A Verifying Adapters for Multiple Directory Identity Stores by Using ODSM

After you have configured your Oracle Virtual Directory adapters as described in Chapter 6, "Configuring an Identity Store with Multiple Directories," you can use ODSM to view the adapters for troubleshooting purposes. This chapter explains how.

This appendix contains the following sections:

A.1 Verifying Oracle Virtual Directory Adapters for Split Profile by Using ODSM

This section describes how to validate the adapters created in Chapter 7, "Configuring Oracle Virtual Directory Adapters for Split Profile."

This section contains the following topics:

A.1.1 Verifying User Adapter for Active Directory Server

Verify the following adapter and plug-ins for Active Directory:

Follow these steps to verify the User Adapter in Oracle Virtual Directory using Oracle Directory Services Manager.

  1. In a web browser, go to Oracle Directory Services Manager (ODSM). The URL is of the form: http://admin.mycompany.com/odsm.

  2. Connect to each Oracle Virtual Directory instance by using the appropriate connection entry.

  3. On the Home page, click the Adapter tab.

  4. Click user_AD1 adapter.

  5. Verify that the User Adapter routing as configured correctly:

    1. Visibility must be set to internal.

    2. Bind Support must be set to enable.

  6. Verify the User Adapter User Management Plug-in as follows:

    1. Select the User Adapter.

    2. Click the Plug-ins tab.

    3. Click the User Management Plug-in, then click Edit in the plug-ins table. The plug-in editing window appears.

    4. Verify that the plug-in parameters are as follows:

      Parameter Value Default
      directoryType activedirectory Yes
      exclusionMapping orclappiduser,uid=samaccountname  
      mapAttribute orclguid=objectGuid  
      mapAttribute uniquemember=member  
      addAttribute user,samaccountname=%uid%,%orclshortuid%  
      mapAttribute mail=userPrincipalName  
      mapAttribute ntgrouptype=grouptype  
      mapObjectclass groupofUniqueNames=group  
      mapObjectclass orclidxperson=user  
      pwdMaxFailure 10 Yes
      oamEnabled TrueFoot 1   
      mapObjectClass inetorgperson=user Yes
      mapPassword True Yes
      oimLanguages Comma separated list of language codes, such as en,fr,ja  

      Footnote 1 Set oamEnabled to true only if you are using Oracle Access Management Access Manager.

A.1.2 Verifying Shadowjoiner User Adapter

Follow these steps to verify the ShadowJoiner Adapter in Oracle Virtual Directory using Oracle Directory Services Manager.

  1. In a web browser, go to Oracle Directory Services Manager (ODSM).

  2. Connect to Oracle Virtual Directory.

  3. On the Home page, click the Adapter tab.

  4. Click the Shadow4AD1 Adapter.

  5. Ensure that User Adapter routing as is configured correctly:

    1. Visibility must be set to internal.

    2. Bind Support must be set to enable.

  6. Verify the User Adapter as follows:

    1. Select the User Adapter.

    2. Click the Plug-ins tab.

    3. Click the User Management Plug-in, then click Edit in the plug-ins table. The plug-in editing window appears.

    4. Verify that the parameters are as follows:

      Parameter Value Default
      directoryType oid Yes
      pwdMaxFailure 10 Yes
      oamEnabled true  
      mapObjectclass container=orclContainer Yes
      oimDateFormat yyyyMMddHHmmss'z'  

A.1.3 Verifying JoinView Adapter

Follow these steps to verify the User Adapter in Oracle Virtual Directory using Oracle Directory Services Manager.

  1. In a web browser, go to the Oracle Directory Services Manager (ODSM) page.

  2. Connect to Oracle Virtual Directory.

  3. On the Home page, click the Adapter tab.

  4. Click the JoinView adapter.

  5. Verify the Adapter as follows

    1. Click Joined Adapter in the adapter tree. It should exist

    2. Click OK.

A.1.4 Verifying User/Role Adapter for Oracle Internet Directory

Follow these steps to verify the User Adapter in Oracle Virtual Directory using Oracle Directory Services Manager.

