Oracle® Communications Connector for Microsoft Outlook

Installation and Administration Guide

Release 9.0

E63670-01

September 2015

Oracle Communications Connector for Microsoft Outlook Installation and Administration Guide, Release 9.0

E63670-01

Copyright © 2014, 2015, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Audience

- Related Documents

- Documentation Accessibility

1 Connector for Microsoft Outlook Overview

- About Connector for Microsoft Outlook

- Overview of Deploying and Installing Connector for Microsoft Outlook

- About Connector for Microsoft Outlook System Architecture

2 Connector for Microsoft Outlook System Requirements

- Requirements for the Deployment Configuration Program

- Requirements for Connector for Microsoft Outlook

- Supported Server-Side Software

3 Installing the Deployment Configuration Program

- Installing the Deployment Configuration Program

- Upgrading the Deployment Configuration Program

4 Connector for Microsoft Outlook Deployment Considerations

- Deployment Planning Overview

- About Migrating User Data

- About Command-Line Switches for Software Installation

- About Letting Users Perform the Installation

- About Using System Management Tools to Automate Installation

- Using Microsoft SMS to Install Connector for Microsoft Outlook

- About Checking for Updates Automatically

5 Working With the Deployment Configuration Program

- About the Deployment Configuration Program

- About the INI File

- About the EXE End-User Package File

- Updating Connector for Microsoft Outlook

- Upgrading Connector for Microsoft Outlook

- Upgrade Impacts When Upgrading to Connector for Microsoft Outlook Release 9.0

- Checking for Updates Automatically

- Migrating User Data

- Configuring the Shared Calendar Name Format

- Configuring PST Optimization

- Configuring the Address Book Display Order

- Configuring Virtual List View

- About Customized Branding

- Configuring Customized Branding

- Running the Deployment Configuration Program in Silent Mode

- Troubleshooting Connector for Microsoft Outlook

- Resolving Duplicate Calendar Resource Entries

- Resolving Address Book Sharing Issues

- Resolving Address Book Lookup Issues

6 Connector for Microsoft Outlook Administration

- Reversing Data Migration

- Uninstalling Connector for Microsoft Outlook

- Changing the Location of PST Files

- About Certificate-Based Authentication

- Using Certificate-Based Authentication

- Configuration Considerations

A INI File Parameter Reference

- Parameter Reference

- Sample INI File

B Understanding Virtual List View

- About Virtual List View

- About VLV Settings and Values

- About the VLV Browsing Index

- Applying the VLV Browsing Index Settings

- Generating the VLV Browsing Index

- About Granting User Data Access

- Determining the Appropriate ACI Mechanisms

- Configuring Authenticated User Access

- Configuring Anonymous Access

Preface

Oracle Communications Connector for Microsoft Outlook enables Oracle Communications Unified Communications Suite features and functionality to be available through Microsoft Outlook.

Audience

This documentation is intended for system administrators whose responsibility includes Connector for Microsoft Outlook. This guide assumes you are familiar with the following topics:

- System administration and networking

- Outlook administration

- Oracle Communications Messaging Server, Oracle Communications Calendar Server, Oracle Communications Contacts Server, and Oracle Communications Address Book protocols and standards

- Directory server and LDAP

- General deployment architectures

Related Documents

For more information, see the following documents in the Connector for Microsoft Outlook documentation set:

- Connector for Microsoft Outlook Security Guide: Describes how to install and configure Connector for Microsoft Outlook in a secure configuration.

- Connector for Microsoft Outlook Release Notes: Describes the new features, fixes, and any known issues in this release of Connector for Microsoft Outlook.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

1 Connector for Microsoft Outlook Overview

This chapter provides an overview of Oracle Communications Connector for Microsoft Outlook.

About Connector for Microsoft Outlook

Connector for Microsoft Outlook is a client application that interfaces between Microsoft Outlook and Oracle Communications Unified Communications Suite software. Connector for Microsoft Outlook allows users in your organization to use Outlook as an email, calendar, and address book client, while using Unified Communications Suite software to deliver these services.

Connector for Microsoft Outlook is a plug-in for Outlook and is installed separately on each end-user computer in your organization.

You, as the installer and administrator, use the Deployment Configuration Program (DCP) to create one or more end-user packages and deliver them to the users in your organization. The end-user package is a complete installer that enhances Outlook with Connector for Microsoft Outlook.

Also, you can configure the end-user package produced by the DCP to migrate existing user profiles and data files to the formats used by the Unified Communications Suite software.

Connector for Microsoft Outlook delivers the following features and functionality:

- Email service, including:

- Email and folder management services

- Email-based group scheduling

- Client-side and server-side email rules and filtering support

- Notes stored in IMAP folders

- Folder synchronization progress display

- Message previewing

- Email folder sharing and permission control

- Virtual folder searching

- Out-of-office notification support

- Personal storage (PST) file support

- Calendar service, including:

- Multiple calendar support

- Calendar subscription, sharing, delegation, and permissions control

- Address book service, including:

- Corporate directory access

- Multiple address book support

- Address book browsing support

- Contacts sharing and permission control

- Offline support for email, calendar, and address book

- Interoperability with Convergence

Overview of Deploying and Installing Connector for Microsoft Outlook

The following procedure outlines the high-level steps required to deploy Connector for Microsoft Outlook to the users of your organization and install it on their computers. This overview assumes that the Unified Communications Suite server software is already installed and working.

To install and deploy Connector for Microsoft Outlook:

1. Prepare a comprehensive deployment plan.
Developing a comprehensive deployment plan requires that you consider all of the factors likely to influence your organization's needs. See "Connector for Microsoft Outlook Deployment Considerations" for more information.

2. Install the DCP.
Install the DCP on your computer. This guide describes the system requirements for the DCP and explains how to install the program. See "Requirements for the Deployment Configuration Program" and "Installing the Deployment Configuration Program" for more information.

3. Create end-user packages.
Use the DCP to create end-user packages. You preconfigure the end-user package to connect the Unified Communications Suite software. You may decide to create a single end-user package for your entire organization, or you can create multiple packages for different groups of users. See "Working With the Deployment Configuration Program" for more information.

4. Deploy end-user packages.
Deploy the end-user packages to your users. For example, you can copy an end-user package to a shared network drive and email the link to your users. See "Connector for Microsoft Outlook Deployment Considerations" for more information.

5. Install Connector for Microsoft Outlook.
The end-user package must be run on the end-user computer. When the end-user package is run, it launches an installation wizard that installs Connector for Microsoft Outlook. The end-user package installation wizard can also migrate user profiles and data files to formats that work with Unified Communications Suite software. Depending on your organization's user privileges, your users may not be authorized to install the end-user package themselves. See "Connector for Microsoft Outlook Deployment Considerations" for more information.

About Connector for Microsoft Outlook System Architecture

Connector for Microsoft Outlook is a plug-in that is installed in Outlook on each end-user computer in your organization. Connector for Microsoft Outlook communicates with the Unified Communications Suite servers to convert the server data into information that Outlook can understand and display. For example, Connector for Microsoft Outlook queries Messaging Server for email messages.

Connector for Microsoft Outlook converts the information into messaging API (MAPI) properties that Outlook can display. Conversely, MAPI information is sent to Connector for Microsoft Outlook and converted to standard protocols for the back-end servers to read.

Connector for Microsoft Outlook uses the following protocols to communicate with the Unified Communications Suite servers:

- Uses Simple Mail Transfer Protocol (SMTP) and Internet Message Access Protocol (IMAP) to communication with Messaging Server.

- Uses Web Calendar Access Protocol (WCAP) to communicate with Calendar Server.

- Uses either Web Address Book Protocol (WABP) to communicate with Convergence, or representational state transfer (REST) protocol to communicate with Contacts Server.

- Uses Lightweight Directory Access Protocol (LDAP) to communicate with the directory server.

Connector for Microsoft Outlook delivers the product offerings of several Unified Communications Suite services in a single client that is familiar to Windows users.

When users create and modify items in Outlook, Connector for Microsoft Outlook passes the new message to the appropriate server depending on its message type.

Figure 1-1 shows the Connector for Microsoft Outlook high-level architecture.

Figure 1-1 Connector for Microsoft Outlook Architecture Overview

2 Connector for Microsoft Outlook System Requirements

This chapter describes the system requirements for the various components of Oracle Communications Connector for Microsoft Outlook.

Requirements for the Deployment Configuration Program

You use the Deployment Configuration Program (DCP) to create the end-user package that installs Connector for Microsoft Outlook. You can install the DCP onto a computer with any of the following operating systems:

- Microsoft Windows 8

- Microsoft Windows 7

Before installing the DCP, you must install Visual C++ Redistributable for Visual Studio 2012 on your computer. If your users use a 32-bit version of Microsoft Outlook, install the 32-bit package, if your users use a 64-bit version of Outlook, install the 64-bit package.

Requirements for Connector for Microsoft Outlook

Connector for Microsoft Outlook can be installed on the following operating systems:

- Microsoft Windows 8

- Microsoft Windows 7

Connector for Microsoft Outlook can be installed into the following versions of Outlook:

- Outlook 2013 (32-bit and 64-bit)

- Outlook 2010 (32-bit and 64-bit)

Before Connector for Microsoft Outlook can be installed, the following requirements must also be met:

- Visual C++ Redistributable for Visual Studio 2012 must be installed on the end-user computer.
If the user has a 32-bit version of Outlook, install the 32-bit version. If the user has a 64-bit version of Outlook, install the 64-bit version.

- Outlook must be configured as the default email client.
See the Outlook Help for information about configuring it as the default mail client.

- Synchronization program (published by Sun Java Systems or Oracle) must not be installed.
See the Windows Help for information about finding and removing programs.

Supported Server-Side Software

Table 2-1 lists the server-side software supported by Connector for Microsoft Outlook.

