Configuring the Active Directory Connector

This section explains how to configure integration with Microsoft Active Directory in various scenarios.

This section contains these topics:

• Summary of Active Directory Connector Configuration Scenarios

• About Scenario Examples

• About the Information You Must Add to the Active Directory Connector

• About the adprofilecfg.sh Tool

• Tasks Common to Various Scenarios

• Synchronization Between a Single-Domain Microsoft Active Directory and Oracle Internet Directory

• Synchronization Between a Multiple-Domain Microsoft Active Directory and Oracle Internet Directory

Summary of Active Directory Connector Configuration Scenarios

The scenarios described in this section share these assumptions:

• The default set of attributes installed with Oracle Internet Directory are sufficient for synchronization

• Only user and group objects must be synchronized

• Migration of users and groups from Microsoft Active Directory is not required

Synchronization Scenarios with Single-Domain Microsoft Active Directory Environments

Table 43-7  Scenarios with Single-Domain Microsoft Active Directory Environments

Scenario#	Synchronization Configuration
Scenario1	Users and groups from Microsoft Active Directory to Oracle Internet Directory
Scenario2	Users and groups from Oracle Internet Directory to Microsoft Active Directory
Scenario3	Two-way synchronization of users and groups between Oracle Internet Directory and Microsoft Active Directory

Synchronization Scenarios with Multiple-Domain Microsoft Active Directory Environments

Table 43-8  Scenarios with Multiple-Domain Microsoft Active Directory Environments

Scenario#	Synchronization Configuration
Scenario4	Users and groups from Global Catalog Server to Oracle Internet Directory
Scenario5	Users and groups from Microsoft Active Directory to Oracle Internet Directory without a Global Catalog Server
Scenario6	Users and Groups from Oracle Internet Directory to Microsoft Active Directory

About Scenario Examples

Each scenario in this section uses an example. These examples rest on the following assumptions:

• The synchronization of users and groups between Oracle Internet Directory and Microsoft Active Directory always use one-to-one domain mapping--that is, the DN of the user and group entries are the same in both directories.

• Oracle Internet Directory is installed on a host iasdemo.us.mycompany.com. This means that the default realm of Oracle Internet Directory is dc=us,dc=mycompany,dc=com.

• The Oracle directory server is running on port 389.

• The password for the directory administrator, as chosen during installation of Oracle Internet Directory, was welcome1.

• Other tools, namely, the Directory Integration and Provisioning Assistant and adprofilecfg.sh prompt you for a password. The password you should supply is welcome1.

• The adprofilecfg.sh prompts you for a super user DN. The value you should supply is dn=orcladmin.

• In a single-domain Microsoft Active Directory environment, the host name is addemo.us.mycompany.com. This means that the domain of the Microsoft Active Directory host is the same as the default realm of Oracle Internet Directory as set during installation, namely, dc=us,dc=mycompany,dc=com.

  If this is not true, then, during installation of Oracle Internet Directory, the default realm value must be set to correspond to the Microsoft Active Directory domain. In this example, that domain is dc=us,dc=mycompany,dc=com.

  If you have already installed Oracle Internet Directory and the default realm does not correspond to the domain of the Microsoft Active Directory host, then Oracle Corporation recommends that you re-install the Oracle Identity Management. As you do this, set the proper value of default realm, otherwise the setup scenarios described in this section fail.

• In this section, the examples of multiple-domain Microsoft Active Directory environments use two domains having the host names ad1demo.a.us.mycompany.com and ad2demo.b.us.mycompany.com. This means that the domains of Microsoft Active Directory hosts are respectively dc=a,dc=us,dc=mycompany,dc=com and dc=b,dc=us,dc=mycompany,dc=com.

  Further, during installation of Oracle Internet Directory, the default realm value must be set to the parent of the Microsoft Active Directory server domains. In this example, the default realm value is dc=us,dc=mycompany,dc=com. If this is not true, then Oracle Corporation recommends that you re-install Oracle Identity Management. As you do this, set the proper value of default realm, otherwise the setup scenarios described in this section fail.

