text:
|Oracle® Fusion Middleware User's Guide for Oracle Identity Manager
11g Release 1 (11.1.1)
Part Number E14316-09
|PDF · Mobi · ePub
The architecture of Oracle Identity Manager provides a number of compelling technical benefits for deploying a provisioning solution as part of the identity and access management architecture.
Oracle Identity Manager platform automates access rights management, security, and provisioning of IT resources. Oracle Identity Manager connects users to resources and revokes and restricts unauthorized access to protect sensitive corporate information.
This chapter consists of the following sections:
How Oracle Identity Manager Works: The Tiers of Oracle Identity Manager
Oracle Identity Manager architecture is flexible and scalable, and provides the following features:
Oracle Identity Manager provides a flexible Deployment Manager utility to assist in the migration of integration and configuration information between environments. The utility exports integration and configuration information as XML files. These files are then imported into the destination environment, which can be staging or production. You can use the XML files to archive configurations and maintain versions, as well as replicate integrations.
The Deployment Manager provides you with the flexibility to select what to import and export. It also helps you to identify data object dependencies during both import and export steps. This flexibility enables you to merge integration work done by multiple people and to ensure the integrity of any migration.
You can deploy Oracle Identity Manager in single or multiple server instances. Multiple server instances provide optimal configuration options, supporting geographically dispersed users and resources for increased flexibility, performance, and control. The Java 2 Enterprise Edition (J2EE) application server model of Oracle Identity Manager also provides scalability, fault tolerance, redundancy, failover, and system load balancing. As deployments grow, moving from a single server to a multiserver implementation is a seamless operation.
To lower cost, minimize complexity, and leverage existing investments, Oracle Identity Manager is built on an open architecture. This allows Oracle Identity Manager to integrate with and leverage existing software and middleware already implemented within the IT infrastructure of an organization. For example, if an implementation requires integrating with an existing customer portal, then the advanced APIs of Oracle Identity Manager offer programmatic access to a comprehensive set of system functions. This allows IT staff to customize any part of its Oracle Identity Manager provisioning implementation to meet the specific needs of the organization.
Oracle Identity Manager enables you to define unlimited user organizational hierarchies and roles. It supports inheritance, customizable user ID policy management, password policy management, and user access policies that reflect customers' changing business needs. It also helps you to manage application parameters and entitlements, and to view a history of resource allocations. In addition, it provides delegated administration with comprehensive permission settings for user management.
Oracle Identity Manager contains a Web-based customizable Oracle Identity Manager Self Service that helps you extensively in user management.
Oracle Identity Manager contains a customizable Web-based, user self-service portal. This portal enables management of user information, changing and synchronizing passwords, resetting forgotten passwords, requesting available applications, reviewing and editing available entitlements, and initiating or reacting to workflow tasks.
Oracle Identity Manager is built on Java EE architecture. The J2EE application server model of Oracle Identity Manager provides scalability, fail over, load-balancing, and Web deployment. It is based on an open, standards-based technology and has a three-tier architecture (the client application, an Oracle Identity Manager supported J2EE-compliant Application Server, and an ANSI SQL-compliant database). Oracle Identity Manager can provision LDAP-enabled and non-LDAP-enabled applications.
Java EE is a standard, robust, scalable, and secure platform that forms the basis for many enterprise applications. Oracle Identity Manager runs on leading Java EE compliant application server platforms, including Oracle WebLogic, to take advantage of the performance and scalability features inherent in these servers. Java EE defines a set of standardized, modular components, provides a complete set of services to those components, and handles many details of the application behavior.
The application server, on which Oracle Identity Manager runs, provides the life-cycle management, security, deployment, and run-time services to the logical components that constitute the Oracle Identity Manager application. These services include:
Scalable management of resources through clustering and failover: A cluster in Java EE architecture is defined as a group of two or more Java EE compliant Web or application servers that cooperate with each other through transparent object replication mechanisms to ensure that each server in the group presents the same content. Each server or node in the cluster is identical in configuration and acts as a single virtual server. Any Java EE server in the cluster can handle client requests directed to this virtual server independently, which gives the impression of a single entity hosting the Java EE application in the cluster.
High availability refers to the capability to ensure that applications hosted in the middle tier remain consistently accessible and operational to the clients. This is achieved through the redundancy of multiple Web and application servers within the cluster, and is implemented by the failover mechanisms of the cluster. If an application component fails to process its task, then the cluster's failover mechanism reroutes the task and any supporting information to a copy of the object on another server to continue the task. Oracle Identity Manager supports a clustered environment. This includes ensuring that the EJBs and the Value Objects used to store data support serialization for the object replication to work.
Transaction management through load balancing: Load balancing refers to the capability to optimally partition inbound client processing requests across all the Java EE servers that constitute a cluster based on certain factors, such as capacity, availability, response time, current load, historical performance, and administrative priorities placed on the clustered servers. A load balancer, which can be based on software or hardware, sits between the Internet and the physical server cluster, acting as a virtual server. When each client request arrives, the load balancer decides how the Java EE server satisfies that request.
Security management: Oracle Identity Manager architecture relies on the application server for certain security services as part of its overall security infrastructure. In addition, Oracle Identity Manager leverages the Java EE security framework to provide a secure application environment. It also has a flexible permission model to provide control over the various functions within the application
Messaging: The basic concept behind messaging is that distributed applications can communicate by using a self-contained package of business data and routing headers. These packages are called messages. While RMI and HTTP rely on a two-way active communication between a client and a server, messaging relies on two or more interested parties communicating asynchronously through a messaging server without waiting for a response. Java Messaging Service (JMS) is a wrapper API incorporated in the J2EE standard as a way to standardize messaging functionality. All standard application servers provide their own JMS server implementations as a part of their service offerings.
Oracle Identity Manager incorporates leading industry standards. For example, Oracle Identity Manager components are fully based on a J2EE architecture, so customers can run them from within their standard application server environments. Complete J2EE support results in performance and scalability benefits while aligning with existing customer environments to leverage in-house expertise.
Oracle develops its identity management products on a foundation of current and emerging standards. For example, Oracle is a Management Board member of Liberty Alliance, and incorporates Liberty Alliance developments in its solutions. Oracle participates in the Provisioning Services Technical Committee (PSTC), which operates under the auspices of the Organization for the Advancement of Structured Information Standards (OASIS).
With Oracle Identity Manager, you can create business and provisioning process models in easy-to-use applications. Process models include support for approval workflows and escalations. You can track the progress of each provisioning event, including the current status of the event and error code support. Oracle Identity Manager supports complex, branching, and nested processes with data interchange and dependencies. The process flow is fully customizable and does not require programming.
Oracle Identity Manager enables you to package new processes, import and export existing ones, and move packages from one system to another.
Oracle Identity Manager is based on the n-tier J2EE application architecture. Oracle Identity Manager architecture contains the following tiers:
Figure 2-1 illustrates Oracle Identity Manager architecture.
Figure 2-1 Oracle Identity Manager Architecture
The Presentation tier consists of two clients, Oracle Identity Manager Administrative and User Console and Oracle Identity Manager Design Console.
Oracle Identity Manager Administrative and User Console is a Web-based thin client that can be accessed from any Web browser. This Web client provides user self-service and delegated administration features that serve most of the users of Oracle Identity Manager.
Oracle Identity Manager Design Console provides the full range of Oracle Identity Manager system configuration and development capabilities, including Form Designer, Workflow Designer, and the Adapter Factory. You can access Oracle Identity Manager Design Console by using a desktop Java client.
Oracle Identity Manager Design Console is implemented as a Java Swing client that communicates directly with the Business Services layer in the application. It also supports a highly sophisticated delegated administration model, guaranteeing that users can only work on those parts of the application configuration for which they are authorized.
See Also:
Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager and Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for details about using Oracle Identity Manager Administrative and User Console and Oracle Identity Manager Design Console
In many enterprises, there is a requirement for the provisioning system to support a custom developed client. Some of the requirements that drive this are:
Integration of the client into an existing enterprise portal and adherence to enterprise portal standards
Creation of custom flows for user interaction
Creation of custom pages built around unique requirements from the provisioning system
To support customization, Oracle Identity Manager exposes the bulk of the necessary functionality via its published public APIs. The client environment for Oracle Identity Manager is customizable via Java APIs.
The Business Services Tier is implemented as an Enterprise JavaBeans (EJB) application. The core functionality for Oracle Identity Manager platform is implemented in Java using a highly modular, object-oriented methodology. This makes Oracle Identity Manager flexible and extensible. The Business Services Tier for Oracle Identity Manager includes the following services and capabilities:
The Core Services that comprise the core of the business features offered by Oracle Identity Manager, such as the User Management Service, the Policy Management Services, and the Provisioning and Reconciliation Services.
The API Services that describe the APIs supported by Oracle Identity Manager that allow custom clients to integrate with Oracle Identity Manager. This includes a rich set of APIs that expose the business functionality of Oracle Identity Manager for use by custom clients, in product customization, and in plug-in and adapter development.
The Integration Services based on the Adapter Factory and Connector Framework, which dynamically generates integration code based on the metadata definition of the adapters.
The Platform Services that are crucial to the business features offered by Oracle Identity Manager, such as the Request Management Service, the Entity Manager Service, and the Scheduler Service.
The API Services describe the APIs supported by Oracle Identity Manager that allow custom clients to integrate with Oracle Identity Manager. This includes a rich set of APIs that expose the business functionality of Oracle Identity Manager for use by custom clients, in product customization, and in plug-in and adapter development.
The API Services consist of:
SPML APIs: Service Provisioning Markup Language (SPML) is a standard for managing the provisioning and allocation of identity information and system resources within and between organizations. Oracle Identity Manager supports a set of SPML-based Web services that expose identity administration functionality to the clients. The APIs provide support for:
Adding, modifying, and deleting identities
Adding, modifying, and deleting roles
Adding and deleting role memberships
These APIs support requests coming into Oracle Identity Manager for administration purposes, which is distinct and separate from SPML as the protocol used to integrate with provisioning targets.
EJB APIs: Highly granular access to the functionality of the platform is via a set of EJB. These session beans are the basis for functionality implemented in Oracle Identity Manager Web application clients. It is also the interface that custom clients can use to access Oracle Identity Manager capabilities.
A scalable and flexible integration architecture is critical for the successful deployment of provisioning solutions. Oracle Identity Manager offers an integration architecture for fast and low-cost deployments.
Oracle Identity Manager integration services provide all the components required to support the development, deployment, and maintenance of connectors. The integration services includes:
See Also:
"Integration Solutions" for details about how to define adapters by using the Adapter Factory.
Oracle Identity Manager connectors are packaged solutions that are used to integrate with target applications for the purposes of managing identities in those applications. Examples of such target applications are Microsoft Active Directory or Oracle E-Business Suite. A connector can be predefined by Oracle for particular target systems or can be custom developed.
Because a predefined connector is designed specifically for the target application, it offers the quickest integration method. These connectors support popular business applications such as Oracle eBusiness Suite, PeopleSoft, Siebel, JD Edward and SAP, as well as technology applications such as Active Directory, Java Directory Server, UNIX, databases, and RSA ClearTrust. Predefined connectors offer the quickest integration alternative because they are designed specifically for the target application. They use integration technologies recommended by target and are preconfigured with application specific attributes.
If predefined connectors does not use integration technologies recommended by target, then a custom connector can be developed. The Adapter Factory tool in Oracle Identity Manager Design Console provides a definitional user interface that facilitates such custom development efforts without coding or scripting.
A connector contains:
Multiple connector-specific Oracle Identity Manager entities such as resource objects, data forms, provisioning workflows, and adapters
Target-specific Java libraries that provide the underlying functions such as connectivity, authentication and user account management
Event triggers that wire provisioning operations to both identity profile changes and policy operations
The connector framework combines all of these components together into a functional connector that is run at appropriate times, either manually based on user interaction or based on system triggering. It defines the various operational triggers, policy triggers, and hooks that allow the connector operation to be tailored to specific requirements.
Connectors are deployed with Oracle Identity Manager, which affects the portability of the connectors across various Oracle Identity Manager releases. The Identity Connector Framework (ICF) decouples the connectors from Oracle Identity Manager. As a result, connectors can be used with any product. Identity connectors are designed to separate the implementation of an application from the dependencies of the system that the application is attempting to connect to.
Identity connectors have the following components:
The identity connector framework: Provides a container that separates the connector bundle from the application. The framework provides many common features that developers would otherwise need to implement on their own. For example, the framework can provide connection pooling, buffering, timeouts, and filtering. The identity connector framework is separated into two parts:
The API: Applications use the API to call connectors
The SPI: Developers can create connectors by implementing the SPI
Identity connector bundle: The specific implementation for a given resource target
The connector server (optional): Allows an application to remotely run one or more connector bundles that are deployed on another system. Connector servers are available in both Java™ and .NET. The .NET connector server is needed only if you are using .NET connector bundles, whereas the Java connector server is available for connector bundles written in Java.
Figure 2-2 shows the ICF architecture:
Figure 2-2 ICF Architecture
Connector SPI
Connector SPI interfaces represent operations supported on a connector. A connector developer can choose to implement one or more operation interfaces for framing target system calls. Extension on existing interfaces or creating new interfaces is not supported. The SPI is broken up into required interfaces, feature-based interfaces, and operation interfaces such as create, update, delete, and search.
The required interfaces include the org.identityconnectors.framework.spi.Connector interface and the org.identityconnectors.framework.spi.Configuration interface. These interfaces must be implemented in order for the API to understand which class contains the implementation of the configuration and which contains the implementation of the operations.
The feature-based interfaces are the org.identityconnectors.framework.spi.AttributeNormalizer and org.identityconnectors.framework.spi.PoolableConnector interfaces.
The operation interfaces determine the features that the connector supports such as create, delete, or search. See Oracle Fusion Middleware Java API Reference for Oracle Identity Manager for details.
For information about developing an identity connector by implementing connector SPI, see "Identity Connector Framework" in the Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager.
Connector API
The connector API is responsible for presenting a consistent view of a connector regardless of the operations it has implemented. For the convenience of the SPI developer, there are several common features that are provided by default. For most of these features there is no need for the application developer to handle the APIs, only configure them. Following is a list of API features:
Provide connection pooling to those connectors that require it and avoid the need for the API to see it, because not all connectors have connections. In addition, if the connector uses connection pooling, it is not the responsibility of the API developer to handle the connections, nor dispose of them during error conditions.
Provide timeouts to all operations. The API consumer should only configure the appropriate timeout if the default is unacceptable. Each SPI developer should not have to implement such a common service and, for this reason, it is implemented in the framework.
Provide search filtering by way of a simple interface that accepts a large variety of filters. The connector developer only needs to implement whichever filters the resource natively supports. The rest is handled by the framework.
Provide search/sync buffering, allowing queries and updates to be handled in chunks if need be. The application need not worry about this, as it is handled within the framework.
Provide scripting via Groovy and Boo .NET for connectors. This allows for great flexibility within a connector, because the framework can run scripts both on the connector and on the target resource (if supported).
The SPI developer has the ability to choose different implementations of an operation. For instance there are two types of updates. This is hidden from the API consumer because there is no need for the application developer to call two different operations that essentially do the same thing. Instead the framework will figure out which operation the connector supports and make the appropriate calls.
The Adapter Factory is a code-generation tool provided by Oracle Identity Manager. It enables an Oracle Identity Manager application developer to create Java classes, known as adapters.
A resource has an associated provisioning process, which in turn has various tasks associated with it. Each task in turn has an adapter associated to it, which in turn can connect to the target resource to carry out the required operations.
An adapter provides the following benefits:
It extends the internal logic and functionality of Oracle Identity Manager.
It interfaces with any software resource by connecting to that resource with the help of the API of the resource.
It enables the integration between Oracle Identity Manager and an external system.
It can be generated without manually writing code.
It can be maintained easily because all the definitions for the adapter are stored in a repository. This repository can be edited through a GUI.
A user in Oracle Identity Manager can retain the domain knowledge about the integration, while another user can maintain the adapter.
It can be modified and upgraded.
The Adapter Factory provides rapid integration with commercial or custom systems. Users can create or modify integrations by using the graphical user interface of the Adapter Factory, without programming or scripting. When connectors are created, Oracle Identity Manager repository maintains the definitions and creates self-documenting views. You use these views to extend, maintain, and upgrade connectors.
See Also:
"Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager" for details about how to define adapters by using the Adapter Factory
Predefined Oracle Identity Manager connectors are designed for commonly used target systems such as Microsoft Active Directory and PeopleSoft Enterprise Applications. The architecture of a predefined connector is based on either the APIs that the target system supports or the data repository type and schema in which the target system stores user data.The use of a predefined connector is the recommended integration method when such a connector is available for the target system. However, in some instances you might want to integrate Oracle Identity Manager with a target system that has no corresponding predefined connector. For example, XYZ Travels Inc. owns a custom Web-based application that its customers use to request airline fare quotes. Agents, who are also employees of XYZ Travels, respond to these requests by using the same application. Customers register themselves to create accounts in this application. However, XYZ Travels employees need to have accounts auto-provisioned based on their HR job title. Account management functions, such as create, update, and delete, of the application are available through Java APIs. There is no predefined connector available to integrate the custom application with Oracle Identity Manager. Therefore, you must create the custom connectors that call the Java APIs exposed by the target application.
To integrate Oracle Identity Manager with a target system that has no corresponding predefined connector, you can create a custom connector to link the target system and Oracle Identity Manager. If you do not need the customization features of the Adapter Factory, then you can create the connector by using the Generic Technology Connector (GTC) feature of Oracle Identity Manager.
You can quickly and easily build a basic connector without advanced features and customized behavior by using generic connectivity technologies such as SPML and JDBC. GTC is a wizard that provides an alternative environment for connector development to rapidly create all the necessary functional components that make up a target system connector in Oracle Identity Manager.
The reconciliation and provisioning modules of a generic technology connector are composed of reusable components that you select. Each component performs a specific function during provisioning or reconciliation. These components that constitute a generic technology connector are called providers. Each provider performs a transport, format change, validation, or transformation function on the data that it receives as input. In other words, data items processed by a provider are moved to a new location, validated against specified criteria, or undergo modification in structure or value. Data sets describe data structures arranged in the form of layers, with data flowing from one layer to another during provisioning and reconciliation.
The GTC employs a Web-based graphical wizard that displays the data flows being defined within the connector. It stores in metadata all the configuration information about the connector so that it can reload the GTC view of the connector and enable ongoing maintenance of the connector in the same graphical environment. Because the GTC builds the connector by using the standard connector framework, the application developer can access the standard Oracle Identity Manager development environment and make further modifications to the generated connector. However, after the GTC-based connector has been customized in this manner, it can no longer be managed or maintained using the GTC.
See Also:
"Generic Technology Connectors" for detailed information about the functional architecture and features of GTC
When your adapter uses Java tasks, you must configure Oracle Identity Manager to find the appropriate Java APIs. The Java APIs are located in JAR files in the Meta Data Store (MDS). Sometimes, instead of directly communicating with the third-party system, Oracle Identity Manager must use an Oracle Identity Manager component that acts like a proxy. This component is known as Remote Manager. The Remote Manager is used for:
Invoking nonremotable APIs through Oracle Identity Manager
Invoking APIs that do not support Secure Sockets Layer (SSL) over secure connections
The Remote Manager is an Oracle Identity Manager server component that runs on a target system computer. It provides the network and security layer required to integrate with applications that do not have network-aware APIs or do not provide security. It is built as a lightweight Remote Method Invocation (RMI) server. The communication protocol is RMI tunneled through Hypertext Transfer Protocol/Secure (HTTP/S).
The J2EE RMI framework enables the creation of virtually transparent, distributed services and applications. RMI-based applications consist of Java objects making method calls to one another, regardless of their location. This enables one Java object to call methods on another Java object residing on another virtual computer in the same manner in which methods are called on a Java object residing on the same virtual computer.
Figure 2-3 shows an overview of the Remote Manager architecture.
Figure 2-3 Remote Manager Architecture
See Also:
"Installing and Configuring a Remote Manager" for information about the Remote Manager and its configuration in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager.
The Platform Services include:
Oracle Identity Manager architecture includes a request service that allows you to configure approval workflows. To deliver this functionality, Oracle Identity Manager uses Oracle Service Oriented Architecture (SOA) Suite.
Oracle SOA Suite enables you to build service-oriented applications and deploy them to your choice of middleware platform. It consists of a number of components, but for the purposes of delivering comprehensive workflow capabilities, Oracle Identity Manager relies on the following components:
BPEL Process Manager: Oracle BPEL Process Manager provides a comprehensive solution for creating, deploying, and managing cross-application business processes with both automated and human workflow steps. It also provides audit trails for both completed and running processes, and process history that enables process improvement.
Human Request Service: Although the BPEL standard does not cover manual tasks, it supports asynchronous services. Therefore, the Oracle SOA Suite supports the Human Request Service, which is a manual task service, so that manual steps can be included in standard BPEL processes. Oracle Identity Manager Administration and User Console includes a task list that allows users to view and interact with assigned tasks being managed within the Human Request Service.
BPEL Designer: The Oracle BPEL Designer is available as a plug-in for JDeveloper and offers a visual design paradigm for creating and deploying BPEL-based processes.
Oracle Identity Manager provides an abstraction service on top of the SOA suite that optimizes and simplifies the interaction of users with the SOA suite. This service includes capabilities to register BPEL composites for use in Oracle Identity Manager, define parameterized variables for use in the BPEL and Human Workflow modules, and APIs that are used by the task list and custom development.
See Also:
"Approval Workflows" in Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for information about workflows and BPEL composites.
The Request Service also provides the services used to raise and track requests in Oracle Identity Manager. A request allows a user to ask that an action be taken after obtaining the necessary approvals, and that a tracking record of the entire process and its status be maintained. The request can be for various types of actions that are defined as request types. The request types can be:
Creating, modifying, or deleting an entity
Enabling or disabling an entity
Provisioning a resource to a user or a set of users
Adding or removing an identity as a member of a role
The request service supports various types of requests and has the ability to accommodate multiple request types. Oracle Identity Manager provides a number of predefined request types that cover the most common use cases. The request service also provides support for request templates, that allow you to customize the request types for a specific requirement.
The request service defines the flow models by which data provided in a request flows through the various services in Oracle Identity Manager. This includes invoking approval workflows at the correct time, monitoring the status of the workflows, and running the request if approval is received.
Both transaction data and history data for requests is maintained, which supports audit and compliance requirements.
See Also:
"Managing Requests"" for information about creating requests and perform request-related operations in the task list of Oracle Identity Manager Self Service
Oracle Identity Manager is a security product and requires a strong level of access control over what users can view and change in the application. To meet this requirement, Oracle Identity Manager lets you define authorization policies that determine at run time whether or not a particular action is allowed. This is controlled by the authorization service that uses Oracle Entitlements Server (OES) embedded within Oracle Identity Manager. OES is an authorization product and enables centralized management of entitlements and authorization policies to granularly determine access to both application components and application business objects.
The OES architecture is made up of two major components. The administration application acts as the policy administration point (PAP) and is used to manage policy, configuration, roles, and entitlements. The second major component is the use of one or more Security Modules (SMs) that are stored in the application container. The SMs evaluate fine-grain access control polices at the policy decision point (PDP) and enforce it at the policy enforcement point (PEP).
Figure 2-4 shows the architecture of OES-based authorization service:
Figure 2-4 OES-Based Authorization Service
Each time a privilege check is requested, the following takes place:
Oracle Identity Manager connects to the authorization service to prepare access decision for the operations performed on protected entities.
The service then finds and evaluates the policy or policies that apply to the resource.
All information required to evaluate a policy is collected by the Security Modules at run time.
If the policy references subject by role, all roles are evaluated and the access decision is made.
Oracle Identity Manager provides an abstraction service on top of OES that optimizes and simplifies the definition of policies in Oracle Identity Manager. This service includes a policy definition UI that allows the definition of authorization policies that are feature specific and support fine-grained controls for attributes and functions on entities such as users and roles. For information about the structural components of authorization policies and how to create and manage authorization policies, refer "Creating and Managing Authorization Policies".
The Plug-in Framework allows customers to easily extend and customize the capabilities of the out-of-the-box Oracle Identity Manager features. The features expose specific plug-in points in the business logic where extensibility can be provided. An interface definition accompanies each such point and is called the plug-in interface. Customers can create code that extends these plug-in interfaces and defines customizations based on their business needs. These plug-ins are deployed and registered with Oracle Identity Manager by using the Plug-in Manager. Oracle Identity Manager then incorporates the plug-ins into the feature processing from that point onward.
Feature developers do not have to keep a track of where the custom implementations are stored and how they are loaded. The plug-in framework supports loading plug-ins from the classpath, from the file system, and from the database.
See Also:
"Developing Plug-ins" in the Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for more information about the plug-in framework
An attempt to enforce good compliance practices is through the definition of Segregation of Duties (SoD) policies. SoD is broadly defined as a way of preventing a user from acquiring a conflicting set of entitlements. This conflicting set is also referred to as a toxic combination. An example of a toxic combination is that a person should not have the ability to create and approve the same purchase order. Enterprises often have business application-specific SoD engines that define and enforce SoD policies on the entitlements users have within those business applications. Examples of such SoD engines are OAACG and SAP GRC.
The SoD Engine Framework allows customers to integrate Oracle Identity Manager with their choice of SoD Engine to enable SoD checks at appropriate points in the request and provisioning process. Oracle Identity Manager can send a request for an SoD check to the SoD Engine through the SoD Invocation Library (SIL). SIL provides a common service interface to all supported SoD engines. The common service interface provides an abstraction on the business components within Oracle Identity Manager. As a result, SoD checks do not have to take care of the correct data formats required by the SoD Engine and also the interpretation of the results returned.
SoD checks can be run at various times in the provisioning lifecycle, such as during an access request, during the approval workflow execution, or during the provisioning execution. If a violation is detected, then the request or resource is marked as being in violation, and the approver or administrator is responsible for deciding whether to proceed or not. If violations are detected during request processing, then various approval workflows can be invoked that allow for higher levels of approval.
See Also:
Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for information about SoD
Business systems frequently make use of scheduling systems, which are configured to run other programs at specified times. Scheduling systems run applications that generate reports, reformat data, or perform audits at regular intervals of time. Scheduling systems often run batch jobs or scheduled jobs that perform routine work automatically at a prescribed time.Scheduling systems are an integral part of any enterprise provisioning solution. Provisioning often involves tasks to be performed in a time-based manner. Some examples are:
Running a nightly job to reconcile all changes made directly on a managed application
Do escalations of assigned tasks that have not been handled within a specified time period
Execute requests at a specific time
Oracle Identity Manager platform includes the Scheduler to provide the scheduling capabilities necessary for enterprise provisioning requirements. This Service is managed as part of Oracle Identity Manager platform and not as an independent product. Figure 2-5 provides an overview of Oracle Identity Manager Scheduler architecture.
Figure 2-5 Oracle Identity Manager Scheduler Architecture
Key capabilities provided by the Scheduler service are:
The ability to create simple or complex schedules for running thousands of jobs
The ability to run the scheduling service as a clustered service to provide the necessary high availability capabilities including fail-over and load balancing
The ability to persist the job definitions for management and fail-over support
The ability to create, modify, enable, disable, and delete jobs and manage individual job runs by using an administrative UI
The ability to run a job in an ad-hoc fashion outside of regularly scheduled runs
The ability to manage errors and failures
The ability to maintain history of job runs, including statistics and results of these runs
The ability to manage the Scheduler service itself
See Also:
"Managing Scheduled Tasks" chapter detailed information about the Scheduler service and creating and implementing custom scheduled tasks in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager
Oracle Identity Manager is driven by data and metadata, which provides flexibility and adaptability to Oracle Identity Manager functionalities. Oracle Identity Manager data tier consists of Oracle Identity Manager repository or database, which manages and stores Oracle Identity Manager data and metadata in an ANSI SQL 92-compliant relational database, and an optional LDAP Identity Store.
This section describes the data tier in the following topics:
Oracle Identity Manager repository is the authoritative store for the Who Has What, When, How, and Why data that is the core value of the identity administration and provisioning system. The data stored in Oracle Identity Manager database falls into the following broad categories:
Entity Data: Users, organizations, roles, role memberships, resources, provisioned resources
Transactional Data: Requests, approval and provisioning workflow instances, human tasks
Audit Data: Request history, user profile history
High Availability
The database provides a scalable and redundant data layer to avoid downtime and performance issues. Reliability, recoverability, timely error detection, and continuous operations are primary characteristics of a highly available solution.