Table 2-1 Supported Server-Side Software

Product

Version

Notes

Oracle Communications Messaging Server

7.x, 8.0

Required for Connector for Microsoft Outlook to work. Provides the email service.

Oracle Communications Calendar Server

7.0.3

Optional. Provides the calendar service.

Oracle Communications Contacts Server

8.0.0.2

Optional. Provides the address book services.

Oracle Communications Convergence

3.0.0, 3.0.1

Optional. Provides information about user settings and preferences.

Oracle Directory Server Enterprise Edition

11gR1 PS2 (11.1.1.7.0)

Required by other UCS software.

3 Installing the Deployment Configuration Program

This chapter explains how to install or upgrade the Deployment Configuration Program (DCP), which you use to create the end-user package that installs Oracle Communications Connector for Microsoft Outlook.

Installing the Deployment Configuration Program

To install the DCP:

1. Verify that your computer meets the system requirements for the DCP.
See "Requirements for the Deployment Configuration Program" for more information.

2. Download the Connector for Microsoft Outlook version (32-bit or 64-bit) software that corresponds to the version of Microsoft Outlook (32-bit or 64-bit) used by your organization.

Note:
If your organization uses a mix of 32-bit and 64-bit versions of Outlook, you must download both versions of the Connector for Microsoft Outlook software. But, put each version on a separate computer.

Download the software from the Oracle software delivery website:

https://edelivery.oracle.com/

The Connector for Microsoft Outlook software is included in the Oracle Communications Messaging Server media pack.

3. Extract Setup.exe to a temporary directory.

4. Run Setup.exe.

5. Follow the on-screen instructions.

6. When you are finished, click Finish.
The DCP is installed in the location you specified.

By default, the 32-bit DCP is installed in the following directory:

C:\Program Files (x86)\Sun\Deployment Configuration Program

By default, the 64-bit DCP is installed in the following directory:

C:\Program Files\Sun\Deployment Configuration Program

If the DCP reports a logon failure or a failure to locate a necessary resource while it is running, and if you know that the resource exists in the location that you have specified, then the account you are using to run the DCP is not authenticated to the file server where the resources reside. Make sure that you are logged in to the locations of all such resources and then run the DCP again.

Upgrading the Deployment Configuration Program

To upgrade the DCP, download the new version of the DCP and install it. The installer replaces an older version with the new version. See "Installing the Deployment Configuration Program" for more information about installing the DCP.

4 Connector for Microsoft Outlook Deployment Considerations

This chapter describes considerations and options for deploying Oracle Communications Connector for Microsoft Outlook to the end-user computers in your organization.

Deployment Planning Overview

Connector for Microsoft Outlook must be installed on each end-user computer. Therefore, the end-user package created by the Deployment Configuration Program (DCP) must be delivered to and run on each end-user computer in your organization.

There are different ways to deploy the end-user package:

- Place the end-user package on a shared network drive and provide users with a link to the package.

- Email the end-user package to your users.

- Host the end-user package on an internal software distribution site.

- Save the end-user package to portable media (for example, a USB memory stick) and copy it to each end-user computer.

- Push the installation of Connector for Microsoft Outlook to end-user computers using system management service utilities.

- Set up an update and upgrade site and configure Connector for Microsoft Outlook to automatically check for updates.

The DCP contains deployment and operational options for a variety of installation and migration strategies for most environments, circumstances, and administrator preferences. This guide describe the most common scenarios.

How you distribute the end-user package depending on your network configurations, the administrative structure of your organization, and whether you want your users to install and configure the software themselves.

About Migrating User Data

You can configure the end-user package installation wizard to migrate Outlook profiles and data files to the formats used by the Oracle Communications Unified Communications Suite software. The installation wizard backs up the user profiles before migrating them. The migration process runs in the background, but the process is likely to slow the performance of other applications.

Users may have old personal storage (PST) files that do not need to be migrated, and they can choose which of their PST files to migrate. Users can read unmigrated email messages, but cannot reply to them.

Outlook users can assign passwords to their PST files. The installation wizard needs to open and modify these files to migrate them for use with the Unified Communications Suite servers. The installation wizard automatically prompts users for the necessary passwords as they are needed.

If you need to run the end-user package installation wizard in silent mode, instruct your users to remove all passwords before the migration. If the wizard runs in silent mode and encounters a password-protected file, it does not migrate that file, and reports that not all files were migrated. Depending on the settings in DCP, the installation wizard may also log the event as an error.

About Command-Line Switches for Software Installation

The end-user package installation wizard supports the following command-line switches that may be used with the deployment methods described in this chapter:

- /USERNAME=xxx, where xxx is the user's user name on the Unified Communications Suite servers.

- /PASSWORD=xxx, where xxx is the user's password on the Unified Communications Suite servers.

- /FULLNAME=xxx, where xxx is the display name of the user.

- /EMAILADDRESS=xxx, where xxx is the email address of the user.

- /DN=xxx, where xxx is the user DN on the Unified Communications Suite servers.

- /NEWPROFILENAME=xxx, where xxx is the name of the created profile.

- /SAVEPASSWORD=n, where n = 1 (save) or 0 (do not save).

- /ALTPSTDIR=dir, where dir is the directory where the local cache is created. If this switch is not present, the default value is Documents and Settings\username\Local Settings\Application Data\Sun\Outlook Connector.

About Letting Users Perform the Installation

When users install their own software, they run the end-user package on their own computers. Your users can retrieve the end-user package from a file server.

The disadvantages of letting your users install the software is an increased demand for IT support, which may be considerable depending on the technical skills of your users and the complexity of your network.

To run the end-user package, users must have the necessary access privileges. If users do not have installation privileges for their own computers, consider one of the following strategies:

- Perform the installation on behalf of the user by logging on to the end-user computer with your administrator credentials.

- Use a configuration management tool to push the software to multiple end-user computers. See "About Using System Management Tools to Automate Installation" for more information.

You may allow some users to perform their own installations and require other users to have the end-user package installed and configured for them. This approach can ensure a smooth migration for top executives or less technical users who are not able to perform the tasks for themselves.

About Using System Management Tools to Automate Installation

If your users do not have the privileges required to install software. You can use a system management tool to remotely install the software on end-user computers.

When users cannot install their own software, you must separate the software installation from the migration. You use the DCP to build two end-user packages: the first installs the software, the second enables users to configure the software and migrate their profile and data files.

You push and run the installation end-user package on each end-user computer. The system management tool has full privileges and is therefore authorized to run the end-user package to install Connector for Microsoft Outlook.

The configuration and migration end-user package can be run by end-users, because it does not install software and therefore does not require administrator privileges. Deploy the second end-user package to your end-users to run themselves, or use a system management tool to fully automate the configuration and migration process. Automating the configuration and migration process requires scripting because the end-user package needs information specific to each user (that is, user credentials).

You can use Microsoft System Management Server (SMS) to push the software onto end-user computers, or you can use other system management tools. See "Using Microsoft SMS to Install Connector for Microsoft Outlook" for more information about using SMS to install and configure Connector for Microsoft Outlook.

Using Microsoft SMS to Install Connector for Microsoft Outlook

A typical SMS push scenario consists of the following tasks:

1. Create two shared directories, named LOGS and WPW, on a computer that is part of the same SMS site as the end-user computers. Assign full control share permissions for all folders to the SMSCliToknLocalAcct$ account. These assignments provide read/write access to the directories for the SMS local account (which requires a password), and lets you avoid having to open the system to guest access. Also, assign full control share permissions for all of the NTFS folders to SMSCliToknLocalAcct$.

2. Use the DCP to create an end-user package that installs the Connector for Microsoft Outlook software on each computer, but does not migrate Outlook profiles or data files. See "Working With the Deployment Configuration Program" for more information. Use the following values on the Processes tab to prepare the package for SMS distribution:

- Set User mode to Silent.

- Deselect Create/convert/upgrade user profile.

- Use UNC paths (\servername\sharename) for all of the path fields.

3. Use the SMS packaging wizard to prepare a package that contains the installation end-user package, and push the package to run on end-user computers.
Follow the SMS instructions to create a package with the following settings:

- On the Package screen, select Create a new package and program.

- On the Source Files screen, select Create a compressed version of this source.

- On the Program Properties screen, select Run with administrative rights.

- On the Assign Program screen, select Yes to assign the program, and specify the date and time of the assignment.

4. Use the DCP to create a second end-user package that permits users to configure Connector for Microsoft Outlook and migrates their existing Outlook profiles and data files. See "Working With the Deployment Configuration Program" for more information Use the following values on the Processes tab to prepare this package:

- Set User mode to Interactive.

- Under Processes to include in this configuration:

- Ensure that none of the Install or upgrade options are selected.

- Select Create/convert/upgrade user profile.

5. Use the SMS packaging wizard to prepare a package that contains the configuration and migration end-user package.
Follow the SMS instructions to create a package with the following settings:

- On the Package screen, select Create a new package and program.

- On the Source Files screen, select Create a compressed version of this source.

- On the Program Properties screen:

- Deselect Run with administrative rights.

- For Program can run, select Only when a user is logged on.

- Select User input required.

- On the Assign Program screen, select Yes to assign the program, and specify the date and time of the assignment.

6. Push the configuration and migration end-user package to end-user computers. Do one of the following:

- To enable users to respond to prompts during the migration process, use the SMS packaging wizard to push the package.

- To run the migration process silently, create an SMS script that runs the end-user package and include in the script the command-line switches that provide user credentials.
For example, you might create an SMS package that runs an end-user package that migrates data, and have the SMS services issue the following commands during the migration process:

DT_Package.exe
/USERNAME=jsmith
/FULLNAME="John Smith"
/EMAILADDRESS="john.smith@example.com"
/DN="uid=jsmith,ou=people,o=example.com,o=example.com"

Note:
Command-line samples are formatted here for ease of reading, but all of the switches must be typed in a continuous string.

