Contents

Title and Copyright Information

Send Us Your Comments

Preface

Intended Audience

Documentation Accessibility

Related Documentation

What's New in Oracle Identity Management Integration?

New Features Introduced with Oracle Application Server 10g Release 2 (10.1.2)

New Features Introduced with Oracle Internet Directory 10g (9.0.4)

New Features Introduced with Oracle Internet Directory Release 9.0.2

New Features Introduced with Oracle Internet Directory Release 3.0.1

New Features Introduced with Oracle Internet Directory Release 2.1.1

Part I Getting Started with Oracle Identity Management Integration

1 Introduction to Oracle Identity Management Integration

Why Oracle Identity Management Integration?

Installation Options

Synchronization, Provisioning, and the Difference Between Them

Synchronization

How Synchronization and Provisioning Differ

Components Involved in Oracle Identity Management Integration

Oracle Internet Directory

Oracle Directory Integration and Provisioning Server

Oracle Application Server Single Sign-On

2 Security Features in Oracle Directory Integration and Provisioning

Authentication in Oracle Directory Integration and Provisioning

Secure Sockets Layer (SSL) and Oracle Directory Integration and Provisioning

Oracle Directory Integration and Provisioning Server Authentication

Profile Authentication

Access Control and Authorization and Oracle Directory Integration and Provisioning

Access Controls for the Oracle Directory Integration and Provisioning Server

Access Controls for Profiles

Data Integrity and Oracle Directory Integration and Provisioning

Data Privacy and Oracle Directory Integration and Provisioning

Tools Security and Oracle Directory Integration and Provisioning

Part II General Administration of Oracle Directory Integration and Provisioning

3 Oracle Directory Integration and Provisioning Administration Tools

The Oracle Directory Integration and Provisioning Server Administration Tool

Starting the Oracle Directory Integration and Provisioning Server Administration Tool

Connecting to a Directory Server by Using the Oracle Directory Integration and Provisioning Server Administration Tool

Navigating the Oracle Directory Integration and Provisioning Server Administration Tool

Disconnecting from a Directory Server by Using the Oracle Directory Integration and Provisioning Server Administration Tool

Configuring the Display and Duration of Searches in the Oracle Directory Integration and Provisioning Server Administration Tool

Configuring the Display of ACPs in the Oracle Directory Integration and Provisioning Server Administration Tool

Graphical Tools for Oracle Directory Integration and Provisioning Administration

Oracle Directory Manager

Oracle Internet Directory Self-Service Console

Command-Line Tools for Oracle Directory Integration and Provisioning Administration

OID Control and OID Monitor

The Oracle Directory Integration and Provisioning Server Registration Tool (odisrvreg)

Directory Integration and Provisioning Assistant (dipassistant)

The Provisioning Subscription Tool (oidprovtool)

Entry and Attribute Management Command-Line Tools

The schemasync Tool

4 Managing the Oracle Directory Integration and Provisioning Server

Operational Information about the Oracle Directory Integration and Provisioning Server

Directory Integration Profiles

The Oracle Directory Integration and Provisioning Server and Configuration Set Entries

Standard Sequences of Directory Integration and Provisioning Server Events

Oracle Directory Integration and Provisioning Event Propagation in a Multimaster Oracle Internet Directory Replication Environment

Viewing Oracle Directory Integration and Provisioning Server Information

Viewing Oracle Directory Integration and Provisioning Server Runtime Information by Using the Oracle Directory Integration and Provisioning Server Administration Tool

Viewing Oracle Directory Integration and Provisioning Server Runtime Information by Using ldapsearch

Managing Configuration Set Entries Used by the Oracle Directory Integration and Provisioning Server

Managing the SSL Certificates of Oracle Internet Directory and Connected Directories

Starting, Stopping, and Restarting the Oracle Directory Integration and Provisioning Server

Starting the Oracle Directory Integration and Provisioning Server

Stopping the Oracle Directory Integration and Provisioning Server

Restarting the Oracle Directory Integration and Provisioning Server

Starting and Stopping the Oracle Directory Integration and Provisioning Server in a High Availability Scenario

The Oracle Directory Integration and Provisioning Server in a Real Application Cluster Environment

The Oracle Directory Integration and Provisioning Server in an Oracle Application Server Cold Failover Cluster (Infrastructure)

Setting the Debug Level for the Oracle Directory Integration and Provisioning Server

