18 Configuring Synchronization with a Third-Party Directory

Understanding Express Configuration

The Directory Integration Assistant (dipassistant) includes an express configuration option that creates two synchronization profiles, one for import and one for export, using predefined assumptions. If the directory integration server is already running, then after enabling the profiles, you can immediately begin synchronizing users and groups between the containers in which users and groups are stored in the third-party directory and cn=users,default_realm/ cn=groups,default_realm in Oracle Internet Directory.

To simplify the configuration, the express configuration option assumes the following:

• Entries for users of the default realm in Oracle Internet Directory are located in the container cn=users,default_realm_DN.

• Entries for groups of the default realm in Oracle Internet Directory are located in the container cn=groups,default_realm_DN

• The Oracle Directory Integration Platform master mapping rules files created during installation are located in $ORACLE_HOME/ldap/odi/conf.

• Master domain mapping rules are located in $ORACLE_HOME/ldap/odi/samples.

• The logon credential is that of a Oracle Directory Integration Platform administrator with sufficient privileges to configure a profile, a realm, and access controls on the Users container in the Oracle directory server. Members of the Oracle Directory Integration Platform Administrators group (cn=dipadmingrp,cn=dipadmin,cn=directory integration platform,cn=products,cn=oraclecontext) have the necessary privileges.

Perform the following steps to run express configuration and verify that users and groups are synchronizing between cn=users,default_naming_context in the third-party directory and cn=users,default_realm in Oracle Internet Directory:

1. Run express configuration by following the instructions in "Running Express Configuration".

2. Express configuration creates two profiles named profile_nameImport and profile_nameExport. By default, both profiles are disabled. Enable the profile_nameImport profile if you need to synchronize from a third-party directory to Oracle Internet Directory and enable the profile_nameExport profile if you need to synchronize from Oracle Internet Directory to a third-party directory. To enable a profile, you use the Directory Integration Assistant (dipassistant) utility with the modifyprofile operation. For example, the following command enables an import profile named myprofileImport:

   $ORACLE_HOME/bin/dipassistant modifyprofile -host myhost -port myport 
   -file import.profile -dn bind_DN -passwd password_of_bind_DN 
   -profile myprofileImport odip.profile.status=ENABLE
   
   

3. Start the Oracle directory integration platform by following the instructions described in "Starting, Stopping, and Restarting the Oracle Directory Integration Platform".

4. Wait until the scheduling interval has elapsed and verify that synchronization has started by entering the following command:

   $ORACLE_HOME/bin/ldapsearch -h OID host -p OID port
   -D "DN of privileged OID user" -w "password of privileged OID user"
   -b "orclodipagentname=import profile,cn=subscriber profile,cn=changelog
   subscriber,cn=oracle internet directory" -s base "objectclass=*"
   orclodipsynchronizationstatus orclodiplastsuccessfulexecutiontime
   

   
   

   Note: The default scheduling interval is 60 seconds (1 minute). You can use the Directory Integration Assistant (dipassistant) to change the default scheduling interval. For more information, see Chapter 3, "Oracle Directory Integration Platform Administration Tools".

   
   

   When synchronization is successfully started:

   • The value of the Synchronization Status attribute is Synchronization Successful.

   • The value of the Last Successful Execution Time attribute is the specific date and time of that execution. Note that this must be close to the current date and time.

   An example of a result indicating successful synchronization is:

   Synchronization successful 20060515012615
   

   
   

   Note: The date and time must be close to current date and time When running the ldapsearch command, you need the dipadmin password, which, as established at installation, is the same as orcladmin password

   
   

5. After verifying that synchronization has started, examine the entries in Oracle Internet Directory and the third-party directory to confirm that users and groups are synchronizing between cn=users,default_naming_context in the third-party directory and cn=users,default_realm in Oracle Internet Directory.

Running Express Configuration

You can run express configuration with either the Directory Integration Assistant (dipassistant) or the Oracle Directory Integration Server Administration tool. The express configuration option with the Oracle Directory Integration Server Administration tool is only available for integrations with Microsoft Active Directory. For all other supported third-party directories, you must run express configuration with the Directory Integration Assistant. How to run express configuration for each tool is described in these topics:

• Running Express Configuration with the Directory Integration Assistant

• Running Express Configuration with the Oracle Directory Integration Server Administration Tool (Microsoft Active Directory Only)

Configuring the Realm

To configure the realm, do the following:

1. Choose the realm DN structure as described in the section "Choose the Structure of the Directory Information Tree", and, more specifically, in the section "Planning the Deployment".

2. Select the attribute for the login name of the user. This attribute contains the name of the attribute used for logging in. By default, it is uid. For more information, see the section "Select the Attribute for the Login Name".

