This chapter describes the command-line tools used to administer Oracle Internet Directory.
This chapter includes the following sections:
Section 2.1, "oidpasswd" (Database Password Utility)
Section 2.2, "oidctl" (Oracle Internet Directory Control)
Section 2.3, "oiddiag" (Oracle Internet Directory Server Diagnostic Tool)
Section 2.4, "oidmon" (Oracle Internet Directory Monitor)
Section 2.5, "opmnctl" (Oracle Process Manager and Notification Server Control)
Section 2.6, "oidstats.sql" (Oracle Internet Directory Database Statistics Collection Tool)
Section 2.7, "oidcred" (Oracle Internet Directory Credential Management Tool)
Section 2.8, "oidrealm" (Oracle Internet Directory Realm Creation Tool)
Note:
The term "instance" refers to an Oracle instance inopmnctl documentation. The term "instance" refers to an Oracle Internet Directory instance in oidctl documentation.The Oracle Internet Directory Database Password Utility (oidpasswd) is used to:
Change the password to the Oracle Internet Directory database.
Oracle Internet Directory uses a password when connecting to an Oracle database. The default for this password matches the value you specified during installation for the Oracle Fusion Middleware administrator's password. You can change this password by using the OID Database Password Utility.
Create wallets for the Oracle Internet Directory database password and the Oracle directory replication server password.
Unlock or reset the directory superuser account, namely, cn=orcladmin.
Reset an access control point (ACP) so that the subtree is accessible by the Oracle Internet Directory superuser.
Manage the restricted superuser ACL.
oidpasswd [connect=connect_string] [change_oiddb_pwd=true | create_wallet=true | unlock_su_acct=true| reset_su_password=true | manage_su_acl=true]
Required. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in ORACLE_HOME/config. (You can set the TNS_ADMIN environment variable if you want to use a different location.)
change_oiddb_pwd=true | unlock_su_acct=true | reset_su_password=true | manage_su_password=true
Required. The operation you want to perform. Depending on the operation you choose, the Oracle Internet Directory Database Password Utility prompts you for additional information. The following choices are available:
change_oiddb_pwd=true - Changes the password to the Oracle Internet Directory database. You are prompted to provide the current database password, enter a new database password, and confirm the new password.
Note:
In an Oracle Real Application Clusters (Oracle RAC) environment, if you update the password on one Oracle RAC node, then you must update the wallet on the other Oracle RAC nodes. Refer to "About Changing the ODS Password on an Oracle RAC System" in the Oracle Application Server High Availability Guide for more information.create_wallet=true - Create a wallet named oidpwdlldap1 for the Oracle Internet Directory database password, and a wallet, named oidpwdrsid, for the Oracle directory replication server password.
The sid is obtained from the connected database.
You must provide the ODS password to authenticate yourself to the ODS database before the ODS wallet can be generated. Note that the default ODS password is the same as that for the Oracle Fusion Middleware administrator.
unlock_su_acct=true - Unlocks a superuser account that has been locked.
reset_su_password=true - Resets the password for the Oracle Internet Directory superuser account. You are prompted to provide the Oracle Internet Directory database password, enter a new superuser password, and confirm the new superuser password.
manage_su_acl=true - Manages the restricted superuser ACL.
Using Oracle Internet Directory Database Password Utility, you can perform the following tasks:
Changing the Password to the Oracle Internet Directory Database
Creating Wallets for Directory Database and Replication Server Passwords
The following example shows how to change the Oracle Internet Directory database password, assuming the database in on the same machine.
oidpasswd current password: oldpassword new password: newpassword confirm password: newpassword password set.
The Oracle Internet Directory Database Password Utility prompts you for the current password. Type the current password, then the new password, then a confirmation of the new password.
Notes:
User responses are not echoed to the screen when you enter a password.
Whenever you change the password to the Oracle Internet Directory database by using the OID Database Password Utility, you should also run the oidemdpasswd utility. This enables the Oracle Enterprise Manager Daemon (a component of Oracle Enterprise Manager) to properly cache that password and contact the ODS schema upon starting up. Once you have run the oidemdpasswd utility, you can monitor Oracle Internet Directory processes from the Oracle Enterprise Manager.
The following example shows how to create wallets for the Oracle Internet Directory database password and the Directory Replication server password.
oidpasswd connect=dbs1 create_wallet=true
The argument create_wallet=true is mandatory in this case. Except for the connect string, no other option can be specified.
The following example shows how to unlock the Oracle Internet Directory superuser account, cn=orcladmin.
oidpasswd connect=dbs1 unlock_su_acct=true
The argument unlock_su_acct is mandatory. Except for connect string, no other option can be specified.
If you forget the Oracle Internet Directory superuser password, you can use the oidpasswd tool to reset it. You must provide the Oracle Internet Directory database password. When you first install Oracle Internet Directory, the superuser password and Oracle Internet Directory database password are the same. After installation, however, you can change the Oracle Internet Directory superuser password using ldapmodify. You can change the Oracle Internet Directory superuser password using the oidpasswd tool separately.