Managing Oracle Directory Integration and Provisioning in a Replicated Environment

Finding the Log Files

Manually Registering the Oracle Directory Integration and Provisioning Server

Manually Registering the Oracle Directory Integration and Provisioning Server by Using Oracle Enterprise Manager 10g Application Server Control Console

Part III Synchronization in Oracle Identity Management Integration

5 Oracle Directory Synchronization Service

Components Involved in Oracle Directory Synchronization

Connectors for Directory Synchronization

Directory Synchronization Profiles

How Synchronization Works

Synchronizing from Oracle Internet Directory to a Connected Directory

Synchronizing from a Connected Directory to Oracle Internet Directory

Synchronizing with Directories with Interfaces Not Supported by Oracle Internet Directory

6 Configuration of Directory Synchronization Profiles

Registration of Connectors into Oracle Directory Integration and Provisioning

Sample Synchronization Profiles

Configuring Connection Details

Additional Configuration Information

The SearchDeltaSize Parameter

The SkipErrorToSyncNextChange Parameter

Configuring Mapping Rules

Distinguished Name Mapping

Attribute-Level Mapping

How to Construct a New Mapping File

Supported Attribute Mapping Rules and Examples

Example: A Mapping File for a TAGGED-File Interface

Example: Mapping Files for an LDIF Interface

Updating Mapping Rules

Applying Matching Filters

Filtering Changes with an LDAP Search

Filtering Changes from a Change Log

Location and Naming of Files

7 Administration of Directory Synchronization

Managing Synchronization Profiles by Using the Oracle Directory Integration and Provisioning Server Administration Tool

Creating a Profile by Using the Oracle Directory Integration and Provisioning Server Administration Tool

Deleting a Profile by Using the Oracle Directory Integration and Provisioning Server Administration Tool

Changing the Synchronization Status Attribute

Managing Synchronization Profiles by Using Command-Line Tools

8 Bootstrapping of a Directory in Oracle Directory Integration and Provisioning

About Directory Bootstrapping in Oracle Directory Integration and Provisioning

Bootstrapping by Using a Parameter File

Bootstrapping Without Using an LDIF File

Bootstrapping by Using an LDIF File

Bootstrapping Directly by Using the Default Integration Profile

9 Synchronization with Relational Database Tables

Preparing the Additional Configuration Information File

Preparing the Mapping File

Preparing the Directory Integration Profile

Example: Synchronizing a Relational Database Table to Oracle Internet Directory

Configuring the Additional Configuration Information File

Configuring the Mapping File

Configuring the Directory Integration Profile

Uploading the Additional Configuration Information File

Uploading the Mapping File

The Synchronization Process

Observations on the Example

10 Synchronization with Oracle Human Resources

Introduction to Synchronization with Oracle Human Resources

Data that You Can Import from Oracle Human Resources

Managing Synchronization Between Oracle Human Resources and Oracle Internet Directory

Task 1: Configure a Directory Integration Profile for the Oracle Human Resources Connector

Task 2: Configure the List of Attributes to Be Synchronized with Oracle Internet Directory

Task 3: Configure Mapping Rules for the Oracle Human Resources Connector

Task 4: Prepare for Synchronization from Oracle Human Resources to Oracle Internet Directory

The Synchronization Process

Bootstrapping Oracle Internet Directory from Oracle Human Resources

11 Synchronization with Third-Party Metadirectory Solutions

About Change Logs

Enabling Third-Party Metadirectory Solutions to Synchronize with Oracle Internet Directory

Task 1: Perform Initial Bootstrapping

Task 2: Create a Change Subscription Object in Oracle Internet Directory for the Third-Party Metadirectory Solution

The Synchronization Process

How a Connected Directory Retrieves Changes the First Time from Oracle Internet Directory

How a Connected Directory Updates the orclLastAppliedChangeNumber Attribute in Oracle Internet Directory

Disabling and Deleting Change Subscription Objects

Disabling a Change Subscription Object

Deleting a Change Subscription Object

Part IV Provisioning in Oracle Identity Management

12 The Oracle Provisioning Service

About Provisioning

Provisioning Procedures

User Enrollment in Applications

Provisioning Information

How the Oracle Provisioning Service Works

How the Oracle Provisioning Service Retrieves Changes from Oracle Internet Directory