• The scenario described later uses the USNChanged approach for tracking changes in Active Directory. However, if the user wishes to use the DirSync approach, replace the profile ActiveChgImp with the profile activeImport Tasks 1-5 required in this setup.

• Every user created from Oracle Internet Directory requires an object class orclADUser to be added the entry, which has a mandatory attribute of orclSAMAccountName. Note that, orclSAMAccountName cannot have any special characters in it. If you are creating users from Oracle Internet Directory Self-Service Console, then you need to modify the user creation property through the Console to include the orclADUser object class and orclSAMAccountName. Further, the value of the attribute orclSAMAccountName could be given as ActiveDirectorydomain$userid.

About the Information You Must Add to the Active Directory Connector

Most of the configuration information required for enabling synchronization is preconfigured in Oracle Internet Directory during installation. Beyond that preconfigured information, you need to add a minimal amount of information to the Active Directory connector.

The information you must add to the Active Directory connector pertains to the Microsoft Active Directory environment. This information includes:

• Microsoft Active Directory URL (host:port)

• Microsoft Active Directory user account and password to be used by the Active Directory connector

• Microsoft Active Directory domain containing the users and groups to be synchronized

To add this information, you can use either command-line tools or Oracle Directory Manager.

Moreover, if the default realm is changed, then you must re-create the ACLs to enable only the owners of various synchronization profiles to create, modify, and delete entries under the user and group containers. Although default ACLs are created during installation, most often they must be modified to meet the security needs of the deployment. The section "Scenario 1: One-Way Synchronization from Microsoft Active Directory to Oracle Internet Directory" advises you as to when you need to change an ACL.

See Also: "Task 3: Reset the Default Security Configuration" for more information about customizing the default access control configuration.

About the adprofilecfg.sh Tool

The scenarios described in the next sections use the adprofilecfg.sh tool to configure Microsoft Active Directory-related information into the default profiles. This tool creates three default profiles from master default profiles and then modifies them with the information it receives from the user. If you have already customized one of the default profiles, then the adprofilecfg.sh tool overwrites it. In this case, rename your default profile as described in the next section, "Tasks Common to Various Scenarios".

Tasks Common to Various Scenarios

This section discusses tasks that, in most scenarios, you must perform only once for a given installation. For example, suppose that you are following both Scenario 1 and Scenario 2 described later in this chapter. If, you perform these tasks to set up Scenario 1, then you do not need to perform them again to set up Scenario 2.

Task 1: Verify the Microsoft Active Directory Information to be Configured into the Active Directory Synchronization Profiles

To do this, enter the following command against the Microsoft Active Directory server:

ldapsearch -p port -h host -D user account -w password -b "" -s base 
"objectclass=*" defaultnamingcontext

For example:

ldapsearch -p 389 -h adtest.us.MyCompany.com -D [e-mail] 
-w welcome1 -b "" -s base "objectclass=*" defaultnamingcontext

This should return the domain name of the Microsoft Active Directory server. In our

example, the exact output should be: defaultNamingContext=DC=us,DC=MyCompany,dc=com

Task 2: Configure the Information Related to the Microsoft Active Directory Environment

This includes adding to the synchronization profile used for synchronization the information explained in "Information Required During Setup".

If you are using the default synchronization profiles, then run the script $ORACLE_HOME/ldap/odi/admin/adprofilecfg.sh to set up the information. The script prompts you for the following:

• The Oracle Internet Directory super user DN and password

• The Microsoft Active Directory URL (host:port)

• The Microsoft Active Directory user account and password to be used by the Active Directory connector

• The Microsoft Active Directory domain to be synchronized--for example, cn=users,dc=us,dc=com.

Once you have entered the parameter values, adprofilecfg.sh invokes the Directory Integration and Provisioning Assistant. The Assistant sets up the Microsoft Active Directory connection information and mapping rules information in the default Active Directory synchronization profiles.

Note: This step is required only once for all the synchronization scenarios where default profiles are used.

Task 3: Start the Oracle Directory Integration and Provisioning Server as You Would for Synchronization

Note: This step is required only once to start the directory integration and provisioning server for the synchronization. However, the synchronization does not start until a synchronization profile is enabled. A directory integration and provisioning server is always running by default after installation as instance=1. That directory integration and provisioning server is unrelated to the one required for synchronization. The directory integration and provisioning server used for synchronization must run as an instance greater than 1.

To start the directory integration and provisioning server as you would for synchronization, enter the following command:

oidctl connect=iasdb server=odisrv instance=2 configset=1 flags="port=3060" 
start

Synchronization Between a Single-Domain Microsoft Active Directory and Oracle Internet Directory

This section describes various scenarios for setting up one-way synchronization of users and groups between a single-domain Microsoft Active Directory and Oracle Internet Directory.

Scenario 1: One-Way Synchronization from Microsoft Active Directory to Oracle Internet Directory

This scenario rests on these assumptions:

• Only the default set of attributes must be synchronized from Microsoft Active Directory to Oracle Internet Directory.

• No initial migration of data is required, as is typical for demo and test systems.

In general, to set up this scenario, do the following:

1. Perform Tasks 1 through 3 described in "Tasks Common to Various Scenarios".

2. If you are synchronizing groups, then perform Tasks 4 through 6 as described in this section.

Task 4: (Required only if you are synchronizing groups) Configure ACLs for Group Synchronization

Note: This step is required only if groups are being synchronized.

This task sets up the proper access controls to enable groups to be created under the users container. To set up the proper access controls, do this:

1. Create an LDIF file named grantrole.ldif. The sample file is given at the end of this chapter. If the default realm is not dc=us,dc=mycompany,dc=com, then edit the file grantrole.ldif and replace every dc=us,dc=mycompany,dc=com string with the actual default realm--for example, dc=us,dc=YourCompany,dc=com.). Save the file.

2. Enter the command:

   ldapmodify -h host  -p port -D DN of orcladmin -p password -f grantrole.ldif
   
   

   For example,

   ldapmodify -c -h iasdemo -p 3060 -D cn=orcladmin -w welcome1 -f 
   grantrole.ldif
   
   

   This configures the required ACL policy in Oracle Internet Directory to enable creation and modification of groups in Oracle Internet Directory.

Task 5: Start the Synchronization from Microsoft Active Directory to Oracle Internet Directory

This requires enabling the respective profile by setting the profileStatus attribute to ENABLE. To do this, enter the command:

Dipassistant mp -profile ActiveChgImp odip.profile.status = ENABLE

Task 6: Verify that Synchronization Has Started

Enter the following command:

ldapsearch -h oid_host -p oid_port -D cn=dipadmin -w orcladmin_password -b 
"orclodipagentname=activechgimp,cn=subscriber profile,cn=changelog 
subscriber,cn=oracle internet directory' -s base "objectclass=*" 
orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime

Table 43-9 shows the values of the status attributes when synchronization is successfully started.

Table 43-9  Attribute Values Indicating Successful Synchronization

Attribute	Value Indicating Successful Synchronization
Synchronization Status	Synchronization successful
Last Successful Execution Time	Date and time (Note: This must be close to the current date and time

An example of a result indicating successful synchronization is:

Synchronization successful November 04, 2003 15:56:03

Note: The date and time must be close to current date and time. When running the ldapsearch command, you need the dipadmin password, which, as established at installation, is the same as orcladmin password.

Scenario 2: One-Way Synchronization from Oracle Internet Directory to Microsoft Active Directory

This scenario rests on the same assumptions as those in "Scenario 1: One-Way Synchronization from Microsoft Active Directory to Oracle Internet Directory", but the synchronization is from Oracle Internet Directory to Microsoft Active Directory. This scenario does not require you to set up any additional information, nor does it require you to set up access controls.

