Understanding the Oracle Directory Integration Platform for Provisioning

15.1 What Is Provisioning?

Provisioning refers to the process of providing users, groups, and other objects with access to applications and other resources that may be available in an enterprise environment.

A provisioning-integrated application refers to an application that has registered for provisioning events and registered a provisioning-integration profile in the Oracle Unified Directory or Oracle Internet Directory back-end directory. At times, you may want to synchronize all user entries in an application-specific directory with those in the back-end directory, but provision a particular application to receive notification about only some of them. For example, the directory for Oracle Human Resources typically contains data for all employees in an enterprise, and you would probably want to synchronize all of that data with the Oracle Unified Directory or Oracle Internet Directory back-end directory. However, you might want to provision another application, such as Oracle Email, to be notified only when members join or leave a particular group.

Before a user account can be provisioned for applications in an Oracle Identity Management deployment, it must first be created in the back-end directory. User accounts can be created in the Oracle back-end directory with the following tools or methods:

Oracle Directory Services Manager
Bulk provisioning using provProfileBulkProv command-line interface
Synchronization with other Oracle and third-party directories
Command-line LDAP tools

The Oracle Directory Integration Platform Service can be invoked for any user entries, regardless of how they were created in the back-end directory. However, creating a user entry in the Oracle back-end directory does not necessarily mean that the user entry will have access to all applications in the Oracle Identity Management environment. The user account must be manually provisioned by an administrator or automatically provisioned according to an application's provisioning policies. The default provisioning policy of an application can be one of the following:

Provision all users
Do not provision users
Provision users after evaluating a provisioning policy

Provisioning policies are entirely dependent on the needs and requirements within each enterprise environment. For example, an organization may choose to provision all users with access to an e-mail application, but may restrict the users that are provisioned to access a human resources application.

15.2 Understanding Oracle Provisioning Products

Oracle offers two complementary provisioning products, optimized for different use cases.

Oracle Identity Manager is an enterprise provisioning platform designed to manage complex environments with highly heterogeneous technologies that can include directories, databases, mainframes, proprietary technologies, and flat files. Oracle Identity Manager offers full-functioned workflow and policy capabilities along with a rich set of audit and compliance features.
Oracle Directory Integration Platform, a component of the Identity Management infrastructure, is a meta-directory technology designed to perform directory synchronization as well as provisioning tasks in a directory-centric environment. Oracle Directory Integration Platform is designed to manage a more homogeneous environment consisting of directories and compatible Oracle products. Oracle Directory Integration Platform performs provisioning tasks by using data synchronization and offers a small deployment footprint when workflow and a full feature policy engine are not required.
Note:
- You must use Oracle Unified Directory 11g Release 2 (11.1.2.3) and above or Oracle Internet Directory 11g Release 1 (11.1.1) as your back-end directory server to use the Oracle Directory Integration Platform provisioning functionality.
- If you are using Oracle Unified Directory as your back-end directory for Oracle Directory Integration Platform provisioning functionality, then you must install Oracle Directory Integration Platform 11g Release 1 (11.1.1.9.0) or a higher version. Earlier versions of Oracle Directory Integration Platform or versions upgraded/patched to 11g Release 1 (11.1.1.9.0) do not support provisioning functionality for Oracle Unified Directory.

15.3 Oracle Directory Integration Platform Service Components

The Oracle Directory Integration Platform Service consists of the following components:

The Oracle Directory Integration Platform.

See Also:

Managing the Oracle Directory Integration Platform
A provisioning integration profile for each provisioning-integrated application in which you want to provision users. You create a provisioning-integration profile by using the manageProvProfiles.

See Also:

"About manageProvProfiles Command" for information about manageProvProfiles.

15.4 Understanding Provisioning Concepts

This section explains how applications are provisioned with Oracle Directory Integration Platform Provisioning.

Topics:

15.4.1 About Synchronous Provisioning

A provisioning-integrated application can maintain user information in the back-end directory or a connected repository. Applications that maintain user information in the back-end directory can use the Data Access Java plug-in to create, modify, and delete user entries whenever the change occurs in back-end directory.

15.4.2 About Asynchronous Provisioning

The Oracle Directory Integration Platform propagates PL/SQL events to a provisioning-integrated application, which then executes a PL/SQL plug-in to process the events.

