Customizing ACLs for Import Profiles

Configuring Synchronization with a Third-Party Directory 17-13

17.3.5 Enabling Password Synchronization from Oracle Internet Directory to a Third-Party Directory

To synchronize passwords from Oracle Internet Directory to a third-party directory, you must enable the password policy and you may have to enable reversible password encryption in the Oracle Internet Directory server. Enable reversible password encryption in the Oracle Internet Directory server only if the hashing algorithm between Oracle Internet Directory and the third-party directory is incompatible or unsupported. For example, IBM Tivoli Directory Server and Oracle Directory Server Enterprise Edition previously Sun Java System Directory Server support similar hashing algorithms as Oracle Internet Directory. Therefore, to synchronize passwords from Oracle Internet Directory to IBM Tivoli Directory Server or Oracle Directory Server Enterprise Edition, you must enable only the password policy in the Oracle Internet Directory server. However, to synchronize passwords from Oracle Internet Directory to Microsoft Active Directory or Novell eDirectory, which both do not support similar hashing algorithms as Oracle Internet Directory, you must enable the password policy and reversible password encryption in the Oracle Internet Directory server. To enable the password policy, assign a value of 1 to the orclPwdPolicyEnable attribute in the appropriate container. To enable reversible password encryption in the Oracle Internet Directory server, assign a value of 1 to the orclpwdEncryptionEnable attribute in the appropriate container. For example, to enable the password policy and reversible password encryption on the default policy for a realm, assign a value of 1 to the orclPwdPolicyEnable and orclpwdEncryptionEnable attributes in the following entry: cn=default,cn=PwdPolicyEntry,cn=common,cn=products,cn=oraclecontext,Realm_DN You can do this by using ldapmodify and uploading an LDIF file containing the following entries: dn: cn=default,cn=PwdPolicyEntry,cn=common,cn=products,cn=oraclecontext,Realm_DN changetype: modify replace: orclpwdpolicyenable orclpwdpolicyenable: 1 - replace: orclpwdencryptionenable orclpwdencryptionenable: 1 See Also: Managing the SSL Certificates of Oracle Internet Directory and Connected Directories on page 4-14 Note: As of Oracle Internet Directory 10g 10.1.4.0.1, Oracle Internet Directory supports multiple password policies in each realm, commonly known as Fine-Grained Password Policies. Refer to the Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory for more information about Fine-Grained Password Policies. 17-14 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

17.3.6 Configuring External Authentication Plug-ins

Oracle Directory Integration Platform supports Java-based external authentication plug-ins. Oracle recommends that you use the Java plug-ins instead of the older, PLSQL-based plug-ins, which only support Microsoft Active Directory and Oracle Directory Server Enterprise Edition Sun Java System Directory Server. The configuration tool for the plug-ins is a Java program called oidexcfg. You use it to configure Java-based external authentication plug-ins for Microsoft Active Directory, Oracle Directory Server Enterprise Edition Sun Java System Directory Server, Novell eDirectory, IBM Tivoli Directory Server, and OpenLDAP. To configure an external authentication plug-in, perform the following steps: 1. Optional Perform this step only if you want to use SSL to secure the communication between the authentication plug-in and the external LDAP directory. If you do not want to secure the communication, proceed to step 2 now. To secure the communication between the authentication plug-in and the external LDAP directory using SSL, a trusted certificate from the external, authenticating directory must reside in a wallet on the file system. When you configure the plug-in using oidexcfg in step 3, you will be prompted to enter information about the external LDAP directory configuration and you can identify the location of this wallet. If you want to use SSL, put the certificate in a new or existing wallet now. 2. Include oidexcfg.jar and ldapjclnt11.jar in the java CLASSPATH environment variable. To set the environment variable: In UNIXLinux environments: setenv CLASSPATH=ORACLE_HOMEjliboidexcfg.jar:ORACLE_ HOME ldapjlibldapjclnt11.jar:CLASSPATH In Windows environments: set CLASSPATH=ORACLE_HOMEjliboidexcfg.jar;ORACLE_ HOME ldapjlibldapjclnt11.jar;CLASSPATH 3. Configure the plug-in using oidexcfg by executing the following command. You will be prompted to enter information about the external LDAP directory See Also: Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory for information on managing Oracle Internet Directory password policies. Note: The oidexcfg tool configures an external authentication plug-in to work only with a single domain. You must perform the steps described in Configuring External Authentication Against Multiple Domains to set up an external authentication plug-in to work with multiple domains. Note: The certificate enables SSL to secure the communication between the authentication plug-in and the external LDAP directory—it does not secure the communication with Oracle Internet Directory when you execute oidexcfg in step 3.