Skip Headers
Oracle® Application Server Developer's Guide for Microsoft Office Interoperability
10g Release 3 (10.1.3.1.0)
Part Number B28947-01
Go to Documentation Home
Home		 Go to Book List
Book List		 Go to Table of Contents
Contents		 Go to Index
Index		 Go to Feedback page
Contact Us
Go to previous page
Previous		 Go to next page
Next
View PDF

10 Provisioning User Identity Information and Alerting Microsoft Outlook Contacts

This chapter describes how you can do the following:

It contains the following sections:

10.1 Overview

Whether user information is stored in Microsoft Active Directory, or in Oracle Internet Directory, it is expected that information in Microsoft Outlook Contacts is always up-to-date. When changes are made in an enterprise application, such as Sales Force Automation, or a Human Resources Management Systems, updates to the directory should be reflected immediately in Microsoft Outlook Contacts. In addition, alerts about organizational changes may need to be sent as soon as they happen.

Oracle Identity Management enables you to reduce administrative time and costs by integrating your applications and directories, including third-party LDAP directories, with Oracle Internet Directory. It does this by using Oracle Directory Integration Platform.

Throughout the integration process, Oracle Directory Integration Platform ensures that the applications and other directories receive and provide the necessary information in a reliable way. Oracle provides centralized security administration by integrating components with Oracle Identity Management. Similarly, Microsoft provides centralized security administration in Microsoft Windows by integrating Microsoft applications with Microsoft Active Directory. If your environment uses both Oracle Identity Management and Microsoft Active Directory, then, to enable interoperability between the two systems, you must synchronize their data. You can do this by using Oracle's Active Directory Connector.

This chapter describes what must be done to ensure contact data in Microsoft Outlook Contacts is always up-to-date in an environment where both Microsoft Exchange and Microsoft Active Directory are used together with Oracle Internet Directory. Microsoft Active Directory and Oracle Internet Directory must be synchronized (integrated) in order to ensure that both have the same up-to-date contact data. This chapter describes how to achieve accurate and timely directory synchronization.

In addition, this chapter also covers the steps that must be performed if an Oracle solution is used to send alerts about organizational changes. These steps include configuring Oracle Directory Integration Platform and Oracle BPEL Process Manager to generate organization alerts whenever user identity information changes in Oracle Internet Directory.

When user identity information changes in an enterprise application, Oracle Internet Directory is updated with this information. Using Active Directory Connector to synchronize Microsoft Active Directory and Oracle Internet Directory ensures that Microsoft Outlook Contacts data is always up-to-date.


Note:

If you are using Oracle Collaboration Suite applications with Microsoft Outlook, then you must use Oracle Connector for Outlook, to enable interoperability of management tasks in Oracle Collaboration Suite applications with Microsoft Outlook. Refer to Chapter 9, "Managing Tasks and Collaborating in Microsoft Outlook" for more information.

The following topics describe the components used in enabling interoperability between Oracle Identity Management and Microsoft Active Directory, and a few related concepts.

Oracle Internet Directory

Oracle Internet Directory is a critical component of Oracle Application Server management and security infrastructure. It ensures that user accounts and groups are managed centrally through the LDAP Version 3 standard. Oracle Application Server enables user accounts and groups to be created centrally in Oracle Internet Directory and shared across all components in Oracle Application Server. When users log in, they are authenticated once by Oracle Application Server Single Sign-On against their Oracle Internet Directory credentials, and can thereby access multiple applications seamlessly.

Oracle Directory Integration Platform

Oracle Directory Integration Platform enables users to synchronize data between various directories and Oracle Internet Directory. Oracle Directory Integration Platform is a set of services and interfaces that makes it possible to develop synchronization solutions with third-party directories and other enterprise repositories. Oracle Directory Integration Platform includes a connector, called Active Directory Connector, for out-of-the-box synchronization with Microsoft Active Directory.

Oracle Application Server Single Sign-On

OracleAS Single Sign-On enables users to access Oracle Web-based components by logging in only once. Oracle components delegate the login function to the OracleAS Single Sign-On server. When a user first logs in to an Oracle component, the component directs the login to the OracleAS Single Sign-On server. The OracleAS Single Sign-On server compares the credentials entered by the user to those stored in Oracle Internet Directory. After verifying the credentials, the OracleAS Single Sign-On server grants the user access to all components the user is authorized to use throughout the current session.