Execution of a PL/SQL plug-in occurs within the application repository and not within the address space of any Oracle Identity Management component. Because, provisioning is handled by a PL/SQL plug-in and not by any component of Oracle Identity Management, provisioning-integrated applications that implement a PL/SQL plug-in are provisioned asynchronously. The PL/SQL plug-in returns the status of SUCCESS or FAILURE to the Oracle Directory Integration Platform. If the status of SUCCESS is returned for the PL/SQL plug-in, then a provisioning status is also returned, which is recorded in the user's provisioning status attribute in the back-end directory for the specific provisioning-integrated application. If the status of FAILURE is returned for new user provisioning requests, then the user's provisioning status is assigned a value of PROVISIONING_FAILURE. See "Provisioning Status in Oracle Back-end Directory" for a list of provisioning status.

Asynchronous provisioning follows this process:

A new user entry and an associated entry containing application-specific user preferences are created in back-end directory from one of the following sources:
- Oracle Enterprise Manager user interface
- Bulk provisioning using the provProfileBulkProv command
- Synchronization with connected Oracle and third-party directories
At the next scheduled synchronization interval, the Oracle Directory Integration Platform identifies new user entries in back-end directory that require provisioning.
Provisioning events are sent from the Oracle Directory Integration Platform to the PL/SQL plug-in.

Figure 15-2 illustrates the process of how an application is asynchronously provisioned using command-line LDAP tools.

Figure 15-2 Asynchronous Provisioning using Command-Line LDAP Tools

This illustration is described in the text.

As illustrated in Figure 15-2, asynchronous provisioning using command-line LDAP tools follows this process:

A new user entry is created in the Oracle Unified Directory or Oracle Internet Directory back-end directory using a command-line LDAP tool.
At the next scheduled synchronization interval, the Oracle Directory Integration Platform identifies new users entries in back-end directory that require provisioning, and creates an associated entry containing application-specific user preferences.
Provisioning events are sent from the Oracle Directory Integration Platform to the PL/SQL plug-in.

15.4.3 About Provisioning Data Flow

Regardless of whether it is provisioned synchronously or asynchronously, an application can invoke the Pre-Data Entry and Post-Data Entry plug-ins to enhance provisioning intelligence and implement business policies. Both plug-ins are invoked by bulk provisioning using the provProfileBulkProv command.

The Pre-Data Entry plug-in populates fields according to provisioning policies. The primary purpose of this plug-in is to determine whether a user should be provisioned in an application. For example, if an organization has a a policy where only managers are provisioned for a financial application, the Pre-Data Entry plug-in can be used to identify which user entries to provision. Common user attributes are already populated when this plug-in is invoked, so it should have adequate information to make provisioning decisions.

The Post-Data Entry plug-in primarily validates data entered by users for common attributes and application-specific attributes. The validation for the plug-in must be successful for provisioning to continue.

Figure 15-3 illustrates the provisioning data flow using the Pre-Data Entry and Post-Data Entry plug-ins.

Figure 15-3 Provisioning Data Flow

Description of "Figure 15-3 Provisioning Data Flow"

As illustrated in Figure 15-3, the provisioning data flow follows this process:

Base user information is created.
The Pre-Data Entry plug-in is invoked, which populates fields according to policies.
The Post-Data Entry plug-in is invoked, which validates data entered by the user.
Depending on the provisioning approach, either asynchronous or synchronous provisioning procedures are invoked.

15.5 Overview of Provisioning Methodologies

This section describes the procedures for provisioning users in Oracle Identity Management.

Topics:

15.5.1 Understanding Provisioning Users that are Synchronized from an External Source

When Oracle Unified Directory or Oracle Internet Directory is used as a central repository, and enterprise user entries are synchronized from connected directories to the back-end directory, each user identity is automatically provisioned according to the default provisioning policy of each provisioning-integrated application.

15.5.2 Understanding Provisioning Users Created with Command-Line LDAP Tools

Any tools developed by Oracle or third-party vendors that use standard command-line LDAP syntax can create user entries in the back-end directory. As with user entries that are synchronized from external sources, any user entries created with command-line LDAP tools or any other means are provisioned according to the default provisioning policies for each provisioning-integrated application.

15.5.3 Bulk Provisioning Using the provProfileBulkProv Tool

Run the provProfileBulkProv utility, located in the ORACLE_HOME/bin directory, to perform initial migration of data from an LDIF file to the back-end directory for a provisioning profile.

For more information, see provProfileBulkProv utility.

15.5.4 On-Demand Provisioning

On-demand provisioning occurs when a user accesses an application and the application has no knowledge of the user in its repository. The application determines whether to provision a user account based on its default provisioning policies. After provisioning a user account in its repository, an application will update the provisioning status of the user entry in the back-end directory.