You could then substitute environment variables for the users (if the Windows user names and the Oracle user names match):

DT_Package.exe
/USERNAME=%username%
/FULLNAME="Change This"
/EMAILADDRESS=%username%@example.com
/DN=uid=%username%,ou=people,o=example.com,o=example.com

See "About Command-Line Switches for Software Installation" for more information about supported command-line switches.

About Checking for Updates Automatically

You can configure an end-user package to include connection information to an update site where you publish updates and upgrades for Connector for Microsoft Outlook. Each time Outlook is opened, Connector for Microsoft Outlook checks the update site for updates and informs the user. Also, when you configure the end-user package with connection information to an update site, users can manually check for updates.

See "Checking for Updates Automatically" for more information.

5 Working With the Deployment Configuration Program

This chapter explains how to use the Deployment Configuration Program (DCP) to create end-user packages that install Oracle Communications Connector for Microsoft Outlook.

About the Deployment Configuration Program

You use the DCP to create end-user packages that are installed on end-user computers in your organization. The DCP includes a user interface, which consists of several tabs, on which you configure the network connections, settings, and permissions required to connect Microsoft Outlook with the Oracle Communications Unified Communications Suite servers. The DCP generates end-user packages that install a fully configured Connector for Microsoft Outlook into Outlook.

You can also generate end-user packages from the command line. See "Running the Deployment Configuration Program in Silent Mode" for more information.

You can create a single end-user package for your entire organization, or you can create different packages with different settings that represent different sets of permissions or roles within your organization.

The following procedure outlines the high-level tasks required to create an end-user package using the DCP:

1. Open the DCP.

2. Complete the tabs of the DCP with the desired connection information and settings.

3. Save the configuration and generate the end-user package.

4. Distribute the end-user package to your users according to your distribution plan.
See "Connector for Microsoft Outlook Deployment Considerations" for more information.

The DCP can create the following kinds of files:

- An INI file
See "About the INI File" for more information.

- An EXE file
See "About the EXE End-User Package File" for more information.

About the INI File

In the DCP, when you save the configuration, the DCP creates an INI file. The INI file contains all the configurations you specified in the DCP saved as parameters.

You can open an INI file in the DCP. You can modify the configurations and resave them, either overwriting the existing INI file, or as a new file.

You can configure some options only by editing the INI file in a text editor, such as configuring customized branding and configuring Connector for Microsoft Outlook to automatically detect updates.

See "INI File Parameter Reference" for descriptions of all the INI file parameters.

Oracle recommends that you retain INI files and label them carefully so that you can use them for future updates.

About the EXE End-User Package File

In the DCP, you can save your configuration as an executable end-user package, which you distribute to your users. The end-user package is run on each end-user computer to install Connector for Microsoft Outlook.

When you create the end-user package, the DCP also creates an INI file. The INI file is an unpackaged version of the configurations contained in the EXE file.

Updating Connector for Microsoft Outlook

Updating Connector for Microsoft Outlook consists of sending your users an end-user package with new or changed configuration settings. The end-user package installation wizard overwrites the previous version with the new one.

When creating an updated end-user package, Oracle recommends that you work from the INI file that corresponds with the current end-user package.

To create an end-user package that updates Connector for Microsoft Outlook:

1. Start the DCP.

2. (Optional) Open the INI file that corresponds with the original end-user package of Connector for Microsoft Outlook you want to update.

3. On the Processes tab, select Create/convert/upgrade user profile.

4. If you are working from an INI file, make any necessary modifications to the configurations in the tabs of the DCP. If you started with a blank DCP, complete the other tabs.
As part of updating Connector for Microsoft Outlook, you can configure the end-user packages to achieve any of the following tasks:

- Upgrading Connector for Microsoft Outlook

- Checking for Updates Automatically

- Migrating User Data

- Configuring the Shared Calendar Name Format

- Configuring PST Optimization

- Configuring the Address Book Display Order

- Configuring Virtual List View

- Configuring Customized Branding

5. From the Tools menu, select Create Package. Name the package.

6. Distribute the end-user package to your users.

Upgrading Connector for Microsoft Outlook

Upgrading Connector for Microsoft Outlook consists of sending your users an end-user package from a new version of the DCP. The end-user package installation wizard overwrites the previous version with the new one. The new end-user package can also include new or changed configuration values.

Oracle recommends that you work from the INI file that corresponds with the original end-user package.

Configure an upgrade for Connector for Microsoft Outlook as part of "Updating Connector for Microsoft Outlook". On the Processes tab of the DCP, select Install or Upgrade Oracle Communications Connector for Microsoft Outlook.

Upgrade Impacts When Upgrading to Connector for Microsoft Outlook Release 9.0

The following changes in this release of Connector for Microsoft Outlook affect how you create end-user packages:

- Oracle Communications Contacts Server integration: Connector for Microsoft Outlook supports Contacts Server as a provider for the address book service. When you select Contacts Server as the provider of the address book service, most of the LDAP tab in the DCP is disabled. See Contacts Server Installation and Configuration Guide for information about configuring the corporate directory, global address list, and VLV.

- User Preference changes: Connector for Microsoft Outlook no longer retrieves user preferences and settings information from the directory server. This version of Connector for Microsoft Outlook manages user preferences using Oracle Communications Convergence. If you open an old INI file in the DCP for the new version of Connector for Microsoft Outlook, you must explicitly configure the Convergence connection settings. If you create an end-user package from an old INI file in the new DCP without configuring the Convergence connection settings, Connector for Microsoft Outlook fails to retrieve user preferences and settings. Configure user preference and settings on the User Settings tab of the DCP.
The DCP may provide Convergence connection information if you are working from an INI file configured where the address book service is provided by the Convergence address book server.

Checking for Updates Automatically

Configure Connector for Microsoft Outlook to automatically check for updates as part of "Updating Connector for Microsoft Outlook".

To configure Connector for Microsoft Outlook to automatically check for updates:

1. In the DCP, save your configuration.

2. Open the INI file in a text editor.

3. Find the [AUServer] section and specify values for the parameters in the following example:

[AUServer]
AutoUpdateURL=Update_Site_URL
FingerprintValue=Unique_Key
FingerprintKey=Key_Type

where:

- Update_Site_URL is the HTTP URL to the update site where you store end-user packages.

- Unique_Key is a unique numeric value.

- Key_Type is the HTTP response type or custom header for the FingerprintValue (for example, etag or content-md5).

Together, FingerprintValue and FingerprintKey make a key/value pair that validate whether an update or upgrade is available.

4. Save and close the INI file.

See "About Checking for Updates Automatically" for more information.

Migrating User Data

You can configure the end-user package installation wizard to migrate existing Outlook profiles and user data to conform to the formats expected by the Oracle Communications Unified Communications Suite software.

Configure Connector for Microsoft Outlook to automatically check for updates as part of "Updating Connector for Microsoft Outlook". On the User Profiles tab of the DCP, select Convert Existing Profile and specify the types of profiles to convert.

See "About Migrating User Data" for more information.

Configuring the Shared Calendar Name Format

Calendar names must be unique. You can configure the shared calendar name format. The configured name applies to subscribed calendar folder name and the subscribed task folder name.

The default name format is:

Calendar - owner - calendar_name(calendar_ID)

Configure Connector for Microsoft Outlook to automatically check for updates as part of "Updating Connector for Microsoft Outlook".

To configure the shared calendar name format in Connector for Microsoft Outlook:

1. In the DCP, save your configuration.

2. Open the INI file in a text editor.

3. In the [S1OC] section of INI file, edit the value of the SubscribedCalendarNameFormat parameter.
The default value of legacy gives the default shared calendar name format.

You can specify one of the following formats:

- SubscribedCalendarNameFormat=%u-%n

- SubscribedCalendarNameFormat=%n

- SubscribedCalendarNameFormat=%n-%u

where:

- %u is the calendar owner name.

- %n is the calendar name or ID.

4. Save and close the INI file.

If you configure an invalid format, the default format is used.

When the end-user package is run on the end-user computer, the shared calendar name format is written to the following registry key:

HKCU\Software\Sun Microsystems\Outlook Connector\Subscribed Calendar Name Format

Configuring PST Optimization

PST optimization reduces the local PST file size by not storing message attachments in the PST file. PST optimization is useful for virtual environments, where the computer image is stored in a central location and is downloaded every time a user logs on to the network. PST optimization is not recommended for typical computer users. By default, PST optimization is disabled.

When you enable PST optimization, email attachments are stored in a temporary Windows directory. The attachment file name has following format:

~oc-date_time-file_name

where date_time is a time stamp and file_name is the attachment's file name and extension of the attachment.

When PST optimization is enabled, the following behaviors and limitations apply:

- Files attached to outgoing messages are not stored in a temporary folder. They are left attached to the outgoing email message in the Outbox folder.

- Optimized PST files cannot be imported into a profile where PST optimization is disabled, and vice versa.

- You cannot switch between normal mode and optimized mode.

- Offline access is not possible with PST optimization is enabled.

- Email attachments cannot be previewed.

- Calendar and address book attachments are saved to the PST file, and not saved to a temporary folder.

Configure Connector for Microsoft Outlook with PST optimization as part of "Updating Connector for Microsoft Outlook".

To configure PST optimization:

1. In the DCP, save your configuration.

2. Open the INI file in a text editor.

3. In the [General] section of INI file, locate the following line:

OptimizePstStore=value

where value is either 0 (PST optimization is disabled) or 1 (enabled).

4. Set the value to 1.

5. Save and close the INI file.

Configuring the Address Book Display Order

You can configure the order in which items are displayed in the global address list (GAL). The address book mapping and display order settings are not configurable if the address book service is provided by Contacts Server.