The following example shows how to reset the Oracle Internet Directory superuser password. The oidpasswd tool prompts you for the Oracle Internet Directory database password.
oidpasswd connect=dbs1 reset_su_password=true OID DB user password: oid_db_password password: new_su_password confirm password: new_su_password OID super user password reset successfully
When an access control point (ACP) is set with an access control item (ACI) that has the keyword DenyGroupOverride, neither the Oracle Internet Directory superuser nor members of DirectoryAdminGroup can access the subtree under that ACP. If necessary, you can use the oidpasswd tool to reset that ACP so that the subtree is accessible by the Oracle Internet Directory superuser.
The following example shows how to reset a restricted ACP. The oidpasswd utility prompts you to enter the Oracle Internet Directory database password and to choose which superuser restricted ACPs to reset.
oidpasswd conn=dbs1 manage_su_acl=true OID DB user password: oid_db_password The super user restricted ACP list [1] o=oracle,c=us [2] ou=personnel,o=oracle,c=us Enter 'resetall' or the number(s) of the ACP to be reset separated by [,] resetall
Once you have reset some ACPs so that the superuser can access them, you can use ldapmodify to make the subtrees inaccessible to the superuser again.
Oracle Internet Directory Control Utility (oidctl) is a command-line tool for starting and stopping Oracle Identity Management server instances. In 11g Release 1 (11.1.1), it is typically used only to configure, start, and stop the Oracle Directory Replication Server.
Notes:
You must set the environment variables ORACLE_INSTANCE, ORACLE_HOME, INSTANCE_NAME and COMPONENT_NAME before you run the oidctl command. Alternatively, you can pass the instance name and component name in the command line as name=instanceName, componentname=componentName.
Best practice is to create new Oracle Internet Directory instances by creating new Oracle Internet Directory components with opmnctl createcomponent. See Section 2.5, "opmnctl." You should use oidctl to create an instance only if you plan to run Oracle Internet Directory in standalone mode and not use Oracle Enterprise Manager Fusion Middleware Control.
The term "instance" refers to an Oracle Internet Directory instance in oidctl command documentation.
The commands issued by Oracle Internet Directory Control Utility are interpreted and executed by the Oracle Internet Directory Monitor process. Before starting a server instance with this utility, make sure that the Monitor process is running. See Section 2.4, "oidmon".
oidctl [connect=connect_string] { server=OIDLDAPD | OIDREPLD } instance=instance_number [name=instance_name] [componentname=component_name] [host=host_name] [flags="flagname=value ..." ] [ {start | stop | add | delete | status [-diag | -odiag interval]}
Required. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in ORACLE_INSTANCE/config. (You can set the TNS_ADMIN environment variable if you want to use a different location.)
Required. The options are:
OIDLDAPD — Oracle Internet Directory server
OIDREPLD — Directory Replication server
Required. The numerical value of the instance. The value must be greater than 0 but less than 100.
Optional. Name of the logical host where the server is located or will be added. If you are using this argument, make sure oidmon is also started with the host=host_name parameter. If oidmon is started by opmn, then make sure the hostname parameter exists in the file ORACLE_INSTANCE/config/OPMN/opmn/opmn.xml.
Optional. Name of the instance to be used. The default is inst1.
Optional. Name of the component to be used. The default is oid1.
flags="flagname=value | -flag value..."
The flags argument is needed only while starting the server. If the flags consist of UNIX-style keywords, then the keyword-value pairs must be separated by spaces.
start | stop | restart | add | delete | status
Required. The operation to perform on the given server process.
start — Start the server=server instance=instance_number [name=instance_name componentName=component_name]
stop — Stop the server=server instance=instance_number [name=instance_name componentName=component_name]
add — Add the instance-specific configuration entry and start the server instance.
delete — Stop the server instance and delete the instance-specific configuration entry
status [-diag | -opdiag] — Report the status of running server instances. Use -diag with status to get diagnostic information. Use -opdiag, followed by interval, an integer value, with status to get the operation count for each operation for each Oracle Internet Directory component.
In 11g Release 1 (11.1.1), the recommended tool for creating instances and managing the LDAP server is opmnctl, not oidctl. See Section 2.5, "opmnctl." You should only use oidctl for these purposes if you plan to run Oracle Internet Directory in standalone mode and never use Oracle Enterprise Manager Fusion Middleware Control.
Optional. Turns replication change logging on or off. Use true to enable change logging. Use false to disable change logging. The default is true. This option has effect only when creating an Oracle Internet Directory instance.
Optional. Specifies the LDAP port that this Oracle Internet Directory server instance will use. If not specified the default 3060 is used.
The number of server processes to start on this port.
Optional. Specifies the LDAPS port that this Oracle Internet Directory server instance will use. If not specified the default 3133 is used.
The maximum number of worker threads for this server.
Required for a start operation. Port number used to connect to Oracle Internet Directory server. The default is 3060.
Required for a start operation. The host name of the Oracle Internet Directory server to which the replication server connects. If not specified, localhost is used.
