Portal requestability is checked for the current user and permissions, not globally.

A request action fails or does nothing

Check:

1. Was the action invoked through API/object layer or direct SQL?

2. Is the object in a state where the method is enabled?

3. Does DialogMethod expose it for the UI, or is it customizer-only?

4. If SQL used HOCallMethod, do parameter count/types match?

5. Does the method have ChangesExternalState, NeedsSaving, or state-machine guards?

6. Was a GenProcID generated and can it be followed into DialogProcess and JobQueue?

A fired event does not generate work

Check:

1. Does (DialogTable.TableName, QBMEvent.EventName) exist?

2. Does JobEventGen map it to a JobChain?

3. Is JobChain.NoGenerate = 0?

4. Is the chain or table deactivated by preprocessor?

5. Does generated runtime event code exist, typically Event_<EventName>?

6. Did the process generation context include required parameters?

DBQueue seems stuck

Check:

1. DialogDBQueue and QBMDBQueueCurrent for task/object/subobject.

2. Negative slot number and V10 meaning.

3. QBMDBQueueTask procedure and dependencies.

4. Whether synchronization is running for the same target system (-1 scenario).

5. Remaining JobQueue entries for the object (-3 scenario).

6. Runtime/deadlock/overload slots (-23, -24, -25).

7. Database Agent Service health.

Safe Implementation Rules for Agents

• Prefer API Server/object-layer actions for request, approval, attestation, and account-definition provisioning.
• Use direct DB DML only for controlled sandbox research or when no supported route is available, and always capture before/after snapshots.
• Do not create LDAP accounts directly for the LDAP Shop test; accounts should be provisioned by OneIM account definitions.
• Do not assume DialogMethod is complete. Cross-check decompiled customizer registrations for non-UI methods.
• Do not assume a QBMEvent row means process execution. Check JobEventGen, active JobChain, and generated event code.
• Do not model IT Shop shelves as nested BO under BO in this sandbox. Use categories and metadata instead.
• Do not use old 9.2.x DBQueue slot-control slides as V10 truth without confirmation.

Key Evidence Pages

Open Work

• Trace one approval action end-to-end like the cart-submit trace.
• Resolve variable method/event names in shipped SQL by parsing local variable assignments.
• Add backend Composition API class names for /portal/cart/submit/{uidcart} and approval endpoints.
• Build a GenProcID trace report that joins PersonWantsOrg, DialogProcess, DialogProcessStep, JobQueue, and JobHistory.
• Expand customizer method correlation to more modules (PAG, POL, RPS, SAP, TSB, UNS, target-system modules).
• Test LDAP account-definition provisioning and then compare direct membership import vs IT Shop assignment origin.