How an Application Registers with the Oracle Provisioning Service

How an Application Receives Provisioning Information from Oracle Internet Directory

How Oracle Internet Directory Receives Provisioning Information from an Application

How an Application Unsubscribes from the Oracle Provisioning Service

About the Oracle Directory Integration and Provisioning Server

Security and the Oracle Provisioning Service

The Need to Control Access to Provisioning Profiles

Entities Needing Access

Entry-Level Privileges Granted to Entities

Attribute-Level Privileges Granted to Entities

13 Administration of Oracle Provisioning Service

Overview: Deploying the Oracle Provisioning Service

Managing Provisioning Profiles

14 Integration of Provisioning Data with the Oracle E-Business Suite

Part V Integrating with Third-Party Identity Management Systems

15 Considerations for Integrating with Third-Party Directories

Preliminary Considerations for Integrating with a Third-Party Directory

Choose Which Directory Is to Be the Central Enterprise Directory

Oracle Internet Directory as the Central Enterprise Directory

Third-Party Directory as the Central Directory

Choose Where to Store Passwords

Advantages and Disadvantages of Storing the Password in One Directory

Advantages and Disadvantages of Storing the Password in Both Directories

Choose the Structure of the Directory Information Tree

Create Identical DIT Structures on Both Directories

Distinguished Name Mapping and Limitations

Select the Attribute for the Login Name

Select the User Search Base

Select the Group Search Base

Decide How to Address Security Concerns

Step-by-Step Guide to Configuring Synchronization with a Third-Party Directory

Limitations of Third-Party Integration in Oracle Internet Directory 10g Release 2 (10.1.2)

16 Integration with the Microsoft Active Directory Environment

Concepts and Architecture of Microsoft Active Directory Integration

Components for Integrating with Microsoft Active Directory

How Oracle Directory Integration and Provisioning Maintains Synchronization

Oracle Internet Directory Schema Elements for Integration with Microsoft Active Directory

Directory Information Tree in an Integration with Microsoft Active Directory

Deployment Options for Integrating with Microsoft Active Directory

Deployments with Oracle Internet Directory as the Central Directory

Deployments with Microsoft Active Directory as the Central Directory

Configuration of Integration with Microsoft Active Directory

Configuring the Realm

Configuring Synchronization Profiles

Customizing Access Control Lists

Configuring the Active Directory Connector for Synchronization in SSL Mode

Considerations for Synchronizing with a Multiple-Domain Microsoft Active Directory Environment

Configuring the Active Directory Connector Profiles

Configuring the Active Directory External Authentication Plug-in

Configuring Windows Native Authentication

Configuring Synchronization of Oracle Internet Directory Foreign Security Principal References with Microsoft Active Directory

Managing Integration with Microsoft Active Directory

Tasks After Configuring with Microsoft Active Directory

Typical Management of Integration with Microsoft Active Directory

17 Integration with the Microsoft Windows NT 4.0 Environment

Overview of Integration with Microsoft Windows NT 4.0

Installing and Configuring Windows NT External Authentication and Auto-Provisioning Plug-ins

Installing and Enabling the Windows NT External Authentication and Provisioning Plug-ins

Managing the Windows NT External Authentication and Provisioning Plug-ins

18 Integration with SunONE (iPlanet) Directory Server

About the SunONE Connector

SunONE Directory Server Integration Concepts

Synchronization Between Oracle Internet Directory and SunONE Directory Server

Synchronization of Deletions from SunONE Directory Server to Oracle Internet Directory

The SunONE Directory Server External Authentication Plug-in

Configuring the SunONE Connector

Task 1: Configure the Synchronization Profiles for the SunONE Connector

Task 2: Configure Access Control Lists

Task 3: Prepare Both Directories for Synchronization

Task 4: (Optional) Configure the SunONE Directory Server External Authentication Plug-in

Task 5: Start the Synchronization

The Synchronization Process

Supported Configurations for Integrating with SunONE Directory Server

Part VI Appendixes

A Syntax for LDIF and Command-Line Tools

LDAP Data Interchange Format (LDIF) Syntax

Starting, Stopping, Restarting, and Monitoring Oracle Internet Directory Servers

The OID Monitor (oidmon) Syntax

The OID Control Utility (oidctl) Syntax

The OPMN Control Utility (opmnctl) Syntax for Starting and Stopping Oracle Internet Directory Servers