Optional. Use true to enable conflict resolution. Use false to disable conflict resolution. The default value is true.
Optional. The number of changes applied in each replication update cycle. If not specified the value from the Oracle Internet Directory server size limit configuration parameter, which has a default of 1024.
In 11g Release 1 (11.1.1), oidctl is used primarily to manage the replication server. The recommended tool for creating instances and managing the LDAP server is opmnctl, not oidctl. See Section 2.5, "opmnctl." You should only use oidctl for these purposes if you plan to run Oracle Internet Directory in standalone mode and never use Oracle Enterprise Manager Fusion Middleware Control.
Before using Oracle Internet Directory Control, make sure that Oracle Internet Directory Monitor is running. To verify this on UNIX, enter to following at the command-line:
ps -ef | grep oidmon
See Section 2.4, "oidmon" for more information about Oracle Internet Directory Monitor.
Using Oracle Internet Directory Control, you can perform the following tasks:
Section 2.2.3.1, "Creating an Oracle Internet Directory Instance in an Existing Component"
Section 2.2.3.2, "Deleting an Oracle Internet Directory Instance in a Component"
Section 2.2.3.3, "Starting an Oracle Internet Directory Server Instance"
Section 2.2.3.4, "Stopping an Oracle Internet Directory Server Instance"
Section 2.2.3.5, "Restarting an Oracle Internet Directory Server Instance"
Section 2.2.3.6, "Starting a Directory Replication Server Instance"
Section 2.2.3.7, "Stopping a Directory Replication Server Instance"
Section 2.2.3.8, "Starting and Stopping a Server Instance on a Virtual Host or Cluster Node"
Section 2.2.3.11, "Reporting Server Manageability Information"
To create another Oracle Internet Directory instance within an existing component, type
oidctl connect=connect_string server=oidldapd inst=new_instance_number \ name=instanceName componentname=componentName \ flags=port=non_ssl_port sport=ssl_port add
The name and component name arguments are required unless the environment variables INSTANCE_NAME and COMPONENT_NAME have been set. Typically, the inst value of the original instance is 1, the second instance you create is 2, and so forth.
As an example:
oidctl connect=oiddb server=oidldapd inst=2 "flags=port=5678 sport=5679" add
To delete one Oracle Internet Directory instance within a component, type
oidctl connect=connect_string server=oidldapd inst=new_instance_number \ name=instanceName componentname=componentName \ flags=port=non_ssl_port sport=ssl_port delete
Typically, the inst value of the original instance is 1, the second instance you create is 2, and so forth.
When starting an Oracle Internet Directory server, you must supply the instance, server=OIDLDAPD, and start arguments. All other arguments are optional.
Before starting a new instance of OIDLDAPD, run the command:
oidctl connect=connstr status
to make sure oidmon is running and that the instance number and ports that you intend to use are not already in use.
oidctl connect=dbs1 server=OIDLDAPD instance=2 flags="-p 3133 \ -debug 1024 -l false" start
oidctl connect=dbs1 server=OIDLDAPD instance=2 stop
A restart operation is useful when you want to refresh the server cache immediately, or when you have changed a configuration set entry and want your changes to take effect on an active server instance. When the Oracle Internet Directory server restarts, it maintains the same arguments it had before it stopped.
For example, if you changed a configuration set that was being referenced by an active instance of Oracle Internet Directory server, you could update it by restarting that server instance. You do not need to supply the configset argument again, as it is maintained from the prior start operation.
oidctl connect=dbs1 server=OIDLDAPD instance=1 restart
To restart all active instances on a node, do not specify the instance argument. Note that a server is momentarily unavailable to client requests during a restart.
When starting an Oracle Directory Replication server, you must supply the information it needs to connect to the Oracle Internet Directory server. You cannot use the add option when starting a replication server.
oidctl connect=dbs1 server=OIDREPL instance=1 flags="-p 3060 \ -h ldaphost.example.com -d 1024" start
This command uses the same instance-specific configuration entry as instance=1.
oidctl connect=dbs1 server=OIDREPLD instance=1 stop
Use the host argument to specify a virtual host name when starting an Oracle Internet Directory server or Oracle Internet Directory Replication server on a virtual host or a Oracle Application Server Identity Management Cluster Node.
When communicating with the directory server, the directory replication server uses the virtual host name. Further, the replicaID attribute that represents the unique replication identification for the Oracle Internet Directory node is generated once. It is independent of the host name and hence requires no special treatment in Oracle Application Server Cold Failover Cluster (Identity Management).
When communicating with the directory server, the Directory Integration Platform server uses the virtual host name.
The following example shows how to start an Oracle Internet Directory server (OIDLDAPD) on a virtual host. The same syntax can be used to also start a directory replication server (OIDREPLD) on a virtual host.
oidctl connect=dbs1 host=vhost.company.com server=OIDLDAPD instance=1 \ configset=2 [flags="..."] start
The status argument is used to report the status of each server running on the node.
oidctl connect=dbs1 status
Use the -diag flag with the status argument to get detailed diagnostic information that can be useful in resolving performance issues.
