Sun Java System Identity Synchronization for Windows 6.0 Installation and Configuration Guide

Using LDAP

ProcedureTo Retrieve an Active Directory Certificate using LDAP

  1. Execute the following search against Active Directory:


    ldapsearch -h CR-hostname -D administrator_DN -w administrator_password 
    -b "cn=configuration,dc=put,dc=your,dc=domain,dc=here" "cacertificate=*"

    Where the administrator_DN might look like:


    cn=administrator,cn=users,dc=put,dc=your,dc=domain,dc=here

    In this example, the domain name is: put.your.domain.name.here.

    Several entries will match the search filter. You probably need the entry using cn=Certification Authorities, cn=Public Key Services in its DN.

  2. Open a text editor and cut the first value of the first CA certificate attribute (it should be a base64 encoded text block). Paste that value (text block) into the text editor (only the value). Edit the contents, so that none of the lines start with white space.

  3. Add-----BEGIN CERTIFICATE----- before the first line and -----END CERTIFICATE----- after the last line. See the following example:


    -----BEGIN CERTIFICATE-----
    MIIDvjCCA2igAwIBAgIQDgoyk+Tu14NGoQnxhmNHLjANBgk
    qhkiG9w0BAQUFADCBjjEeMBwGCSqGSIb3DQEJARYPYmVydG
    9sZEBzdW4uY29tMQswCQYDVQQGEwJVUzELMAkGA1UECBMCV
    FgxDzANBgNVBAcTBkF1c3RpbjEZMBcGA1UEChMQU3VuIE1p
    Y3Jvc3lzdGVtczEQMA4GA1UECxMHaVBsYW5ldDEUMBIGA1U
    EAxMLUmVzdGF1cmFudHMwHhcNMDIwMTExMDA1NDA5WhcNMT
    IwMTExMDA1OTQ2WjCBjjEeMBwGCSqGSIb3DQEJARYPYmVyd
    G9sZEBzdW4uY29tMQswCQYDVQQGEwJVUELMAkGA1UECBMCV
    FgxDzANBgNVBAcTBkF1c3RpbjEZMBcGA1UEChMQU3VuIE1p
    Y3Jvc3lzdGVtczEQMA4GA1UECxMHaVBsYW5ldDEUMBIGA1U
    EAxMLUmVzdGF1cmFudHMwXDANBgkqhkiG9w0BAQEFAANLAD
    BIAkEAyekZa8gwwhw3rLK3eV/12St1DVUsg31LOu3CnB8cM
    HQZXlgiUgtQ0hm2kpZ4nEhwCAHhFLD3iIhIP4BGWQFjcwID
    AQABo4IBnjCCAZowEwYJKwYBBAGCNxQCBAYeBABDAEEwCwY
    DVR0PBAQDAgFGMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBB
    YEFJ5Bgt6Oypq7T8Oykw4LH6ws2d/IMIIBMgYDVR0fBIIBK
    TCCASUwgdOggdCggc2GgcpsZGFwOi8vL0NOPVJlc3RhdXJh
    bnRzLENOPWRvd2l0Y2hlcixDTj1DRFAsQ049UHVibGljJTI
    wS2V5JTIwU2VydmljZXMsQ049U2VydmljZXMsQ049Q29uZm
    lndXJhdGlvbixEQz1yZXN0YXVyYW50cyxEQz1jZW50cmFsL
    RPXN1bixEQz1jb20/Y2VydGlmaWNhdGVSZXZvY2F0aW9u
    TGlzdD9iYXNlP29iamVjdGNsYXNzPWNSTERpc3RyaWJ1dGl
    vblBvaW50ME2gS6BJhkdodHRwOi8vZG93aXRjaGVyLnJlc3
    RhdXJhbnRzLmNlbnRyYWwuc3VuLmNvbS9DZXJ0RW5yb2xsL
    1Jlc3RhdXJhbnRzLmNybDAQBgkrBgEEAYI3FQEEAwIBADAN
    BgkqhkiG9w0BAQUFAANBAL5R9R+ONDdVHWu/5Sd9Tn9dpxN
    8oegjS88ztv1HD6XSTDzGTuaaVebSZV3I+ghSInsgQbH0gW
    4fGRwaI BvePI4=
    -----END CERTIFICATE-----
  4. Save the certificate into a file (such as ad-cert.txt).

  5. You can then import that file (for example, ad-cert.txt) into a certificate database. Continue to the next section, Adding Active Directory Certificates to the Connector’s Certificate Database