OracleAS Single Sign-On enables native authentication in a Microsoft Windows environment, using the user's Kerberos credentials.


See Also:

Oracle Identity Management Integration Guide for details about configuring Windows native authentication.

Directory Synchronization

Synchronization, which is a service of Oracle Directory Integration Platform, enables you to make changes persist between Oracle Internet Directory and connected directories, like Microsoft Active Directory. For all directories to both use and provide only the latest data, each directory must be informed of change made in the other connected directories. Synchronization ensures that any change to directory information is kept consistent.

Connectors for Directory Synchronization

To synchronize between Oracle Internet Directory and a connected directory, Oracle Directory Integration Platform relies on a prepackaged connectivity solution called a connector. Minimally, this connector consists of a directory integration profile containing all the configuration information required for synchronization, including the following:

Active Directory Connector

Oracle Directory Integration Platform includes connectors to synchronize Oracle Internet Directory with other LDAP directories or identity stores. One of its connectors, Active Directory Connector, is designed to synchronize Oracle Internet Directory with Microsoft Active Directory.

Active Directory Connector enables any the following:

Using Active Directory Connector for Microsoft Exchange Provisioning

Active Directory Connector, available as part of Oracle Identity Management release 10.1.2, can be used for provisioning users to Microsoft Exchange. This is applicable in deployments having Microsoft Active Directory Server 2000 or later as their identity store. Provisioning users to Microsoft Exchange Server involves creating a user account in the corresponding Microsoft Active Directory with Microsoft Exchange-specific user attributes. These attributes contain details about the Microsoft Exchange server, mail transfer agent, proxy address, and so on. To configure provisioning to Microsoft Exchange, the default mapping rules for Active Directory Connector are enhanced to include Microsoft Exchange-specific mapping rules.

10.2 Prerequisites

In the scenario described in this chapter, it is assumed that you have deployed Microsoft Exchange 2000 or later with Microsoft Active Directory as its back-end repository, and Microsoft Office, specifically Microsoft Outlook as the e-mail client. The scenario expects the following Oracle software components to be installed:

10.3 Step-by-Step Procedures

This section will provide the following procedures, based on example data:

10.3.1 Procedure 1: Synchronizing Enterprise Identity Information

User identity information can be stored in many places, but some common directories are Oracle Internet Directory and Microsoft Active Directory. Microsoft Exchange version 2000 or later uses Microsoft Active Directory as its identity store. This procedure shows you how to synchronize Oracle Internet Directory with Microsoft Active Directory.

A very common enterprise scenario is illustrated in Figure 10-1. Enterprise applications, for example, the Human Resources Management System, update user identity information in Oracle Internet Directory. Oracle Directory Integration Platform synchronizes user identity information between Oracle Internet Directory and Microsoft Active Directory by using Active Directory Connector. Microsoft Active Directory is used by Microsoft Exchange as the identity store. Users in the enterprise use Microsoft Outlook to read their e-mail and to get up-to-date contact information. Besides setting up the Microsoft Active Directory synchronization, you must perform some additional configuration to provision Microsoft Exchange-specific attributes.

Figure 10-1 Oracle Internet Directory Interoperability with Microsoft Active Directory and Microsoft Exchange

Description of Figure 10-1 follows
Description of "Figure 10-1 Oracle Internet Directory Interoperability with Microsoft Active Directory and Microsoft Exchange"

The subsequent example describes how Microsoft Exchange and Microsoft Active Directory may need to be synchronized with Oracle Internet Directory.

The context of this example is the Union Loan Company, which has hundreds of employees. Union Loan Company uses Oracle Application Server for its enterprise applications, Oracle Internet Directory for central identity management, and Microsoft Exchange server with Microsoft Active Directory for e-mail and contact information. Employees use Microsoft Outlook.

Assume that Union Loan Company hires John Steinbeck as a new loan approver. John's personal information is entered into the Human Resources Management System, and provisioned to Oracle Internet Directory. Directory synchronization is set up between Oracle Internet Directory and Microsoft Active Directory. Additional configuration modifications ensure that all the Microsoft Exchange-specific attributes were modified appropriately. As a result, John's profile now shows up in Microsoft Outlook and John's manager and co-workers can now quickly look up his telephone number. Directory integration ensures that change in user identity information, such as a change of John's telephone number, will almost immediately be visible in everyone's Microsoft Outlook Contacts.