15.5.5 Application Bootstrapping

The Oracle Directory Integration Platform Service notifies newly registered applications of all existing user entries in Oracle Unified Directory or Oracle Internet Directory and attempts to provision each existing user entry as if they were a new user in the application.

15.6 About Organization of User Profiles in the Oracle Back-End Directory

This section discusses the organization of user profiles in the Oracle Unified Directory or Oracle Internet Directory back-end directory.

Topics:

15.6.1 Understanding Organization of Provisioning Entries in the Directory Information Tree

The Oracle Directory Integration Platform Provisioning relies on user profiles in the directory information tree (DIT) that consist of attributes containing personal information and preferences for the various applications in which the user is provisioned.

These user attributes for the Oracle Directory Integration Platform Service can be categorized as follows:

Base attributes that are available for every user entry
Application-specific attributes that are only available if a user is provisioned in an application

Base user attributes primarily belong to standard LDAP object classes such as organizationalPerson and inetOrgPerson, and consist of personal details that include first name, last name, given name, e-mail address, and telephone numbers. Base user attributes also consist of Oracle application-specific attributes that belong to the orclUserV2 auxilliary class.

The back-end directory is the primary repository for both base attributes and application-specific attributes. Both types of attributes are stored in each user's profile. However, an application can cache user attributes that are updated with the provisioning event notification service.As shown in Figure 15-4, user attributes are stored in two locations within the DIT. Base user entries, which include attributes belonging to inetorgperson and orcluserv2, are stored under cn=users,Realm DN. The provisioning status of each user entry is also stored in the base user entry. Application-specific attributes reside in separate entries in the application container. The LDAP schema relating to the application-specific attribute definitions and the object classes are created during the installation or upgrade process. Application-specific attributes are qualified by an auxiliary object class, which will enable searching for the application-specific user properties of the entry. By default, application-specific entries are stored as orclOwnerGUID=GUID of the Base User under the cn=User Properties, cn=Application Type, cn=Products,cn=OracleContext, Realm DN container.Some applications manage their own application attributes and implement the Data Access Java plug-in, which is described in "Understanding Provisioning Concepts". The Oracle Directory Integration Platform Service invokes this plug-in whenever the base user attributes or application-specific attributes are modified.

Figure 15-4 Oracle Back-End Directory Base User and Application-Specific Attributes

Description of "Figure 15-4 Oracle Back-End Directory Base User and Application-Specific Attributes"

15.6.2 Understanding User Provisioning Status

This section discusses the user provisioning status in Oracle Unified Directory or Oracle Internet Directory.

Topics:

15.6.2.1 Provisioning Status in Oracle Back-end Directory

The Oracle Provisioning Service records a user's provisioning status in the back-end directory for each provisioning-integrated application. Provisioning status can be set by the Oracle Directory Integration Platform, with bulk provisioning using the provProfileBulkProv command, or by a provisioning-integrated application. Table 15-1 lists the provisioning status.

Table 15-1 Provisioning Status in the Back-end Directory

Internal Status	GUI Status	Description
Provisioning Status
`PROVISIONING_REQUIRED`	Pending	Provisioning required. This status is selected by an administrator or set according to an application's provisioning policies. Note that this status determines whether a user has been provisioned.
`PROVISIONING_IN_PROGRESS`	In Progress	Provisioning in progress. The user can access the application when this is the current status if the application performs provisioning at scheduled intervals. The application can also provision the user on-demand.
`PROVISIONING_SUCCESSFUL`	Successful	Provisioning successful. This status is updated automatically by the Oracle Directory Integration Platform, with bulk provisioning using the provProfileBulkProv command, or a provisioning-integrated application.
`PROVISIONING_NOT_REQUIRED`	Not Requested	Provisioning not required. This status is selected by an administrator or set according to an application's provisioning policies. Note that this status determines whether a user will be provisioned.
`PROVISIONING_FAILURE`	Failed	Provisioning failed. This status is updated automatically by the Oracle Directory Integration Platform, with bulk provisioning using the provProfileBulkProv command, or a provisioning-integrated application. The user cannot access the application when this is the current status.
Deprovisioning Status
`DEPROVISIONING_REQUIRED`	Pending de-provisioning	Deprovisioning required. The user is still provisioned when this is the current status.
`DEPROVISIONING_IN_PROGRESS`	De-provisioning In Progress	Deprovisioning in progress.
`DEPROVISIONING_SUCCESSFUL`	Successfully de-provisioned	Deprovisioning successful. The user cannot access the application when this is the current status.
`DEPROVISIONING_FAILURE`	Failed de-provisioning	Deprovisioning failed. The user is still provisioned when this is the current status.
Upgrade Status
`PENDING_UPGRADE`	Pending Upgrade	Provisioning upgrade pending.
`UPGRADE_IN_PROGRESS`	Upgrade In Progress	Provisioning upgrade in progress.
`UPGRADE_FAILURE`	Upgrade Failed	Provisioning upgrade failed.

