LDAP with Multiple Search Bases

Figure 33. Domain Delimiter Field descriptions: Domain Delimiter Specifies the character that delimits domain and user name. When left empty, users are searched from all domains. Domain Prefix, Domain Postfix Domains are searched using the following pattern: {domain prefix}domain_name{domain postfix}{search base} where {domain prefix} is value of property whose name is domain prefix, {domain postfix} is value of property whose name is domain postfix and {searchbase} is value of property whose name is searchbase. Page 110

6.1.2. LDAP with Multiple Search Bases

Figure 34. EnableDisable Domains Enable Domains Left column: domain name that users will be using during login. Right column: distinguished domain name. Disable Domains Enter distinguished domain name of domains you wish to disable.

6.1.3. Multiple LDAP Services

The correct LDAP service is chosen via DNS. The installation consists of the following steps: 1. Specify useraccount search properties as shown in Figure 29 . 2. Map Registry user properties to LDAP properties as shown in Figure 30 . 3. Specify group search properties as shown in Figure 31 . 4. Map Registry group properties to LDAP properties as shown in Figure 32 . Page 111

6.1.3. Multiple LDAP Services

6.1.4. LDAP over SSLTLS

It is only a matter of configuration to setup LDAP over SSL or TLS with a directory server of your choice. We recommend that you first install Oracle Service Registry with a connection to LDAP that does not use SSL. You can then verify the configuration by logging in as a user defined in this directory before configuring use of SSL. The configuration procedure assumes that you have already installed Oracle Service Registry with an LDAP account provider. Oracle Service Registry must not be running. LDAP over SSL Without Client Authentication In this case only LDAP server authentication is required. This is usually the case. Edit the REGISTRY_HOMEappuddiconfdirectory.xml file in one of the following ways depending on the version of Java used to run Oracle Service Registry: • If Oracle Service Registry will always be running with Java 1.4.2 or later: 1. Change the java.naming.provider.url property to use the ldaps protocol and the port on which the directory server accepts SSLTLS connections. For example ldaps:sranka.in.idoox.com:636; • Otherwise, if Oracle Service Registry may be run with a Java version less than 1.4.2: 1. Change the java.naming.provider.url property to the appropriate URL using the ldap protocol. For example ldap:sranka.in.idoox.com:636 ; 2. Add a new property, after the java.naming.provider.url property, with name java.naming.security.protocol and value ssl; This is shown in the following example: Example 1. Directory configuration config name=directory savingPeriod=5000 directory -- LDAP over SSLTLS unprotected connection -- -- property name=java.naming.provider.url value=ldap:hostname:47361 -- -- LDAP over SSLTLS for Java 1.4.2 and later -- -- property name=java.naming.provider.url value=ldaps:hostname:636 -- -- LDAP over SSLTLS for Java where LDAP over SSL is supported -- property name=java.naming.provider.url value=ldap:hostname:636 property name=java.naming.security.protocol value=ssl ... ... ... directory config In both cases, be sure that the hostname specified in the java.naming.provider.url property matches the name that is in the directory server certificates subject common name CN part of certificates Subject. Otherwise you will get an Page 112 LDAP over SSL Without Client Authentication