Connector for Microsoft Outlook maps LDAP attributes to corresponding display items in Outlook. You can specify the LDAP attribute mapping and GAL display order in the DCP.

In the GAL, the display order is presented to users in columns. The first column is the display name. Subsequent columns are configured by the GALDisplayOrder parameter.

Configure the address book display order in Connector for Microsoft Outlook as part of "Updating Connector for Microsoft Outlook".

To configure the address book display order:

1. In the DCP, on the LDAP tab, in the LDAP Mapping String field, change the attribute mapping to the desired values.
For example, you can change it to Firstname = given name, Dept = DeptID.

2. Save your configuration.

3. Open the INI file in a text editor.

4. In the [GAL] section of INI file, locate the GALDisplayOrder parameter.

5. Set the GALDisplayOrder attribute to the desired display order.
For example, you can set GALDisplayOrder to the following:

GALDisplayOrder=Officephonenumber,Address,Title,Company,uid,PrimaryEmailAddress,AddressType

In this example, the GAL display order would be: display name, office phone number, address, title, company, user ID, and so forth.

6. Save and close the INI file.

Note:
The display name is also used by directory server as a virtual list view (VLV) sort attribute. The display name value in the DCP must match what is configured in the directory server to prevent degraded performance. See "Configuring Virtual List View" for more information.

Configuring Virtual List View

The GAL allows users to view and search address book information for users, groups, and calendar resources stored in the corporate directory on the directory server. You must configure Connector for Microsoft Outlook to have the same VLV settings as those on the directory server.

The GAL is a read-only MAPI address book provided by a directory server. The VLV settings are not configurable if the address book service is provided by Contacts Server.

Connector for Microsoft Outlook uses VLV to optimize GAL information requests. The directory server must also be configured for VLV. The VLV configurations for Connector for Microsoft Outlook must match those configured on the directory server.

See "Understanding Virtual List View" for more information about the VLV index in the directory server.

Note:
Any mismatch between directory server VLV properties and the VLV configurations in the end-user package negatively affects search performance of the corporate directory in Connector for Microsoft Outlook.

Configure Connector for Microsoft Outlook for VLV as part of "Updating Connector for Microsoft Outlook". On the LDAP tab of the DCP, do the following:

- In the Search Base field, enter the LDAP search base. For example, enter ou=people,dc=example,dc=com.

- In the LDAP Mapping String field, enter the mapping values between the directory server and the VLV index. For example, PrimaryEmailAddress=mail means that the PrimaryEmailAddress VLV attribute is mapped to the mail LDAP attribute.
The following example shows the default value of the LDAP Mapping String field.

Uid=uid,FirstName=givenName,LastName=sn,Initials=initials,Department=departmentNumber,Title=title,Homephonenumber=homePhone,PrimaryEmailAddress=mail,Manager=manager,Mobile=mobile,Company=company,Pager=pager,Assistant=secretary,Notes=description,Fax=facsimileTelephoneNumber,City=l,Address=physicalDeliveryOfficeName,Zipcode=postalCode,State=st,Street=street,Country=c,Officephonenumber=telephoneNumber,EmailAddresses=mailAlternateAddress

- In the VLV Search Filter field, enter the filter values used to return search values to the user.
The default value of (&(mail=*)(cn=*)) means that search results are filtered by email address and display name.

- In the Displayname field, enter the LDAP sort key for the display name.
The default value cn means that the results are sorted by the full common name.

If you modify the LDAP Mapping String value, modify the VLV Search Filter value to match.

About Customized Branding

You can configure Connector for Microsoft Outlook to display your custom brand, such as your own company name, product name, artwork, and information. The customized branding is applied when the end-user package is run on the end-user computer.

The customized brand is applied to the end-user package installation wizard, the application properties and description, the application online Help, configuration dialog boxes, and to the Connector for Microsoft Outlook user interface. The customized brand is also applied to some fields in the control panel, except for the company and product name.

Connector for Microsoft Outlook supports the following customized branding locales:

- English: en-US, en-AU, en-BZ, en-CA, en-029, en-IN, en-IE, en-JM, en-MY, en-NZ, en-PH, en-SG, en-ZA, en-TT, en-GB, en-ZW
The en-US locale is the fall-back locale if users select an English locale that does not have any customized branding.

- Simplified Chinese: zh-CN

- Traditional Chinese: zh-HK, zh-TW

- German: de-DE, de-AT, de-CH, de-LU, de-LI
The de-DE locale is the fall-back locale if users select a German locale that does not have any customized branding.

- Spanish: es-ES, es-AR, es-BO, es-CL, es-CO, es-CR, es-DO, es-EC, es-SV, es-GT, es-HN, es-MX, es-NI, es-PA, es-PY, es-PE, es-PR, es-UY, es-VE
The es-ES locale is the fall-back locale if users select a Spanish locale that does not have any customized branding.

- French: fr-FR, fr-BE, fr-CA, fr-CH, fr-LU
The fr-FR locale is the fall-back locale if users select a French locale that does not have any customized branding.

- Japanese: ja-JP

- Korean: ko-KR

Note:
If the user selects a locale for which there is no customized branding, and the fall-back locale has not any customized branding, the default Oracle branding is shown. For example, if a user opens Microsoft Outlook in fr-CA (French-Canada), and no customized branding is configured for fr-CA or fr-FR (French-France), then Connector for Microsoft Outlook appears with the default Oracle branding.

The following directories were created on your computer when you installed the DCP:

DCP_Home/c11n/template

DCP_Home/c11n/nls/en-US

where DCP_Home is the location you installed the DCP.

DCP_Home/c11n/template contains a template INI file named template.ini, which lists and describes all the branding parameters you can customize.

DCP_Home/c11n/nls/en-US contains a reference implementation INI file named resourceconfig.ini, which provides sample values for an English customization.

In DCP_Home/c11n/nls, you can create directories for any of the supported locales. Copy template.ini into the folder and rename it to resourceconfig.ini.

If you choose not to customize branding, the default Oracle brand is displayed in Connector for Microsoft Outlook.

Configuring Customized Branding

To configure customized branding in Connector for Microsoft Outlook:

1. In Windows Explorer, go to DCP_Home/c11n/nls.

2. Create folders for each supported locale for which you want to customize branding.
For example, if you want to customize branding for a French-France deployment of Connector for Microsoft Outlook, create a folder named fr-FR in the /nls directory.

See "About Customized Branding" for a list of supported locales.

3. Copy the template.ini file from DCP_Home/c11n/template and paste it into the new localization folders you created.

4. Rename all copies of template.ini to resourceconfig.ini.

5. In DCP_Home/c11n/nls/en-US, edit resourceconfig.ini in a text editor.
The en-US version of resourceconfig.ini is a reference implementation that contains sample Oracle values. Replace the sample Oracle values with those of your organization

6. Save and close the file.

7. Edit any localized copies of resourceconfig.ini in a text editor, providing parameter values that correspond to localized values for your organization. Save and close the files when you are finished.

Running the Deployment Configuration Program in Silent Mode

You can run the DCP from a command line to silently create end-user packages. In silent mode, you provide the path to an already prepared INI file.

To run the DCP in silent mode:

1. Connect to the system where the DCP is installed.

2. Fom the command line, change directories to where the DCP is installed (DCP_Home).

3. Enter the following command:

admin.exe -i INI_path [-o package_path -l log_path -c c11n_Path]

Table 5-1 describes the parameter values for the admin.exe command and the placeholders used in the above example.

Table 5-1 admin.exe Command Parameter Values

Parameter

Description

-i

The path and file name to the prepared INI file you are using to create the end-user packages.

See "About the INI File" for more information about the INI file.

For example: -i C:\Users\user_name\Documents\DCP\Input\eup01.ini

-o

(Optional) The path and file name of the end-user package EXE file to create. If you omit this parameter, the end-user package is created in the same directory as the DCP and is given the same file name as the INI file.

For example: -o C:\Users\user_name\Documents\DCP\Output\eup01.exe

-l

(Optional) The path where you want the DCP log file written. If you omit this parameter, the log file is written to the default location, which is %TEMP%\Sun Outlook Connector Logs\DCP.

-c

(Optional) The parent directory where the directories and files for customized branding are located. If you omit this parameter, the DCP uses the default customization directory, which is DCP_Home/c11n.

See "About Customized Branding" for more information about customizing Connector for Microsoft Outlook.

Troubleshooting Connector for Microsoft Outlook

This section explains how to resolve some common issues in Connector for Microsoft Outlook.

Resolving Duplicate Calendar Resource Entries

In some deployments where Contacts Server provides the address book service, users might report that their searches for calendar resources in the global address list returns duplicate entries.

To resolve this issue, set the vlvfilter parameter in the directory server to (&(mail=*)(cn=*)).

Resolving Address Book Sharing Issues

In some deployments where Contacts Server provides the address book service, users might report that they cannot share an address book with another user when they provide the email address in the User ID field.

To resolve this issue, set the vlvfilter parameter in the directory server to (&(mail=*)(cn=*)).

Resolving Address Book Lookup Issues

In some deployments, searching for specific users by email ID is not possible and Connector for Microsoft Outlook presents the following error to users:

Cannot validate the input ID

In other deployments, search for users in the global address list takes a long time or times out.

To resolve this issue, tune the look-through-limit parameter on the directory server. See your directory server documentation for information and guidelines about tuning the look-through-limit parameter.

6 Connector for Microsoft Outlook Administration

This chapter describes some administration tasks you may need to perform for users of Oracle Communications Connector for Microsoft Outlook. Most of these tasks are performed on end-user computers.

Reversing Data Migration

If you have decided to stop using the Oracle Communications Unified Communications Suite software, you may need to reverse any migrated user profiles and data files.

To reverse migrated user profiles and data files:

1. Delete the profile Xxx (old).

2. Copy the profile Xxx to Xxx Oracle or some other name, like Xxx (new), and so forth.

3. Delete the profile Xxx.

4. Copy the profile Xxx (Backup) to Xxx.

5. Delete the profile Xxx (Backup).

6. Determine where the PST files are located by viewing Properties on the profile. There is no standard location for PST files, so the only reliable way to find them is to open the profile (now named Xxx) and, for each PST file, click Properties and note the path.

7. For each PST file: Rename Yyy.pst to Yyy.new, and rename Yyy.bak to Yyy.pst.

8. Determine where the PAB files are located by viewing Properties on the profile. There is no standard location for PAB files, so the only reliable way to find them is to open the profile (now named Xxx) and, for each PAB service, click Properties and note the path.

9. For each PAB file: Rename Zzz.pab to Zzz.new, and rename Zzz.bak to Zzz.pab. The Yyy.bak and Zzz.bak files are in the same directory.

Uninstalling Connector for Microsoft Outlook

To uninstall Connector for Microsoft Outlook, use Add/Remove Programs in the Windows Control Panel.

You cannot roll back to a previous version of Connector for Microsoft Outlook. You can uninstall the current version by using Add/Remove Programs from the Control Panel, and then install the required version.

Changing the Location of PST Files

You can specify where Connector for Microsoft Outlook stores new PST files. The default location is:

C:\Documents and Settings\username\Local Settings\Sun\Outlook Connector

To change the location where Connector for Microsoft Outlook stores PST files:

1. On the end-user computer, using the Windows Registry Editor, locate the following registry key:
HKEY_CURRENT_USER\Software\Microsoft\Office\version\Outlook

Where version is the registry version value for Connector for Microsoft Outlook.

If the user is using Outlook 2010, version is 14.0. If the user is using Outlook 2013, version is 15.0.

2. Right-click the ForcePSTPath string and select Modify.

3. Change the path to point to the desired location.

About Certificate-Based Authentication

Certificate-based authentication is a secure authentication method that uses digital certificates stored locally in the system (or in a smart card) to authenticate a user. Certificate-based authentication is an alternative to using passwords.

Connector for Microsoft Outlook supports certificate-based authentication for the following back-end services:

- Mail access service: IMAP + SSL, IMAP + STARTTLS

- Mail transport service: SMTP + SSL

- Calendar service: WCAP + SSL

- Address book service: WABP + SSL or REST + SSL

- Corporate directory: LDAP + SSL or REST + SSL

- User preferences: LDAP + SSL

Connector for Microsoft Outlook supports smart-card certificates and software digital certificates.

Using Certificate-Based Authentication

When logging in, Outlook determines whether the server is configured for certificate-based authentication. If the server is configured for certificate-based authentication, Connector for Microsoft Outlook searches through the local system for eligible certificates with which to authenticate.

The eligible certificates are filtered by:

1. Certificates issued by "trusted CA" by the back-end servers.

2. Unexpired certificates.

3. Certificates that can be used for SSL client authentication.

Connector for Microsoft Outlook prompts the user with the list of eligible certificates. The user selects the certificate with which to authenticate to back-end servers. If certificate-based authentication fails, Connector for Microsoft Outlook falls back to password-based authentication and prompts the user to enter a password. This is also the case if the user does not select any certificates from the list.

Note:
If you configure a profile to only support certificate-based authentication, then the user is not prompted for a password.

If certificate-based authentication fails and password based authentication succeeds for the mail server, then certificate-based authentication is not attempted for other back-end services. If certificate-based authentication succeeds, then certificate-based authentication is attempted with other back-end services first. If certificate-based authentication fails, password-based authentication is attempted.

If a user mistakenly chooses a certificate different than the certificate used during the last login, the user is warned that a different certificate is being used to log in from the previous attempt and is given an option not to continue.

Caution:
If both certificate-based and password-based authentication fail with the mail server, Connector for Microsoft Outlook does not proceed authenticating with other back-end services.

Configuration Considerations

You can configure a profile such that an authentication certificate is used with the back-end services without the user having to choose the certificate.

A user can configure a Connector for Microsoft Outlook profile so that the certificate information is saved, allowing the user to log in without being prompted to select an authentication certificate.

A INI File Parameter Reference

This appendix lists and describes all the possible parameters that can appear in the INI file for Oracle Communications Connector for Microsoft Outlook.

Parameter Reference

The following tables list all the possible parameters that can appear in the INI file. Each table groups together a different section of the INI file.

- Table A-1, "Parameters Belonging to the General Section"

- Table A-2, "Parameters Belonging to the NewAccount_Admin Section"

- Table A-3, "Parameters Belonging to the IMAP Section"

- Table A-4, "Parameters Belonging to the SMTP Section"

- Table A-5, "Parameters Belonging to the S1OC Section"

- Table A-6, "Parameters Belonging to the FreeBusy Section"

- Table A-7, "Parameters Belonging to the ABServer Section"

- Table A-8, "Parameters Belonging to the GAL Section"

- Table A-9, "Parameters Belonging to the UserPreferences Section"

- Table A-10, "Parameters Belonging to the AUServer Section"

Table A-1 Parameters Belonging to the General Section

Parameter Name

Description

Package

The batch file used to create the end-user package.

Default: Package.bat

ConfirmInstall

When set to 1, the end-user package displays the following warning message when it is run:

You are saving a configuration to install one or more of the following: MAPI services. These services require that each user have installation privileges. Save anyway?

Possible values: 1 (default), 0

PostStatus

When set to 1, the end-user program adds a one-line summary of user activity to the CSV file you specify in the accompanying text box.

Possible values: 1 (default), 0

VerboseLog

When set to 1, the end-user package installation log file is written in the more verbose, debug style. When set to 0, the log file is written more concisely.

Possible values: 1, 0 (default).

Silent

When set to 1, the end-user package installation is run in silent mode. When set to 0, the end-user package installation is run in interactive mode.

Possible values: 1, 0 (default)

InstallServiceProviders

When set to 1, the end-user package installs software to facilitate ongoing communications between Microsoft Outlook and Connector for Microsoft Outlook.

Possible values: 1 (default), 0

NewProfileName

Specifies the name of the profile being created or converted.

Default: Oracle Unified Communications Suite

ProfileMode

When set to Create, the end-user package creates a new profile. When set to ConvertOrCreate, the end-user package converts and upgrades an existing user profile.

Possible values: ConvertOrCreate (default), Create

ShareLogs

When set to 1, the Connector for Microsoft Outlook log files are written to the shared directory value for the LogFile parameter. When set to 0, the log file is written to the default location on the end-user computer.

Possible values: 1, 0 (default)

LogFile

The shared directory to which you want Connector for Microsoft Outlook log files written. This parameter value is considered only if the ShareLogs parameter is set to 1.

NewProfileAsDefault

When set to 1, the new profile is designated as the default profile in Microsoft Outlook.

Possible values: 1 (default), 0

StatusLogFile

The shared directory to which Connector for Microsoft Outlook status log files are written.

MaxPstSizeMB

Specifies the amount of available memory in megabytes for which Connector for Microsoft Outlook checks before converting user profiles.

Default: 100

MaxAggregatePstSizesMB

Specifies the maximum personal storage (PST) files size in megabytes to be converted by the end-user package installation wizard. Larger PST files can be converted after the installation as a background operation.

Default: 400

DiskHeadRoomMB

The amount of disk space in megabytes required for the new PST file into which selected items from old IMAP or POP servers are copied.

Default: 64

PasswordedPstDisposition

When set to Convert, converts password-protected PST files.

Possible values: Convert, none

GetMailhostfromUser

When set to 1, the end-user package installation wizard asks the user to provide the mail host.

Possible values: 1, 0 (default)

CreateConvert

When set to 1, the end-user package installation wizard converts existing eligible Outlook user profiles or create a new profile for use with Oracle Communications Connector for Microsoft Outlook.

Possible values: 1 (default), 0

ProfileConvert

Tells the end-user package installation wizard to create new profile when value is set to Create, or to convert/upgrade the profile when set to ConvertOrCreate.

Possible values: Create, ConvertOrCreate (default)

ConvertFromPOP

Set to 1 to convert eligible POP profiles to Connector for Microsoft Outlook profile.

Possible values: 1 (default), 0

ConvertFromIMAP

Make this 1 if eligible IMAP profile should be converted as OC profile.

Possible values: 1 (default), 0

ConvertChangeProfileName

Set to 1 to use the ConvertProfileName parameter.

Possible values: 1, 0 (default)

ConvertProfileName

Specifies the name of the converted profile. This parameter is considered only if the ConvertChangeProfileName parameter is set to 1.

Default: Oracle Unified Communications Suite

UpgradeChangeProfileName

Set to 1 to use the UpgradeProfileName parameter.

Possible values: 1, 0 (default)

UpgradeProfileName

Specifies the name of the upgraded profile. This parameter is considered only if the UpgradeChangeProfileName parameter is set to 1.

Default: Oracle Unified Communications Suite

MigratePopImapCalendar

Set to 1 to have the end-user package installation wizard migrate the user POP/IMAP calendar data and tasks to Connector for Microsoft Outlook.

Possible values: 1 (default), 0

KeepPopImapLocalPst

Set to 1 to have the end-user package installation wizard associate the existing user POP/IMAP desktop data with the new Connector for Microsoft Outlook profile.

Possible values: 1 (default), 0

KeepSunLocalPst

Set to 1 to have the end-user package installation wizard associate the existing user Connector for Microsoft Outlook profile desktop data with upgraded Connector for Microsoft Outlook profile.

Possible values: 1, 0 (default)

RequireMSXML

Set to 1 to have the end-user package installation wizard check for the MSXML3.DLL library.

Possible values: 1 (default), 0

UseOffice2003Pst

Set to 1 to have the end-user package installation wizard create a PST file that supports multilingual Unicode data.

Possible values: 1, 0 (default)

DisallowCalendarAttachments

Set to 1 to have Connector for Microsoft Outlook save calendar/task attachments on the local machine rather than on the calendar server.

Possible values: 1, 0 (default)

DisallowSavePassword

Set to 1 to have Connector for Microsoft Outlook require users to enter their passwords each time they log into Microsoft Outlook.

Possible values: 1, 0 (default)

AllowUserChangeProfileName

Set to 1 to have the end-user package installation wizard allow users to change their profile name.

Possible values: 1, 0 (default)

DisallowPasswordAuth

Set to 1 to configure Connector for Microsoft Outlook to use certificate-based authentication. Set to 0 to use password-based authentication.

Possible values: 1, 0 (default)

EnableCertificateAuth

Set to 1 to configure Connector for Microsoft Outlook to use certificate-based authentication. Set to 0 to use password-based authentication.

Possible values: 1 (default), 0

ModifySun71PlusProfile

Set to 1 to upgrade an existing Connector for Microsoft Outlook profile.

Possible values: 1 (default), 0

ABNewSearchPath

Set to GAL_Contacts to configure directory search to start with LDAP directory, or set to Contacts_GAL to configure directory search to start with the address book.

Possible values: GAL_Contacts (default), Contacts_GAL

ABNewDefaultDir

Set to Contacts to configure the personal address book to appear first in Outlook Address Book. Set to GAL to configure the LDAP directory to appear first in Outlook Address Book.

Possible values: Contacts (default), GAL

OptimizePstStore

Set to 1 to create an optimized PST file store.

Possible values: 1, 0 (default)

Table A-2 Parameters Belonging to the NewAccount_Admin Section

Parameter Name

Description

SavePassword

Set to -1 to configure Connector for Microsoft Outlook to provide users the option to save their passwords when they log in. Set to 0 to remove the Save Password field from the login dialog box. Set to 1 to configure Connector for Microsoft Outlook to always prompt users for their password.

Possible values: -1, 0 (default), 1

Table A-3 Parameters Belonging to the IMAP Section

Parameter Name

Description

Server

The host name for the Oracle Communications Messaging Server incoming mail (IMAP) server.

Port

The port number for the IMAP server. By default, the SSL port is suggested and the UseSSL parameter is enabled.

Default: 993

UseSSL

Set to 1 to configure the Port parameter as a secure port.

Possible values: 1 (default), 0

UseMaxCachedMsgPartKB

Set to 1 to configure mail server to download messages to the user's Inbox when the user goes offline.

Possible values: 1, 0 (default)

MaxCachedMsgPartKB

The per-message size limit in kilobytes for the mail server local message cache.

Default: 50

PollingIntervalSec

The messaging server polling interval in seconds. The value must be a multiple of 60.

Default: 300

EnableCache

Set 1 to enable mail caching.

Possible values: 1 (default), 0

FolderNameMap

Set to Outlook or uwc to specify the standard used by Connector for Microsoft Outlook to name IMAP mail folders.

Possible values: Outlook (default), uwc

ExpungeOnDelete

Set to 1 to permanently delete emails from the server when the user deletes a message.

Possible values: 1, 0 (default)

Table A-4 Parameters Belonging to the SMTP Section

Parameter Name

Description

Server

The host name for the Oracle Communications Messaging Server outgoing mail (SMTP) server.

Port

The port number for the SMTP server. By default, the SSL port is suggested and the UseSSL parameter is enabled.

Default: 465

UseSSL

Set to 1 to configure the Port parameter as a secure port.

Possible values: 1 (default), 0

BccToSender

Set to 1 to configure Connector for Microsoft Outlook to automatically include the sender's email address in the BCC field of each outgoing email message, which allows the sender to file a copy of every sent message.

Possible values: 1, 0 (default)

UseAuth

Set to 1 to configure the SMTP server to require a user password for outbound email messages.

Possible values: 1, 0 (default)

BackgroundPoll

Set to 1 to configure Connector for Microsoft Outlook to poll all email folders for new messages. Set to 0 to poll only the email inbox.

Possible values: 1, 0 (default)

Table A-5 Parameters Belonging to the S1OC Section

Parameter Name

Description

Server

The host name for the Oracle Communications Calendar Server.

Port

The port number for the calendar server. By default, the SSL port is suggested and the UseSSL parameter is enabled.

Default: 443

UseSSL

Set to 1 to configure the Port parameter as a secure port.

Possible values: 1 (default), 0

RelativePath

The relative path to the calendar service.

PollingIntervalSec

The calendar server polling interval in seconds. The value must be a multiple of 60.

Default: 300

FetchPastItemsForLastInDays

Set to 1 to configure Connector for Microsoft Outlook to fetch past calendar events from the calendar server.

Possible values: 1, 0 (default)

WarnNoInviteAccess

Set to 1 to configure Connector for Microsoft Outlook to display a warning when a user is not granted access to invite.

Possible values: 1 (default), 0

GenerateIcalForInvitations

Set 1 to configure Connector for Microsoft Outlook to generate ICAL invitations.

Possible values: 1, 0 (default)

SubscribedCalendarNameFormat

Specifies the name format used for shared calendars. See "Configuring the Shared Calendar Name Format" for more information.

Possible values: Legacy (default), custom

DisplayDefaultCalendarNameInOutlookFormat

Determines the default calendar name format. Set to 1 to display the calendar name using the default format. Set to -1 to display calendar names as they are defined in Calendar Server.

Possible values: -1 (default), 1

Table A-6 Parameters Belonging to the FreeBusy Section

Parameter Name

Description

Server

The host name for the Oracle Communications Calendar server.

Port

The port number for the server. By default, the SSL port is suggested and the UseSSL parameter is enabled.

Default: 443

Table A-7 Parameters Belonging to the ABServer Section

Parameter Name

Description

Server

The host name for the address book service server. The address book service can be provided by either Oracle Communications Contacts Server or Oracle Communications Convergence.

Port

The port number for the server. By default, the SSL port is suggested and the UseSSL parameter is enabled.

Default: 443

UseSSL

Set to 1 to configure the Port parameter as a secure port.

Possible values: 1 (default), 0

RelativePath

Relative path to the address book service.

PollingIntervalSec

The address book service polling interval in seconds. The value must be a multiple of 60.

Default: 300

ABServerType

Set to 1 to specify that the address book service is provided by Contacts Server. Set to 2 to specify that the address book service is provided by Convergence.

Possible values: 1 (default), 2

Table A-8 Parameters Belonging to the GAL Section

Parameter Name

Description

Host

The directory server host name.

Port

The port number for the server. By default, the SSL port is suggested and the UseSSL parameter is enabled.

Default: 443

UseSSL

Set to 1 to configure the Port parameter as a secure port.

Possible values: 1 (default), 0

SizeLimit

Specifies the maximum number of search results returned.

Default: 100

TimeLimitSec

Specifies the maximum length of time in seconds a search can take before the server cancels the attempt.

Default: 60

SearchBase

The LDAP root directory distinguished name.

UseAuth

Set to 1 to configure the directory server to require a user distinguished name (DN) for each directory query.

Possible values: 1 (default), 0

DNPattern

The user DN elements that, when assembled, form the complete DN to authenticate the user with the directory server (if authentication is required).

Default: uid=%s,<search base>

Filter

Specifies the filter used for virtual list view, for the displaying of entries within the directory.

Default: (&(mail=*)(cn=*))

SortKey

The directory server sort key for the global address list (GAL).

Default: Cn

ResolveNameFilter

Specifies which fields to search when entering a name while composing a new message.

Default: N/A

AdvanceSearchFilter

Specifies what fields are used when searching for users within the GAL.

Default: N/A

ShowMemberOF

Set to 1 to display the static LDAP groups to which the selected user belongs.

Possible values: 1, 0 (default)

LdapMappingString

This field contains mappings for the GAL and the directory server. Corporate directory displays contact information by fetching the data from directory server.

GALDisplayOrder

Specifies the attribute display order in the global address list. See "Configuring the Address Book Display Order" for more information.

Table A-9 Parameters Belonging to the UserPreferences Section

Parameter Name

Description

UsrPrefHost

The host name for the Convergence server.

UsrPrefPort

The port number for the server. By default, the SSL port is suggested and the UseSSL parameter is enabled.

Default: 443

UsrPrefUseSSL

Set to 1 to configure the Port parameter as a secure port.

Possible values: 1, 0 (default)

UsrPrefRelativePath

The relative path to the Convergence server.

Default: iwc

UsrPrefOutOfOffice

Set to 1 to configure Connector for Microsoft Outlook to display a dialog box when the user logs on and out of office is enabled.

Possible values: 1, 0 (default)

UsrPrefLookup

Set to 1 to configure the user display name to be taken from the directory server.

Possible values: 1, 0 (default)

UsrPrefMailFilter

Set to 1 to allow users to use Microsoft Outlook to create mail filtering rules.

Possible values: 1 (default), 0

UsrPrefOutOfOfficeSetting

Set to 1 to allow users to use Microsoft Outlook to enable and configure out of office.

Possible values: 1 (default), 0

UsrPrefAttribList

Specifies a list of user attributes to extract from the Convergence server.

Default: mailDeliveryOption,vacationStartDate,vacationEndDate,cn,mail

Table A-10 Parameters Belonging to the AUServer Section

Parameter Name

Description

AutoUpdateURL

Specifies the HTTP URL to the update site where you publish updated and upgraded end-user packages for Connector for Microsoft Outlook.

FingerprintValue

A numeric value that must unique for Connector for Microsoft Outlook to detect the update.

FingerprintKey

The HTTP response type or custom header for the fingerprint value (for example, etag or content-md5).

Together, FingerprintValue and FingerprintKey make a key/value pair that validate whether an update or upgrade is available.

Sample INI File

The following example is a sample INI file.

[General]
Package=package.bat
ConfirmInstall=0
PostStatus=0
VerboseLog=0
Silent=0
InstallServiceProviders=0
NewProfileName=Oracle Unified Communications Suite
ProfileMode=Create
ShareLogs=0
LogFile=
NewProfileAsDefault=1
StatusLogFile=
MaxPstSizeMB=100
MaxAggregatePstSizesMB=400
DiskHeadRoomMB=64
PasswordedPstDisposition=Convert
PstUpdateMode=All
GetMailhostfromUser=0
CreateConvert=1
ProfileConvert=Create
ConvertFromExchange=0
ConvertFromPOP=0
ConvertFromIMAP=0
ConvertExchangeContacts=1
ConvertChangeProfileName=0
ConvertProfileName=Oracle Unified Communications Suite
UpgradeChangeProfileName=0
UpgradeProfileName=Oracle Unified Communications Suite
MigratePopImapCalendar=1
KeepPopImapLocalPst=1
KeepSunLocalPst=0
RequireMSXML=1
UseOffice2003Pst=0
DisallowCalendarAttachments=0
DisallowSavePassword=0
AllowUserChangeProfileName=1
DisallowPasswordAuth=0
EnableCertificateAuth=1
ModifySun71PlusProfile=0
ABNewSearchPath=Contacts_GAL
ABNewDefaultDir=Contacts
UWC_Url=
Use_UWC_Url=0
OptimizePstStore=0
[NewAccount_Admin]
SavePassword=-1
[IMAP]
Server=host.example.com
Port=143
UseSSL=0
UseMaxCachedMsgPartKB=0
MaxCachedMsgPartKB=50
PollingIntervalSec=300
EnableCache=1
FolderNameMap=outlook
ExpungeOnDelete=0
[SMTP]
Server=host.example.com
Port=25
UseSSL=0
BccToSender=0
UseAuth=0
BackgroundPoll=0
[S1OC]
UseDefaultStore=1
UseSSL=0
Server=host.example.com
Port=8080
RelativePath=davserver/wcap
PollingIntervalSec=300
FetchPastItemsForLastInDays=0
WarnNoInviteAccess=1
GenerateIcalForInvitations=0
SubscribedCalendarNameFormat=legacy
DisplayDefaultCalendarNameInOutlookFormat=-1
[FreeBusy]
Server=host.example.com
Port=8080
[ABServer]
UseSSL=0
Server=host.example.com
Port=80
RelativePath=iwc/svc
PollingIntervalSec=300
ABServerType=0
[GAL]
SizeLimit=100
TimeLimitSec=60
Port=389
Server=host.example.com
UseSSL=0
SearchBase=o=isp
UseAuth=1
DNPattern=uid=%s,dc=in,dc=oracle,dc=com
Filter=(&(mail=*)(cn=*))
SortKey=cn
CollationRule=oid=1.3.6.1.4.1.42.2.27.9.4.34.1
ResolveNameFilter=(&(mail=*)(|(mail=%s*)(cn=%s*)(sn=%s*)(givenName=%s*)))
AdvanceSearchFilter=(cn=%s*),(givenName=%s*),(sn=%s*),(title=%s*),(uid=%s*),(company=%s*),(departmentNumber=%s*),(physicalDeliveryOfficeName=%s*),(l=*%s*)
UseDNPattern=1
ShowMemberOF=0
isMemberOf=isMemberOf
LdapMappingString=Uid=uid,FirstName=givenName,LastName=sn,Initials=initials,Department=departmentNumber,Title=title,Homephonenumber=homePhone,PrimaryEmailAddress=mail,Manager=manager,Mobile=mobile,Company=company,Pager=pager,Assistant=secretary,Notes=description,Fax=facsimileTelephoneNumber,City=l,Address=physicalDeliveryOfficeName,Zipcode=postalCode,State=st,Street=street,Country=c,Officephonenumber=telephoneNumber,EmailAddresses=mailAlternateAddress
GALDisplayOrder=Officephonenumber,Address,Title,Company,uid,PrimaryEmailAddress,AddressType
[UserPreference]
UsrPrefHost=host.example.com
UsrPrefPort=389
UsrPrefUseSSL=0
UsrPrefSearchBase=
UsrPrefRetrieveSetting=0
UsrPrefDNPattern=
UsrPrefOutOfOffice=
UsrPrefLookup=
UsrPrefAttribList=mailDeliveryOption,vacationStartDate,vacationEndDate,cn,mail
UserPrefCalDelegateAttributeList=mailGrantSendPermissionsTo,calendarDelegateMailAddress,calendarDelegateForwardMethod
UserPrefCalDelegateON=0
[AUServer]
AutoUpdateURL=host.example.com
FingerprintValue=123456
FingerprintKey=etag

B Understanding Virtual List View

This appendix explains some of the concepts about setting up virtual list view (VLV) in the directory server and the global address list (GAL) for Oracle Communications Connector for Microsoft Outlook.

About Virtual List View

The GAL allows users to view and search address book information for users, groups, and calendar resources stored in the corporate directory on the directory server. You can configure the end-user package with VLV browsing index configurations that affect how Connector for Microsoft Outlook queries the GAL.

The GAL is a read-only MAPI address book provided by a directory server. The VLV settings are not configurable if the address book service is provided by Contacts Server.

Connector for Microsoft Outlook uses VLV to optimize GAL information requests. The directory server must also be configured for VLV. The VLV configurations for Connector for Microsoft Outlook must match those configured on the directory server.

In the directory Server, the VLV index is very precisely defined by the following properties:

- basedn

- search filter

- sort attribute

- scope

Any mismatch between these properties on the directory server and the configurations in Connector for Microsoft Outlook negatively affect search performance of the corporate directory.

About VLV Settings and Values

If you wanted the GAL search to also provide results from other hosted-domain organizations, you could use the overall base for hosted domains, that is o=isp.

The security ramifications of selecting the Require authentication check box are discussed in "About Granting User Data Access".

This article assumes that the directory server has a single database back-end for user/group information (o=isp in this example). If multiple database back ends are used for the user/group tree (that is, one per hosted domain), then you need to add VLV browsing indexes will need to each appropriate back end.

The easiest mechanism to determine the database_backend setting is to refer to the dse.ldif directory configuration file located under the ds5_root_path/config/ directory for Directory Server 5.2, or the ds6_root_path/config/ directory for Directory Server 6.0, and search for nsslapd-suffix: user_group_base.

About the VLV Browsing Index

You must create a VLV browsing index on every directory server used by Connector for Microsoft Outlook. Directory server index configuration settings are not replicated.

Without a VLV browsing index, or if the index settings differ from those configured in Connector for Microsoft Outlook, searches and lookups in the corporate directory take considerable time and the Outlook appears to freeze. If the time taken to perform the search is longer then the configured search time out (1 minute by default), no results are seen by the end-user.

In the directory server logs you will see VLV searches returning after a period of time and a "notes=U" in the result line, indicating the lack of an index.

The following example shows a sample search log:

conn=2500737 op=1 msgId=2 - SRCH base="o=aus.sun.com,o=isp" scope=2 filter="(&(mail=*)(cn=*))" attrs="cn mail uid objectClass"
conn=2500737 op=1 msgId=2 -  SORT cn (12345)
conn=2500737 op=1 msgId=2 -  VLV 1:1:1:0 0:0 (0)
conn=2500737 op=1 msgId=2 - RESULT err=12 tag=101 nentries=0 etime=60 notes=U
conn=2500737 op=10 msgId=11 - ABANDON targetop=9 msgid=10 nentries=0 etime=60

Applying the VLV Browsing Index Settings

The following ldap modifications add the required directory settings to allow for the VLV index creation.

ldapmodify -h ds_hostname -p ds_port -D "cn=Directory Manager"
dn: cn=Browsing db_backend,cn=db_backend,cn=ldbm database,cn=plugins,cn=config
changetype: add
objectClass: top
objectClass: vlvSearch
cn: Browsing db_backend
vlvbase: org_base
vlvscope: 2
vlvfilter: vlv_search_filter
aci: (targetattr="*")(version 3.0; acl "VLV for Anonymous";
allow (read,search,compare) userdn="ldap:///anyone";)

dn: cn=Sort by vlv_sort_attribute,cn=Browsing db_backend,cn=db_backend,cn=ldbm database,cn=plugins,cn=config
changetype: add
objectClass: top
objectClass: vlvIndex
cn: Sort by vlv_sort_attribute
vlvSort: vlv_sort_attribute

The following example shows the directory server settings with sample values:

ldapmodify -h directory.example.com -p 389 -D "cn=Directory Manager"
dn: cn=Browsing isp,cn=isp,cn=ldbm database,cn=plugins,cn=config
changetype: add
objectClass: top
objectClass: vlvSearch
cn: Browsing isp
vlvbase: o=example.com,o=isp
vlvscope: 2
vlvfilter: (&(mail=*)(cn=*))
aci: (targetattr="*")(version 3.0; acl "VLV for Anonymous";
allow (read,search,compare) userdn="ldap:///anyone";)

dn: cn=Sort by cn,cn=Browsing isp,cn=isp,cn=ldbm database,cn=plugins,cn=config
changetype: add
objectClass: top
objectClass: vlvIndex
cn: Sort by cn
vlvSort: cn

See your directory server documentation for more information about creating the VLV browsing index.

Generating the VLV Browsing Index

Run the following commands to generate the VLV browsing index on the directory server. Because the directory server needs to be shut down, you should consider generating the VLV browsing index during non-peak hours.