To provision users in Microsoft Exchange, that is, to push data from Oracle Internet Directory to Microsoft Active Directory, you must use Active Directory Connector to synchronize all the attributes of the data that is exchanged. Figure 10-1 illustrates how this interoperability works. To ensure that this data is ready to be used by Microsoft Exchange, however, you must make some changes to the mapping rules. To synchronize between Oracle Internet Directory and Microsoft Active Directory, a directory integration profile for synchronization must be created that contains all the configuration information required for synchronization to Microsoft Exchange. To do this, perform the steps in the following sections:

10.3.1.1 Configuring Microsoft Active Directory Synchronization Profiles for Microsoft Exchange

The Oracle Directory Integration Platform server includes an express configuration option that you can run with Directory Integration and Provisioning Assistant. This type of configuration uses certain predefined values and creates two synchronization connector profiles, one for import and one for export, pointing to Microsoft Active Directory.


See Also:

Oracle Identity Management Integration Guide for more information about express configuration.

Run express configuration by using the Directory Integration and Provisioning Assistant tool as follows:

  1. Start the Oracle Directory Integration Platform Server Administration tool by entering the following command:

    INFRA_ORACLE_HOME/bin/dipassistant expressconfig –h <oid_host> 
 -p <oid_non-SSL_port> -configset <DIP_configuration_set> 
 -3rdpartyds adforexchange

    where, DIP_configuration_set refers to the configuration set for Oracle Directory Integration Platform. The default value is 1. For example:

    INFRA_ORACLE_HOME/bin/dipassistant expressconfig –h m1.abc.com \
-p 389 -configset 1 -3rdpartyds adforexchange

  2. You are prompted for information about the setup. Enter appropriate values as described in Table 10-2.

    Table 10-2 Parameters for Running the dipassistant Tool

    Parameter Description

    OID user name

    Oracle Internet Directory user name.

    Specify the super user, that is, cn=orcladmin, or any user that is a member of the Directory Integration and Provisioning Administrators group (cn=dipadmingrp, cn=odi, cn=oracle internet directory).

    OID password

    Password for the Oracle Internet Directory user.

    Active Directory Host

    Host name of the Microsoft Active Directory.

    Active Directory Port

    Microsoft Active Directory port number.

    Account Name

    User name of a privileged Microsoft Active Directory user.

    Note: To synchronize deletions, you must have the necessary administrative privileges in Microsoft Active Directory, for example, administrator@MyCompany.com.

    Account Password

    Microsoft Active Directory password.

    Connector name

    Name for the connector. Depending on the name specified here, two profiles, an import and an export profile, are created with names as <connector name>Import and <connector name>Export respectively.

    For example, if you specify the name test, then the tool creates two profiles: testImport and testExport.

    Options to configure ACLs

    ACL configuration options. Enter y to update the access control policies for the default realm user search base, to give Oracle components the required access.Default value is n.

Running express configuration creates two synchronization connector profiles pointing to Microsoft Active Directory. The <Connectorname>IMPORT profile maintains the configuration information for importing user identity information from Microsoft Active Directory to Oracle Internet Directory and the <Connectorname>EXPORT profile maintains configuration details for exporting changes from Oracle Internet Directory to Microsoft Active Directory. By default, both profiles are configured to synchronize the data between the connected directories in one minute intervals. At the end of the express configuration, the necessary mapping rules are configured to handle Microsoft Active Directory and Microsoft Exchange-specific attributes in case of export of users from Oracle Internet Directory to the Microsoft Active Directory.

10.3.1.2 Enabling the Profiles for Synchronization

You now must enable the export and import profiles by performing the following steps:

  1. If user identity information changes are made only in Human Resources Management System, from which the identity details are synchronized to Oracle Internet Directory, then users are synchronized from Oracle Internet Directory to Microsoft Active Directory. In this case, enable the export synchronization profile by using the Oracle Directory Integration Platform Server Administration tool with the modifyprofile option. The following Oracle Directory Integration Platform assistant command enables an export profile:

    INFRA_ORACLE_HOME/bin/dipassistant modifyprofile -profile <profile_name>
 [-host <oid_host>] [-port <oid_port>] [-dn "<oid_bindDN>"] 
 [-passwd <oid_bindDN_password>] odip.profile.status=ENABLE

