Application Administration and Oracle Delegated Administration Services Privileges

13-2 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

13.2 Managing Provisioning Profiles Using oidprovtool

Provisioning enables you to ensure that an application is notified of directory changes, such as changes to user or group information. Such changes can affect whether the application allows a user access to its processes and resources. When you install an application that you want to provision, you must create a provisioning integration profile using the oidprovtool command located in the ORACLE_HOMEbin directory. You can use the oidprovtool to: ■ Create a new provisioning profile. A new provisioning profile is created and set to the enabled state so that Oracle Directory Integration Platform can process it. ■ Disable an existing provisioning profile. ■ Enable a disabled provisioning profile. ■ Modify an existing provisioning profile. ■ Delete an existing provisioning profile. ■ Get the current status of a given provisioning profile. ■ Clear all of the errors in an existing provisioning profile. The oidprovtool utility shields the location and schema details of the provisioning profile entries from the callers of the tool. From the callers perspective, the combination of an application and a realm uniquely identify a provisioning profile. The constraint in the system is that there can be only one provisioning profile for each application for each realm. Once a profile is created, its mode—that is, INBOUND, OUTBOUND, or BOTH—cannot be changed by using the modify operation. To change the mode, you must delete, then re-create, the profile. The Oracle directory integration platform server automatically monitors provisioning profile configuration changes in Oracle Internet Directory, including the creation, modification, and deletion of provisioning profiles. For this reason, you do not need to manually enable or disable a provisioning profile.

13.2.1 Syntax for oidprovtool

oidprovtool oidprovtool operation=[create|modify] ldap_host=oid_hostname ldap_port=port ldap_user_dn=bindDN ldap_user_password=password [profile_mode=INBOUND|OUTBOUND|BOTH] application_dn=DN application_type=type [application_name=name] [application_display_name=display name] organization_dn=DN [application_isdasvisible=TRUE|FALSE] [manage_application_defaults=TRUE|FALSE] [enable_bootstrap=TRUE|FALSE] [user_data_location=DN] [default_provisioning_policy=PROVISIONING_REQUIRED|PROVISIONING_NOT_REQUIRED] See Also: The chapter on logging, auditing, and monitoring the directory in Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory Note: For improved security, do not enter a password with the oidprovtool command unless prompted for one. Deploying Provisioning-Integrated Applications 13-3 interface_name=SCHEMA.PACKAGE [interface_type=PLSQL|JAVA] interface_version=1.1|2.0|3.0] interface_connect_info=connection_string schedule=number_seconds lastchangenumber=number max_prov_failure_limit=number max_events_per_schedule=number max_events_per_invocation=number event_mapping_rules=OBJECT_TYPE:FILTER:DOMAIN event_permitted_operations=OBJECT:DOMAIN:OPERATIONattributes,... event_subscription=USER|GROUP:DOMAIN:OPERATIONattributes,... max_events_per_schedule=number max_retries=number profile_group=number profile_status=ENABLED | DISABLED profile_debug=debug_level oidprovtool {operation=enable|disable|delete|status|reset} application_dn=DN [organization_dn=DN] [ldap_host=oid_hostname] [ldap_port=port] [ldap_user_dn=bindDN] [ldap_user_password=password] [profile_debug=debug_level]

13.2.2 Arguments for oidprovtool

operation=create | modify | enable | disable | delete | status | reset Required. The operation to perform using oidprovtool. You can only perform one operation at a time. The operations are: ■ create—Creates a new provisioning profile. ■ modify—Modifies the given properties of an existing provisioning profile. ■ enable—Enables a provisioning profile. ■ disable—Disables a provisioning profile. ■ delete—Deletes a provisioning profile. ■ status—Shows the current status of a given provisioning profile. ■ reset—Clears all errors for a provisioning profile. ldap_host=oid_hostname Optional. The host name of the Oracle Internet Directory server. If not provided then the name of the local host is used. ldap_port=port Optional. The LDAP listening port of Oracle Internet Directory. The default is 389. ldap_user_dn=bindDN Required. The DN of the superuser or a user that has sufficient permissions to perform provisioning subscription operations. The default is cn=orcladmin. ldap_user_password=password Optional.The user password used to bind to the directory. If you do not specify the password on the command line, you will be prompted for it. Best security practice is to provide the password in response to a prompt. profile_mode=OUTBOUND | INBOUND | BOTH Optional for the create operation only. The direction of the provisioning events. The default is OUTBOUND data is provisioned from Oracle Internet Directory to the application.