Oracle Identity Manager architecture relies on the corresponding capabilities provided by the Database Management System that is used with the product. These capabilities must:
Encompass redundancy across all components
Provide protection and tolerance from computer failures, storage failures, human errors, data corruption, lost writes, system hangs or slowdown, and site disasters
Recover from outages as quickly and transparently as possible
Provide solutions to eliminate or reduce planned downtime
Provide consistent high performance
Be easy to deploy, manage, and scale
Achieve Service Level Agreements (SLAs) at the lowest possible total cost of ownership
A broad range of high availability and business continuity solutions are available. You can find out more about maximizing database availability by using technologies such as Oracle Real Application Clusters (Oracle RAC) and Oracle Data Guard at the following Web site:
The rich set of data stored in Oracle Identity Manager repository can be viewed through detailed reports that support management and compliance requirements. Oracle Identity Manager provides support for data reporting through the use of Oracle BI Publisher, which is an enterprise reporting solution and provides a single reporting environment to author, manage, and deliver all of your reports and business documents. Utilizing a set of familiar desktop tools, such as Microsoft Word, Microsoft Excel, or Adobe Acrobat, you can create and maintain report layouts based on data from diverse sources, including Oracle Identity Management products.
Oracle Identity Manager provides a set of standard Oracle BI Publisher report templates. However, you can customize each template to change its look and feel. in addition, you can create your own custom reports by leveraging Oracle Identity Manager database schema.
The logic underlying Oracle Identity Manager is metadata driven. The structural and behavioral aspects are described by using metadata. Oracle Identity Manager architecture relies on Oracle Metadata Services (MDS) to provide a unified store for metadata. This ensures consistent and reliable access to the metadata for Oracle Identity Manager and for the other Fusion Middleware components that it is built on. The same metadata that is used during the design phase of an application is used at application runtime through the metadata services layer. This ensures consistency through the lifecycle of Oracle Identity Manager. MDS also provides common administrative tooling for the metadata that can be used across various types of metadata stored in the common repository.
Key features and architectural principles of the MDS include:
Simplified resource management through a single, unified repository for all artifacts used by various Fusion Middleware components
Management of the metadata lifecycle for each artifact as it moves through the various stages of development, testing, staging, and production
Sharing and reuse of metadata across components
Categorization and reuse of artifacts, encouraging reuse, and promoting consistency
Versioning capabilities, which form the basis for various features
An upgrade-safe and layered customization mechanism through which metadata and application logic can be tailored per usage of the metadata
Advanced caching and assembling techniques coupled with configurable tuning options to optimize performance
Metadata accessed and managed via MDS can be in a file-based repository or a database-based repository. In Oracle Identity Manager architecture, the metadata is in Oracle Identity Manager database to take advantage of some of the advanced performance and availability features that this mode provides.
Oracle Identity Manager 11g Release 1 (11.1.1) provides the ability to integrate an LDAP-based identity store into Oracle Identity Manager architecture. In 9.x releases, Oracle Identity Manager identity store is in Oracle Identity Manager database. Therefore, Oracle Identity Manager integrates with LDAP as a provisioning target, or you can build custom integration between Oracle Identity Manager users and LDAP users. However, in 11g Release 1 (11.1.1), you can connect and manage an LDAP-based identity store directly from Oracle Identity Manager. Using this feature, you can use advanced user management capabilities of Oracle Identity Manager, including request-based creation and management of identities, to manage the identities within the corporate identity store.
In this deployment architecture, user identity information is stored in Oracle Identity Manager database to support the relational functionality necessary for Oracle Identity Manager to function, as well as in the LDAP store. All data is kept in sync transparently without the need for provisioning actions and setting up policies and rules. Identity operations started within Oracle Identity Manager, such as user creation or modification, are run on both the stores in a manner that maintains transactional integrity. In addition, any changes in the LDAP store made outside of Oracle Identity Manager is pulled into Oracle Identity Manager and made available as a part of the identity context.
See Also:
"Integration Between LDAP Identity Store and Oracle Identity Manager" for more information about LDAP store integration and configuration
Oracle Identity Manager is built on an enterprise-class, modular architecture that is both open and scalable. Each module plays a critical role in the overall functionality of the system. Figure 2-6 illustrates the system components of Oracle Identity Manager.
Figure 2-6 System Components of Oracle Identity Manager
Oracle Identity Manager user interfaces define and administer the provisioning environment. Oracle Identity Manager offers two user interfaces to satisfy both administrator and user requirements:
Powerful Java-based Oracle Identity Manager Design Console for developers and system administrators
Web-based Administration and Oracle Identity Manager Self Service interfaces for identity administrators and users respectively
This section describes the following Oracle Identity Manager components:
Identity Administration
Identity administration includes creation and management of identities in Oracle Identity Manager. Identities include users, organizations, and roles. Identity administration also enables password management and user Oracle Identity Manager Self Service operations. Identity administration is performed by using Oracle Identity Manager Administration and Oracle Identity Manager Self Service Web clients, and the SPML Web service.
The identity administration tasks include, managing users, managing roles, managing organizations and managing authorization policies, which are explained in detail in this guide.
The provisioning transactions are assembled and modified in the provisioning module. This module maintains the "who" and "what" of provisioning. User profiles, access policies, and resources are defined in the provisioning module, as are business process workflows and business rules.
The Provisioning Server is the run-time engine for Oracle Identity Manager. It runs the provisioning process transactions as defined through Oracle Identity Manager Administration and Oracle Identity Manager Design Console and maintained within the provisioning module.
Audit and Reports
The audit and compliance functions include evaluating a person, organization, system, process, project, or product. This occurs by capturing data generated by the suite's workflow, policy, and reconciliation engines. By combining this data with identity data, an enterprise has all the information it requires to address any identity and to access a related audit inquiry. Audits are performed to ascertain the validity and reliability of information, and also provide an assessment of a system's internal control.
Reporting is the process of generating a formal document, which is created as a result of an audit. The report is subsequently provided to a user, such as an individual, a group of persons, a company, a government, or even the general public, as an assurance service so that the user can make decisions, based on the results of the audit. An enterprise can create reports on both the history and the current state of its provisioning environment. Some captured identity data includes user identity profile history, role membership history, user resource access, and fine-grained entitlement history.
Reconciliation and Bulk Load
The reconciliation engine ensures consistency between the provisioning environment of Oracle Identity Manager and Oracle Identity Manager managed resources within the organization. The reconciliation engine discovers illegal accounts created outside Oracle Identity Manager. The reconciliation engine also synchronizes business roles located inside and outside the provisioning system to ensure consistency.
See Also:
"Reconciliation Configuration" for detailed information about reconciliation
"Managing Reconciliation Events" for information about managing reconciliation events in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager
If you want to load a large amount of data from other repositories in your organization into Oracle Identity Manager, then you can use the Bulk Load utility. The Bulk Load utility reduces the downtime in loading the data. In addition, Bulk Load utility import Oracle Identity Manager users, roles, role memberships, and accounts provisioned to users.
See Also:
"Bulk Load Utility" in the Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for detailed information about Bulk Load utility
Common Services
Various services are grouped together that are shared and used by other Oracle Identity Manager components. These services are:
Form Designer: A form that allows you to create process and resource object forms that do not come packaged with Oracle Identity Manager. See "Form Designer Form" in the Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager for detailed information about the Form Designer.
Scheduler: A service that provides the capability to run specific jobs at specific schedules. This service can be used by users, application developers, connector developer, and administrators to create and configure a Job to be run at specified intervals. In addition, this service provides administrative capabilities to manage the functionality of jobs and their schedules. See the "Managing Scheduled Tasks" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information.
Notification Templates: A common notification service is used by other functional components to send notifications to interested parties about events occurring in Oracle Identity Manager. In addition, this service provides the administrative capabilities for notification template management. A notification template is used for sending the outgoing notifications. These templates typically contain the variables that refer to the available data to provide more contextual content. See the "Creating and Managing Notification Templates" chapter for more information.
System Properties: A system property is an entity that controls the configuration aspect of an application. In addition, to the default system properties, you can create and manage system properties in Oracle Identity Manager. See the "Administering System Properties" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information.
Deployment Manager: The Deployment Manager is a tool for exporting and importing Oracle Identity Manager configurations. The Deployment Manager enables you to export the objects that make up your Oracle Identity Manager configuration. See "Importing and Exporting Data Using the Deployment Manager" chapter in the Oracle Fusion Middleware Administrator's Guide for Oracle Identity Manager for more information.
Workflow and Request Management
Various operations in Oracle Identity Manager cannot be performed directly. Instead, the operations must be requested. The request management service provides a mechanism to create, approve, and manage requests. A request is an entity created by the users or administrators who want to perform a specific action, which requires a discretionary permission to be obtained from someone or some process before the action can be performed. For example, a user can create a request to gain access to a laptop computer, a manager can approve the request and create an open requisition, and an IT resource administrator can approve the request.
The primary goal of a provisioning solution is to manage requests and provision resources. Request service provides an abstraction layer on the Business Process Execution Language (BPEL) 11g workflow engine. Functional components such as request, provisioning, and attestation interacts with the workflow engine for human approvals. Request service caters to the various functional components in Oracle Identity Manager by managing workflow instances and categories, and provides an abstraction layer on BPEL. For information about registering workflows with Oracle Identity Manager, see, Oracle Fusion Middleware Developer's Guide for Oracle Identity Manager.
Infrastructure and Middleware Integration
The Adapter Factory, Kernel Orchestration mechanism, Context Manager, and Plug-in Framework are designed to eliminate the need for hard-coding integrations with these systems.
For more information about the integration of Oracle Identity Manager with middleware applications, see "Integration Solutions".
Connector Framework
A description of the Connector Framework is provided in the "Integration Services".


