Configure the first domain using the instructions in

19-26 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory 6. Update the Oracle Context with the newly added namespace by performing the following steps: a. Create an LDIF file like the following example and replace dc=dbdemo,dc=orion,dc=com with the DN of your first domain: dn: cn=Common,cn=Products,cn=OracleContext,dc=dbdemo,dc=orion,dc=com changetype: modify add: orclcommonusersearchbase orclcommonusersearchbase: Mapped_Namespace_for_Second_Domain b. Update Oracle Virtual Directory using the LDIF file. For example: ORACLE_HOME binldapmodify -h Oracle_Virtual_Directory_Host –p Port \ -D bindDN -q -v -f LDIF_File 7. Repeat steps 2-6 to support additional domains.

19.2.5 Enabling User Account Lockout

LDAP servers can lock a user account after several bind attempts fail. The Oracle Virtual Directory-Enterprise User Security integration can use this lockout feature and enforce the back-end LDAP servers password lockout policy as follows: ■ An incorrect login to the Oracle Database records a login failure to the back-end LDAP server ■ A correct login to the Oracle Database resets the login failure count in the back-end LDAP server Note: The following ACL must be the last ACL in the ACL list for the Mapped Namespace for second domain. Target DN Mapped Namespace for second domain Scope subtree Applies To authpassword Grant Search and Read Access Group with DN of: cn=EUSDBGroup,dc=dbdemo,dc=orion,dc=com. Note : Replace dc=dbdemo,dc=orion,dc=com with the DN of your first domain. Note: To login to the database as an enterprise user from any of these additional domains, you must create the User-Schema Mappings for the additional user containers from Enterprise Security Manager or Enterprise Manager. Refer to Oracle® Database Enterprise User Security Administrators Guide for instructions. Note: This functionality is not available for integrations that use Active Directory. Configuring Oracle Virtual Directory for Integrated Directory Solutions 19-27 ■ A locked user account cannot be used to log in to the Oracle Database After performing the Oracle Virtual Directory-Enterprise User Security integration, you can enable user account lockout by performing the following steps: 1. Create and configure the euslockout plug-in for the Enterprise User Security integration LDAP Adapter by referring to Managing Adapter Plug-ins on page 13-1. When you configure the euslockout plug-in, you must: ■ Create a directoryType parameter with a value according to your back-end LDAP server, such as ActiveDirectory for Active Directory, iPlanet for Oracle Directory Server Enterprise Edition, or eDirectory for Novell eDirectory. ■ Create a namespace using the name of your user container. 2. If you are using Oracle Directory Server Enterprise Edition as a back-end LDAP server, you must configure an additional plug-in parameter on the Enterprise User Security integration LDAP Adapter. If you are using Novell eDirectory as a back-end LDAP server, go to step 3. a. Query the Oracle Directory Server Enterprise Edition to determine its passwordMaxFailure value. For example: ORACLE_HOME binldapsearch -h Sun_Java_System_Directory_Server_Name \ -D bindDN -q -s base -b cn=password policy,cn=config objectclass= passwordmaxfailure

b. Set the passwordMaxFailure parameter in the EUSiPlanet plug-in using the

value returned from the query. Click the EUSiPlanet plug-in, then click the Create New Parameter button. Select passwordMaxFailure and enter the value in the Parameter field. Click OK. 3. Create the following Access Control Lists. Refer to Creating Access Control Lists Using Oracle Directory Services Manager on page 16-1 for information on creating ACLs: Note: If you are using Oracle Internet Directory as the back-end LDAP server, skip steps 1 and 2 in the following procedure. Target DN Your_User_Container Scope subtree Applies To orclaccountstatusevent Deny All operations Access Public Target DN Your_User_Container Scope subtree Applies To orclaccountstatusevent Grant Write Access Group with DN of: cn=EUSDBGroup,dc=dbdemo,dc=orion,dc=com. Note : Replace dc=dbdemo,dc=orion,dc=com with the DN of your namespace.