Creating Access Control Lists in Non-Oracle Internet Directory Directories

Preparing Identity and Policy Stores 10-17 SystemIDBase subtreeACI: grant:s,r,w,o,c,m[all]authzID-dn:s_NamingAttr=s_UserName,s_ SystemIDBase For example: dn: dc=mycompany,dc=com changetype: modify add: subtreeACI subtreeACI: grant:b,t,a,d,n[entry]authzID-dn:cn=oimLDAP,cn=systemids,dc=mycompany,dc=com subtreeACI: grant:s,r,w,o,c,m[all]authzID-dn:cn=oimLDAP,cn=systemids,dc=mycompany,dc=com dn: cn=changelog changetype: modify add: subtreeACI subtreeACI: grant:b,t,a,d,n[entry]authzID-dn:cn=oimLDAP,cn=systemids,dc=mycompany,dc=com subtreeACI: grant:s,r,w,o,c,m[all]authzID-dn:cn=oimLDAP,cn=systemids,dc=mycompany,dc=com Once you have created the file, load it into Oracle Virtual Directory using the command: ldapmodify -h ovdhost1.mycompany.com -p 389 -D cn=orcladmin -q -f filename.ldif ldapmodify -h ovdhost2.mycompany.com -p 389 -D cn=orcladmin -q -f filename.ldif

10.4.8 Creating Access Control Lists in Non-Oracle Internet Directory Directories

In the preceding sections, you seeded the Identity Store with users and artifacts for the Oracle components. If your Identity Store is hosted in a non-Oracle Internet Directory directory, such as Microsoft Active Directory or Oracle Directory Server Enterprise Edition, you must set up the access control information ACIs to provide appropriate privileges to the entities you created. This section lists the artifacts created and the privileges required for the artifacts. ■ Systemids. The System ID container is created for storing all the system identifiers. If there is another container in which the users are to be created, that is specified as part of the admin. ■ Oracle Access Manager Admin User. This user is added to the OAM Administrator group, which provides permission for the administration of the OAM console. No LDAP schema level privileges are required, since this is just an application user. ■ Oracle Access Manager Software User. This user is added to the groups where the user gets read privileges to the container. This is also provided with schema admin privileges. ■ Oracle Identity Manager user oimLDAP under System ID container. Password policies are set accordingly in the container. The passwords for the users in the System ID container must be set up so that they do not expire. Note: If you get the error: LDAP Error 32 : No Such Object verify the DN. If the DN is correct, you can ignore the error. 10-18 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management ■ Oracle Identity Manager administration group. The Oracle Identity Manager user is added as its member. The Oracle Identity Manager admin group is given complete readwrite privileges to all the user and group entities in the directory. ■ WebLogic Administrator. This is the administrator of the IDM domain for Oracle Virtual Directory ■ WebLogic Administrator Group. The WebLogic administrator is added as a member. This is the administrator group of the IDM domain for Oracle Virtual Directory. ■ Reserve container. Permissions are provided to the Oracle Identity Manager admin group to perform readwrite operations.

10.4.9 Updating Oracle Virtual Directory Adapters