The -diag flag causes oidctl to print information about each LDAP operation as it executes, including the time it spends in the database layer.
For example:
oidctl connect=dbs1 status -diag
oidctl : ORACLE_INSTANCE is not set, defaulting to /ade/rsathyan_ldmain5/oracle/ldap/
oidctl : INSTANCE_NAME is not set, defaulting to inst1
oidctl : COMPONENT_NAME is not set, defaulting to oid1
+------------------------------------------------------------------------+
| Process | PID | InstName | CompName | Inst# | Port | Sport |
+------------------------------------------------------------------------+
| oidmon | 12838 | inst1 | oid1 | | | | +------------------------------------------------------------------------+
| oidldapd disp| 12926 | inst1 | oid1 | 1| 8856 | 0 |
| oidldapd serv| 12930 | inst1 | oid1 | 1| 8856 | 0 |
| Config DN | cn=oid1,cn=osdldapd,cn=subconfigsubentry |
+------------------------------------------------------------------------+
+------------------------------------------------------------------------+
|Printing LDAP Operation in progress status ... |
+------------------------------------------------------------------------+
Search:
OIDLDAPD_PID: 12930 WorkerID: 8 DBSID: 162
ConnDN:
BaseDN:c=us
Scope=2
Filter=(|(uid=a*)(cn=b*)(objectclass=person)) ReqdAttrs:
SqlText:
SELECT /*+ FIRST_ROWS */ dn.entryid FROM ct_dn dn WHERE dn.entryi
d IN (SELECT /*+ INDEX( at1 VA_uid ) */ entryid FROM CT_uid at1 W
HERE attrValue like :0 ESCAPE '\' UNION SELECT /*+ INDEX( at1 V
A_cn ) */ entryid FROM CT_cn at1 WHERE attrValue like :1 ESCAPE
'\' UNION SELECT /*+ INDEX( at1 VA_objectclass ) */ entryid FROM
CT_objectclass at1 WHERE attrValue = 'person') AND ( (dn.parent
dn like :bdn ESCAPE '\' OR (dn.rdn = :rdn AND dn.parentdn = :pdn
)) ) AND dn.entryid >= :entryThreshold
Plan Hash Value : 0
Rows Fetched : 0
Number of Sorts : 0
Disk Read : 0
Disk Writes : 0
Buffer Gets : 0
IO Wait Time : 0 (ms)
CPU Time : 0 (ms)
+------------------------------------------------------------------------+
When you run oidctl with status -opdiag interval, oidctl reads the shared memory contents for all servers in the running instances associated with the OIDMON in that environment and aggregates the operation count of each type for each OID component. It repeatedly displays current and total operation counts on the standard output at interval seconds. oidctl resets all the current values of operation count in the shared memory so that the directory server starts from zero for each type of operation for the next cycle.
For example:
$ oidctl status -opdiag 15
oidctl : ORACLE_INSTANCE is not set, defaulting to
/ade/myOID/oracle/ldap/
oidctl : INSTANCE_NAME is not set, defaulting to inst1
oidctl : COMPONENT_NAME is not set, defaulting to oid1
+--------------------------------------------------------------------------+
+--------------------------------------------------------------------------+
|Printing completed LDAP operation counts ...
| +--------------------------------------------------------------------------+
ComponentName: oid1 Current Total
Bind Count : 0 0
Add Count : 0 0
Delete Count : 0 0
Modify Count : 0 0
ModRdn Count : 0 0
Compare Count : 0 0
Search Count : 0 0
Extended Count : 0 0
. +--------------------------------------------------------------------------+
+--------------------------------------------------------------------------+
The Oracle Internet Directory Server Diagnostic command-line tool (oiddiag) collects diagnostic information that helps triage issues reported on Oracle Internet Directory. It is available as oiddiag for use on UNIX and Linux platforms and as oiddiag.bat for Windows. The tool connects to the database used as the directory store (also called Metadata Repository) of Oracle Internet Directory and reads the information. The tool makes no recommendations on potential fixes to issues. Rather, it collects information to help Support and Development understand a problem and determine its solution. The tool can collect four types of diagnostic information:
Directory information tree (DIT)
Data consistency
Server manageability statistics
System and process information
If you use either the collect_all=true or the collect_sub=true arguments, you are prompted to supply the following information:
The fully domain-qualified database host name
The database listener port number
The database service name
The ODS database user password
The SYS database user password
Whether the Oracle Database connection uses SSL or not. Only NoSSL Authentication (Encryption only) is supported.