In general, to set up this scenario, do the following:

1. Perform Tasks 1 through 3 described in "Tasks Common to Various Scenarios".

2. Perform Tasks 4 and 5 as described in this section.

Task 4: Start the Synchronization from Microsoft Active Directory to Oracle Internet Directory

This requires enabling the respective profile by setting the profileStatus attribute to ENABLE. To do this, enter the command:

Dipassistant mp -profile ActiveChgImp odip.profile.status = ENABLE

Task 5: Verify that Synchronization Has Started

Enter the following command:

ldapsearch -h oid_host -p oid_port -D cn=dipadmin -w orcladmin_password -b 
"orclodipagentname=activechgimp,cn=subscriber profile,cn=changelog 
subscriber,cn=oracle internet directory' -s base "objectclass=*" 
orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime

Table 43-9 shows the values of the status attributes when synchronization is successfully started.

Table 43-10  Attribute Values Indicating Successful Synchronization

Attribute	Value Indicating Successful Synchronization
Synchronization Status	Synchronization successful
Last Successful Execution Time	Date and time (Note: This must be close to the current date and time

An example of a result indicating successful synchronization is:

Synchronization successful November 04, 2003 15:56:03

Note: The date and time must be close to current date and time. When running the ldapsearch command, you need the dipadmin password, which, as established at installation, is the same as orcladmin password.

Scenario 3: Two-Way Synchronization Between Oracle Internet Directory and Microsoft Active Directory

To set up two-way synchronization, execute both Scenario 1 and Scenario 2 as previously described.

Synchronization Between a Multiple-Domain Microsoft Active Directory and Oracle Internet Directory

This section describes setup tasks for a two-domain Microsoft Active Directory environment. In a Microsoft Active Directory environment with more than two domains, the tasks for setting up synchronization for additional domains are similar to those outlined in this section.

Scenario 4: One-Way Synchronization from Microsoft Active Directory to Oracle Internet Directory when Global Catalog Is Configured in the Microsoft Active Directory Environment

Note: The Global Catalog can be used only for synchronizing changes from Microsoft Active Directory to Oracle Internet Directory. Further, it can be used only when the USNChanged method is used to track changes in Microsoft Active Directory.

To illustrate this scenario, we use a sample deployment with two Microsoft Active Directory domain servers:

• a.us.MyCompany.com

• b.us.MyCompany.com

If there are more than two domains, then the setup procedures are the same as those in Scenario 1, with the exception of Task 4 in which the LDIF file is customized to the actual multiple-domain environment.

In general, to set up this scenario, do the following:

1. Perform Tasks 1through 3 as described in "Tasks Common to Various Scenarios".

2. Perform Tasks 4 through 6 as described in this section.

As you perform Tasks 1 through 3, keep these considerations in mind:

• In Tasks 1 and 2, make sure that the Microsoft Active Directory host and port information are those where the Global Catalog is running. The default port number on which global catalog is running is 3268.

• In Task 2, you must properly supply the value of the Microsoft Active Directory domain. Usually it should be the DN of the entry that is the parent of all the Microsoft Active Directory domains. In our example, this value should be dc=us,dc=MyCompany,dc=com.

Task 4: Create the Appropriate DIT Structure and Configure Required ACLs for User and Group Synchronization

Oracle Internet Directory does not have the complete DIT structure ready for use in a multiple-domain Microsoft Active Directory scenario. It requires performing the following:

• Creating some entries in Oracle Internet Directory. In our example, to create the users container for the first domain, it requires creating entries with following DNs:

  dc=a,dc=us,dc=mycompany,dc=com
  dc=b,dc=us,dc=mycompany,dc=com 
  cn=users,dc=a,dc=us,dc=mycompany,dc=com
  
  

  To create the users container for the second domain requires creating entries with following DN:

  cn=users,dc=b,dc=us,dc=mycompany,dc=com
  
  

• Assigning ACLs to the users containers to allow users and groups to be created under those containers

  Reset the User Search Base and Group Search Base to point to the value dc=us,dc=mycompany,dc=com. This allows all Oracle applications to be able to find users and groups in the two users containers.

• Creating an LDIF file by named multidomaindit.ldif. This file creates the appropriate DIT structure and the required ACLs for our example.

• You can see an example of this file in "multidomaindit.ldif". You can edit this file by replacing sample Microsoft Active Directory domains in this scenario with those in your environment.

