Source: projects/identity-management/oim-kb-update/local-app/2026-04-27-oim-decompiled-method-event-evidence.md
> Source: projects/identity-management/oim-kb-update/local-app/2026-04-27-oim-decompiled-method-event-evidence.md
Goal
Use the local copy of the One Identity Manager application files under F:/Claude/agent-tools/oim to verify what methods and events are reachable after SQL creates HandleObject jobs through QBM_PJobCreate_HOCallMethod* and QBM_PJobCreate_HOFireEvent*.
Local Source
- Application root:
F:/Claude/agent-tools/oim/One Identity Manager - Decompiler:
F:/Claude/.tmp/tools/ilspycmd.exe - Decompiled output:
F:/Claude/.tmp/oim-decompiled - Assemblies inspected:
VI.DB.dllQER.Customizer.dllATT.Customizer.dllCommon.Customizer.dllADS.Customizer.dll
This is local reverse-engineering evidence for the installed application files. It should be used as implementation evidence for this sandbox/V10 file set, alongside live DB metadata and vendor documentation.
Key Findings
HandleObject CallMethod
VI.DB.Implementation.HandleObjectKernel confirms that the HandleObject CallMethod operation:
- reads
ObjectType,MethodName,WhereClause,Param1,Param2, and following numbered parameters from the job parameter set - loads the selected entities through the object layer
- resolves the named object/customizer method
- converts string parameters to target .NET parameter types where possible
- loads object/entity parameters by object key for
ISingleDbObjectorIEntitytarget parameters - saves when the method behavior or explicit
Saveparameter requires it
The runtime can resolve a method by name plus parameter count, or by a typed method signature in MethodName when parentheses are supplied. This is important for overloaded methods.
HandleObject FireEvent
VI.DB.Implementation.HandleObjectKernel confirms that the HandleObject FireEvent operation:
- reads
ObjectType,Eventname,WhereClause,StartTime, column values, and event parameter collection from the job parameters - loads matching entities read-only
- calls object-layer process generation for each entity and event
- adds
__StartTimeto the process parameters whenStartTimeis provided - commits the generated job chains through a unit of work
VI.DB.JobGeneration.JobGeneratorImpl shows that event generation looks for a generated script method named Event_<EventName>. If the generated method or chain assembly is missing, no process chain is created and the runtime logs/raises a warning. This means QBMEvent and JobEventGen are discovery and mapping metadata, but process generation still depends on the generated runtime script/chain availability.
PersonWantsOrg Methods and Events
QER.Customizer.PersonWantsOrg registers approval/request methods including:
Abort,AbortOrder,MakeDecision,EscalateUnsubscribe,DirectDecision,RecallDecision,CancelOrderSetDecisionStart,Prolongate,Reserve,ResetReservationQueryToPerson,AnswerFromPerson,RecallQueryFillOrder,Replace,Assign,Waiting,PrepareForMethodAddAdditional,RevokeAdditional,AddInsteadOf,DenyDecision,RevokeDelegationMakeDecisionOnInsertAsync,AddHistoryEntry
These methods are gated by the current PWO state machine (PwOFunction). A name existing in the customizer does not mean every PersonWantsOrg row can execute it. State, permission context, and method parameters still matter.
PersonWantsOrg registers the names from PwOEvents as custom-generated events. The enum includes core IT Shop approval events such as Granted, Dismissed, OrderGranted, OrderRefused, Aborted, Canceled, Escalate, Direct, Recall, AddAdditional, AddInsteadOf, Deny, RevokeDelegation, RecallQuery, and RevokeAdditional.
ITShopOrg and Product Methods
QER.Customizer.ITShopOrg registers hierarchy actions:
MoveProductNodefor product nodes (ITShopInfo = PR)MoveProductsMoveBoardfor shelves (ITShopInfo = BO)MoveShopfor shops (ITShopInfo = SH)DeleteBoardfor shelves (ITShopInfo = BO)
This reinforces the IT Shop structure finding: product nodes, shelves, shops, and customer nodes are different object states over the BaseTree/ITShopOrg shape, not interchangeable rows.
QER.Customizer.ITShopProductCustomizer registers RemoveFromITShop with SingleObject and ChangesExternalState behavior. The live DB also has DialogMethod assignments such as RemoveFromITShopBoards for entitlement tables. Treat these as object-layer operations that can change IT Shop assignment state.
Attestation Methods and Events
ATT.Customizer.AttestationCase registers custom-generated events:
Aborted,Escalate,CanceledAddAdditional,RevokeAdditional,AddInsteadOfDeny,Granted,Dismissed,OrderGranted,FinalDismissedQueryToPerson,AnswerFromPerson
It registers decision methods similar to IT Shop approval handling, including Reserve, ResetReservation, Abort, Escalate, CancelAttestation, MakeDecision, DirectDecision, RecallDecision, query/answer methods, delegation methods, and prolongation.
ATT.Customizer.AttestationPolicy and AttestationPolicyGroup register creation/preparation functions such as CreateAttestations, PrepareAttestations, and CompleteCasesUnderConstruction, with state guards and ChangesExternalState behavior. This matches shipped SQL calls that delegate attestation setup/completion from SQL into the object layer.
Conclusions
HOCallMethodshould be understood as "call an object-layer/customizer method in a job-service context." It is broader thanDialogMethod.DialogMethodis still useful for UI-visible actions, but non-UI customizer methods must be verified in decompiled customizer code, shipped SQL call sites, or vendor documentation.- For
PersonWantsOrgandAttestationCase, method validity is state-dependent. HOFireEventshould be validated as a(table, event)mapping plus active process-generation path. A string or catalog row alone is not enough proof that work will be generated.
Follow-up Experiments
- Correlate shipped SQL
HOCallMethodmethod names toDialogMethodrows and decompiledRegisterMethod/RegisterExtendedMethodregistrations. - Correlate shipped SQL
HOFireEventevent names toQBMEvent,JobEventGen, activeJobChain, and generatedEvent_<EventName>methods where accessible. - Decompile additional module customizer assemblies (
PAG,POL,RPS,SAP,TSB,UNS, and target-system modules) to expand the method map beyond IT Shop and attestation.