  1. In a web browser, go to Oracle Directory Services Manager (ODSM).

  2. Connect to Oracle Virtual Directory.

  3. On the Home page, click the Adapter tab.

  4. Click User Adapter.

  5. Verify the plug-in as follows:

    1. Select the User Adapter.

    2. Click the Plug-ins tab.

    3. Click the User Management Plug-in in the plug-ins table, then click Edit. The plug-in editing window appears.

    4. Verify that the parameters are as follows:

      Parameter Value Default
      directoryType oid Yes
      pwdMaxFailure 10 Yes
      oamEnabled true  
      mapObjectclass container=orclContainer Yes
      oimDateFormat yyyyMMddHHmmss'z'  

    5. Click OK.

A.1.5 Verifying Changelog adapter for Active Directory Server

Follow these steps to verify the Changelog Adapter in Oracle Virtual Directory using Oracle Directory Services Manager.

  1. In a web browser, go to Oracle Directory Services Manager (ODSM).

  2. Connect to Oracle Virtual Directory.

  3. On the Home page, click the Adapter tab.

  4. Click the changelog_AD1 adapter.

  5. Verify the plug-in as follows.

    1. Select the Changelog Adapter.

    2. Click the Plug-ins tab.

    3. In the Deployed Plus-ins table, click the changelog plug-in, then click "Edit in the plug-ins table. The plug-in editing window appears.

    4. Verify that the parameter values are as follows:

      Parameter Value
      directoryType activedirectory
      mapAttribute targetGUID=objectGUID
      requiredAttribute samaccountname
      sizeLimit 1000
      targetDNFilter cn=users,dc=idm,dc=ad,dc=com

      The users container in Active Directory
      mapUserState true
      oamEnabled true
      virtualDITAdapterName user_J1;user_AD1

A.1.6 Verifying Changelog Adapter for Oracle Internet Directory

To use the changelog adapter, you must first enable changelog on the connected directory. To test whether the directory is changelog enabled, type:

ldapsearch -h directory_host -p ldap_port -D bind_dn -q -b '' -s base 'objectclass=*' lastchangenumber

for example:

ldapsearch -h ldaphost1 -p 389 -D "cn=orcladmin" -q -b '' -s base 'objectclass=*' lastchangenumber

If you see lastchangenumber with a value, it is enabled. If it is not enabled, enable it as described in the Enabling and Disabling Changelog Generation by Using the Command Line section of Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.

Follow these steps to verify the Changelog Adapter in Oracle Virtual Directory using Oracle Directory Services Manager.

  1. In a web browser, go to Oracle Directory Services Manager (ODSM).

  2. Connect to an Oracle Virtual Directory instance.

  3. On the Home page, click the Adapter tab.

  4. Click the Changelog Adapter.

  5. Verify the plug-in as follow.

    1. Select the Changelog Adapter.

    2. Click the Plug-ins tab.

    3. In the Deployed Plug-ins table, click the changelog plug-in, then click Edit in the plug-ins table. The plug-in editing window appears.

    4. Verify that the parameter values are as follows:

      Parameter Value
      directoryType oid
      mapAttribute targetGUID=orclguid
      requiredAttribute orclGUID
      modifierDNFilter cn=orcladmin
      sizeLimit 1000
      targetDNFilter dc=mycompany,dc=com
      targetDNFilter cn=shadowentries
      mapUserState true
      oamEnabled true
      virtualDITAdapterName user_J1;shadow4AD1
      virtualDITAdapterName User Adapter (The name of the User adapter's name)

A.1.7 Configuring a Global Consolidated Changelog Plug-in

Verify the global level consolidated changelog plug-in as follows

  1. In a web browser, go to Oracle Directory Services Manager (ODSM).

  2. Connect to an Oracle Virtual Directory instance.

  3. On the Home page, click the Advanced tab. The Advanced navigation tree appears.

  4. Expand Global Plugins

  5. Click the ConsolidatedChglogPlugin. The plug-in editing window appears.

A.1.8 Validate Oracle Virtual Directory Changelog

Run the following command to validate that the changelog adapter is working:

$IDM_ORACLE_HOME/bin/ldapsearch -p 6501 -D cn=orcladmin -q -b 'cn=changelog' -s base 'objectclass=*' lastchangenumber

The command should return a changelog result, such as:

Please enter bind password:
cn=Changelog
lastChangeNumber=changelog_OID:190048;changelog_AD1:363878

If ldapsearch does not return a changelog result, double check the changelog adapter configuration.

A.2 Verifying Adapters for Distinct User and Group Populations in Multiple Directories by Using ODSM

This section describes how to view the adapters created in Section 7.3.2, "Configuring Oracle Virtual Directory Adapters for Distinct User and Group Populations in Multiple Directories."

Verify the user adapter on the Oracle Virtual Directory instances running on LDAPHOST1 and LDAPHOST2 individually. Follow these steps to verify the User Adapter in Oracle Virtual Directory using Oracle Directory Services Manager:

  1. If they are not already running, start the Administration Server and the WLS_ODSM Managed Servers.

  2. In a web browser, go to Oracle Directory Services Manager (ODSM) at:

    http://admin.mycompany.com/odsm

  3. Verify connections to each of the Oracle Virtual Directory instances running on LDAPHOST1 and LDAPHOST2, if they do not already exist.

  4. Connect to each Oracle Virtual Directory instance by using the appropriate connection entry.

  5. On the Home page, click the Adapter tab.

  6. Click the name of each adapter. Verify that it has the parameters shown in the following tables.

This section contains the following topics:

A.2.1 User/Role Adapter A1

Verify the plug-in of the User/Role Adapter A1, as follows:

  1. Select the OIM User Adapter.

  2. Click the Plug-ins tab.

  3. Click the User Management Plug-in, then click Edit in the plug-ins table. The plug-in editing window appears.

  4. Verify that the parameter values are as follows:

    Parameter Value Default
    directoryType activedirectory Yes
    exclusionMapping orclappiduser,uid=samaccountname  
    mapAttribute orclguid=objectGuid  
    mapAttribute uniquemember=member  
    addAttribute user,samaccountname=%uid%,%orclshortuid%  
    mapAttribute mail=userPrincipalName  
    mapAttribute ntgrouptype=grouptype  
    mapObjectclass groupofUniqueNames=group  
    mapObjectclass orclidxperson=user  
    pwdMaxFailure 10 Yes
    oamEnabled TrueFoot 1   
    mapObjectClass inetorgperson=user Yes
    mapPassword True Yes
    oimLanguages Comma separated list of language codes, such as en,fr,ja  

    Footnote 1 Set oamEnabled to true only if you are using Oracle Access Management Access Manager.

A.2.2 User/Role Adapter A2

Verify the plug-in of the User/Role Adapter A2 as follows:

  1. Select the User Adapter.

  2. Click the Plug-ins tab.

  3. Click the User Management Plug-in in the plug-ins table, then click Edit. The plug-in editing window appears.

  4. Verify that the parameter values are as follows:

    Parameter Value Default
    directoryType oid Yes
    pwdMaxFailure 10 Yes
    oamEnabled trueFoot 1   
    mapObjectclass container=orclContainer Yes

    Footnote 1 Set oamEnabled to true only if you are using Oracle Access Management Access Manager.

A.2.3 Changelog Adapter C1

To verify the Changelog Adapter C1 plug-in, follow these steps:

  1. Select the OIM changelog adapter Changelog_Adapter_C1.

  2. Click the Plug-ins tab.

  3. In the Deployed Plus-ins table, click the changelog plug-in, then click Edit in the plug-ins table. The plug-in editing window appears.

