Asynchronous Provisioning Understanding Provisioning Concepts

12-8 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

12.4.4.2 Arguments for provProfileBulkProv

-h | -host Oracle WebLogic Server host where Oracle Directory Integration Platform is deployed. -p | -port Listening port of the Oracle WebLogic Managed Server where Oracle Directory Integration Platform is deployed. -D | -wlsuser Oracle WebLogic Server login ID -f | -file LDIF file containing the data to be migrated. -realm The realm in which the users are to be provisioned. -ssl Executes the command in SSL mode. -keystorePath The full path to the keystore. -keystoreType The type of the keystore identified by -keystorePath. For example: -keystorePath jks or -keystorePath PKCS12 -encoding Input file encoding. -help Provides command usage help. Note: You will be prompted for the Oracle WebLogic Server login password. You cannot provide the password as a command-line argument. Best security practice is to provide a password only in response to a prompt from the command. If you must execute provProfileBulkProv from a script, you can redirect input from a file containing the Oracle WebLogic Server login password. Use file permissions to protect the file and delete it when it is no longer necessary. Note: The Oracle WebLogic Managed Server where Oracle Directory Integration Platform is deployed must be configured for SSL to execute this command in SSL mode. Refer to the Configuring SSL chapter in Oracle Fusion Middleware Securing Oracle WebLogic Server for more information. Understanding the Oracle Directory Integration Platform for Provisioning 12-9

12.4.4.3 Tasks and Examples for provProfileBulkProv

provProfileBulkprov -h myhost.mycompany.com -p 7005 -D login_ID \ -f optldapodipusers.ldif -realm cn=aaaa,ou=bbbb,dc=cccc

12.4.5 On-Demand Provisioning

On-demand provisioning occurs when a user accesses an application and the application has no knowledge of the user in its repository. The application determines whether to provision a user account based on its default provisioning policies. After provisioning a user account in its repository, an application will update the provisioning status of the user entry in Oracle Internet Directory.

12.4.6 Application Bootstrapping

The Oracle Directory Integration Platform Service notifies newly registered applications of all existing user entries in Oracle Internet Directory and attempts to provision each existing user entry as if they were a new user in the application.

12.5 Organization of User Profiles in Oracle Internet Directory

This section discusses the organization of user profiles in Oracle Internet Directory. It contains these topics: ■ Organization of Provisioning Entries in the Directory Information Tree ■ Understanding User Provisioning Statuses

12.5.1 Organization of Provisioning Entries in the Directory Information Tree

The Oracle Directory Integration Platform Provisioning relies on user profiles in the directory information tree DIT that consist of attributes containing personal information and preferences for the various applications in which the user is provisioned. These user attributes for the Oracle Directory Integration Platform Service can be categorized as follows: ■ Base attributes that are available for every user entry ■ Application-specific attributes that are only available if a user is provisioned in an application Base user attributes primarily belong to standard LDAP object classes such as organizationalPerson and inetOrgPerson, and consist of personal details that include first name, last name, given name, e-mail address, and telephone numbers. Base user attributes also consist of Oracle application-specific attributes that belong to the orclUserV2 auxilliary class. Oracle Internet Directory is the primary repository for both base attributes and application-specific attributes. Both types of attributes are stored in each user’s profile. However, an application can cache user attributes that are updated with the provisioning event notification service. As shown in Figure 12–4 , user attributes are stored in two locations within the DIT. Base user entries, which include attributes belonging to inetorgperson and orcluserv2, are stored under cn=users,Realm DN. The provisioning status of each user entry is also stored in the base user entry. Application-specific attributes reside in separate entries in the application container. The LDAP schema relating to the application-specific attribute definitions and the object classes are created during the