Reconciliation Manager Reconciliation Architecture

Deployment Configurations 4-23

4.3 Integration Between LDAP Identity Store and Oracle Identity Manager

Oracle Identity Manager users and roles are stored in Oracle Identity Manager database. However, when a user, role, or role membership change takes place in Oracle Identity Manager, this information is propagated to LDAP identity store. If user, role, or role membership change takes place in LDAP directly, then these changes are synchronized into Oracle Identity Manager. The synchronization involves: ■ User creation, modification, deletion, change in enable or disable states, and password change are made in LDAP in addition to the internal Oracle Identity Manager tables. ■ Role creation, modification, and deletion actions update the LDAP groups, including membership changes. ■ Initial load of users, roles, and role memberships are synchronized. ■ Direct changes to user profile in LDAP are reconciled to Oracle Identity Manager. ■ Direct changes to roles and role memberships in LDAP are reconciled to Oracle Identity Manager. When changes are made in the user and role data, the actual operation is performed with the help of the kernel handlers. These handlers go through an orchestration lifecycle of various stages, such as validation, preprocessing, action, and postprocessing. For more information about the various stages of kernel orchestration, see Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. Oracle Identity Manager kernel orchestration connects to the Entity Manager, which in turn connects to the LDAP provider. The LDAP provider connects to Oracle Virtual Directory OVD. The OVD is an interface to various directory systems, such as Oracle Internet Directory, iPlanet, and Active Directory. The LDAP provider reaches the LDAP data by using OVD. Figure 4–8 shows the communication between Oracle Identity Manager and LDAP: Figure 4–8 Oracle Identity Manager and LDAP The integration configuration and synchronization of data between Oracle Identity Manager and the LDAP identity store are described in the following sections: ■ Configuring the Integration with LDAP ■ Provisioning Data From Oracle Identity Manager to LDAP Identity Store See Also: Managing Reconciliation Events for more information about the Reconciliation Manager in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager. Oracle Identity Manager Kernel Orchestration Entity Manager LDAP Provider OVD LDAP 4-24 Oracle Fusion Middleware Users Guide for Oracle Identity Manager ■ Reconciliation From LDAP Identity Store to Oracle Identity Manager

4.3.1 Configuring the Integration with LDAP

Configuring the integration between Oracle Identity Manager and LDAP is performed while installing Oracle Identity Manager. You can choose to install Oracle Identity Manager with or without LDAP. If you install Oracle Identity Manager with LDAP, then you must install OVD and Oracle Internet Directory, create a container to store reserved users, create a new user in Oracle Identity Manager to perform Oracle Identity Manager operations, and configure OVD and Oracle Internet Directory for Oracle Identity Manager. For information about how to perform these configuration steps, see Setting Up LDAP Synchronization in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management. After installing Oracle Identity Manager with LDAP enabled, you must open the following scheduled jobs and update their Last Change Number parameter with the last changelog number value of Oracle Internet Directory: ■ LDAP User Create and Update Reconciliation ■ LDAP User Delete Reconciliation ■ LDAP Role Membership Reconciliation ■ LDAP Role Hierarchy Reconciliation ■ LDAP Role Create and Update Reconciliation ■ LDAP Role Delete Reconciliation In addition, you must enable these scheduled jobs after updating the Last Change Number parameter. To do so, see Disabling and Enabling Jobs in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager.

4.3.2 Provisioning Data From Oracle Identity Manager to LDAP Identity Store

Oracle Identity Manager database stores the user and role information. When the user and role information is updated in Oracle Identity Manager, then the external repositories, such as the LDAP directory, must also be updated. The LDAP changes are performed before Oracle Identity Manager changes. If Oracle Identity Manager changes fail, then the LDAP changes must be reverted to the original state. This is achieved by correcting an enable operation with a disable operation, a create operation with a delete operation, and a modification operation with another modification operation with the original values. For instance, when a user is created, the validation processes are performed in the validation stage, such as password or any other policy validation. In the preprocessing stage, the user is created in LDAP first. Then, in the action stage, the user is to be created in Oracle Identity Manager. If there is an error in creating the user in Oracle Identity Manager, then the user must be deleted from LDAP because the corresponding user could not be created in Oracle Identity Manager. The operation to revert the change made is provided by the kernel handlers through the compensation method, which is predefined in Oracle Identity Manager. See Also: Managing Scheduled Tasks for detailed information about scheduled jobs in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager.