9 Configuring External LDAP Providers

This chapter discusses how to configure OC4J to use non-Oracle LDAP servers. It is divided into the following sections:

Prerequisites
Creating a <login-module> Element in jazn-data.xml
An Example LDIF Description
Configuring Sun Java System Application Server as LDAP Provider
Configuring Microsoft Active Directory as LDAP Provider

Note:

Although OC4J supports non-Oracle LDAP servers, Oracle Identity Management does not. You cannot configure Oracle Identity Management to use a third-party LDAP server. Furthermore, you should not configure the JAAS Provider to use Oracle Identity Management as a third-party LDAP server; by doing so, you lose access to the optimizations and integrations available when using Oracle Identity Management as the native LDAP provider.

Prerequisites

Before you configure OC4J, you must complete the following prerequisites:

Install and configure Sun Java System Application Server (formerly iPlanet) or Active Directory.
Install and configure OC4J.
Locate the jazn-data.xml file associated with your OC4J instance. This is normally in the directory ORACLE_HOME/j2ee/instance_name/config. You will be editing this file using a text editor.

Note:
Although many jazn-data.xml files can be associated with an OC4J instance, the jazn-data.xml specified in the bootstrap jazn.xml serves as the default repository for JAAS login modules.
Locate the orion-application.xml file that controls your application. This file will normally be located in the directory ORACLE_HOME/j2ee/instance_name/application-deployment/application_name. You will be editing this file using a text editor.

Note:

Sample login module entries for Sun Java System Application Provider and Microsoft Active Directory are provided in the directory J2EE_HOME/jazn/config. A non-provider-specific login module entry is provided in J2EE_HOME/jazn/config/ldap_login_module.template.

Creating a <login-module> Element in jazn-data.xml

Each option in a <login-module> corresponds to a configuration setting in the LDAP provider. The supported options are listed in Table 9-2,Table 9-2 , and Table 9-3. Unless marked (optional), all options must be explicitly specified.

Table 9-1 LoginModule Provider Options

Option name	Meaning
oracle.security.jaas.ldap.provider.url	The URL of the LDAP provider in the format `hostname`:`portname`.
oracle.security.jaas.ldap.provider.principal	The Distinguished Name (DN) of the LDAP user that is used to connect to the LDAP server. This user must be an admiinstrator with privileges to search users and groups, and to invoke `ldapcompare` on a user password if the target directory supports this.
oracle.security.jaas.ldap.provider.credential	The credential (generally a password) used to authenticate the LDAP user defined in `oracle.security.jaas.ldap.provider.principal`.
oracle.security.jaas.ldap.provider.type	(Optional) The product name of the LDAP provider. Supported values are `iplanet`, `active directory`, and `other`. If you supply `iplanet` or `active directory`, the login module is able to infer some LDAP properties (for example, the group objectclass for active directory is "group") and do some optimizations.
oracle.security.jaas.ldap.provider.connect.pool	(Optional) Boolean: whether connection pooling is enabled. `True` (default) enables connection pooling, `false` disables it.
oracle.security.jaas.ldap.lm.cache_enabled	(Optional) Boolean: whether login module caching is enabled. `True` (default) enables caching, `false` disables it.

Table 9-2 LoginModule User Options

Option name	Meaning
oracle.security.jaas.ldap.user.name.attribute	The name of the LDAP attribute that uniquely identifies the name of the user. In Sun Java System Application Server, `uid`; on Active Directory, `sAMAccountName`.
oracle.security.jaas.ldap.user.objectclass	A list of space-separated LDAP schema object class(es) used to represent a use. On SSun Java System Application Server, `inetOrgPerson`.
oracle.security.jaas.ldap.user.searchbase	A list of space-separated based distinguished name (DN) in the LDAP directory that contains users. For example, `cn=users,dc=us,dc=abc,dc=com`
oracle.security.jaas.ldap.user.searchscope	Specifies how deep in the LDAP directory tree to search for users. Supported values: `subtree`, `onelevel`

Table 9-3 LoginModule Role Options

Option name	Meaning
oracle.security.jaas.ldap.role.name.attribute	The name of the LDAP attribute that uniquely identifies the name of the role. In iplanet, this would be `uniqueMember`; in Active Directory, it would be `member`.
oracle.security.jaas.ldap.role.object.class	A list of space-separated LDAP schema object classes that is used to represent a group. On Sun Java System Application Server, `groupOfUniqueNames`. On Active Directory, `group`.
oracle.security.jaas.ldap.role.searchbase	A list of space-separated distinguished names (DN) in the LDAP directory that contains group. For example, `cn=groups,dc=us,dc=abc,dc=com`
oracle.security.jaas.ldap.role.searchscope	Specifies how deep in the LDAP directory tree to search for roles. Supported values: `subtree`, `onelevel`.
oracle.security.jaas.ldap..role.membership.searchscope	Specifies how deep in the LDAP directory tree to search for role membership. Supported values: `direct`, `nested`.
oracle.security.jaas.ldap.role.member.attribute	The attribute of a static LDAP group object specifying the distinguished names (DNs) of the members of the group. On Sun Java System Application Server, `uniqueMember`; on Active Directory, `member`.