You can find the host name, port number and service name in the file tnsnames.ora, located by default in ORACLE_INSTANCE/config. For example, in the following tnsnames.ora file, the hostname, port number and service names are, respectively, sun16.example.com, 1521, and orcl.example.com:
ORCL =
(DESCRIPTION =
(ADDRESS = (PROTOCOL = TCP)(HOST = sun16.example.com)(PORT = 1521))
(CONNECT_DATA =
(SERVER = DEDICATED)
(SERVICE_NAME = orcl.example.com)
)
)
Note:
You must set theORACLE_HOME environment variable before executing the OIDDIAG tool.
oiddiag {listdiags=true [targetfile=filename]} | {collect_all=true [outfile=filename]} | {collect_sub=true [infile=filename] [outfile=filename]} | {audit_report=true [outfile=file_name]}
Writes a list of available diagnostics that can be collected. The list is written to an output file, which is ORACLE_INSTANCE/diagnostics/logs/OID/tools/oiddiag.txt by default. You should run a listdiags command before running a collect_sub command. The collect_sub command uses the file that is output by listdiags. You can edit this file as needed to contain only the diagnostic items you want.
This is the location of the output file where the diagnostic tool writes the list of available diagnostics when listdiags=true is given. If not specified, the tool writes the list to ORACLE_INSTANCE/diagnostics/logs/OID/tools/oiddiag.txt.
Collect all of the diagnostic information available and writes it to an output file. You are prompted to provide the Oracle Internet Directory database host name, listener port, net service name, and password.
The name of the output file that the diagnostic information is written to. If not specified, the default output file is written to ORACLE_INSTANCE/diagnostics/logs/OID/tools/oiddiag/timestamp.log. The timestamp format is YYYYMMDDHHmmss.
Collects a subset of diagnostic information (based on the diagnostics specified in the input file) and writes it to an output file. You are prompted to provide the Oracle Internet Directory database host name, listener port, net service name, and password.
You should run a listdiags command before running a collect_sub command. The collect_sub command uses the file that is output by listdiags. You can edit this file as needed to contain only the diagnostic items you want.
A file that contains the list of diagnostic items for which you want to output information. By default, the diagnostic tool looks for this file in ORACLE_INSTANCE/diagnostics/logs/OID/tools/oiddiag.txt, which is the default target file location of the listdiags command. You can edit this file as needed to contain only the diagnostic items you want.
Generates standard reports for Secure Events Tracking and writes them to an output file.
Using the Oracle Internet Directory diagnostic tool, you can perform the following tasks:
The following example shows how to collect all available diagnostic information and write it to the specified output file.
oiddiag collect_all=true outfile=~/myfiles/oid.log
To collect a subset of diagnostic data, you must first run the oiddiag tool with the listdiags argument. This outputs a list of available diagnostics, which you can then edit. This list is then passed in to the collect_sub command to determine the diagnostics for which to collect output. The following example uses the default file locations of ORACLE_INSTANCE/diagnostics/logs/OID/tools/oiddiag.txt (for the list) and ORACLE_INSTANCE/diagnostics/logs/OID/tools/oiddiagtimestamp.log (for the output file).
oiddiag listdiags=true oiddiag collect_sub=true
An important type of information that the oiddiag tool collects is the stack trace data for Oracle Internet Directory processes. Examining the stack trace is useful if you are experiencing slow response times or if your system stops responding. Because Oracle Internet Directory is usually started as a setuid-root program, you must log in as the root user before you can use the oiddiag tool to trace the stack for any Oracle Internet Directory processes. The root user must belong to the same operating system group that the Oracle operating system user belongs to. The following example logs in as the root user and changes to the dba group before executing the oiddiag tool:
su newgrp dba oiddiag collect_all=true
In 11g Release 1 (11.1.1), you typically manage Oracle Internet Directory by using Oracle Enterprise Manager Fusion Middleware Control or the command-line utility opmnctl. Both opmnctl and Fusion Middleware Control use the Oracle Process Manager and Notification Server to issue commands to the Oracle Internet Directory Monitor, oidmon, which initiates, monitors, and terminates directory server processes.
oidmon [connect=connect_string] [host=hostname] [sleep=seconds] start | stop
Required. The directory database connect string. If you already have a tnsnames.ora file configured, then this is the net service name specified in that file, which is located by default in ORACLE_INSTANCE/config. (You can set the TNS_ADMIN environment variable if you want to use a different location.)
Optional. Enables you to specify a virtual host name for the server or the name of an Oracle Application Server Identity Management Cluster Node. If not given, the default of localhost is used.
Optional. The number of seconds after which Oracle Internet Directory Monitor should check for new requests from Oracle Internet Directory Control and for requests to restart any server instances that may have stopped. The default is 10 seconds.
Required. The operation to perform (start or stop the Monitor process).
Using Oracle Internet Directory Monitor, you can perform the following tasks:
Section 2.4.3.1, "Starting Oracle Internet Directory Monitor"
Section 2.4.3.2, "Starting Oracle Internet Directory Monitor on a Virtual Host or Cluster Node"
Section 2.4.3.3, "Stopping Oracle Internet Directory Monitor"
You should start Oracle Internet Directory Monitor before using Oracle Internet Directory Control.
oidmon connect=dbs1 sleep=15 start
Use the host argument to specify a virtual host name when starting an Oracle Internet Directory Monitor on a virtual host or a Oracle Application Server Identity Management Cluster Node.
oidmon connect=dbs1 host=virtualhostname.company.com start
Stopping Oracle Internet Directory Monitor also stops all other Oracle Internet Directory processes. The oidmon tool does not remove server instance information from the ODS_PROCESS table. When an oidmon start operation is executed, it starts all the server processes it had stopped previously.
oidmon connect=dbs1 stop
The Oracle Process Manager and Notification Server Control Utility (opmnctl) enables you to manage system components, such as Oracle Internet Directory, in an integrated way.
