Preliminary Considerations for Integrating with a Third-Party Directory

Third-Party Directory Integration Concepts and Considerations 16-13 Figure 16–4 Interaction of Components with a Third-Party Directory as the Central Enterprise Directory

16.2.2.2.1 Process for Provisioning of a User or Group As

Figure 16–4 shows, when a third-party directory is the central enterprise directory, typical provisioning of a user or group follows this process:

1. The user or group entry is created in the third-party directory.

2. At the next scheduled interval, the entry creation event is read by the third-party

directory connector in Oracle Directory Integration Platform.

3. Following the mapping information in the integration profile, the user or group

attributes in the third-party directory are mapped to the corresponding attributes in Oracle Internet Directory.

4. The user or group entry is created in Oracle Internet Directory.

16.2.2.2.2 Process for Modifying a User or Group Entry An entry is modified in the

third-party directory when: ■ A new attribute gets added to the entry. ■ The value of an existing attribute is modified. ■ An existing attribute is deleted. When a third-party directory is the central enterprise directory, modification of a user or group entry follows this process:

1. The entry is modified in the third-party directory.

2. At the next scheduled interval, that entry modification event is read by the

third-party directory connector in Oracle Directory Integration Platform.

3. Following the mapping information in the integration profile, the attribute in the

third-party directory is appropriately mapped to the corresponding attribute in Oracle Internet Directory.

4. The user or group entry is modified in Oracle Internet Directory.

As Figure 16–4 shows, when a third-party directory is the central enterprise directory, modification of passwords happens asynchronously in the directory that serves as the password repository. This happens by using plug-ins. Oracle Internet Directory Password Plug-in for External Authentication Third-Party Directory Oracle Directory Integration Platform Third-Party Directory Connector 3 1 User Administration Sync 2 4 Sync 16-14 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

16.2.3 Customizing the LDAP Schema

Customizing the LDAP schema is required if: ■ A directory deployment contains schema extensions such as custom object classes and attributes ■ The custom attributes must be synchronized from one directory server to the other To customize the LDAP schema, you must: ■ Identify the schema extensions on the source directory ■ Create those extensions on the target directory before starting the data migration and the synchronization

16.2.4 Choose Where to Store Passwords

Regardless of which directory is the central enterprise directory, the password can be stored in one or both directories. There are advantages and disadvantages to each option. This section compares the two options in these topics: ■ Advantages and Disadvantages of Storing the Password in One Directory ■ Advantages and Disadvantages of Storing Passwords in Both Directories

16.2.4.1 Advantages and Disadvantages of Storing the Password in One Directory

Storing the password in one directory can make the password more secure because it reduces the number of points of entry. Further, it eliminates synchronization issues when the password is modified. On the other hand, storing the password in one directory provides a single point of failure for the entire network. If third-party directory fails, then even though user footprints are available in Oracle Internet Directory, users cannot access Oracle components. Although storing passwords in the central directory eliminates possible synchronization issues, it requires you to enable applications to authenticate users to that directory. This involves using the appropriate plug-ins. For example, if you are using Microsoft Active Directory as both the central enterprise directory and the central password store, then you must enable applications to authenticate users to Microsoft Active Directory. You do this by using an external authentication plug-in. Note: In addition to creating schema extensions, you must also add the attribute to be synchronized with the corresponding object classes to the mapping rules. See Also: ■ The chapter on administering the schema in Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory for instructions on customizing the schema in Oracle Internet Directory ■ Microsoft documentation available at http:msdn.microsoft.com for instructions on customizing the schema in Microsoft Active Directory