An Example LDIF Description

Table 9-3, "Sample LDIF Defining A User and Role" contains sample declarations for a user object and role object; each of the next two sections discusses how to map those objects to an LDAP provider.

Example 9-1 Sample LDIF Defining A User and Role

# An example user object entry
uid= jdoe,dc=us,dc=example,dc=com
uid= jdoe
givenName=John
sn=Doe
cn=John Doe
userPassword={SSHA}zD/44JbZY33osry4mzfLn0du7nBhIIAHKDG5Fg==
uidNumber=1
gidNumber=1
homeDirectory=c:\
objectClass=top
objectClass=person
objectClass=organizationalPerson
objectClass= inetOrgPerson
objectClass=posixAccount
 
# An example role object entry
cn=managers,ou=groups,dc=us,dc=example,dc=com
objectClass=top
objectClass= groupOfUniqueNames
cn=managers
uniqueMember=uid=jdoe,dc=us,dc=example,dc=com

Configuring Sun Java System Application Server as LDAP Provider

At this release, you must configure Sun Java System Application Server as your LDAP provider by editing the jazn-data.xml file to add a <login-module> corresponding to the Sun product. This section discusses the necessary changes.

Note:

A template file containing a sample login module entry for Sun Java System Application Server is provided in the file J2EE_HOME/jazn/config/sample_login_module.sun.

Open your jazn-data.xml file (see "Prerequisites") using a text editor.
Locate the <application> element representing your application. If there is no <application> element, create one.
Locate the <login-modules> section within the <application> element. If there is no <login-modules> element, create one.
Open your orion-application.xml file (see "Prerequisites") using a text editor.
Locate the <jazn> element within orion-application.xml. Set the provider property to "XML" and add a <property> element setting custom.ldap.provider to true. The edited <jazn> element should look like this:
```
 <jazn provider="XML">
     <property name="custom.ldap.provider" value="true"/>
  </jazn>
```
Restart the OC4J instance using Enterprise Manager.

SunOne Example

Suppose that your Sun Java System Application Server installation is described by the set of LDIF entries shown in Example 9-1.

The corresponding <jazn-loginconfig> entity is shown in Example 9-2.

Example 9-2 JAAS LoginModule Configuration Corresponding To Example 9-1

<jazn-loginconfig>
<application>
<name>callerInfo</name>
<login-modules>
<login-module
<class>oracle.security.jazn.login.module.LDAPLoginModule</class>
<control-flag>required</control-flag>
<options>
... irrelevant options omitted ...
<option>
<name>oracle.security.jaas.ldap.user.name.attribute</name>
<value>uid</value>
</option>
<option>
<name>oracle.security.jaas.ldap.user.object.class</name>
<value>inetOrgPerson</value>
</option>
<option>
<name>oracle.security.jaas.ldap.user.searchbase</name>
<value>dc=us,dc=example,dc=com</value>
</option>
<option>
<name>oracle.security.jaas.ldap.role.name.attribute</name>
<value>cn</value>
</option>
<option>
<name>oracle.security.jaas.ldap.role.object.class</name>
<value>groupOfUniqueNames</value>
</option>
<option>
<name>oracle.security.jaas.ldap.role.searchbase</name>
<value>ou=groups,dc=us,dc=example,dc=com</value>
</option>
<option>
<name>oracle.security.jaas.ldap.member.attribute</name>
<value> uniqueMember </value>
</option>
</options>
</login-module>
</login-modules>
</application>
</jazn-loginconfig>

Configuring Microsoft Active Directory as LDAP Provider

At this release, you must configure Microsoft Active Directory as your LDAP provider by editing the jazn-data.xml file to add a <login-module> corresponding to the Microsoft product. This section discusses the necessary changes.

Note:

A template file containing a sample login module entry for Active Directory is provided in the file J2EE_HOME/jazn/config/sample_login_module.ad

Locate the <application> element representing your application. If there is no <application> element, create one.
Locate the <login-modules> section within the <application> element. If there is no <login-modules> element, create one.
Edit the <option> elements to specify appropriate values for Microsoft Active Directory. Save the edited file.
Open your orion-application.xml file (see "Prerequisites") using a text editor.
Locate the <jazn> element within orion-application.xml. Set the provider property to "XML" and add a <property> element setting custom.ldap.provider to true. The edited <jazn> element should look like this:
```
 <jazn provider="XML">
     <property name="custom.ldap.provider" value="true"/>
  </jazn>
```
Restart the OC4J instance using Enterprise Manager.