text:
Save while supplies last!
Disorders of the Auditory System covers both classic as well as new disorders of the auditory system and reflects the combined efforts of renowned audiologists and otologists. Perhaps for the first time, both the audiological and medical aspects of auditory dysfunction associated with disorders of the peripheral and central auditory system will be covered in one text.
This book provides numerous insightful case studies that will provide informative reading for professionals in the fields of audiology, otology and neurology.
ASHA offers these products as a convenience. Inclusion in ASHA promotional material does not imply ASHA endorsement of any publisher, author, product, program, viewpoint, or technique. Prices are subject to change.
Site Help | A—Z Topic Index | Privacy Notice | Terms of Use
© 1997-? American Speech-Language-Hearing Association

subset: commoncrawl


text:
(AP) — A published report says Metra has spent more than $250,000 through June to cover legal fees.
The Chicago Sun-Times says the embattled transit agency has hired three outside law firms, along with a mediator and a crisis strategy firm.
The newspaper says the figures come from heavily redacted documents it obtained through the Freedom of Information Act.
Metra's been embroiled in legal problems since ousted CEO Alex Clifford left with a $718,000 separation agreement. He's said he was forced out of the agency for resisting pressure from House Speaker Michael Madigan and others over jobs and construction contracts.
That's sparked a state investigation.
At least one Illinois lawmaker says the legal fees, which began accumulating in early March, are an abuse of taxpayer money.


text:
Why should eclectic music be forced to confirm to society's standards of "big cities" and "predictable venues"?
That seems to be the thinking behind Mumford and Sons' "Gentlemen of the Road Stopover" events, during which the English folk act will appear with a varied group of artists (including St. Vincent, Gogol Bordello, Dawes and more) in locations that don't usually house major concert events.
The "local" date stops Aug. 18 at Page Park in Dixon, Ill., with tickets ($59-$69) on sale 10 a.m. Saturday, June 9. See below for full dates, locations and lineups. Says the band, in a press release: "The Gentlemen of the Road Stopover is based loosely upon our favorite festivals like Colorado's Telluride Bluegrass and Scotland's Loopallu Festivals. We want to stop off in towns where bands don't usually tour, and celebrate the local people, food and music. We're keen to promote the town's local businesses, and we'll be using the local bars and venues for after-show parties, whilst working closely with the local people to get everyone involved in making these shows spectacular. There will be a host of our friends playing too, and the vibe falls somewhere between 'travelling Victorian circus' and 'Victorian travelling circus'. It should be a whole lot of fun."
You heading down to Dixon?
Gentlemen of the Road Stopovers
August 4 – Gentlemen of the Road Stopover In Portland, ME (The Eastern Promenade) – Mumford & Sons + St. Vincent, Dawes, The Maccabees, Apache Relay, Simone Felice, Haim
August 11 – Gentlemen of the Road Stopover In Bristol, VA/TN (Off State Street in Downtown Bristol) – Mumford & Sons + Dawes, JEFF The Brotherhood, The Very Best, Justin Townes Earle, Apache Relay, Simone Felice, Haim
August 18 – Gentlemen of the Road Stopover In Dixon, IL (Page Park) – Mumford & Sons + Gogol Bordello, Dawes, Abigail Washburn, The Very Best, Apache Relay, Haim
August 25 – Gentlemen of the Road Stopover In Monterey, CA (Monterey County Fairgrounds) – Mumford & Sons + Gogol Bordello, The Very Best, Grouplove, Two Gallants, Apache Relay, Haim


text:
KidsWalk and Other Fun At ArtWalk San Diego With Kids!
Attending ArtWalk San Diego with kids can be really fun, but it helps to have some tips prior to doing so. We love this FREE yearly event, and have been going with our kids for many years. It's a great opportunity to visit Little Italy, and introduce the littles to some culture.
[Read more…]


text:
Documents are defined as being findings or data resulting from a project. They may take the form of publications, posters, presentations, images, videos, maps or webpages. Documents appear on this page when they are In Press or Published.
Copies and copyright relating to publications. Like any publication, copyright conditions apply:
Abstracts - Abstracts are available free of charge from publishers' websites. Click on the document title in the table below to display more information, including the abstract URL (View webpage) link in the Bibliography Entry table on the right hand side of a publication's webpage.
Full or pdf versions - In some cases, access is only available by subscription or copies may be obtained by contacting the author (email links are usually included in abstracts) or see our People page for a listing of researchers. Some publications are Open Access and free to download without subscription.
Enquiries: firstname.lastname@example.com
Information Sheets
Also check out our Information sheets page for fact sheets and guides
Latest reports published by projects


text:
A bold presence
Our sporty sedan certainly stood out workshop, but it wasn't until we got it on the road that we really saw the full impact of the design.
Premium comfort
Every detail reflects our passion for refinement—Swedish minimalism made to enhance your driving experience.
Our Innovation Brands
Everything we do is designed around people, so every innovation we make is designed to simplify and improve your life. We're especially proud of our advances in efficient power, connectivity and safety. We call our thinking in these areas: Drive-E, Sensus and IntelliSafe.


