Create an Oracle Wallet by executing the following command: Export the Oracle Virtual Directory server certificate by executing the following

Configuring High Availability for Identity Management Components 8-67 ORACLE_INSTANCE binopmnctl start if OPMN is not running ORACLE_INSTANCE binopmnctl startproc ias-component=ovd1 For more information about the ldapbind command, see the ldapbind section in Oracle Fusion Middleware Reference for Oracle Identity Management.

8.4.4.1 Validating Oracle Virtual Directory High Availability Using SSL

Oracle Virtual Directory is configured to use the SSL Server Authentication Only Mode by default. When using command line tools like ldapbind to validate a connection using connection secured by SSL Server Authentication mode, the server certificate must be stored in an Oracle Wallet. Follow the steps below to perform this task:

1. Create an Oracle Wallet by executing the following command:

ORACLE_HOME binorapki wallet create -wallet DIRECTORY_FOR_SSL_WALLET -pwd WALLET_PASSWORD

2. Export the Oracle Virtual Directory server certificate by executing the following

command: ORACLE_HOME jdkjrebinkeytool -exportcert -keystore OVD_KEYSTORE_FILE -storepass PASSWORD -alias OVD_SERVER_CERT_ALIAS -rfc -file OVD_SERVER_CERT_FILE 3. Add the Oracle Virtual Directory server certificate to the Oracle Wallet by executing the following command: ORACLE_HOME binorapki wallet add -wallet DIRECTORY_FOR_SSL_WALLET -trusted_cert -cert OVD_SERVER_CERT_FILE -pwd WALLET_PASSWORD 4. Follow the instructions shown in Section 8.4.4, Validating Oracle Virtual Directory High Availability but use the ldapbind command shown below to validate the high availability setup of Oracle Virtual Directory on OVDHOST1 and OVDHOST2. Use the Oracle Wallet from step 3 while executing the following command: ORACLE_HOME binldapbind -D cn=orcladmin -q -U 2 -h HOST -p SSL_PORT -W file:DIRECTORY_FOR_SSL_WALLET -q 5. When an Oracle Virtual Directory high availability deployment is front ended by a hardware load balancer, the wallets on all the Oracle Virtual Directory nodes must contain the client certificates of all the Oracle Virtual Directory instances that are a part of that topology. Add the client certificates of all the Oracle Virtual Directory instances in the topology to the wallets on all the nodes in the topology. This ensures that a valid connection request made through the load balancer URL does not fail. Note: If you are using default settings after installing 11g Release 1 11.1.1, you can use the following values for the variables described in this section: ■ For OVD_KEYSTORE_FILE, use: ORACLE_INSTANCE configOVDovd1keystoreskeys.jks ■ For OVD_SERVER_CERT_ALIAS, use serverselfsigned ■ For PASSWORD used for the -storepass option, use the orcladmin account password. 8-68 Oracle Fusion Middleware High Availability Guide

8.4.5 Oracle Virtual Directory Failover and Expected Behavior