Skip Headers
Oracle® Fusion Middleware Administrator's Guide for Oracle Authentication Services for Operating Systems
11g Release 1 (11.1.1)

Part Number E16454-02
Go to Documentation Home
Go to Book List
Book List
Go to Table of Contents
Go to Index
Go to Master Index
Master Index
Go to Feedback page
Contact Us

Go to previous page
Go to next page
PDF · Mobi · ePub

2 Before You Configure

Before configuring Oracle Authentication Services for Operating Systems, ensure that you are using a supported operating system and the supported version of Oracle Internet Directory. Then, before you start the install, determine which of the optional product features you will use and locate the scripts you will use for migration.

This chapter contains the following topics:

2.1 Verify Your Client and Server Operating Systems

Oracle Authentication Services for Operating Systems has both server and client components. The server is the computer that runs Oracle Internet Directory. The client is a computer that uses the services of Oracle Internet Directory for authentication.

For up-to-date information about supported server and client operating systems, please consult the following documents:

2.2 Install Oracle Internet Directory and Oracle Directory Integration Platform

Before you can configure Oracle Authentication Services for Operating Systems, you must install Oracle Internet Directory. If you plan to migrate entries from an existing LDAP-compliant directory, or to synchronize Oracle Internet Directory with another directory, such as Active Directory, you must install Oracle Directory Integration Platform along with Oracle Internet Directory.

See Also:

The Oracle Fusion Middleware Installation Guide for Oracle Identity Management for your platform for information about installing Identity Management components.

2.3 Upgrade from Oracle Authentication Services for Operating Systems 10g

If you have already installed Oracle Authentication Services for Operating Systems 10g, you do not need to reconfigure your server or client machines unless you are changing some configuration features, such as ports or SSL certificate.

Upgrade to Oracle Internet Directory 11g as described in Oracle Fusion Middleware Upgrade Guide for Oracle Identity Management. Apply 11g R1 Patch Set 2 (

If you need to change the configuration, use the 11g scripts, as described in Chapter 3, "Configuring Oracle Authentication Services for Operating Systems."

In Oracle Internet Directory 11g Release 1 (11.1.1) and later, anonymous binds are allowed by default, but anonymous users can only perform search operations on the root DSE entry. When you upgrade, however, Oracle Internet Directory enables anonymous binds. If, for some reason, anonymous binds have been disabled, you can enable them by using the ldapmodify command, as described in the Troubleshooting section "Users Cannot Log In".

2.4 Determine Which Product Features You Will Use

Before you begin the installation, consider which features of the product you are likely to use. For basic functionality, you must run the server script on the system where you are running the Oracle Internet Directory server, then run the client script on each client. These scripts configure the server and clients for LDAP authentication. In addition to configuring basic LDAP authentication, you can choose from the following options:

2.5 Get NIS Migration Tools

If you have user, group, and other entries maintained in the local file system or in NIS/NIS+, you can move to LDAP as your storage mechanism for these entries. There are tools available to extract the existing information and produce output files in the LDAP Data Interchange Format (LDIF). Once you have your information in LDIF files, you can use the ldapadd tool to load the information into Oracle Internet Directory.

2.5.1 AIX 5.3

You must use the sectoldif and nistoldif tools on AIX for user and group migrations. Do not use the migration tools from

2.5.2 Other Platforms

A number of free tools are available. We have validated the process of migrating information using the LDAP migration tools available at:

If you have the openldap packages installed on your host, you will find the same migration tools at: /usr/share/openldap/migration.

2.6 Download SUDO Package

If you want to migrate the contents of the sudoers file to LDAP, you must run a migration script and build sudo with LDAP enabled. You can obtain the sudo package from:

2.7 Create and Index New Custom Attributes (Optional)

You cannot successfully search for an attribute in Oracle Internet Directory unless the attribute is indexed. If you plan to add custom attributes, you can index them at the time you create them by using Oracle Directory Manager. You can also use ldapmodify to create an indexed attribute. You would use an LDIF file such as this:

dn: cn=catalogs
changetype: modify
add: orclindexedattribute
orclindexedattribute: attribute_name

Alternatively, you can index attributes after they have been created in Oracle Internet Directory by using catalog, as explained in "Using Custom Attributes in Oracle Internet Directory".


If you attempt to perform a search with a non-indexed attribute specified as a required attribute, the server will return the error:
Function not implemented. DSA unwilling to perform.


2.8 Platform-Specific Tasks

The following pre-installation tasks are platform-specific.

2.8.1 HP-UX

If a computer that you plan to use as a client is running HP-UX, you must download and install: LDAP-UX Integration J4269AA, HP-UX 11iv2 for Workstations and Servers B.04.00.03, as root. You can download the software from:

2.8.2 Solaris 5.9 and 5.10

If you plan to run the SSL version of the server configuration script on Solaris 5.9 or 5.10, you must ensure that Oracle Internet Directory is using the standard LDAP ports, 389 and 636, for non-SSL and SSL, respectively.

If necessary, start a new Oracle Internet Directory instance using the standard LDAP ports. Proceed as follows:

  1. Stop all Oracle Internet Directory instances by using the opmnctl command. Type:

    opmnctl stopproc process-type=OID
  2. As root, execute the command:

  3. Create a new component of type OID. For example, to create a component with component name oid2 and namespace dc=us,dc=example,dc=com, type:

    $ORACLE_INSTANCE/bin/opmnctl createcomponent -componentType OID \
       -componentName oid2 -Db_info \
       "" \
       -Port 389 -Sport 636 -Namespace "dc=us,dc=example,dc=com"
  4. Start the Oracle Internet Directory instances. For example, to start component oid2, type:

    $ORACLE_INSTANCE/bin/opmnctl startproc ias-component=oid2

See Also:

The chapter "Managing Oracle Internet Directory Instances," in Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.