  To load this file, enter the following command:

  ldapmodify -h host  -p port -D DN of orcladmin -p password -f 
  multidomaindit.ldif
  
  

  For example:

  ldapmodify -h iasdemo  -p 3060 -D cn=orcladmin -p welcome1 
  
  -f multidomaindit.ldif
  

Task 5: Start the Synchronization from Microsoft Active Directory to Oracle Internet Directory

This requires enabling the respective profile by setting the profileStatus attribute to ENABLE. To do this, enter the following command:

Dipassistant mp -profile ActiveChgImp odip.profile.status = ENABLE

Task 6: Verify that Synchronization Has Started

Enter the following command:

ldapsearch -h oid_host -p oid_port -D cn=dipadmin -w orcladmin_password -b 
"orclodipagentname=activechgimp,cn=subscriber profile,cn=changelog 
subscriber,cn=oracle internet directory' -s base "objectclass=*" 
orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime

Table 43-11 shows the values of the status attributes when synchronization is successfully started.

Table 43-11   Attribute Values Indicating Successful Synchronization

Attribute	Value Indicating Successful Synchronization
Synchronization Status	Synchronization successful
Last Successful Execution Time	Date and time (Note: This must be close to the current date and time

An example of a result indicating successful synchronization is:

Synchronization successful November 04, 2003 15:56:03

Note: The date and time must be close to current date and time. When running the ldapsearch command, you need the dipadmin password, which, as established at installation, is the same as orcladmin password.

Scenario 5: One-Way Synchronization from Microsoft Active Directory to Oracle Internet Directory when Global Catalog is not Configured in the Microsoft Active Directory Environment

In general, to set up this scenario, do the following:

1. On the first Microsoft Active Directory domain, perform Tasks 1 through 3 as described in "Tasks Common to Various Scenarios". You can call this domain, for example, a.MyOracle.com.

2. Perform Tasks 4 through 9 as described in this section.

As you perform Tasks 1 through 3, keep the following in mind:

• In Tasks 1 and 2, make sure that the Microsoft Active Directory host and port information is that of first domain server. In our example, this is a.MyOracle.com.

• In Task 2, the value of the Microsoft Active Directory domain must be properly supplied. Usually, this is the DN of the Microsoft Active Directory domain entry. In our example, this value is dc=a,dc=us,dc=MyCompany,dc=com.

Task 4: Create the Appropriate DIT Structure and Configure Required ACLs for User and Group Synchronization

Oracle Internet Directory does not have the complete DIT structure ready for use in a multiple-domain Microsoft Active Directory scenario. It requires performing the following:

• Creating some entries in Oracle Internet Directory. In our example, to create the users container for the first domain, it requires creating entries with following DNs:

  dc=a,dc=us,dc=mycompany,dc=com
  dc=b,dc=us,dc=mycompany,dc=com 
  cn=users,dc=a,dc=us,dc=mycompany,dc=com
  
  

  To create the users container for the second domain requires creating entries with following DN:

  cn=users,dc=b,dc=us,dc=mycompany,dc=com
  
  

• Assigning ACLs to the users containers to allow users and groups to be created under those containers

  Reset the User Search Base and Group Search Base to point to the value dc=us,dc=mycompany,dc=com. This allows all Oracle applications to be able to find users and groups in the two users containers.

• Creating an LDIF file by named multidomainditimp.ldif. This file creates the appropriate DIT structure and the required ACLs for our example.

  You can find an example of this file at "multidomaindit.ldif".

  To load this file, enter the following command:

  ldapmodify -h host  -p port -D DN of orcladmin -p password -f 
  multidomaindit.ldif
  

  For example:

  ldapmodify -h iasdemo  -p 3060 -D cn=orcladmin -p welcome1 
  
  -f multidomaindit.ldif
  

Task 5: Rename a Profile

Renaming a profile requires:

• Adding permissions for it in the directory. The permissions allow the directory integration and provisioning server to add, modify, and delete users and groups on behalf of the connector using the renamed profile.