The provisioning status for each application is stored in the orclUserApplnProvStatus attribute in a user entry. This attribute is indexed in the back-end directory and is searchable. A subtyped orclUserApplnProvStatus attribute is created for each provisioning-integrated application. For example, the following statements store a user's provisioning status for an e-mail application and a scheduling application. The user's provisioning status for the e-mail application is PROVISIONING_SUCCESS while his or her provisioning status for the scheduling application is PROVISIONING_FAILURE.

orclUserApplnProvStatus;CORP-MAIL_E-MAIL:PROVISIONING_SUCCESS
orclUserApplnProvStatus;CORP-SCHEDULE_CALENDAR:PROVISIONING_FAILURE

Additional information about a user's provisioning status in an application is stored in the orclUserApplnProvStatusDesc attribute and the provisioning failure account for each application is stored in the orclUserApplnProvFailureCount attribute. As with the orclUserApplnProvStatus attribute, separate orclUserApplnProvStatusDesc and orclUserApplnProvFailureCount attributes are created for each provisioning-integrated application. The format for the orclUserApplnProvStatusDesc attribute is the same as the orclUserApplnProvStatus attribute, except that a timestamp and descriptive information are appended to the application name and type, as follows:

orclUserApplnProvStatusDesc;CORP-MAIL_E-MAIL:20040101010101^Missing employee ID

The orclUserApplnProvStatus, orclUserApplnProvStatusDesc, and orclUserApplnProvFailureCount attributes are contained in the orclUserProvStatus object class as optional attributes.

15.6.2.2 Provisioning Status Transitions

Table 15-2 lists the valid provisioning status transitions.

Table 15-2 Valid Provisioning Status Transitions in the Back-end Directory

Internal Status	GUI Status	Valid Transition From
Provisioning Status
`PROVISIONING_REQUIRED`	Pending	Initial missing state `DEPROVISIONING_SUCCESSFUL`
`PROVISIONING_IN_PROGRESS`	In Progress	`PROVISIONING_REQUIRED`
`PROVISIONING_SUCCESSFUL`	Successful	`PROVISIONING_REQUIRED` `PROVISIONING_IN_PROGRESS` `PROVISIONING_FAILURE`
`PROVISIONING_NOT_REQUIRED`	Not Requested	Initial missing state
`PROVISIONING_FAILURE`	Failed	`PROVISIONING_REQUIRED` `PROVISIONING_IN_PROGRESS`
Deprovisioning Status
`DEPROVISIONING_REQUIRED`	Pending de-provisioning	`PROVISIONING_SUCCESSFUL`
`DEPROVISIONING_IN_PROGRESS`	De-provisioning In Progress	`PROVISIONING_SUCCESSFUL`
`DEPROVISIONING_SUCCESSFUL`	Successfully de-provisioned	`DEPROVISIONING_REQUIRED` `DEPROVISIONING_IN_PROGRESS` `DEPROVISIONING_FAILURE`
`DEPROVISIONING_FAILURE`	Failed de-provisioning	`DEPROVISIONING_REQUIRED` `DEPROVISIONING_IN_PROGRESS`

Figure 15-5 illustrates the valid provisioning status transitions.

Figure 15-5 Valid Provisioning Status Transitions

Description of "Figure 15-5 Valid Provisioning Status Transitions"

15.6.2.3 Understanding Upgrade and Coexistence Provisioning Status

In Oracle Identity Management, a user entry can be physically represented in the back-end directory by multiple LDAP entries. In addition to the base user entry, separate LDAP entries can exist for each provisioning-integrated application.

In a typical upgrade of Oracle Identity Management, multiple middle tiers are not upgraded simultaneously. This means that following an Oracle Identity Management upgrade, middle tiers from a previous version may need to run in parallel with middle tiers from the upgraded version. When a middle tier is upgraded, all of a user's application-specific data that was previously stored in the application metadata repository, will be migrated on-demand. For each user entry that is present in the back-end directory prior to the upgrade, the Oracle Directory Integration Platform will initiate a new user event and assign a provisioning status of PENDING_UPGRADE to the user entry. If a new user entry is created from an older middle tier or some unsupported route, such as an existing application using the standard LDAP SDK, the provisioning status attribute will be missing. In this case, the Oracle Directory Integration Platform also initiates a new user event and assign a provisioning status of PENDING_UPGRADE to the user entry.