    The following is an example of a command used to enable an export profile named testExport:

    INFRA_ORACLE_HOME/bin/dipassistant modifyprofile –profile testExport \
 -host m1.abc.com -port 389 \
 -dn "cn=orcladmin" -passwd welcome1 odip.profile.status=ENABLE

    In addition, if user entries created from a Human Resources Management System can be modified from Microsoft Active Directory and Microsoft Exchange server, then you must synchronize the data from Microsoft Active Directory to Oracle Internet Directory. In this case, you must enable the import profile. The following Oracle Directory Integration Platform assistant command enables an import profile:

    INFRA_ORACLE_HOME/bin/dipassistant modifyprofile -profile <profile_name>
 [-host <oid_host>] [-port <oid_port>] [-dn "<oid_bindDN>"]
 [-passwd <oid_bindDN_password>] odip.profile.status=ENABLE

    The following is an example of a command used to enable an import profile named testImport:

    INFRA_ORACLE_HOME/bin/dipassistant modifyprofile –profile testImport \
 -host m1.abc.com -port 389 \
 -dn "cn=orcladmin" -passwd welcome1 odip.profile.status=ENABLE

  2. Start the Oracle Directory Integration Platform server as follows if this is not already running with the configuration set that contains the Microsoft Exchange profiles:

    oidctl connect=<oid_metadatarep_connect_string> server=odisrv
 instance=<instance_number> configset=<configuration_set_number>
 [flags="flagname=<value> ..."]  {start | stop | restart}

    For example:

    oidctl connect=dbs1 server=odisrv instance=1 configset=1 \
 flags="host=ldaphost.company.com port=389" start

10.3.1.3 Verifying the Synchronization

To verify that the synchronization between Oracle Internet Directory and Microsoft Active Directory is working properly, perform the following steps:

  1. After you have enabled the profiles, you can verify the status of synchronization by running the following command (the default interval for change synchronization is 1 minute):

    INFRA_ORACLE_HOME/bin/ldapsearch -h <oid_host> -p <oid_port> 
-D "<DN of privileged oid user>" -w "<password of privileged oid user>"
-b "orclodipagentname=testExport,cn=subscriber profile,
cn=changelog subscriber,cn=oracle internet directory" 
-s base "objectclass=*" 
orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime

    For example:

    INFRA_ORACLE_HOME/bin/ldapsearch -h m1.abc.com -p 389 -D "cn=orcladmin" \
-w "welcome1" 
-b "orclodipagentname=testExport,cn=subscriber profile,\
cn=changelog subscriber,cn=oracle internet directory" \
-s base "objectclass=*" \
orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime

    When synchronization is successfully started:

    • The value of the orclodipsynchronizationstatus attribute is Synchronization Successful.

    • The value of the orclodiplastsuccessfulexecutiontime attribute is the specific date and time of that execution. Note that this must be close to the current date and time.

    The following is an example of a result indicating successful synchronization:

    orclodipsynchronizationstatus=Synchronization Successful
orclodiplastsuccessfulexecutiontime=20060302170214

  2. After verifying that synchronization has started, check if the entries in Oracle Internet Directory are actually synchronized to Microsoft Active Directory by performing the following steps:

    1. Click Start, Programs, Microsoft Exchange, and then Active Directory Users and Computers.

    2. Look for entries under the Users container under the Active Directory domain.

10.3.2 Procedure 2: Configuring BPEL-Based Organization Alerts

Although it is convenient to always have up-to-date information available in Microsoft Outlook, there are some changes for which you may want to be notified by e-mail. For example, if a change is made in the Human Resources Management System to John Steinbeck's telephone number, John might want to be notified about this.

If you are using Oracle Internet Directory and Microsoft Active Directory in an enterprise environment such as the one described in Figure 10-1, you can optimize the power of Oracle Directory Integration Platform, combined with Oracle BPEL Process Manager, to create a robust alerting system that generates organization alerts based on changes that happen to user identity information in the directory.

User identity information in Oracle Internet Directory can change for the following reasons:

  1. Changes occur in Human Resources Management System and are synchronized to Oracle Internet Directory.

  2. Modifications are directly applied to Oracle Internet Directory from other directory administration components in the deployment such as Oracle Delegated Administration Services or Oracle COREid administration service.

