Provisioning Data Flow Understanding Provisioning Concepts

Understanding the Oracle Directory Integration Platform for Provisioning 12-9

12.4.4.3 Tasks and Examples for provProfileBulkProv

provProfileBulkprov -h myhost.mycompany.com -p 7005 -D login_ID \ -f optldapodipusers.ldif -realm cn=aaaa,ou=bbbb,dc=cccc

12.4.5 On-Demand Provisioning

On-demand provisioning occurs when a user accesses an application and the application has no knowledge of the user in its repository. The application determines whether to provision a user account based on its default provisioning policies. After provisioning a user account in its repository, an application will update the provisioning status of the user entry in Oracle Internet Directory.

12.4.6 Application Bootstrapping

The Oracle Directory Integration Platform Service notifies newly registered applications of all existing user entries in Oracle Internet Directory and attempts to provision each existing user entry as if they were a new user in the application.

12.5 Organization of User Profiles in Oracle Internet Directory

This section discusses the organization of user profiles in Oracle Internet Directory. It contains these topics: ■ Organization of Provisioning Entries in the Directory Information Tree ■ Understanding User Provisioning Statuses

12.5.1 Organization of Provisioning Entries in the Directory Information Tree

The Oracle Directory Integration Platform Provisioning relies on user profiles in the directory information tree DIT that consist of attributes containing personal information and preferences for the various applications in which the user is provisioned. These user attributes for the Oracle Directory Integration Platform Service can be categorized as follows: ■ Base attributes that are available for every user entry ■ Application-specific attributes that are only available if a user is provisioned in an application Base user attributes primarily belong to standard LDAP object classes such as organizationalPerson and inetOrgPerson, and consist of personal details that include first name, last name, given name, e-mail address, and telephone numbers. Base user attributes also consist of Oracle application-specific attributes that belong to the orclUserV2 auxilliary class. Oracle Internet Directory is the primary repository for both base attributes and application-specific attributes. Both types of attributes are stored in each user’s profile. However, an application can cache user attributes that are updated with the provisioning event notification service. As shown in Figure 12–4 , user attributes are stored in two locations within the DIT. Base user entries, which include attributes belonging to inetorgperson and orcluserv2, are stored under cn=users,Realm DN. The provisioning status of each user entry is also stored in the base user entry. Application-specific attributes reside in separate entries in the application container. The LDAP schema relating to the application-specific attribute definitions and the object classes are created during the 12-10 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform installation or upgrade process. Application-specific attributes are qualified by an auxiliary object class, which will enable searching for the application-specific user properties of the entry. By default, application-specific entries are stored as orclOwnerGUID=GUID of the Base User under the cn=User Properties, cn=Application Type, cn=Products,cn=OracleContext, Realm DN container. Some applications manage their own application attributes and implement the Data Access Java plug-in, which is described in Understanding Provisioning Concepts on page 12-3. The Oracle Directory Integration Platform Service invokes this plug-in whenever the base user attributes or application-specific attributes are modified. Figure 12–4 Base User and Application-Specific Attributes

12.5.2 Understanding User Provisioning Statuses

This section discusses the user provisioning statuses in Oracle Internet Directory. It contains these topics: ■ Provisioning Status in Oracle Internet Directory ■ Provisioning Status Transitions ■ Upgrading and Coexistence Provisioning Statuses ■ Provisioning Statuses and Exception Handling

12.5.2.1 Provisioning Status in Oracle Internet Directory

The Oracle Provisioning Service records a user’s provisioning status in Oracle Internet Directory for each provisioning-integrated application. Provisioning status can be set by the Oracle Directory Integration Platform, with bulk provisioning using the provProfileBulkProv command, or by a provisioning-integrated application. Table 12–1 lists the provisioning statuses. dc=MyCompany cn=OracleContext Root dc=com cn= user2 cn= user1 cn=Users dc=us cn=Products orclOwnerGUID =user1GUID cn=user properties cn=Application1 orclOwnerGUID =user2GUID orclOwnerGUID =user1GUID cn=user properties cn=Application2 cn=Application3 Managed by the Data Access Java Plug-in Attributes in the base user entry will include the users status in provisioning-integrated applications Identity Management Realm