text:
Story courtesy CharlotteHounds.com
CHARLOTTE, N.C. - Major League Lacrosse today
announced its weekly award winners for Week 11 of the 2013
season, naming Charlotte Hounds goalie Adam
Ghitelman the Warrior Defensive Player of the Week. The
winners are chosen by the league's front office and are based on
outstanding in-game achievements. In addition to Ghitelman's
honor, the MLL named the Chesapeake Bayhawks' Casey
Powell Warrior Offensive Player of the Week and Ohio
Machine midfielder Logan Schuss Cascade Rookie of
the Week.
Ghitelman on Saturday afternoon helped lead the Hounds to a 13-11 win over the New York Lizards in front of the home crowd at American Legion Memorial Stadium. The captain faced 21 shots and his 12 saves were split evenly between the first and second halves to anchor the victory. Ghitelman also had five groundballs and provided quick outlet passes, allowing the Hounds to capitalize on multiple transition goals, highlighted by four points from long-pole defenders. The Hounds built up an 11-3 lead at the break before allowing the Lizards to sneak back into the game with four fourth-quarter goals, including a 2-pointer. But the defense tightened up and Ghitelman held the Lizards scoreless for the final 4:04 to improve the team to 5-6 on the season and remain in the hunt for a playoff spot.
Through 10 games this season, Ghitelman has posted a 12.43 goals against average and a .486 save percentage. He becomes the third Hounds player to be honored by the league with a weekly award. Mike Sawyer was named Cascade Rookie of the Week following Week 4 action, while Matt Danowski earned Offensive Player of the Week honors at the conclusion of Week 8.
The Hounds this weekend travel to Columbus for a rematch with the Ohio Machine. The teams first met Week 6 in Charlotte, when the Hounds came away with a 13-7 victory. The game will begin at 7:00pm ET and be televised in the Charlotte area on WMYT-12 as well as be available for streaming nationally through ESPN3.com.


text:
Our team is dedicated to putting our experience and local knowledge to work for you in all steps of your real estate transaction, from start to finish. Find out why the Elaine Pippi Team is one of the most respected teams for buying and selling in Alberta.
We deliver the very best in service and experience in real estate, because you deserve no less.
Compare your home to others in your neighborhood, Calculate your Mortgage, and find a Lender.Get Started!
When it comes to convenience, our site is unparalleled. Whether you're in the comfort of your home, or on the go, our site works flawlessly on multiple devices so you can find the information you need.Search Homes
#201, 811 - Manning Rd. NE Calgary, AB, Canada T2E 7L4Contact Us


text:
Die manufacturing
Tebis provides specific process solutions in die manufacturing that enable you to quickly and flexibly deliver the necessary results for every customer application. You can standardize and highly automate your NC program generation. You can also use powerful CAD functions to reduce manual reworking in tryout and keep unnecessary correction grinding to a minimum. All subprocesses can be easily combined thanks to the Job Manager and process libraries. Tebis solutions such as the small parts process can also be used in combination with an MES.
- Springback compensation
- Reverse engineering
- Die surfaces
- NC large parts prismatic
- NC large parts: Freeform
- NC small parts
- Small parts plus


text:
(photo credit – Aphasia Community Group)
In 2000 I produced a program called "Faces of Aphasia," which was held at Boston University. It aimed a spotlight on aphasia and the Aphasia Community Group of Boston. Now beginning its 24th year, the Group is one of the oldest support groups of its kind.
"Faces of Aphasia" introduced aphasia to the community through the performing arts. It featured the first public performance by acclaimed mezzo soprano Jan Curtis following her stroke. Actor/playwright Joseph Chaikin performed "Struck Dumb," a monologue on the inner thoughts of an aphasic individual. "The Other Voices of Aphasia," an original piece by group co-founder Judy Blatt, was performed by family members. A staged reading of "Night Sky" by Susan Yankowitz, a play about aphasia, was performed by individuals living with aphasia. It was filmed and used as a teaching tool in communication disorders graduate programs.
Inspired by "Faces of Aphasia," Emmy Award winning filmmaker Vincent Straggas and I created the documentary "after words 2003," which premiered in Boston in June, 2003. It featured vivid portraits of members of the Aphasia Community Group as well as internationally acclaimed celebrities such as Tony Award winner Julie Harris, Academy Award winner Patricia Neal, Grammy Award winner Bobby McFerrin, Robert McFerrin, and Annie Glenn Award winner Jan Curtis, all of whose lives were touched by aphasia and related disorders. "after words 2003" opened to wide acclaim and was embraced by the public and in academic, rehabilitation, community, and medical settings.
A new documentary, based on the original film, and comprised of new portraits and interviews has been produced and is currently airing on public television stations around the country. Co-produced by me, Vincent Straggas, ASHA fellow and executive director of the National Aphasia Association Ellayne Ganzfried, the new "after words" features neurologists, authors and clinicians including Nancy Helm Estabrooks, Ellayne Ganzfried, Jerome Kaplan, Howard Kirshner, Marjorie Nicholas, Oliver Sacks, Martha Sarno, and Gottfried Schlaug. It profiles individuals living successfully with aphasia, presents different types and severities of aphasia, including primary progressive aphasia, explores aphasia's impact on families, discusses legal implications of aphasia, and explores the life participation approach to aphasia.
"After Words" is currently being distributed to public television stations nationwide. However, it is up to each individual station to include it in their schedule. While it has already aired in a number of cities, it has not yet aired on the majority of public television stations. Therefore, the producers of "After Words" encourage the aphasia community—speech-language pathologists, state and local speech-language hearing associations, aphasia support groups, rehabilitation centers, individuals touched by aphasia—to contact their local public television stations and urge them to air "After Words." We anticipate a new wave of airings to occur in the months to come, following the program's re-distribution to public television in mid-January. Thus, contacting local stations, and in particular, program managers at these stations, when the film is re-distributed, would be especially timely.
We hope to bring this important program to the widest possible audience. Take a look at the trailer:
[youtube http://www.youtube.com/watch?v=GW-TDmQMTVc]
Jerome Kaplan is an SLP and founder of the Aphasia Community Group of Boston. Working with artists, actors, musicians, filmmakers, and members of the aphasia community, he has developed projects to raise aphasia awareness and understanding by illuminating the world of aphasia and promoting the life participation approach to aphasia. His latest project, "after words," a documentary about aphasia, is currently airing on public television.


text:
Artist description:
No description entered.
Flash Draw Created Feb 16, 2009 470 x 338px Unless noted Copyright 2009 IIII.
We encourage you to submit a comment and let the artist know what you think of this drawing. Please log in or join to post a comment.
Post a comment
Great drawing!!! Collect
5H lol me again. sup. loved your work, amazing, im lucky im not easerly intimidated or i might leave that 1 star here ;) (("its not me btw, keep ur nose out"))
That is so freakin' cool! I do not know how you got the ground to look so realistic- but it looks so dang awesome!!!!! The word "love" looks like it is written in chalk and I really like the person's shoes and how they make the "v." 5/5 and favorites
Awesome work!!
loooks sooo reeealll~~~~~ omg!!! O.o awesomee~~
so unique!!i like it!!
thats adorable!! and pz I LOVE UR PROFILE PICTURE ROFL!!!
I really like this!!! 5/5