  3. Modifications are made in Microsoft Active Directory or Microsoft Exchange in deployments where Microsoft Active Directory is the enterprise directory.

Extending our first example, Enterprise applications, for example, the Human Resources Management System, update user identity information in Oracle Internet Directory. Oracle Directory Integration Platform synchronizes user identity information between Oracle Internet Directory and Microsoft Active Directory by using Active Directory Connector. A BPEL process can be deployed on the enterprise's Oracle Application Server middle tier to send organization alerts when specific user identity information attributes change in a certain domain.

Figure 10-2 shows how a BPEL process is integrated into the directory synchronization process.

Figure 10-2 Generating Organization Alerts Using Oracle BPEL Process Manager

Description of Figure 10-2 follows
Description of "Figure 10-2 Generating Organization Alerts Using Oracle BPEL Process Manager"

This example is an extension of Section 10.3.1, "Procedure 1: Synchronizing Enterprise Identity Information". When John's telephone number changes, it is updated in Human Resources Management System and synchronized with Oracle Internet Directory. John would like to receive an e-mail notifying him of the recent change.

Oracle Directory Integration Platform and Oracle BPEL Process Manager enable enterprise applications to create these kinds of organization alerts based on changes in Oracle Internet Directory.

The high-level steps in this scenario are the following:

  1. A change is made in Union Loan's Human Resources Management System. For example, John Steinbeck's telephone number is changed.

  2. This change in John's profile is recorded in Oracle Internet Directory. The telephonenumber attribute in Oracle Internet Directory is updated with John's new telephone number.

  3. Oracle Directory Integration Platform detects the change and writes this change to a database table.

  4. A BPEL process, which is configured to check for changes in the same database table, picks up this change and sends an organization alert to John.

In this example, Oracle Directory Integration Platform must be configured to check Oracle Internet Directory for user identity information changes. It must provision these changes into the EXCHGSYNC schema in OracleAS Metadata Repository. Specifically, the changes should be written to the ORG_ALERTS table.


Note:

Alternatively, the EXCHGSYNC schema can be present in any Oracle Database.

A BPEL process must be configured to check for changes in the ORG_ALERTS table, and send an organization alert to the interested parties depending on the attributes that are changed.

The following sections show how to create and send organization alerts that trigger when user information changes:

10.3.2.1 Configuring the BPEL Process

A sample BPEL process, IdentityNotification, SQL scripts to create EXCHGSYNC schema with the ORG_ALERTS table, and corresponding packages for attribute change propagation to the table are available in the demonstration folder described in Section 10.2, "Prerequisites". The BPEL process checks for user identity information changes in the table, EXCHGSYNC.ORG_ALERTS, and sends organization alerts to the user if specific attributes like telephone number have changed.

To set up the schema, and to configure and test the BPEL process, IdentityNotification, you must perform the steps in the following sections:

Installing the EXCHGSYNC Schema

To install the EXCHGSYNC schema, you must perform the following steps:

  1. Locate the notificationsetup.sql script. This is available in the identitymanagement/sql folder in the examples ZIP file, described in Section 10.2, "Prerequisites".

  2. Run the notificationsetup.sql script as follows:

    sqlplus "sys/<sys pwd>@<DB connect string> as SYSDBA" @notificationsetup.sql

  3. Set the password for the database user, EXCHGSYNC, by performing the following steps:

    1. Connect to the database as the SYS user.

    2. Run the alter command as follows:

      alter user EXCHGSYNC identified by <password>

Configuring the Database Adapter in the BPEL Process

After installing Oracle BPEL Process Manager, you must edit the database adapter's oc4j-ra.xml file to enter connection details for the databases to which you will be connecting. You must create a new connection called eis/DB/IdNotifySample, which lets you run the samples against the EXCHGSYNC schema in OracleAS Metadata Repository or your custom database.

To connect to the EXCHGSYNC schema in the OracleAS Metadata Repository, perform the following steps:

  1. Open the oc4j-ra.xml file, which is available in the BPEL_ORACLE_HOME/j2ee/OC4J_BPEL/application-deployments/default/DbAdapter directory.

    Here, BPEL_ORACLE_HOME is Oracle home on the Oracle Application Server middle tier that contains the BPEL Process Manager.