• Removing permissions for the old profile

For example, using the sample file in the section "renameprofile.ldif", create a profile with the name renameprofile.ldif. The sample profile assumes that you are renaming a default import profile from ActiveChgImp to ActiveChgImp1. Do the following:

1. Modify the LDIF file to replace the names ActiveChgImp and ActiveChgImp1 with your profile names.

2. Enter the following command:

   ldapmodify -h host  -p port -D DN of orcladmin -p password -f 
   renameprofile.ldif
   
   

   For example:

   ldapmodify -h iasdemo  -p 3060 -D cn=orcladmin -p welcome1 -f 
   renameprofile.ldif
   

Task 6: Create Another Profile for the Second Microsoft Active Directory Domain Server (b.MyCompany.com)

To do this, enter the following command:

Dipassistant cp $ORACLE_HOME/ldap/odi/conf/activechgimp.properties

This creates another profile named ActiveChgImp.

Task 7: On the New Profile, Perform Tasks 1 and 2

On the second directory domain, namely, b.MyOracle.com, perform Tasks 1 and 2 as described in "Tasks Common to Various Scenarios". Keep the following in mind:

• In Tasks 1 and 2, make sure that the Microsoft Active Directory host and port information is that of second domain server. In our example, this is b.MyOracle.com.

• In Task 2, the value of the Microsoft Active Directory domain must be properly supplied. Usually, it should be the DN of the Microsoft Active Directory domain entry. In the example described above, this value should be dc=b,dc=us,dc=MyCompany,dc=com.

Task 8: Start the Synchronization from Microsoft Active Directory to Oracle Internet Directory

This requires enabling the respective profile by setting the profileStatus attribute to ENABLE.

To start the synchronization enter the command:

Dipassistant mp -profile ActiveChgImp odip.profile.status = ENABLE
Dipassistant mp -profile ActiveChgImp1 odip.profile.status = ENABLE

This starts the synchronization from both Microsoft Active Directory domains to Oracle Internet Directory.

Task 9: Verify that Synchronization Has Started

Enter the following command:

ldapsearch -h oid_host -p oid_port -D cn=dipadmin -w orcladmin_password -b 
"orclodipagentname=activechgimp,cn=subscriber profile,cn=changelog 
subscriber,cn=oracle internet directory' -s base "objectclass=*" 
orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime

Table 43-12 shows the values of the status attributes when synchronization is successfully started.

Table 43-12   Attribute Values Indicating Successful Synchronization

Attribute	Value Indicating Successful Synchronization
Synchronization Status	Synchronization successful
Last Successful Execution Time	Date and time (Note: This must be close to the current date and time

An example of a result indicating successful synchronization is:

Synchronization successful November 04, 2003 15:56:03

Note: The date and time must be close to current date and time. When running the ldapsearch command, you need the dipadmin password, which, as established at installation, is the same as orcladmin password.

Scenario 6: One-Way Synchronization from Oracle Internet Directory to Microsoft Active Directory

In general, to set up this scenario, do the following:

1. On the first Microsoft Active Directory domain, perform Tasks 1 through 3 as described in "Tasks Common to Various Scenarios". You can call this domain, for example, a.MyOracle.com.

2. Perform Tasks 4 through 9 as described in this section.

As you perform Tasks 1 through 3, keep the following in mind:

• In Tasks 1 and 2, make sure that the Microsoft Active Directory host and port information is that of first domain server. In our example, this is a.MyOracle.com.

• In Task 2, the value of the Microsoft Active Directory domain must be properly supplied. Usually, this is the DN of the Microsoft Active Directory domain entry. In our example, this value is dc=a,dc=us,dc=MyCompany,dc=com.