Once a provisioning-integrated application receives the event, it will return a response to the Oracle Directory Integration Platform indicating whether or not the user is provisioned. The Oracle Directory Integration Platform then updates the provisioning status in the user entry accordingly.

15.6.2.4 Understanding Provisioning Status and Exception Handling

If a new user entry created with the user interface or through synchronization with an external data source does not contain enough information to provision the user in a particular application, provisioning may fail. Provisioning can also fail for a variety of other reasons. The Oracle Directory Integration Platform Service identifies user provisioning failures as exceptions. Whenever an application responds to a USER_ADD event with a failure status, the Oracle Directory Integration Platform will change the user's provisioning status to PROVISIONING_FAILURE. The Oracle Directory Integration Platform will then send notifications to the applications of the failed cases also just like a new user case. This will serve as a retry for the provisioning request. The provisioning status of a user displays in the user interface. The administrator can make the necessary changes to fix the problem, and the provisioning would get retried automatically. This will result in invocation of the data access plug-in if the provisioning is synchronous. However, an event will be propagated if the provisioning is asynchronous.This sequence of steps will be retried as long as the user is not provisioned successfully.

15.7 Understanding Provisioning Flow

This section discusses the flow of information and control in various provisioning scenarios.

Topics:

15.7.1 Viewing and Editing Provisioning Profiles Using Fusion Middleware Control

You can view and edit provisioning profiles using the Oracle Enterprise Manager Fusion Middleware Control.

To do so, performing the following steps:

Open a Web browser and enter the Oracle Enterprise Manager Fusion Middleware Control URL for your environment. The format of the Oracle Enterprise Manager Fusion Middleware Control URL is: https://host:port/em.
Log in to Oracle Enterprise Manager Fusion Middleware Control.
In the navigation panel on the left, click or expand the Identity and Access entry and then select the DIP component that contains the profile you want to view or edit.

Select Administration and then Provisioning Profiles from the DIP Server menu. The Manage Provision Profiles screen appears displaying the existing provisioning profiles.

To change which attributes of the provisioning profiles are displayed, click View, then Column, and select the attributes you want to display or hide. You can also reorder the columns of provision profiles by clicking View, and then Reorder Columns.

To enable or disable a provisioning profile, click the appropriate profile, and then click Enable or Disable.

To edit a provisioning profile, click the profile you want to edit, and then click Edit. The attributes of the profile appear. Edit the settings as desired and click OK to save the changes. Table 15-3 lists and describes the provisioning profile fields:

Table 15-3 Provisioning Profile Fields

Field Name	Description
Profile Name	The name of the profile you are editing. You cannot edit a profile name after it is created. This field is provided only to identify the profile you are editing.
Application Name	The name of the application the provisioning profile applies to.
Profile Version	The version of the provisioning profile.
Application to OID or Application to OUD	Options to set the provisioning profile as Configured and Enabled in the relationship between the Application and the Oracle back-end directory.
OID to Application or OUD to Application	Options to set the provisioning profile as Configured and Enabled in the relationship between the Application and the Oracle back-end directory.
Scheduled Interval (HH:MM:SS)	Specifies the number of hours, minutes, and seconds between provisioning attempts between a connected directory and relationship between the application and the back-end directory.
Last Execution	Shows the status (Success/Failed) and execution time of the last provisioning attempt.

15.7.2 Provisioning User from an External Source

The majority of deployments are expected to provision users from an external source, such as a third-party enterprise user repository. In these types of deployments, the third-party repository bootstraps the back-end directory. Oracle Directory Integration Platform will provide ongoing synchronization between the back-end directory and the connected repository.

Examples of connected user repositories include Human Resources and LDAP directories such as Microsoft Active Directory, Oracle Directory Server Enterprise Edition (previously Sun Java System Directory Server), Novell eDirectory, IBM Tivoli Directory Server, and OpenLDAP.

The Oracle Directory Synchronization Service will create the user entry in the back-end directory. Because the information coming from the external source may not be sufficient to provision the user in various applications, the application defaults will be used to create the application information.