  2. Add a new connector factory element called eis/DB/IdNotifySample, as shown in Example 10-1.

    Example 10-1 New Connection String Details in the oc4j-ra.xml File

    <connector-factory location="eis/DB/IdNotifySample" connector-name="Database Adapter">
      <config-property name="driverClassName" value="oracle.jdbc.driver.OracleDriver"/>
      <config-property name="connectionString" value=" jdbc:oracle:thin:@abc.unionloan.com:1521:iasdb "/>
      <config-property name="userName" value=" EXCHGSYNC "/>
      <config-property name="password" value="secret"/>
      <config-property name="minConnections" value="1"/>
      <config-property name="maxConnections" value="5"/>
      <config-property name="minReadConnections" value="1"/>
      <config-property name="maxReadConnections" value="5"/> 
      <config-property name="usesExternalConnectionPooling" value="false"/>
      <config-property name="dataSourceName" value=""/>
      <config-property name="usesExternalTransactionController" value="false"/>
      <config-property name="platformClassName" value="oracle.toplink.internal.databaseaccess.OraclePlatform"/>
      <config-property name="usesNativeSequencing" value="true"/>
      <config-property name="sequencePreallocationSize" value="50"/>
    </connector-factory>

    Replace the values for connectionString and password (in bold) with the connection string for the EXCHGSYNC schema in OracleAS Metadata Repository or your custom database and EXCHGSYNC password respectively.

  3. After editing the file, stop and restart the Oracle BPEL Process Manager server. To do this, click Start, Programs, Oracle-ORACLE_BPEL_HOME, Oracle BPEL Process Manager 10.1.2, Stop BPEL PM Server, and then click Start BPEL PM Server.

Configuring E-Mail Server Settings to Enable Organization Alerts

The default e-mail account is used to send organization alert e-mail messages. Therefore, you must configure the e-mail server settings for the account, Default. To do this, perform the following steps:

  1. Edit the e-mail server configuration file, ORACLE_HOME/integration/orabpel/system/services/config/ns_emails.xml, and change the parameters that are indicated in bold in Example 10-2.

    Example 10-2 Parameters in the E-Mail Configuration File

    <EmailAccount>
      <Name>Default</Name>
      <GeneralSettings>
         <FromName>Oracle BPM</FromName>
         <FromAddress>bpm1@m1.abc.com</FromAddress>
      </GeneralSettings>
      <OutgoingServerSettings>
         <SMTPHost>m1.abc.com</SMTPHost>
         <SMTPPort>225</SMTPPort>
      </OutgoingServerSettings>
      <IncomingServerSettings>
         <Server>m1.abc.com</Server>
         <Port>2110</Port>
         <Protocol>pop3</Protocol>
         <UserName>bpm1</UserName>
         <Password ns0:encrypted="false"  xmlns:ns0="http://xmlns.oracle.com/ias/pcbpel/NotificationService">welcome</Password>
         <UseSSL>false</UseSSL>
         <Folder>Inbox</Folder>
         <PollingFrequency>1</PollingFrequency>
         <PostReadOperation>
            <MarkAsRead/>
         </PostReadOperation>
      </IncomingServerSettings>
   </EmailAccount>

Compiling and Deploying the IdentityNotification BPEL Process

To compile and deploy the BPEL process to Oracle BPEL Process Manager on the Oracle Application Server middle tier, perform the following steps:


Note:

The database connector feature in Oracle BPEL Process Manager requires the Oracle Application Server version of Oracle BPEL Process Manager for connectivity with Oracle Internet Directory. You cannot use the standalone version of Oracle BPEL Process Manager for this.

  1. Open JDeveloper BPEL Designer. Click Start, All Programs, Oracle - ORACLE_HOME, Oracle BPEL Process Manager 10.1.2, and then JDeveloper BPEL Designer.

  2. Open the IdentityNotification.jpr file in JDeveloper BPEL Designer. This contains the IdentityNotification BPEL process shown in Figure 10-3.

    The IdentityNotification.jpr file is located in the identitymanagement/IdentityNotification folder in the examples ZIP file, described in Section 10.2, "Prerequisites".