text:
Illinois Gov. Pat Quinn's plan to save money by closing seven correctional facilities was halted again Wednesday when a southern Illinois judge ordered the Democrat to negotiate terms with a union representing prison workers.
Associate Circuit Judge Charles Cavaness issued the ruling from Alexander County in far southern Illinois. It's home to the central point of the dustup, the high-security Tamms prison Quinn wants shuttered.
The preliminary injunction sought by the American Federation of State, County, and Municipal Employees would continue holding up closure of the Tamms "supermax" prison, where gang leaders and extraordinarily violent inmates are housed, the women's prison at Dwight, three halfway houses and two juvenile detention centers. It also bars any employee layoffs.
Quinn spokesman Abdon Pallasch said delaying the closures, most of which were scheduled for Aug. 31, is costing the state $7 million a month it doesn't have. Pallasch said the administration plans to appeal the ruling to the Illinois Supreme Court.
The two sides will go back before an independent arbitrator in hearings next week, AFSCME spokesman Anders Lindall said. The arbitrator, Steven Bierig, is the same official who ruled in late August that the administration had violated its labor agreement with AFSCME by not negotiating conditions of the closures.
Cavaness agreed with AFSCME's argument that Quinn's changes, such as closing Tamms and transferring highly troublesome inmates to the maximum-security prison at Pontiac, are so critical they require adjustments to contractual working conditions. From the union's point of view, it's particularly crucial in a prison system designed for 33,700 inmates but holding more than 49,000.
The union claims the Department of Corrections has too few staff to handle the number of prisoners and is transferring volatile inmates to lower-security prisons to make room at Pontiac for Tamms arrivals. The Associated Press reported last week that Corrections loosened security rules for Tamms inmates transferring to Pontiac after Corrections Director S.A. "Tony" Godinez promised lawmakers last spring that protocol would be "identical" to the tough restrictions at Tamms.
In the order, Cavaness reiterated his believe that AFSMCE had shown the closures "have the potential to make the prisons that remain more dangerous for employees." He previously made that statement a month ago when he issued a temporary prohibition on closures. Quinn appealed that decision to a state appellate court but lost, and that case remains before the Supreme Court.
Cavaness wrote Wednesday that AFSMCE "met its burden of showing irreparable harm if the closures are implemented" before the two sides agree on conditions. "The employees represented by plaintiff may suffer physical injuries that cannot be fully remedied later," Cavaness said.
The administration argues that the court's intervention interferes with a governor's executive power to close facilities when necessary and violate the Constitution by spending money that has not been appropriated. Lawmakers hoping to spare the closures appropriated money to run them but Quinn vetoed it, saying it would be better spent on the agency that helps abused children.
Besides Tamms and Dwight, Quinn wants to shutter adult inmate transition centers in Carbondale, Chicago and Decatur and juvenile detention facilities in Joliet and Murphysboro. The Murphysboro site has already been emptied of juvenile residents and its employees assigned to other locations.
Pallasch did not know how the judge's ruling or the administration's appeal would affect facility closures. He did not know how the administration planned to make up the budgetary shortfall caused by the forced operation of the prisons, but options include asking the Legislature for more money or reducing spending for other programs in the Departments of Corrections and Juvenile Justice.


text:
Activities and Events at the Adult Center of Prescott
Event Date: Sat Dec 07, 2019
Event Time: 7:30 PM-10:30 PM
Event Calendar:
|All Events
Today's Date is:
Monthly Newsletter
Click here to receive a pdf version of the newsletter by email each month or view past issues.
FREE! Seminars
Click here to see our free seminars and events!
Lounge WiFi
CABLEONE provides the Adult Center with High-Speed WiFi for our members and guests. Just bring in your laptop or other wireless device. Inquire at front desk for information.


text:
I presented a short Intro to Twisted at the SoCal Piggies meetup in Santa Monica last night. It went pretty well and I think I did a good job explaining the basics. I know it took me a long time to even become even remotely familiar with the way Twisted operates, so I felt like this was a good choice for a five-minute presentation. Short, sweet, and to the point!
Here is is for your viewing pleasure:
I borrowed the image on slide five from the Twisted Intro, which is a very excellent introductory tutorial written by Dave Peticolas. If you are curious about Twisted, what it can do, or are even experienced and want a great refresher, it's definitely worth your time to give it a look!


text:
This article was cross-posted from HIVhaven.com.
When it comes to relationships, some HIV positive people have a clear cut policy on the serostatus of potential partners. Some will only be with another HIV positive person, some will only be with an HIV negative partner and for some it's not even a part of the 'should I get involved with this person' decision. Of the four relationships I've had since the person I became positive from, only one was HIV positive. I'm one of the 'it has no bearing on my decision' people.
Nonetheless, being HIV positive with an HIV negative partner does come with some challenges. But what relationship doesn't? For me, the positive partner, it's rare that my HIV status is an issue in our life together, though there have been a few times. For my husband, he's been amazing and has had few concerns with me being positive right from the beginning.
In fact, his reaction to me telling him I had HIV made me fall in love with him immediately. (This is my favorite part of the 'how we met' story). The first night we met, after it became obvious that something was on my mind and several inquiries on his behalf as to what was wrong, I told him that there was something that I had to tell him. He said 'okay' as I saw him almost physically brace himself for what I was about to say. I blurted out 'I'm HIV positive'. He let out a big sigh as if he was holding his breath and with a look of relief said 'Is that it? I thought you were going to tell me that you didn't like me and you're leaving.' I mean really, how could I not love this man?
Over the course of our almost 3 year relationship and year and a half marriage, I can think of only two issues that have evolved from our HIV sero-discordant relationship.
In the beginning I was concerned how his family would react to me being positive. We discussed it and decided, mostly on my urging, to wait awhile to tell them. Being British and with England having such a low rate of HIV, I figured they probably didn't know much about HIV. It was likely, with only 120,000 cases in the UK, that they had never known anyone that was HIV positive, at least not to their knowledge. I wanted my future mother and father in law to get to know me first before we told them. I thought if they knew my status first that HIV would be all they saw when they looked at me. I'd be their son's fiancé with HIV, not their son's fiancé Jeannie, an American writer who loves animals, has a good sense of humor and is crazy about their son.
Unfortunately, it didn't work out that way. Someone told them before I could get to know them very well. They weren't upset that I was HIV positive but they were upset that we didn't tell them. Although it probably marred our relationship early on, I still feel it was the right decision.
It took me several months to get past the anger I felt towards the person who we believed told them. The last year Martyn was in England, waiting for his U.S. Visa to be issued, we'd stay at his parents' house when I'd come to visit. This was the justification given for this person needing to tell his parents I had HIV. As if they were in some kind of danger from being around me and needed to be protected by having the knowledge that I was HIV positive. It's one of the few times that I ever really felt stigmatized. I felt as if I were being looked at as a lesser woman, diseased, judged and as if I was trying to hide my status because I was ashamed of it. I've never been ashamed that I was HIV positive. If I don't disclose to someone it's either because I have a reason not to or it's just none of their business.
The only other issue I have with him being negative is the fear that I might transmit HIV to him. This comes up mainly when he gets tested. I know the likelihood is extremely small due to my very low viral load. I try to keep it in perspective but when he gets tested for HIV it's hard not to think about it and the possibility scares the hell out of me.
What if? What if he tests HIV positive? Of course my first concern is for him, his health and helping him deal with it but after that, even if he's okay with it, how would I live with it? My rational mind tells me the same things he tells me. It is both of our decisions. He wants to be with me and with that comes some level of risk. He agreed to and accepts that risk and so do I. My head knows these things but my heart wonders if I could forgive myself.
As I'm sure it is for many poz halves of a poz/negative couple, there's always that fear in the back of my mind. That guilt that it's never 100% safe. However, I plan to spend the rest of my life with this person. We'll deal with anything and everything that comes up throughout the course of our life together. If a little bit of stigma and fear is what we have to face to be together, then so be it.
Every HIV positive and HIV negative person has to decide if even the most minute risk of transmission is worth it for them. We made our decision and live with it. Sure there are the now-and-then worries I spoke of. But in the end, the worry is a small price to pay for having such a wonderful person in my life. And for him, I guess being with me outweighs the risk of HIV infection. For us, if me being HIV positive is the worst thing that we have to deal with in our marriage, then we know we're in for a very happy and fulfilling life together.


