Directory Synchronization Profiles Components Involved in Oracle Directory Synchronization

6 Configuring Directory Synchronization 6-1 6 Configuring Directory Synchronization This chapter explains how to configure directory synchronization and how to format mapping rules. It contains these topics: ■ Registering Connectors in Oracle Directory Integration Platform ■ Synchronization Profile Templates ■ Configuring Connection Details ■ Configuring Mapping Rules ■ Extending Mappings Using Custom Plug-ins ■ Configuring Matching Filters ■ Location and Naming of Files

6.1 Registering Connectors in Oracle Directory Integration Platform

Before deploying a connector, you register it in Oracle Internet Directory. This registration involves creating a synchronization profile, which is stored as an entry in the directory. Refer to Creating Synchronization Profiles on page 7-1 for information about creating a directory synchronization profile using Oracle Enterprise Manager Fusion Middleware Control. Attributes in a synchronization profile entry belong to the object class orclodiProfile. The only exception is the orclodiplastappliedchangenumber attribute, which belongs to the orclchangesubscriber object class. The 2.16.840.1.113894.7 object identifier prefix is assigned to platform-related classes and attributes. The various synchronization profile entries in the directory are created under the container cn=subscriber profile,cn=changelog subscriber,cn=oracle internet directory. For example, a connector called OracleHRAgent is stored in the directory as orclodipagentname=OracleHRAgent,cn=subscriber profile,cn=changelog subscriber,cn=oracle internet directory. See Also: Chapter 3, Administering Oracle Directory Integration Platform for information on using Oracle Enterprise Manager Fusion Middleware Control. See Also: Directory Synchronization Profiles on page 5-2 6-2 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

6.2 Synchronization Profile Templates

When you install Oracle Directory Integration Platform, template profiles are created for synchronization with the different directory types, including: ■ Microsoft Active Directory 2003 ■ Microsoft Active Directory Lightweight Directory Service AD LDS Version 1 previously known as Active Directory Application Mode or ADAM ■ IBM Tivoli Directory Server 6.2 ■ Sun Java System Directory Server 6.3 going forward, renamed to Oracle Directory Server Enterprise Edition ■ Oracle Directory Server Enterprise Edition 11.1.1.3 previously known as Sun Java System Directory Server ■ Novell eDirectory 8.8 ■ OpenLDAP-2.2 ■ LDIF files ■ Tagged files The property and mapping files used to create the template profiles are available in the ORACLE_HOMEldapodiconf directory.

6.3 Configuring Connection Details

You can configure the connection details for a third-party directory by creating or editing a synchronization profile using Oracle Enterprise Manager Fusion Middleware Control. To use one of the sample synchronization profiles that was creating during installation, be sure to specify the correct connection details. In addition to specifying the connection details, you must also ensure that the user account in the third-party directory has the necessary privileges to read user and group information. You can also create the profiles based on the template properties file provided during installation. If you are doing this, then you must specify the connection details in the odip.profile.condirurl, and odip.profile.condiraccount properties of the profile. You will be prompted for the password. In addition to specifying the connection details, you must also ensure that the user account in the third-party directory has the necessary privileges to read user and group information. Each third-party directory requires a different configuration for getting deleted entries. Refer to the third-party directorys documentation to set up the tombstone configuration and privileges required to read tombstone entries. For example, with Microsoft Active Directory, you must also ensure that the user account has the privileges to replicate directory changes for every domain of the forest monitored for changes. You can do this by one of the following methods: ■ Grant to this account Domain Administrative permissions ■ Make this account a member of the Domain Administrator’s group ■ Grant to this account Replicating Directory Changes permissions for every domain of the forest that is monitored for changes To grant this permission to a non-administrative user, follow the instructions in the More Information section of the Microsoft Help and Support article How to Grant