- For Oracle Directory Server Enterprise Edition 6

cd /opt/SUNWdsee/ds6/bin
./dsadm stop ds_instance_path
./dsadm reindex -l -t "Sort by vlv_sort_attribute" ds_root_path "user_group_base"
./dsadm start ds_root_path

The following example shows the commands with sample values:

cd /opt/SUNWdsee/ds6/bin
./dsadm stop /var/opt/SUNWdsee/dsins1/
./dsadm reindex -l -t "Sort by cn" /var/opt/SUNWdsee/dsins1/ "o=isp"
./dsadm start /var/opt/SUNWdsee/dsins1/

- For Oracle Directory Server Enterprise Edition 5

cd ds_root_path
./stop-slapd
./vlvindex -n db_backend -T "Sort by vlv_sort_attribute"
./start-slapd

The following example shows the commands with sample values:

cd /opt/SUNWdir/slapd-directory
./stop-slapd
./vlvindex -n userRoot -T "Sort by cn"
./start-slapd

About Granting User Data Access

Consider carefully how to grant access to user and group data in the organizations directory. Organizations are now increasingly under pressure to reduce the amount of private data that non-authorised entities can access. Connector for Microsoft Outlook, however, must access user data for correct operation of the GAL and other functionality.

Default directory server installation blocks access to user data. You likely need to modify access controls for Connector for Microsoft Outlook to provide the best end-user experience.

Determining the Appropriate ACI Mechanisms

The following list enumerates some security approaches for granting access to user data, from most to least preferred:

- Access by authenticated users in the same domain to limited attributes

- Access by authenticated users in the same domain to all attributes (except userpassword)

- Access by authenticated users in any domain to limited attributes

- Access by authenticated users in any domain to all attributes (except userpassword)

- Anonymous access to limited attributes

- Anonymous access to all attributes (except userpassword)

To any of these approaches, you can also apply IP-based restrictions (for example, restrict access to clients running Connector for Microsoft Outlook on hosts within a specific IP range).

See your directory server documentation for more information about ACI mechanisms.

Configuring Authenticated User Access

Configuring authenticated user access is the most desirable approach as it restricts access to only those users who provide the correct authentication details. This has the advantage of being very granular and allowing the administrator to identify which user is attempting to make a search which can be useful for debugging, or throttling.

If using this approach, also consider the use of SSL encryption for directory server access. Connector for Microsoft Outlook sends user login details in clear-text when binding to the directory if not configured to communicate with the directory server on a secure port.

Consider making the following configurations:

- Configure the end-user package with the Require Authentication option.
In the DCP, on the LDAP tab, select Require Authentication.

- Set the User DN value.
In the DCP, on the LDAP tab, in the User DN field, enter a DN pattern, such as uid=%s,ou=People,o=example.com,o=isp.

This example value binds Connector for Microsoft Outlook as the login user (%s is substituted with the login user name).

- Enable user access to user/group details.
Determine the most appropriate ACI for your organization. Specifically, consider who needs to be given access to what.

If the who is any authenticated user (any user in the directory), then the ACI representation is ldap:///all. If the who is any user at a specific domain level, then the ACI representation can be expressed as a DN wildcard match, such as ldap:///uid=*,ou=people,o=example.com,o=isp.

The what is controlled by where in the directory tree you add the ACI (for example, at the base of the organization or at the base of a hosted domain). The user/group attributes you choose to return determine what information is provided back to Connector for Microsoft Outlook.

For example, in a hosted domain environment, you may want to prevent users in one domain from accessing another domain. Apply the access control at the domain level and allow results to be returned for users whose DN contain the hosted domain LDAP base path.

- Test your settings.
Use the following directory server command to test that your settings are working correctly:

ldapsearch -h ds_hostname -p ds_port -D user_dn -b user_group_base objectclass=inetmailuser dn uid mail

For example:

ldapsearch -h directory.example.com -p 389 -D "uid=someuser,ou=people,o=aus.sun.com,o=isp" -b o=isp objectclass=inetmailuser dn uid mail

This command should return a list of UIDs, mail addresses, and DNs of the users and groups in the domain or organization, depending on the ACI.

The following examples show different ACI authentication approaches.

Example B-1 Authenticated Access by Users in the Same Domain to Limited Attributes

aci: (targetattr = "cn || displayName || givenName || sn || initials || uid || departmentNumber || title || homePhone || mail || manager || mobile || company || pager || secretary || description || facsimileTelephoneNumber || l || physicalDeliveryOfficeName || postalCode || st || street || c || telephoneNumber || mailAlternateAddress || isMemberOf || objectClass") (version 3.0;acl "Authenticated user access at domain-level"; allow (read,compare,search)(userdn = "ldap:///uid=*,ou=people,o=aus.sun.com,o=isp");)

Example B-2 Authenticated Access by Users in Same Domain to All Attributes (Except Password)

aci: (targetattr != "userPassword")(version 3.0;acl "Authenticated user access at domain-level";
allow (read,compare,search)(userdn = "ldap:///uid=*,ou=people,o=aus.sun.com,o=isp");)

Example B-3 Authenticated Access by Users in Any Domain to Limited Attributes

aci: (targetattr = "cn || displayName || givenName || sn || initials || uid || departmentNumber || title || homePhone || mail || manager || mobile || company || pager || secretary || description || facsimileTelephoneNumber || l || physicalDeliveryOfficeName || postalCode || st || street || c || telephoneNumber || mailAlternateAddress || isMemberOf || objectClass") (version 3.0;acl "Authenticated user access"; allow (read,compare,search)(userdn = "ldap:///all");)

Example B-4 Authenticated Access by Users in Any Domain to All Attributes (Except Passwords)

aci: (targetattr != "userPassword")(version 3.0;acl "Authenticated user access";
allow (read,compare,search)(userdn = "ldap:///all");)

Once you have determined the most appropriate ACI settings, use the following command to apply the rule to the directory:

ldapmodify -h ds_hostname -p ds_port -D "cn=Directory manager"
dn: base_for_aci
changetype: modify
add: aci
aci: user_data_aci

For example:

ldapmodify -h directory.example.com -p 389 -D "cn=Directory manager"
dn: o=example.com,o=isp
changetype: modify
add: aci
aci: (targetattr != "userPassword")(version 3.0;acl "Authenticated user access at domain-level"; allow (read,compare,search)(userdn = "ldap:///uid=*,ou=people,o=aus.sun.com,o=isp");)

Configuring Anonymous Access

Granting data access for connections that bind anonymously is not-desirable, as it increases the risk that data could be accessed by unwanted agents, such as spammers. At a minimum, consider restricting anonymous access by IP address (such as, IP addresses used by your organization's servers and clients).

Consider making the following configurations:

- Configure the end-user package without the Require Authentication option.
In the DCP, on the LDAP tab, deselect Require Authentication.

Connector for Microsoft Outlook uses anonymous bind functionality.

- In the directory server, grant anonymous access to the VLV browsing indexes.
By default, the directory server does not allow anonymous VLV browsing access. Use the following command on the directory server to enable anonymous VLV browsing access:

ldapmodify -h ds_hostname -p ds_port -D "cn=Directory Manager"
dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
changetype: modify
add: aci
aci: (targetattr !="aci")(version 3.0; acl "VLV Request Control"; allow (compare,read,search) userdn = "ldap:///anyone";)

For example:

ldapmodify -h directory.example.com -p 389 -D "cn=Directory Manager"
dn: oid=2.16.840.1.113730.3.4.9,cn=features,cn=config
changetype: modify
add: aci
aci: (targetattr !="aci")(version 3.0; acl "VLV Request Control"; allow (compare,read,search) userdn = "ldap:///anyone";)

- In the directory server, enable anonymous access to user/group details.
By default, the directory server does not allow anonymous access to user/group details. Use the following command on the directory server to grant anonymous access to user/group details.

ldapmodify -h ds_hostname -p ds_port -D "cn=Directory manager"
dn: base_for_aci
changetype: modify
add: aci
aci: user_data_aci

For example:

ldapmodify -h directory.example.com -p 389 -D "cn=Directory manager"
dn: o=aus.sun.com,o=isp
changetype: modify
add: aci
aci: (targetattr != "userPassword")(version 3.0;acl "Anonymous access"; allow (read,compare,search)(userdn = "ldap:///anyone");)

If you do not successfully add this entry, you do not receive any search results and you receive the following error message:

conn=197 op=1 msgId=10 - SRCH base="o=example.com,o=isp" scope=2 filter="(&(mail=*)(cn=*))" attrs="uid mail cn title company telephoneNumber physicalDeliveryOfficeName objectClass"
conn=197 op=1 msgId=10 - SORT cn (10)
conn=197 op=1 msgId=10 - VLV 0:9:0:0 1:10 (0)
conn=197 op=1 msgId=10 - RESULT err=0 tag=101 nentries=0 etime=0

- Test your settings.
Use the following directory server command to test that your settings are working correctly:

ldapsearch -h ds_hostname -p ds_port -b user_group_base objectclass=inetmailuser dn uid mail

For example:

ldapsearch -h directory.example.com -p 389 -b o=isp objectclass=inetmailuser dn uid mail

This command should return a list of UIDs, mail addresses, and DNs of the users and groups in the domain or organization, depending on the ACI.

If your organization restricts access to the directory servers through some other means (for example, network perimeter firewalls which block access to port 389/636), you could use the following rules to allow access to data.

Example B-5 Anonymous Access to Limited Attributes

aci: (targetattr = "cn || displayName || givenName || sn || initials || uid || departmentNumber || title || homePhone || mail || manager || mobile || company || pager || secretary || description || facsimileTelephoneNumber || l || physicalDeliveryOfficeName || postalCode || st || street || c || telephoneNumber || mailAlternateAddress || isMemberOf || objectClass") (version 3.0;acl "Anonymous access"; allow (read,compare,search)(userdn = "ldap:///anyone");)

Example B-6 Anonymous Access to All Attributes (Except Passwords)

aci: (targetattr != "userPassword")(version 3.0;acl "Anonymous access"; allow (read,compare,search)(userdn = "ldap:///anyone");)

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2015, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.