text:
Planned Giving
Thank you for your interest in the Providence Life Services Ministry. Our hope is to serve you and your family with helpful information. We have an increasing number of friends at Providence Life Services who now are benefiting from life income gifts, gift annuities and other plans. Thank you for taking the time to explore the benefits of gift planning.
Donor Stories
Gift OptionsWhat to Give and learn about the best assets to make a planned gift. Learn about gifts of cash, securities and property. Learn How to Give and discover gift options that provide tax and income benefits. Discover the best planned gift to meet your goals.
Personal Planner
Washington News


text:
Top Quality Case for iPhone 4 4S 4G users
Choose one of them now:
SPIGEN SGP Tough Armor Case
Payment :
- We only accept payments through PayPal (which supports Visa, MasterCard, Discover, American Express, or Echecks). Paypal is a secure payment method for both seller and buyer in ecommerce.
Shipment :
- All products have been checked and packaged in good condition before dispatch.
- Shipment is totally FREE for all countries.Item will be shipped within 3-7 business days.
- All items will be shipped to buyer's Paypal address
- Before you pay, please make sure your address in paypal matches the address you would like us to ship to.
- In order to ensure you receive you order tax free upon import, we will declare it as a 'GIFT' with a lower value. This lower price doesn not reflect the total price you paid or the market value of the product and may not apply to countries with different tariff rules. Any import charges of fees are the buyer's responsibility.
- Delivery Time: Generally 10-30 working days.
- If you have not received your shipment within 30 business days from payment, please contact us. We will track the shipment and get back to you as soon as possible with a reply.
1. All products have 1 year warranty.
- 2. For any reason, if you aren't satisfied with orders, just contact with us immediately. So, we have a chance to solve the problem for you.
Return Policy
- We Accept return for unsatisfactory items
- Please contact us to report defective products within 30 days upon receipt
- Returned items mut come with the original parts, accessories
- Refund will be issued once we have received your returned items
- Buyer is responsible for all return shipping charges
Colors may not appear exactly as shown on photos in real life due to variations between the computer monitors and naked eye colour difference.


text: In This Section Classes & Events Filter events by: Topic ▼ AgingArts and CultureCommunity Health EducationDartmouth-Hitchcock Employee EventsFirst Aid and SafetyMedical Certification and Continuing EducationMental and Spiritual WellnessPregnancy and ParentingSupport Groups Location ▼ Concord AreaKeene AreaLebanon / Upper Valley AreaManchester AreaNashua AreaBennington, VT Area Your Selections:Concord Area xSupport Groups xClear all selections x No upcoming events match your selections. Return to the full Classes & Events list. Classes & Events CHaD Events Cancer Center Events Aging Resource Center Events Women's Health Resource Center Events Youth Summit Opioid Collaborative Forum


text:
REVERE, Mass. (AP) � A storm system that wreaked havoc across the eastern half of the U.S. spawned a tornado just north of Boston on Monday, ripping roofs off homes, uprooting dozens of large trees and forcing businesses to close.
REVERE, Mass. (AP) � A storm system that wreaked havoc across the eastern half of the U.S. spawned a tornado just north of Boston on Monday, ripping roofs off homes, uprooting dozens of large trees and forcing businesses to close.
The tornado � a rarity in�Massachusetts�and virtually unheard of in the Boston area � touched down in Revere, a coastal city of nearly 52,000. City officials said there were no immediate reports of serious injuries, but several people suffered minor injuries, including a baby who was in a car and hurt by flying glass and an elderly woman who suffered cuts.
"Given the magnitude of the storm, it's really a miracle that no one sustained more serious injuries," said Mayor Dan Rizzo.
Gov. Deval Patrick said state emergency officials were on the scene and would "do whatever we can to help them stand up again."
The tornado was spawned by a powerful storm that moved through the Boston area shortly after 9 a.m. Revere residents said it touched down around 10 a.m. and lasted about five minutes.
The National Weather Service's office in�Massachusetts�said it was the first tornado in Suffolk County, which includes Boston and the northern communities of Revere, Chelsea and Winthrop, since the agency began keeping records on them in 1950.�Massachusetts�has had 162 confirmed tornadoes during that time, the majority of them weak, according to meteorologist Kim Buttrick.
Revere officials were assessing the extent of the damage early Monday afternoon and going door-to-door in neighborhoods around the city's busy commercial thoroughfare of Broadway, which appeared to have sustained the brunt of the damage. Officials were advising many residents not to return to their homes until they could confirm there were no gas leaks.
Rizzo said he expected the city to open a shelter for residents who needed one.
Paul and Patty Carrabes said they were both at work when the wind tore the roof off their Revere Beach Parkway home.
"I probably would have died if I was in there," said Patty Carrabes said.
About a block over, Luis Fonseca said emergency warnings came too late. By the time a tornado warning popped up on his cellphone, he was already running to the basement with his niece and nephew as windows shattered and the wooden house swayed from side to side.
Other residents said they received the warnings roughly 10 minutes before the tornado hit, giving them enough time to find shelter.
Communities across the U.S. were cleaning up Monday after strong storms destroyed homes, knocked out power for thousands of people and toppled power lines and trees.
In eastern Tennessee, officials said there were no reports of any deaths or injuries from Sunday's storms, though at least 10 homes were destroyed.
In Kentucky, National Weather Service forecaster Tony Edwards said some areas got softball-sized hail Sunday.
Massive hail also was reported in Michigan, where winds toppled trees and ripped the roofs off buildings. And in Ohio, some roads had been blocked by flash flooding. In Pennsylvania, nighttime storms knocked out power to thousands.
In Revere, business owners cleared broken glass from shattered windows as cleanup crews broke apart downed trees and fallen billboards. Rizzo said City Hall was damaged and likely would be closed for a couple of days.
A few Broadway businesses still had power and reopened Monday afternoon. The Revere House of Pizza had a steady stream of customers, despite damage to the building's exterior.
"We're full throttle now," said general manager Arthur Pirint.
A few block over at N.C.'s Auto Repairs, owner John Curley sat at his desk looking up at where the roof used to be. The garage bay was filled with rubble.
Curley said he and his workers were mostly unharmed.
"We're really just trying to absorb what happened," he said. "My concern now is really for my guys. Their livelihoods depend on this place."
Associated Press writers Bob Salsberg, Denise Lavoie and Steve LeBlanc in Boston contributed to this report.
An earlier version of this report was published at 11:03 a.m.


text:
A mother's loving touch saves baby's life
Aug 31, 2010
I never cease to be amazed at the power of a mother's love! There is so much more to birth than the medical profession can understand or see. One amazing example of this comes out of Australia. A new mother had just given birth to twins but one of the babies couldn't be resuscitated and was declared dead by the doctors. After TWO HOURS of skin to skin touch from the mother and many positive, loving words from both parents, the two-pound baby miraculously began to breath! Little baby Jamie is now five months old and doing fine. This just goes to show how technology isn't always all we think it is. Some have this idea that if a laboring woman is surrounded by all the latest machines her baby will have the greatest chance of survival. All this mother needed was to give her warm touch and her loving words to this little one. Thank God for such a beautiful miracle!
Here's the story: Miracle premature baby declared dead by doctors revived by mother's touch
I applaud that mother for going with her instincts and not giving up on that baby!
Posted In: Pregnancy • Comments (0)
Lowes Build and Grow
Aug 31, 2010
This past summer Emma decided that she wanted to learn to work with wood. Shortly after we discovered that Lowes runs a program where kids can come and build a simple wood project for FREE! They usually do a couple projects a month and provide all that is needed. As a bonus, the kids get to keep their work apron. Whenever they complete a project they're given a badge that can be sewn onto the apron.
The projects are recommended for grades 1-5 but younger kids could do them as well with an adult's help. They do have a maximum amount of kids that they can accommodate so it's best to register at least a few days in advance. I sign up as soon as they post the project!
You can sign up on their website: Lowes Build and Grow
So far Emma has built a race car, ball and cup game, schoolbus and a bug box. I'm amazed that they offer this for free! You can also purchase additional kits inside their store to do at home.
Posted In: Parenting | Homeschooling • Comments (0)
Childbirth education
Aug 31, 2010
I have some fun news to share with you! For several years now I have had a passion for birth and a desire to spread the word about it's beauty and importance. My dream is finally coming true! I have begun training with Birthworks to become a certified childbirth educator. At this point it looks like I will be the only educator in Michigan certified through Birthworks. I can't wait! Women and babies are my passion! At some point I would like to become a doula or midwife but as a homeschooling mom of young children that wouldn't be the best for my family right now. I'm saving that dream for when they're older. I figure it will give me something fun to look forward to when I have an empty nest.
For more information on the Birthworks organization you can visit their website: Birthworks International
Posted In: Pregnancy | My Life • Comments (0)
Wordless Wednesday: You make me smile!
Jul 07, 2010
Posted In: Wordless Wednesday • Comments (3)
Emma's cloth doll
Jul 07, 2010
My oldest daughter Emma just finished sewing her first doll. She had expressed an interest in learning to sew and I'm not a very advanced seamstress so we checked out some sewing books from the library. The book Emma found the most helpful was "Made By Me" by Jane Bull. It's full of sewing, embroidery and knitting projects for girls that are easy to make. Each project is shown step-by-step with detailed pictures and easy to understand instructions. Emma chose the to make the doll from the book.
She is so proud of her new "friend." Emma told me not to tell the doll that it IS a doll because she doesn't want her to know she's not real!
Posted In: My Life | Crafts • Comments (0)