Simulating ODSEE Roles in an Oracle Unified Directory Server

Oracle Directory Server Enterprise Edition (ODSEE) includes a roles subsystem that is used to provide a specialized type of grouping mechanism. This capability is not included directly in Oracle Unified Directory, because it is based on non-standard functionality, uses Netscape-proprietary schema elements, and is not widely used in LDAP-enabled applications.

However, Oracle Unified Directory does provide all of the functionality offered by ODSEE roles, and this functionality is available for use with standard grouping mechanisms. If you have an application that was specifically written to rely on the roles functionality available in ODSEE and cannot work with standard grouping mechanisms, you can configure Oracle Unified Directory to simulate ODSEE roles to satisfy such applications.

To Determine Whether a User is a Member of a Role

If the application needs only to determine whether a user is a member of a given role, it should only need to look at the nsRole attribute in the target user's entry to determine whether the DN of the appropriate role is present. In this case, you can simulate role functionality by following these steps.

After these steps are completed, the nsRole virtual attribute appears as an operational attribute in user entries, and should include the DNs of all groups in which that user is a member. Note that nsRole is an operational attribute, and must be explicitly requested for it to be returned in search results. You must also ensure that the authenticated user has permission to see that attribute.

1. Update the directory server to include the necessary schema for the ODSEE roles implementation.

   This schema is provided in the LDIF file named 03-dsee-roles.ldif.

   • Either copy the file into the config/schema directory of the directory server implementation and restart the server, or
   • Use the add schema file task to cause the server to load the schema file into a running server instance.
2. Create a static or dynamic group to define role membership.

   Make sure that the group has an appropriate set of members.

3. Create a new instance of the isMemberOf virtual attribute to provide the nsRole virtual attribute.

   The nsRole attribute will include a list of the DNs of all groups in which the target user is a member. Use the dsconfig command to create the virtual attribute, as follows:

   $ dsconfig -h localhost -p 4444 -D "cn=directory manager" -w password -n \
     create-virtual-attribute \
     --type is-member-of --name nsRole --set attribute-type:nsRole --set enabled:true

To Alter Membership by Using the nsRoleDN Attribute

Follow this procedure if the application you are using expects to be able to alter membership by placing the name of the corresponding role in the nsRoleDN virtual attribute in a user's entry.

After these steps are completed, any user entry that contains an nsRoleDN value of "cn=Test Role,ou=Roles,dc=example,dc=com" also has that DN present in the nsRole operational attribute.

1. Create a dynamic group entry with the DN of the desired role.
2. Configure the group to include members that contain an nsRoleDN attribute with a value equal to the DN of the target role.

   For example, if the application is going to add an nsRoleDN value of "cn=Test Role,ou=Roles,dc=example,dc=com", add the following entry:

   dn: cn=Test Role,ou=Roles,dc=example,dc=com
   objectClass: top
   objectClass: groupOfURLs
   cn: Test Role
   memberURL: ldap:///dc=example,dc=com??sub?(nsRoleDN=\
     cn=Test Role,ou=Roles,dc=example,dc=com)