  4. In the Parameters table, verify that the values are as shown.

    Table A-1 Values in Parameters Table

    Parameter Value Comments

    modifierDNFilter

    A bind DN that has administrative rights on the directory server, in the format:

    "!(modifiersname=cn=BindDN)"

    For example:

    "!(modifiersname=cn=orcladmin,cn=systemids,dc=mycompany,dc=com)"

    Create

    sizeLimit

    1000

    Create

    targetDNFilter

    dc=us,dc=mycompany,dc=com

    Create

    mapUserState

    true

    Update

    oamEnabled

    true

    Update

    virtualDITAdapterName

    The adapter name of User/Role Adapter A1: User_Adapter_A1

    Create

A.2.4 Changelog Adapter for Active Directory

Verify the plug-in as follows.

  1. Select the OIM Changelog Adapter.

  2. Click the Plug-ins tab.

  3. In the Deployed Plus-ins table, click the changelog plug-in, then click "Edit in the plug-ins table. The plug-in editing window appears.

  4. In the Parameters table, verify that the parameters are as follows:

    Parameter Value
    directoryType activedirectory
    mapAttribute targetGUID=objectGUID
    requiredAttribute samaccountname
    sizeLimit 1000
    targetDNFilter dc=mycompany,dc=com

    Search base from which reconciliation must happen. This value must be the same as the LDAP SearchDN that is specified during Oracle Identity Manager installation.
    mapUserState true
    oamEnabled trueFoot 1 
    virtualDITAdapterName The name of the User adapter's name

    Footnote 1 Set oamEnabled to true only if you are using Oracle Access Management Access Manager.

    Note:

    virtualDITAdapterName identifies the corresponding user profile adapter name. For example, in a single-directory deployment, you can set this parameter value to User Adapter, which is the user adapter name. In a split-user profile scenario, you can set this parameter to J1;A2, where J1 is the JoinView adapter name, and A2 is the corresponding user adapter in the J1.

A.2.5 Changelog Adapter C2

Verify the plug-in as follows:

  1. Select the OIM changelog adapter Changelog_Adapter_C2.

  2. Click the Plug-ins tab.

  3. In the Deployed Plus-ins table, click the changelog plug-in, then click Edit in the plug-ins table. The plug-in editing window appears.

  4. In the Parameters table, verify that the parameters are as follows:

    Table A-2 Values in Parameters Table

    Parameter Value Comments

    modifierDNFilter

    A bind DN that has administrative rights on the directory server, in the format:

    "!(modifiersname=cn=BindDN)"

    For example:

    "!(modifiersname=cn=orcladmin,dc=mycompany,dc=com)"

    Create

    sizeLimit

    1000

    Create

    targetDNFilter

    dc=uk,dc=mycompany,dc=com

    Create

    mapUserState

    true

    Update

    oamEnabled

    true

    Update

    virtualDITAdapterName

    The adapter name of User/Role adapter A2: User_Adapter_A2

    Create

A.2.6 Verifying Oracle Virtual Directory Global Plug-in

To verify the Global Oracle Virtual Directory plug-in, proceed as follows

  1. In a web browser, go to Oracle Directory Services Manager (ODSM) at:

    http://admin.mycompany.com/odsm

  2. Verify connections to each of the Oracle Virtual Directory instances running on LDAPHOST1 and LDAPHOST2, if they do not already exist.

  3. Connect to each Oracle Virtual Directory instance by using the appropriate connection entry.

  4. On the Home page, click the Adapter tab.

  5. Click the Plug-ins tab.

  6. Verify that the Global Consolidated Changelog Plug-in exists.

    Click OK when finished.

A.2.7 Configuring a Global Consolidated Changelog Plug-in

Verify the global level consolidated changelog plug-in as follows

  1. In a web browser, go to Oracle Directory Services Manager (ODSM).

  2. Connect to an Oracle Virtual Directory instance.

  3. On the Home page, click the Advanced tab. The Advanced navigation tree appears.

  4. Expand Global Plugins

  5. Click the ConsolidatedChglogPlugin. The plug-in editing window appears.