   • If you are integrating with Microsoft Active Directory, and the userprincipalname attribute is used for logging in, then you would map userprincipalname to the uid attribute in Oracle Internet Directory

   • If you are integrating with Novell eDirectory or OpenLDAP, and the mail attribute is used for logging in, then you would map mail to the uid attribute in Oracle Internet Directory

3. Set up the usersearchbase and groupsearchbase values in Oracle Internet Directory. These values indicate to the various Oracle components where to look for users and groups in Oracle Internet Directory. They are set to default values during installation. However, you may need to reset these values so that they correspond to the DIT structures in the two directories. Be sure to set them correctly. Otherwise, even if the synchronization seems to function properly, components still may be unable to access users and groups in Oracle Internet Directory.

   To illustrate how you might configure the user search base and group search base: In the example in , the value of usersearchbase should be set to cn=users,dc=us,dc=MyCompany,dc=com or one of its parents. Similarly, assuming there is a subtree named groups in the DIT, the multivalued groupsearchbase attribute should be set to both of the following:

   • cn=groups,dc=us,dc=MyCompany,dc=com or one of its parents

   • cn=users,dc=us,dc=MyCompany,dc=com

   To configure the user search base and group search base, use the Oracle Internet Directory Self-Service Console.

4. Set up the usercreatebase and groupcreatebase values in Oracle Internet Directory. These values indicate to the various Oracle components where users and groups can be created. They are set to default values during installation.

   To illustrate how to configure the user create base and group create base: In the example in , the value of usercreatebase should be set to cn=users,dc=us,dc=MyCompany,dc=com or one of its parents. Similarly, the groupcreatebase should be set to cn=groups,dc=us, dc=MyCompany,dc=com or one of its parents.

   To configure the user create base and group create base, use the Oracle Internet Directory Self-Service Console.

Customizing Access Control Lists

This section discusses how to customize ACLs for import profiles, export profiles, and for other Oracle components. It contains these topics:

• Customizing ACLs for Import Profiles

• Customizing ACLs for Export Profiles

• ACLs for Other Oracle Components

$ORACLE_HOME/bin/ldapmodify -h OID host -p OID port 
-D "DN of privileged OID user" -w "password of privileged OID user" 
-v -f realmacl.ldif

Customizing Mapping Rules

Mapping rules, an important part of the synchronization profile, determine the directory information to be synchronized and how it is to be transformed when synchronized. You can change mapping rules at run time to meet your requirements.

Each sample synchronization profile includes default mapping rules. These rules contain a minimal set of default user and group attributes configured for out-of-the-box synchronization.

Mapping rules govern the way data is transformed when a source directory and a destination directory are synchronized. Customize the default mapping rules found in the sample profiles when you need to do the following:

• Change distinguished name mappings. The distinguished name mappings establish how the third-party directory DIT maps to the Oracle Internet Directory DIT.

• Change the attributes that need to be synchronized.

• Change the transformations (mapping rules) that occur during the synchronization.

You can perform any mapping if the resulting data in the destination directory conforms to the schema in that directory.

Once you have established a working synchronization between Oracle Internet Directory and a third-party directory, you can customize the attribute mapping rules for your synchronization profiles to meet the needs of your deployment. When you use express configuration to create import and export synchronization profiles, mapping files are created for each profile in the $ORACLE_HOME/ldap/conf directory. The mapping files are named profile_nameImport.map and profile_nameExport.map. For example, if you enter "abc" when express configuration prompts you for the name of your profile, your import mapping files will be named abcImport.map and abcExport.map.

To customize the attribute mapping rules for your synchronization profiles:

1. Make a duplicate of the sample mapping rules file. The sample mapping rules files are stored in the $ORACLE_HOME/ldap/odi/conf directory with the extension of map.master for the various profiles.

2. Edit the sample mapping rules file to make the previously discussed modifications. You can find instructions for editing mapping rules in "Configuring Mapping Rules".

3. After the changes are made, enter the following command:

   $ORACLE_HOME/bin/dipassistant modifyprofile -profile profile_name 
   -host oid_host -port oid_port -dn DN -passwd password
   odip.profile.mapfile=path_name
   
   

   For example:

   $ORACLE_HOME/bin/dipassistant modifyprofile -profile my_profile 
   -host my_host -port 3060 -dn cn=orcladmin -passwd welcome1
   odip.profile.mapfile=my_profile.map
   
   

   
   

   See Also: The dipassistant section in the Oracle Directory Integration Platform tools chapter of the Oracle Identity Management User Reference

   
   

4. Wait until the scheduling interval has elapsed, and then check the synchronized users and groups to ensure that the attribute mapping rules meet your requirements.

   
   

   Tip: You may find it helpful to add test users and groups to Oracle Internet Directory or the third-party directory when customizing attribute mapping rules.

   
   

Configuring the Third-Party Directory Connector for Synchronization in SSL Mode

By default, SSL is not enabled for the import and export synchronization profiles created with express configuration. Whether or not you synchronize in the SSL mode depends on your deployment requirements. For example, synchronizing public data does not require SSL, but synchronizing sensitive information such as passwords does. To synchronize password changes between Oracle Internet Directory and a third-party directory, you must use SSL server authentication mode.

