It is required to use Oracle Internet Directory(OID) as LDAP directory for implementing SSO for Oracle products like EBS using Oracle Access Manager.If you are using any other LDAP servers like Microsoft Active directory across the enterprise it will be required to use Oracle Directory Integration Platform for synchronizing the directories.
If all the users from the third party directory are not required into OID we can use filters like AD groups and make use of the filtering in the DIP synchronization profiles to bring in the selected users.If the AD you are connecting to is a global catalog server rather than the child domain with a referral the users from the child domain is expected to get synced to the OID.But if it is a referral child domain ldap search will fail with below error.
$ORACLE_HOME/bin/ldapsearch -h ADhost -p port -D "admin@mydomain.com" -w welcome1 -b "cn=users,dc=child1,dc=mydomain,dc=com" -s sub"objectclass=*"
ldap_search: LDAP Referral Error
ldap_search: additional info: 0000202B: RefErr: DSID-0310063C, data 0, 1 access points
ref 1: 'child1.mydomain.com'
If there is no global catalog server the solution for this will be to create a new synchronization profile in DIP pointing to the child domain directly.This can be targeted to the new container in OID or a new one.The ldapsearch query can be run against the child Domain controller to verify if all the user accounts of interest including all attributes and values that will be synchronized are pulled in the query using the filter if any.
$ORACLE_HOME/bin/ldapsearch -h ChildADhost -p port -D "admin@mydomain.com" -w welcome1 -b "cn=users,dc=child1,dc=mydomain,dc=com" -s sub"objectclass=*"
To manually create the AD OID integration profile and setup the synchronization perform the below steps
If all the users from the third party directory are not required into OID we can use filters like AD groups and make use of the filtering in the DIP synchronization profiles to bring in the selected users.If the AD you are connecting to is a global catalog server rather than the child domain with a referral the users from the child domain is expected to get synced to the OID.But if it is a referral child domain ldap search will fail with below error.
$ORACLE_HOME/bin/ldapsearch -h ADhost -p port -D "admin@mydomain.com" -w welcome1 -b "cn=users,dc=child1,dc=mydomain,dc=com" -s sub"objectclass=*"
ldap_search: LDAP Referral Error
ldap_search: additional info: 0000202B: RefErr: DSID-0310063C, data 0, 1 access points
ref 1: 'child1.mydomain.com'
If there is no global catalog server the solution for this will be to create a new synchronization profile in DIP pointing to the child domain directly.This can be targeted to the new container in OID or a new one.The ldapsearch query can be run against the child Domain controller to verify if all the user accounts of interest including all attributes and values that will be synchronized are pulled in the query using the filter if any.
$ORACLE_HOME/bin/ldapsearch -h ChildADhost -p port -D "admin@mydomain.com" -w welcome1 -b "cn=users,dc=child1,dc=mydomain,dc=com" -s sub"objectclass=*"
To manually create the AD OID integration profile and setup the synchronization perform the below steps
- Launch the FMW Enterprise Manager console and login with weblogic user.
- Expand your domain and Navigate to Identity and Access
- Select DIP
- From the DIP Server drop down list select Administration , then Synchronization Profiles
- Using the navigation path, create a new DIP Sync profile with a name , you can give your name.For Example take it as AD2OID is the integration profilename , in this window you'll be asked to enter the AD details
- For the attribute Use DIP-OID as Source or Destination , you need to select the option Destination if you are using import (AD to OID) sync or select Sourceoption if you are using Export (OID to AD) sync. Also source type you need to select Active Directory(MS) from the drop down next type.
- After Providing the above mentioned details in the general tab click on Test Connection Tab, If the provided values are correct you'll see the Information dialogue saying that "Test Passed.Connection Successful". If the values provided for AD are wrong in the General tab , when you click on the Test Connection, you will get an Error dialogue saying Authentication Failure,Make sure that you provide the correct values and get connection Successful to move Further
- Then Click on OK to Save the profile.Now select the AD2OID profile from the list of available profiles and click on Edit.
- Now select the Mapping tab and configure mapping like below
Configure Domain Rules Click on Create option, You'll get a Add Mapping Rule Window , in that Select the Source Container DN and OID container DN from the lookup windows provided and click on OK.
Validate / re-Validate mapping until you have no errors, warnings are OK
Make sure the user account used has read access privileges to the sub tree root.