OID Server Diagnostic Tool (oiddiag)

OID Server Diagnostic Tool Syntax

OID Server Diagnostic Tool Usage Examples

Entry and Attribute Management Command-Line Tools Syntax

The Catalog Management Tool (catalog.sh) Syntax

ldapaddmt Syntax

ldapbind Syntax

ldapcompare Syntax

ldapdelete Syntax

ldapmoddn Syntax

ldapmodify Syntax

ldapmodifymt Syntax

ldapsearch Syntax

Bulk Operations Command-Line Tools Syntax

bulkdelete Syntax

bulkload Syntax

bulkmodify Syntax

ldifwrite Syntax

The schemasync Tool Syntax

The Oracle Directory Integration and Provisioning Server Registration Tool (odisrvreg)

The Directory Integration and Provisioning Assistant (dipassistant) Syntax

Creating, Modifying, and Deleting Synchronization Profiles

Listing All Synchronization Profiles in Oracle Internet Directory

Viewing the Details of a Specific Synchronization Profile

Performing an Express Configuration of the Active Directory Connector Profiles

Bootstrapping a Directory by Using the Directory Integration and Provisioning Assistant

Properties Expected by the Bootstrapping Command

Setting the Wallet Password for the Oracle Directory Integration and Provisioning Server

Changing the Password of the Administrator of Oracle Directory Integration and Provisioning

Moving an Integration Profile to a Different Identity Management Node

Limitations of the Directory Integration and Provisioning Assistant in Oracle Internet Directory 10g Release 2 (10.1.2)

The Provisioning Subscription Tool (oidprovtool) Syntax

OID Database Password Utility (oidpasswd) Syntax

Changing the Password to the Oracle Internet Directory Database

Creating Wallets for the Oracle Internet Directory Database Password and the Oracle Directory Replication Server Password

Unlocking a Super User Account

Resetting the Super User Password

Managing Super User Restricted ACPs

OID Database Statistics Collection Tool (oidstats.sh) Syntax

The OID Migration Tool (ldifmigrator) Syntax

Examples: Using the OID Migration Tool

OID Migration Tool Error Messages

B LDAP Schema Elements for Oracle Directory Integration and Provisioning

C Elements in the Oracle Directory Integration and Provisioning Server Administration Tool

Windows and Fields for Connecting to a Directory Server

Configure Entry Management

Configure Access Control Policy Management

Directory Server Connection

Select Distinguished Name (DN) Path: Tree View

Select Directory Server

Windows and Fields for Viewing Server Information

Active Processes

Configuration Sets: Integration Profiles

Windows and Fields for Registering and Editing a Directory Integration Profile

Integration Profiles

Windows and Fields for Configuring the Active Directory Connector

Active Directory Connector Express Synchronization Setup

D Case Study: A Deployment of Oracle Directory Integration and Provisioning

Components in the MyCompany Enterprise

Requirements of the MyCompany Enterprise

Overall Deployment in the MyCompany Enterprise

User Creation and Provisioning in the MyCompany Enterprise

Modification of User Properties in the MyCompany Enterprise

Deletion of Users in the MyCompany Enterprise

E Troubleshooting Oracle Directory Integration and Provisioning

Troubleshooting the Oracle Directory Integration and Provisioning Server

Troubleshooting the Oracle Directory Integration and Provisioning Server in an Infrastructure Installation

Troubleshooting the Oracle Directory Integration and Provisioning Server in an Oracle Directory Integration and Provisioning-Only Installation

Troubleshooting Utilities

Troubleshooting Provisioning

Troubleshooting Synchronization

Oracle Directory Integration and Provisioning Server Synchronization Process Flow

Checklist for Debugging Synchronization

Sample Valid Trace Files in Debug Level 63 Mode

Troubleshooting Integration with Microsoft Active Directory

Debugging the Active Directory Connector

Debugging Windows Native Authentication

Troubleshooting the Microsoft Active Directory External Authentication Plug-in

Troubleshooting Integration with the SunONE Connector

Troubleshooting Error Messages and Other Problems

Location of Error Messages

Oracle Directory Integration and Provisioning Server Errors

Provisioning Errors and Problems

Synchronization Errors and Problems

Windows Native Authentication Error and Problems

Microsoft Active Directory and SunONE Directory Server Synchronization Errors and Problems

Need More Help?

Glossary

Index