Securing the channel requires:

• Enabling SSL between Oracle Internet Directory and the Oracle directory integration platform

• Enabling SSL between the Oracle directory integration platform and the third-party directory

Although you can enable SSL either between Oracle Internet Directory and the Oracle directory integration platform or between that server and the third-party directory, Oracle recommends that you completely secure the channel before you synchronize sensitive information. In certain cases, such as password synchronization, synchronization can occur only over SSL.

Configuring SSL requires the following:

• Running the Oracle directory server in SSL mode as described in the chapter on Secure Sockets Layer (SSL) in Oracle Internet Directory Administrator's Guide .

• Running the Oracle directory integration platform in the SSL mode as described in Chapter 2, "Security Features in Oracle Directory Integration Platform". The SSL mode should be the same as the one in which Oracle Internet Directory server was started. When starting the Oracle directory integration platform, specify the sslauth parameter to 1 for no authentication or 2 for server authentication. If you do not include the sslauth parameter, the SSL mode defaults to no authentication.

• Running the third-party directory server in SSL mode. Communication with a third-party directory over SSL requires SSL server authentication. This requires that both Oracle Internet Directory and the Oracle directory integration platform be run in SSL server authentication mode.

Perform the following steps to configure communication with a connected directory in SSL mode:

1. In the integration profile, to indicate that the mode of communication is SSL, configure the connectedDirectoryURL attribute in the form of host:port:1. Make sure the port number is the SSL port. The default SSL port number is 636.

2. Generate a certificate from the connected directory. What is required is the trust point certificate from the server. You do not need to use any external certificate server.

3. Export the certificates to Base 64 encoded format.

4. Import the certificates as trust points in the Oracle Wallet by using Oracle Wallet Manager. When you save the wallet, be sure to enable Auto Login by selecting Wallet from the menu bar, and then by selecting the check box next to the Auto Login menu item.

5. Specify the wallet location in the odi.properties file in $ORACLE_HOME/ldap/odi/conf.

6. Modify the third-party directory connection information, including the host name and profile, using the Directory Integration Assistant's modifyprofile command, as follows:

   $ORACLE_HOME/bin/dipassistant modifyprofile -h hostName -p ssl_port 
   -U ssl_mode -profile profile_name 
   odip.profile.condirurl=ad_host_name:636:1
   
   

7. Enter the following command to create the certWalletPwd file:

   dipassistant wpasswd
   
   

   This command reads the odi.properties file for the location where the certWalletPwd file will be created. Enter the wallet password when prompted.

8. Use the odisrvreg utility to register the server. The following command demonstrates how to use the odisrvreg utility to register the server in non-SSL mode:

   odisrvreg -h hostname -p port -D bindDN -w password
   
   

   
   

   See Also: Oracle Identity Management User Reference information on how to use the odisrvreg utility

   
   

9. Restart the Oracle directory integration platform in SSL mode by following the instructions "Starting, Stopping, and Restarting the Oracle Directory Integration Platform".

10. Add a test user and verify that it synchronizes successfully. If the test user does not synchronize successfully, then troubleshoot your SSL configuration.

Enabling Password Synchronization from Oracle Internet Directory to a Third-Party Directory

To synchronize passwords from Oracle Internet Directory to a third-party directory, you must enable the password policy and reversible password encryption in the Oracle directory server. To do this, assign a value of 1 to the orclPwdPolicyEnable and orclpwdEncryptionEnable attributes in the entry cn=PwdPolicyEntry,cn=common,cn=products,cn=oraclecontext,DN_of_realm. You can do this by using either Oracle Directory Manager or ldapmodify by uploading an LDIF file containing the following entries:

dn:cn=PwdPolicyEntry,cn=common,cn=products,cn=oraclecontext,DN_of_realm.
changetype: modify
replace: orclpwdpolicyenable
orclpwdpolicyenable: 1
-
replace: orclpwdencryptionenable
orclpwdencryptionenable: 1

Configuring External Authentication Plug-ins

Starting in 10g (10.1.4.0.1), Oracle Directory Integration Platform supports Java-based external authentication plug-ins. Oracle recommends that you use the Java plug-ins instead of the older, PL/SQL-based plug-ins, which only support Microsoft Active Directory and Sun Java System Directory.

The configuration tool for the new plug-ins is a Java program called oidexcfg. You use it to configure Java-based external authentication plug-ins for Microsoft Active Directory, Sun Java System Directory, Novell eDirectory, and OpenLDAP. The tool only sets up an external authentication plug-in to work with a single domain. You must perform additional steps to set up an external authentication plug-in to work with multiple domains.

This section contains these topics:

• Configuring an External Authentication Plug-in

• Configuring External Authentication Against Multiple Domains