Changing the Password of the ODS Schema Used by Oracle Internet Directory

Configuring High Availability for Identity Management Components 8-45 c. Forcing Failover abort as setting of DB parameters for the session failed If high availability event notification is enabled, you would see a message similar to the following: HA Callback Event Thread Id: 8 Event type: 0 HA Source: OCI_HA_INSTANCE Host name: dbhost1 Database name: orcl Instance name: orcl1 Timestamp: 14-MAY-09 03.25.24 PM -07:00 Service name: orcl.us.oracle.com HA status: DOWN - TAF Capable If TAF is disabled, HA status will be shown as DOWN. Action : See why database node went down. Error : Time Difference of at least 250 sec found between node1 and node2. Cause : There is time difference between the two nodes Action : Synchronize the system time. Error : Node= did not respond for configured d times, Failing over... Cause : One of the OID nodes oidmon is not responding. Action : See if the node is alive or OIDMON process is running. For more information about troubleshooting Oracle Internet Directory, see Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory.

8.3.7 Additional Oracle Internet Directory High Availability Issues

This section describes issues for Oracle Internet Directory in a high availability environment.

8.3.7.1 Changing the Password of the ODS Schema Used by Oracle Internet Directory

You can change the Oracle Internet Directory database schema password that is, the password of the ODS user in the database using the Oracle Internet Directory Database Password Utility oidpasswd from any of the Oracle Internet Directory nodes. However, since the ODS schema password is stored in a password wallet under the ORACLE_INSTANCE of each OID instance, the password wallet must be updated in each Oracle Internet Directory node. To change the ODS database user password, invoke the following command on one of the Oracle Internet Directory nodes: oidpasswd connect=database-connection-string change_oiddb_pwd=true On all other Oracle Internet Directory nodes, invoke the following command to synchronize the password wallet: oidpasswd connect=database-connection-string create_wallet=true If you change the ODS password on one Oracle RAC node by using the OID Database Password Utility oidpasswd, then you must do one of the following to update the wallet ORACLE_HOMEldapadminoidpwdlldap1 on the other Oracle RAC nodes: 8-46 Oracle Fusion Middleware High Availability Guide ■ Invoke the OID Database Password Utility on all the other nodes to update the wallet file only. This applies to replication password changes also, but for replication password changes you would use the Replication Environment Management Tool to update the password instead of the OID Database Password Utility. ■ Copy the changed wallet to the other nodes. If you run the oidpasswd command on one node only, and do not update the wallet on all the Oracle RAC nodes, the Oracle Internet Directory instance on the second node will not be able to start on the other nodes. You will see this error in the OIDMON log file: [gsdsiConnect] ORA-1017, ORA-01017: invalid usernamepassword; logon denied. As mentioned above, the fix is to copy the oidpwdlldap1 file to the other Oracle RAC nodes, or to invoke the oidpasswd tool with the create_wallet=true option on the other nodes.

8.4 Oracle Virtual Directory High Availability

This section provides an introduction to Oracle Virtual Directory and describes how to design and deploy a high availability environment for Oracle Virtual Directory. This section includes the following topics: ■ Section 8.4.1, Oracle Virtual Directory Component Architecture ■ Section 8.4.2, Oracle Virtual Directory High Availability Concepts ■ Section 8.4.3, Oracle Virtual Directory High Availability Configuration Steps ■ Section 8.4.4, Validating Oracle Virtual Directory High Availability ■ Section 8.4.5, Oracle Virtual Directory Failover and Expected Behavior ■ Section 8.4.6, Troubleshooting Oracle Virtual Directory High Availability

8.4.1 Oracle Virtual Directory Component Architecture

Oracle Virtual Directory is an LDAP version 3 enabled service that provides virtualized abstraction of one or more enterprise data sources into a single directory view. Oracle Virtual Directory provides the ability to integrate LDAP-aware applications into diverse directory environments while minimizing or eliminating the need to change either the infrastructure or the applications. Oracle Virtual Directory supports a diverse set of clients, such as Web Applications and portals, and it can connect to directories, databases and Web Services as shown in Figure 8–4 . Figure 8–4 shows Oracle Virtual Directory in a non-high availability architecture.