    Figure 10-3 IdentityNotification BPEL Process

    Description of Figure 10-3 follows
    Description of "Figure 10-3 IdentityNotification BPEL Process"

  3. On the Navigator pane in JDeveloper BPEL Designer, right-click the Project node, and click Deploy.

  4. Click Invoke Deployment Tool.

  5. In the Deploy Properties dialog box, click New. The BPEL Process Manager Connection wizard is displayed.

  6. Specify your connection name, and click Next.

  7. Specify authentication details using the Oracle Application Server middle tier host name and port number, as shown in Figure 10-4.

    Figure 10-4 Entering Authentication Details in the BPEL Process Manager Connection Wizard

    Description of Figure 10-4 follows
    Description of "Figure 10-4 Entering Authentication Details in the BPEL Process Manager Connection Wizard"

  8. Click Next.

  9. Test your connection, and click Finish.

  10. Enter your password, and click OK.

    You are now ready to deploy the BPEL process to the remote Oracle Application Server middle tier.

10.3.2.2 Configuring Oracle Directory Integration Platform Profile

To enable this capability, you must configure Oracle Directory Integration Platform by running the following command:

dipassistant exchgalertcfg -h <oid_host> -p <oid_non-ssl_port> -profile <profile_name>

For example:

dipassistant exchgalertcfg -h stadd63 -profile testExport

The script prompts you for the following information. Default answers to the questions are given in brackets. Press Enter to accept the default values.

  • Account DN:(default: cn=orclAdmin) >

    Specify the super user, that is, cn=orcladmin, or any user that is a member of the Directory Integration and Provisioning Administrators group (cn=dipadmingrp, cn=odi, cn=oracle internet directory).

  • Account Password >

    Enter the account password.

  • User login attribute name:(default: uid) >

    If the login ID is different from the user ID, then specify the login ID.

  • Oracle Database URL for Alert Notification: >

    Specify the URL for accessing the database. This must be in the format localhost:port:iasdb.us.oracle.com.

  • Oracle Database User for Alert Notification:(default: EXCHGSYNC) >

    Specify the database user who must receive the organization alert. Accept the default value, EXCHGSYNC, because that is the user you created in the section Installing the EXCHGSYNC Schema.

  • Oracle Database Password for Alert Notification: >

    Specify the EXCHGSYNC user password. This is the password you set in the section Installing the EXCHGSYNC Schema.

  • Microsoft Exchange Attributes to be propagated for Alert Notification:(default: mail, telephonenumber) >

    Specify a comma-delimited list of attributes, for which organization alerts must be generated. For this example, accept the default values of mail and telephone number.

Oracle Directory Integration Platform will now check Oracle Internet Directory for changes to the user's mail information and telephone number. To enable the BPEL process to use this information, you must configure it as described in the next section.

10.3.2.3 Testing the Identity Alerting Configuration

After you configure, compile, and deploy the IdentityNotification BPEL process, you can now test if all these steps were correct, and if the sample BPEL process is working. To do this, perform the following steps:

  1. Log in to Oracle Directory Manager as the Oracle Internet Directory administrator by running the following command:

    On UNIX:

    ORACLE_HOME/bin/oidadmin

    On Windows:

    From the Start menu, choose Programs, then ORACLE_HOME, then Integrated Management, then Oracle Directory Manager

  2. Update the telephonenumber attribute with a new telephone number in the container that is set up to be synchronized. To do this, perform the following steps:

    1. Click Entry Management and locate the entry you want to modify. You can also perform a search for the entry.


      See Also:

      Oracle Internet Directory Administrator's Guide

    2. At the top of the tab page, select View Properties: All.

    3. Find the telephonenumber property and modify it.

    4. Click Apply.

  3. Check if the appropriate users receive an organization alert e-mail message about this change.

  4. Access the Oracle BPEL Control. The URL has the following format:

    http://<BPEL_Host>:<BPEL_Port>/BPELConsole

    Look for the BPEL process that was invoked when the value for the telephonenumber attribute was changed.

10.4 Troubleshooting

Refer to the appendix titled "Troubleshooting Oracle Directory Integration and Provisioning" in Oracle Identity Management Integration Guide.

10.5 Related Documentation

The following is a list of references to documents that provide more information about synchronizing and provisioning Oracle Identity Management with Microsoft Active Directory:

Go to previous page
Previous		 Go to next page
Next
Go to Documentation Home
Home		 Go to Book List
Book List		 Go to Table of Contents
Contents		 Go to Index
Index		 Go to Feedback page
Contact Us