At the next scheduled interval, that entry modification event is read by the

16-16 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

16.2.5 Choose the Structure of the Directory Information Tree

At installation, each directory server creates a default domain and a default directory information tree DIT structure. The Oracle Internet Directory infrastructure installation creates a default realm with designated containers for storing enterprise users and groups. When integrating with a third-party directory, you must create identical DIT structures in both directories to use the default installation of Oracle Internet Directory. Alternatively, you can perform domain-level mapping. This section contains these topics: ■ Create Identical DIT Structures on Both Directories ■ Distinguished Name Mapping and Limitations

16.2.5.1 Create Identical DIT Structures on Both Directories

Oracle recommends that you configure identical DITs on both directories. This enables all the user and group objects to be synchronized as they are, and eliminates the task of mapping entries with distinguished names in one directory to URLs in the other. It also eliminates the performance problems that those mappings can cause. To create identical DITs, first decide which directory is the central enterprise directory, and then change the DIT of the other one to match. Be sure to update the directory integration profile to reflect the domain-level rules. To enable users to access Oracle applications through Oracle Application Server Single Sign-On, Oracle recommends that you identify the DIT as a separate identity management realm with its own authentication and authorization domain. Note: In deployments where both directories do not use the same hashing algorithm, password synchronization is not available in an out-of-the-box installation of Oracle Internet Directory. You must configure it. In deployments where Oracle Internet Directory is not the central directory, the password policy is enforced by the third-party directory. When there is an authentication request to the third-party directory, the latter replies that the authentication either succeeded or failed. However, any detailed password policy errors from the third-party directory are not delivered to Oracle Internet Directory and then to the client applications. See Also: The following chapter for information about plug-ins: ■ The chapter in the Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory about the directory plug-in framework ■ The chapter in Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory about customizing the external authentication plug-in See Also: The chapter about deploying identity management realms in Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory