Configuring Oracle Virtual Directory for Oracle Access Manager

19-4 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory Perform the following steps to prepare Oracle Virtual Directory for integration with with Enterprise User Security: 1. Create a back-up copy of the ORACLE_HOMEovdeus directory. All the configuration files required for the Enterprise User Security integration are in the eus directory. Making a back-up copy of the eus directory enables you to edit the template-like files in the original eus directory based on your environment, and still keep copies of the original files. 2. If one does not already exist, create an LDAP listener that is secured with SSL No Authentication Mode by referring to Chapter 11, Creating and Managing Oracle Virtual Directory Listeners. 3. Create and add the subschemasubentry and Dynamic Groups plug-ins as global server plug-ins. Refer to Managing Global Server Plug-ins on page 13-4 for steps on creating server plug-ins.

19.2.2 Integrating Oracle Virtual Directory with External Directories

This section contains instructions for integrating Oracle Virtual Directory with Enterprise User Security for use with specific external directories. Perform the steps in the appropriate section that are specific to the external directory in which you are storing your user identities. This sections contains the following sections: ■ User Identities in Microsoft Active Directory ■ User Identities in Microsoft Active Directory and Metadata in Oracle Internet Directory ■ User Identities in Oracle Directory Server Enterprise Edition ■ User Identities in Novell eDirectory ■ User Identities in Oracle Internet Directory

19.2.2.1 User Identities in Microsoft Active Directory

Perform the following procedures to integrate Oracle Virtual Directory with Enterprise User Security for user identities stored in Active Directory: ■ Configuring Active Directory for the Integration ■ Configuring Oracle Virtual Directory for the Integration

19.2.2.1.1 Configuring Active Directory for the Integration Perform the following steps to

configure Active Directory for the integration: Important: The steps for integrating Oracle Virtual Directory with Enterprise User Security from this point forward differ depending on which external directory you are storing your user identities in. Continue the integration with Enterprise User Security by referring to Integrating Oracle Virtual Directory with External Directories . Note: If you are using Kerberos authentication in the integration, do not perform steps 3 and 4 in the following procedure. Configuring Oracle Virtual Directory for Integrated Directory Solutions 19-5 1. Make a back-up copy of your Active Directory image. The schema extensions inside of Active Directory are permanent and cannot be canceled. The back-up image enables you to restore all your changes if required. 2. Load the Enterprise User Security required schema, extendAD, into Active Directory using the Java classes included in Oracle Virtual Directory by executing the following command. The extendAD file is located in the ORACLE_ HOME ovdeus directory. You can use the java executable in the ORACLE_ HOME jdkbin directory. java extendAD -h Active_Directory_Host_Name -p Active_Directory_Port -D Active_Directory_Admin_DN -w Active_Directory_Admin_Password –AD Active_Directory_Domain_DN 3. Install the Oracle Internet Directory Password Change Notification plug-in, oidpwdcn.dll, by performing the following steps: a. Copy the ORACLE_HOMEovdeusoidpwdcn.dll file to the Active Directory WINDOWS\system32 directory. b. Use regedt32 to edit the registry and enable the oidpwdcn.dll. Start regedt32 by entering regedt32 at the command prompt.

c. Add oidpwdcn to the end of the Notification Packages entry in the HKEY_

LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ registry, for example: RASSFM KDCSVC WDIGEST scecli oidpwdcn d. Restart the Active Directory system after making these changes. 4. Verify the Oracle Internet Directory Password Change Notification plug-in by performing the following steps: a. Change the password of an Active Directory user. b. Search Active Directory for the user you changed the password for. Verify the orclCommonAttribute attribute contains the generated hash password value. This value adds the orclCommonAttribute attribute definition in Active Directory. c. Reset the password for all the Active Directory users, allowing the plug-in to acquire the password changes and generate and store password verifiers. 5. If you are using Kerberos authentication on Windows 2000 or Windows 2003 with Oracle Database Advanced Security, you must configure it now by referring to the Oracle Database Advanced Security Administrators Guide. After you configure the Kerberos authentication, make sure you can log in to the database using your Active Directory user credential before proceeding to the next steps. Note: An example of a valid Active Directory domain DN is: dc=oracle,dc=com