Sun OpenSSO Enterprise 8.0 Installation and Configuration Guide

Configuring Active Directory With the OpenSSO Enterprise Schema Files

The Access Manager Identity Repository (IdRepo) LDAPv3 plug-in must be able to assign the service's object class name to the user's object class attribute, so it can tell if a user has been assigned a given service. The following procedure describes how to load the OpenSSO Enterprise schema files into Active Directory and then to configure OpenSSO Enterprise to enable the OpenSSO Enterprise services.

ProcedureTo Configure Active Directory with OpenSSO Enterprise Schema Files

  1. Back up the am_remote_ad_schema.ldif file.

    After you have unzipped, this file is available in the following directory:


  2. In the am_remote_ad_schema.ldif file, replace @ROOT_SUFFIX@ with the root suffix of your Active Directory installation.

  3. Using Active Directory tools (or another tool of your choice), load the am_remote_ad_schema.ldif file from the previous step into Active Directory.

  4. Log in to the OpenSSO Administration Console. In the data store configuration page's LDAP User Attributes field, add the attribute names defined in the above LDIF file.

  5. If you are writing your own service with dynamic user attributes, the service.ldif file for Active Directory must NOT have the following lines:

    dn: CN=User,CN=Schema,CN=Configuration,ROOT_SUFFIX
    changetype: modify
    add: auxiliaryClass
    auxiliaryClass: yourClassname

    Otherwise, OpenSSO Enterprise will not be able to assign the service's object class name to the user's object class attribute.