The term "instance" refers to an Oracle instance in opmnctl command descriptions.
Notes:
This section only discusses how to use the OPMN Control Utility to manage Oracle Internet Directory components. For detailed information on how to use the OPMN Control Utility, see Oracle Fusion Middleware Oracle Process Manager and Notification Server Administrator's Guide.
Arguments to opmnctl are case-sensitive. Be sure to type them exactly as shown. For example, -adminUsername must have only the letter U in upper case.
opmnctl startproc ias-component=componentName opmnctl stopproc ias-component=componentName opmnctl restartproc ias-component=componentName opmnctl restartproc process-type=componentType opmnctl createcomponent [admin_server_properties] [instance_properties] [opmn_properties] [component_properties] [component_configuration_properties] opmnctl deletecomponent [admin_server_properties] [instance_properties] [opmn_properties] [component_properties] [component_configuration_properties] opmnctl registerinstance [admin_server_properties] [instance_properties] [component_configuration_properties] opmnctl unregisterinstance [admin_server_properties] [instance_properties] [component_configuration_properties] opmnctl updatecomponentregistration [admin_server_properties] [instance_properties] [component_configuration_properties] opmnctl status [-l]
Arguments for opmnctl consist of commands and several types of properties. This section describes the following types of arguments:
Section 2.5.2.2, "WebLogic Administration Server Properties"
Section 2.5.2.5, "Component Properties for Oracle Internet Directory"
Section 2.5.2.6, "Oracle Internet Directory Component Configuration Properties"
Note:
Arguments toopmnctl are case-sensitive. Be sure to type them exactly as shown. For example, -adminUsername must have only the letter U in upper case.The command indicates the operation to perform. The following commands are relevant to Oracle Internet Directory:
Starts server process.
Stops server process.
Restarts a specific Oracle Internet Directory component or all Oracle Internet Directory components.
Creates a component and automatically registers the component with a WebLogic domain, as long as the instance is in a registered state.
Deletes a component.
Registers an Oracle instance that was not previously registered with a domain. This scenario occurs if you chose Configure Without a Domain during installation of Oracle Internet Directory or if you created an Oracle instance from the command line and did not register the instance.
Unregisters an Oracle instance that was previously registered with a domain.
Shows the status of components. Add the -l option for detailed information.
Registers an existing Oracle Internet Directory component that was not previously registered with a domain. This scenario occurs if you created a new component in an Oracle instance using opmnctl createcomponent and did not register the component.
The following administration server properties are relevant to Oracle Internet Directory:
The WebLogic Administration Server host name
The WebLogic Administration Server port. The default is 7001.
The WebLogic administrator user name.
A text file containing the WebLogic administrator password. You are prompted for the administrator password if this parameter is missing. Best security practice is to provide the password in response to a prompt. If you must use a file containing the password in clear text, protect it with file permissions and delete it when it is no longer needed.
You do not need to specify instance properties with the opmnctl command, as long as you invoke the command as ORACLE_INSTANCE/bin/opmnctl.
No OPMN configuration properties are required with the opmnctl commands shown in this chapter.
The following component properties are relevant to Oracle Internet Directory.
For Oracle Internet Directory, this is always OID. This is required for createcomponent.
The name of an Oracle Internet Directory component, such as oid1. The component name must be unique within the Oracle instance.
These arguments are specific to Oracle Internet Directory
Specifies the name, TNS port, and service name of the Oracle Database associated with this Oracle Internet Directory component, in the format:
DBHostName:TNSPORT:DBSERVICENAME
For example:
linux12.example.com:1521:orcl.example.com
When you are using the createcomponent command, the DBHostName:Port:DBSvcName argument to the -DB_info parameter must be the same as that provided during installation. If it is not, the command fails. You can find this value in the file ORACLE_INSTANCE/config/tnsnames_copy.ora.
If the Oracle Database is based on Real Application Clusters, the argument to the -DB_info parameter is of the form:
DBHostName1:Port1^DBHostName2:Port2@DBSvcName
Optional. The file that contains the ODS password in cleartext.You are prompted for the ODS password if this parameter is missing. Best security practice is to provide the password in response to a prompt. If you must use a file containing the password in clear text, protect it with file permissions and delete it when it is no longer needed.
Optional. The file that contains the ODSSM password in cleartext.You are prompted for the ODSSM password if this parameter is missing. Best security practice is to provide the password in response to a prompt. If you must use a file containing the password in clear text, protect it with file permissions and delete it when it is no longer needed.
Required only for the first Oracle Internet Directory component in an instance. The Oracle Internet Directory namespace. For example: "dc=us,dc=example,dc=com".
Optional. The file that contains the password for the Oracle Internet Directory superuser account cn=orcladmin.You are prompted for the Oracle Internet Directory superuser password if this parameter is missing.
Optional. The non-SSL port for this Oracle Internet Directory component. The command uses a default available port if this parameter is missing.
Optional. The SSL port for this Oracle Internet Directory component. The command uses a default available port if this parameter is missing.
Using the OPMN Control Utility, you can perform the following Oracle Internet Directory server management tasks:
Section 2.5.3.1, "Creating an Oracle Internet Directory Component"
Section 2.5.3.4, "Updating the Component Registration of an Oracle Instance"
Section 2.5.3.5, "Deleting an Oracle Internet Directory Component"
Section 2.5.3.6, "Stopping All Oracle Internet Directory Server Components"
Section 2.5.3.7, "Starting All Oracle Internet Directory Server Components"
Section 2.5.3.8, "Stopping a Specific Oracle Internet Directory Server Component"
Section 2.5.3.9, "Starting a Specific Oracle Internet Directory Server Component"
Section 2.5.3.10, "Restarting All Oracle Internet Directory Server Components"
Section 2.5.3.11, "Restarting a Specific Oracle Internet Directory Server Component"
This command creates a component and registers it with a WebLogic domain, as long as the instance is in a registered state:
opmnctl createcomponent -componentType OID -componentName oid2 -adminHost myhost -adminPort 7001 -Db_info "linux12.example.com:1521:orcl.example.com" -Namespace "dc=domain_component1,dc=domain_component2..."
The DBHostName:Port:DBSvcName argument to the -DB_info parameter must be the same as that provided during installation. If it is not, the command fails. You can find this value in the file ORACLE_INSTANCE/config/tnsnames_copy.ora
If the Oracle Database is based on Real Application Clusters, the argument to the -DB_info parameter is of the form:
DBHostName1:Port1^DBHostName2:Port2@DBSvcName
The opmnctl command prompts for the WebLogic administrator's user name if you do not supply it. It also prompts for the passwords if you do not supply password file names on the command line. The opmnctl command also uses available ports if you do not specify -Port or -Sport
This example registers an Oracle instance with a WebLogic server:
ORACLE_INSTANCE/bin/opmnctl registerinstance \
-adminHost myhost \
-adminPort 7001 \
-adminUsername weblogic
You are prompted for the WebLogic administrator's user name and password.
This example unregisters an Oracle instance with a WebLogic server:
ORACLE_INSTANCE/bin/opmnctl unregisterinstance \
-adminHost myhost \
-adminPort 7001 \
-adminUsername weblogic
You are prompted for the WebLogic administrator's user name and password if you do not supply them.
You must update the registration of an Oracle Internet Directory component in a registered Oracle instance whenever you change any of the configuration attributes orclhostname, orclsslport, or orclnonsslport in the instance-specific configuration entry, or if you change the password for the EMD administrator. If you do not update the component registration, you will be unable to use Fusion Middleware Control or wlst to manage that component.
This example updates the component registration of an Oracle instance that has been registered.
ORACLE_INSTANCE/bin/opmnctl updatecomponentregistration \
-adminHost myhost \
-adminPort 7001 \
-adminUsername weblogic
-componentType OID \
-componentName oid2 \
-Port 6589 \
-Sport 3032
You are prompted for the WebLogic administrator's user name and password if you do not supply them.
The default administrative port on the WebLogic Administration Server is 7001.
You must supply both a non-SSL port and an SSL port.
This example deletes an Oracle Internet Directory component that has been registered with a WebLogic server:
ORACLE_INSTANCE/bin/opmnctl deletecomponent \
-adminHost myhost \
-adminPort 7001 \
-adminUsername weblogic \
-componentType OID \
-compnentName oid2
You are prompted for the WebLogic administrator's user name and password if you do not supply them.
The following example shows how to stop all running directory server processes (Oracle Internet Directory and Oracle Directory Replication server).
ORACLE_INSTANCE/bin/opmnctl process-type=OID stop
The following example shows how to start all directory server components.
$ORACLE_INSTANCE/bin/opmnctl startproc componentType=OID
The following example shows how to stop a specific Oracle Internet Directory component.
ORACLE_INSTANCE/bin/opmnctl stopproc componentName=oid1
The following example shows how to start a specific Oracle Internet Directory component.
ORACLE_INSTANCE/bin/opmnctl startproc componentName=oid1
The following example shows how to restart all Oracle Internet Directory components.
ORACLE_INSTANCE/bin/opmnctl restartproc process-type=OID
The following example shows how to restart an Oracle Internet Directory component named oid1.
ORACLE_INSTANCE/bin/opmnctl restartproc ias-component=oid1
The following example shows the status information provided by opmnctl.