Task 4: Create the Appropriate DIT Structure and Configure Required ACLs for User and Group Synchronization

Oracle Internet Directory does not have the complete DIT structure ready for use in a multiple-domain Microsoft Active Directory scenario. It requires performing the following:

• Creating some entries in Oracle Internet Directory. In our example, to create the users container for the first domain, it requires creating entries with following DNs:

  dc=a,dc=us,dc=mycompany,dc=com
  dc=b,dc=us,dc=mycompany,dc=com 
  cn=users,dc=a,dc=us,dc=mycompany,dc=com
  
  

  To create the users container for the second domain requires creating entries with following DN:

  cn=users,dc=b,dc=us,dc=mycompany,dc=com
  
  

• Assigning ACLs to the users containers to allow users and groups to be created under those containers

  Reset the User Search Base and Group Search Base to point to the value dc=us,dc=mycompany,dc=com. This allows all Oracle applications to be able to find users and groups in the two users containers.

• Creating an LDIF file by named multidomainditimp.ldif. This file creates the appropriate DIT structure and the required ACLs for our example.

  You can find an example of this file at "multidomaindit.ldif".

  To load this file, enter the following command:

  ldapmodify -h host  -p port -D DN of orcladmin -p password -f 
  multidomaindit.ldif
  

  For example:

  ldapmodify -h iasdemo  -p 3060 -D cn=orcladmin -p welcome1 
  
  -f multidomaindit.ldif
  

Task 5: Rename a Profile

Renaming a profile requires:

• Adding permissions for it in the directory. The permissions allow the directory integration and provisioning server to add, modify, and delete users and groups on behalf of the connector using the renamed profile.

• Removing permissions for the old profile

For example, using the sample file in the section "renameprofile.ldif", create a profile with the name renameprofile.ldif. The sample profile assumes that you are renaming a default export profile from ActiveExport to ActiveExport1. Do the following:

1. Modify the LDIF file to replace the names ActiveChgImp to ActiveExport and ActiveChgImp1 to ActiveExport1.

2. Enter the following command:

   ldapmodify -h host  -p port -D DN of orcladmin -p password -f 
   renameprofile.ldif
   
   

   For example:

   ldapmodify -h iasdemo  -p 3060 -D cn=orcladmin -p welcome1 -f 
   renameprofile.ldif
   

Task 6: Create Another Profile for the Second Microsoft Active Directory Domain Server (b.MyCompany.com)

To do this, enter the following command:

Dipassistant cp $ORACLE_HOME/ldap/odi/conf/activeexport.properties

This creates another profile named ActiveExport.

Task 7: On the New Profile, Perform Tasks 1 and 2

On the second directory domain, namely, b.MyOracle.com, perform Tasks 1 and 2 as described in "Tasks Common to Various Scenarios". Keep the following in mind:

• In Tasks 1 and 2, make sure that the Microsoft Active Directory host and port information is that of second domain server. In our example, this is b.MyOracle.com.

• In Task 2, the value of the Microsoft Active Directory domain must be properly supplied. Usually, it should be the DN of the Microsoft Active Directory domain entry. In the example described above, this value should be dc=b,dc=us,dc=MyCompany,dc=com.

Task 8: Start the Synchronization from Microsoft Active Directory to Oracle Internet Directory

This requires enabling the respective profile by setting the profileStatus attribute to ENABLE.

To start the synchronization enter the command:

Dipassistant mp -profile ActiveExport odip.profile.status = ENABLE
Dipassistant mp -profile ActiveExport1 odip.profile.status = ENABLE

This starts the synchronization from both Microsoft Active Directory domains to Oracle Internet Directory.

Task 9: Verify that Synchronization Has Started

Enter the following command:

ldapsearch -h oid_host -p oid_port -D cn=dipadmin -w orcladmin_password -b 
"orclodipagentname=ActiveExport,cn=subscriber profile,cn=changelog 
subscriber,cn=oracle internet directory' -s base "objectclass=*" 
orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime

Table 43-12 shows the values of the status attributes when synchronization is successfully started.

Table 43-13   Attribute Values Indicating Successful Synchronization

Attribute	Value Indicating Successful Synchronization
Synchronization Status	Synchronization successful
Last Successful Execution Time	Date and time (Note: This must be close to the current date and time

An example of a result indicating successful synchronization is:

Synchronization successful November 04, 2003 15:56:03

Note: The date and time must be close to current date and time. When running the ldapsearch command, you need the dipadmin password, which, as established at installation, is the same as orcladmin password.