Default Directory Information Tree and Identity Management Realm

To make configuration easier, Oracle Internet Directory, at installation, creates a default DIT and sets up a default identity management realm. It gives you the option of setting up a DIT based on the domain of the computer on which the installation is performed. For example, if the installation is on a computer named oidhost.us.mycompany.com, then the root of the default identity management realm is dc=us,dc=mycompany,dc=com. Oracle Internet Directory creates the following:

• An Oracle Context associated with the default identity management realm. The Oracle Context stores all the realm-specific policies and metadata. Using the example in the previous paragraph, it creates the Oracle Context with the distinguished name cn=OracleContext,dc=us,dc=mycompany,dc=com. This entry and the nodes under it enable Oracle software to detect realm-specific policies and settings.

• A directory structure and naming policies in the default identity management realm. These enable Oracle components to locate various identities. The default values for these are:
  • All users are located in the container cn=users under the base of the identity management realm. In this example, it is cn=users,dc=us,dc=mycompany,dc=com.

  • Any new users created in the identity management realm using the Oracle Identity Management infrastructure are also created under the cn=users container.

  • All new users created in the identity management realm using the Oracle Identity Management infrastructure belong to the object classes orclUserV2 and inetOrgPerson.

  • All groups are located in the container cn=groups under the base of the identity management realm. In this example, it is cn=groups,dc=us,dc=mycompany,dc=com.

• Identity management realm administrator. This user, called cn=orcladmin, is located under the users container. In this example, the fully qualified DN of the bootstrap user is cn=orcladmin,cn=users,dc=us,dc=mycompany,dc=com.

• Default authentication policies, which enable authentication services to perform the appropriate actions. These include:
  • The default directory password policy--for example, password length, lockout, and expiration

  • Additional password verifiers that need to be automatically generated when provisioning the user

• Identity management authorizations. Oracle Internet Directory grants these to the bootstrap user who can further delegate these authorizations through the Oracle Internet Directory Self-Service Console. Some of these authorizations include:
  • Common identity management operational privileges--for example, user creation, user profile modification, group creation

  • Privileges to install new Oracle components by using the Oracle Identity Management infrastructure.

  • Privileges to administer Oracle Internet Directory Self-Service Console

    See Also: "Optional Attributes of the orclUserV2 Object Class" for more information about the orclUserV2 object class Chapter 17, "Delegation of Privileges for an Oracle Technology Deployment" for a fuller description of the default access control policies in Oracle Identity Management