$ opmnctl status -l
Processes in Instance: asinst_2
---------------------------------+--------------------+---------+----------+------------+----------+-----------+------
ias-component | process-type | pid | status | uid | memused | uptime | ports
---------------------------------+--------------------+---------+----------+------------+----------+-----------+------
oid2 | oidldapd | 24760 | Alive | 988238800 | 102744 | 0:01:12 | N/A
oid2 | oidldapd | 24756 | Alive | 988238799 | 55052 | 0:01:12 | N/A
oid2 | oidmon | 24745 | Alive | 988238796 | 48168 | 0:01:14 | LDAPS:6789,LDAP:6788
oid1 | oidldapd | 21590 | Alive | 988238048 | 103716 | 19:51:48 | N/A
oid1 | oidldapd | 21586 | Alive | 988238047 | 54420 | 19:51:49 | N/A
oid1 | oidmon | 21577 | Alive | 988238046 | 48168 | 19:51:49 | LDAPS:3133,LDAP:3060
Use the Oracle Internet Directory Database Statistics Collection Tool (oidstats.sql) to analyze the various database ods (Oracle Directory Server) schema objects to estimate the statistics. It is located in the following directory: ORACLE_HOME/ldap/admin/. You must run this utility whenever there are significant changes in directory data—including the initial load of data into the directory.
If you load data into the directory by any means other than the bulk load tool (bulkload), then you must run the Oracle Internet Directory Database Statistics Collection tool after loading. Statistics collection is essential for the Oracle Optimizer to choose an optimal plan in executing the queries corresponding to the LDAP operations. You can run Oracle Internet Directory Database Statistics Collection tool at any time, without shutting down any of the Oracle Internet Directory processes.
Note:
If you do not use the bulkload utility to populate the directory, then you must run theoidstats.sql tool to avoid significant search performance degradation.If you do not supply the ODS password on the command line, sqlplus prompts for it. Note that the default ODS password is the same as that for the Oracle Application Server administrator. (For security reasons, avoid supplying a password on the command line whenever possible. A password typed on the command line is visible on your screen. When you supply a password at a prompt, it is not visible on the screen.)
Required. The connect string for the ODS database. This is the network service name set in the tnsnames.ora file, which is located by default in $ORACLE_INSTANCE/config. (You can set the TNS_ADMIN environment variable if you want to use a different location.)
The Oracle Internet Directory Credential Management Tool is used to add, update, or delete a credential that has been created in the Credential Store Framework. It determines the instance name from the opmn.xml file
The oidcred command takes the following arguments:
Required. Value can be odssm or emd.
Required. Value can be update or delete.The update option adds the credential if it does not exists or updates it if it exists.
Required if ORACLE_INSTANCE environment is not set. Path of Oracle Instance directory.
If not specified on the command line, oidcred uses ORACLE_INSTANCE environment variable if set.
The Oracle Internet Directory realm tool is used to create multiple realms in Oracle Internet Directory. The individual realms can be managed separately, so you can use oidrealm as a replacement for Delegated Administration Services.
The oidrealm tool supports creation, but not deletion, of a realm. A procedure for deleting a realm is provided in Note 604884.1, which is available on My Oracle Support at https://support.oracle.com/
On UNIX or Linux:
oidrealm oid_host oid_port DN [-SSL]
On Windows:
oidrealm.bat oid_host oid_port DN [-SSL]
Note:
If you specify an SSL port, that port must be configured in SSL No Authentication Mode, that is,orclsslauthentication must be 1. For more information, see the section on SSL authentication modes in Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.Name of host where Oracle Internet Directory is running.
Specifies the port number to use, which can be either SSL or non-SSL
DN of realm to add
Specifies that the port is an SSL port. Only no-auth mode is supported.
$ oidrealm myhost.example.com 3133 'dc=newrealm,dc=com' -SSL Enter OID Admin Password: password [info] ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidSubscriberCreateCommon.lst * Feb 2, 2009 9:22:57 PM oracle.ldap.util.LDIFLoader recursiveLoad INFO: ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidSubscriberCreateCommon.lst * [info] ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextCreate.lst * Feb 2, 2009 9:22:57 PM oracle.ldap.util.LDIFLoader recursiveLoad INFO: ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextCreate.lst * [info] -> LOADING: /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextCreateCommon.sbs Feb 2, 2009 9:22:57 PM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: -> LOADING: /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextCreateCommon.sbs [info] ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextUpgradeFrom81600.lst *Feb 2, 2009 9:22:58 PM oracle.ldap.util.LDIFLoader recursiveLoad INFO: ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextUpgradeFrom81600.lst* [info] -> LOADING: /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextUpgradeFrom81600Common.sbs Feb 2, 2009 9:22:58 PM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: -> LOADING: /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextUpgradeFrom81600Common.sbs [info] ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextCreate90100Changes.lst * Feb 2, 2009 9:23:00 PM oracle.ldap.util.LDIFLoader recursiveLoad INFO: ->> /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextCreate90100Changes.lst * [info] -> LOADING: /scratch/mydir/mwhome/idm3/ldap/schema/oid/oidContextUpgradeFrom90000Common.sbs Feb 2, 2009 9:23:00 PM oracle.ldap.util.LDIFLoader loadOneLdifFile ... ... ... ...