User creation by the Oracle Directory Synchronization Service occurs as follows:

The Oracle Directory Synchronization Service evaluates the provisioning policies specified by the applications to determine whether the user should be provisioned in the application.
The Oracle Directory Synchronization Service evaluates any other plug-ins that the application has registered.
The Oracle Directory Integration Platform Service invokes the PL/SQL plug-in or the Data Access Java plug-in to deliver the user information to the application.
The provisioning status of the user is returned by the application using the event interfaces.
The Oracle Directory Integration Platform Service updates the provisioning status of the user for the application.

15.8 Understanding the Delegation of Administrative Privileges

Administrative rights in Oracle Delegated Administration Services vary according to the privileges delegated to each administrator.

An administrator can be granted rights to manage and provision users, manage applications, or any combination of these privileges, as described in the following scenarios:

Note:

Oracle Directory Integration Platform 11g Release 1 (11.1.1) interoperates with and supports Oracle Delegated Administration Services release 10.1.4.3.0 and higher for Oracle Internet Directory.
Oracle Unified Directory does not support Oracle Delegated Administration Services.

Provisioning Administration Model

The following types of provisioning information is managed in the Oracle Internet Directory back-end directory:

Base user information.
Application-specific information.
User provisioning status in each provisioning-integrated application; this information is stored in the base user entry but is administered separately.

Administrators and users each require the following types of privileges:

Administrators require privileges for managing base user attributes and application-specific information.
Users require privileges for managing their own base attributes and application-specific information.

User accounts with administrative privileges are represented by the group entry "cn=User Provisioning Admins,cn=Groups,cn=OracleContext". To manage application-specific information, the application must grant privileges to the "cn=User Provisioning Admins,cn=Groups,cn=OracleContext" group. If an application already defines a group with administrative privileges, then the application needs to add this group as a member of the group.

15.9 provProfileBulkProv utility

Use the provProfileBulkProv utility, located in the ORACLE_HOME/bin directory, to perform initial migration of data from an LDIF file to the back-end directory for a provisioning profile.

Note:

When you run provProfileBulkProv utility, ensure that you specify the absolute path. For example: /tmp/bulk.ldif.
Best security practice is to provide a password only in response to a prompt from the command.
You must set the WLS_HOME and ORACLE_HOME environment variables before executing any of the Oracle Directory Integration Platform commands
The Oracle WebLogic Managed Server where Oracle Directory Integration Platform is deployed must be configured for SSL to execute this command in SSL mode. Refer to the Configuring SSL chapter in Oracle Fusion Middleware Securing Oracle WebLogic Server for more information.

Syntax for provProfileBulkProv

provProfileBulkProv

provProfileBulkProv -h HOST -p PORT -D wlsuser -file LDIF_FILE -realm REALM_DN
[-ssl -keystorePath PATH_TO_KEYSTORE -keystoreType TYPE]
[-encoding INPUT_ENCODING] [-help]

Arguments for provProfileBulkProv

The following table describes the arguments for provProfileBulkProv utility.

Table 15-4 dipStatus utility Arguments

Argument	Description
-h \| -host	Oracle WebLogic Server where Oracle Directory Integration Platform is deployed.
-p \| -port	Listening port of the Oracle WebLogic Managed Server where Oracle Directory Integration Platform is deployed.
-D \| -wlsuser	Oracle WebLogic Server login ID. Note: You will be prompted for the Oracle WebLogic Server login password. You cannot provide the password as a command-line argument.Best security practice is to provide a password only in response to a prompt from the command. If you must execute `dipStatus` from a script, you can redirect input from a file containing the Oracle WebLogic Server password. Use file permissions to protect the file and delete it when it is no longer necessary.
-f \| -file	LDIF file containing the data to be migrated.
-realm	The realm in which the users are to be provisioned.
-ssl	Executes the command in SSL mode. Note: The Oracle WebLogic Managed Server where Oracle Directory Integration Platform is deployed must be configured for SSL to execute this command in SSL mode. For more information, see "Configuring SSL" in Oracle Fusion Middleware Securing Oracle WebLogic Server.
-keystorePath	The full path to the keystore.
-keystoreType	The type of the keystore identified by `-keystorePath`. For example: `-keystorePath jks` or `-keystorePath PKCS12`
-encoding	Input file encoding.
-help	Provides usage help for the command.

Tasks and Examples for provProfileBulkProv

provProfileBulkprov -h myhost.mycompany.com -p 7005 -D login_ID \
  -f /opt/ldap/odip/users.ldif -realm cn=aaaa,ou=bbbb,dc=cccc