Criticality Understanding Routing Settings

3-10 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory

3.2.9 Views

Views allow applications to see different information in Oracle Virtual Directory. Views are defined by the distinguished names DN and IP addresses configured for the View. If an Adapter is enabled for a View, then only the DNs or IP Addresses configured in the View may see data from that Adapter. An Adapter can be enabled for one or more Views. A user that is a member of a View can only see information from Adapters that are enabled to the same View. To enable an Adapter for a View, in the Views section on the adapter’s Routing tab, select the Enable option for the appropriate View. If an Adapter is not enabled for a View, it is part of the default View. Any client not assigned to a View may see any Adapter that is part of the default View.

3.2.9.1 Creating and Configuring Views

Perform the following steps to create and configure a View: 1. Log in to Oracle Directory Services Manager.

2. Select Advanced from the task selection bar. The Advanced navigation tree

appears.

3. Expand the Server Views entry in the tree. The list of existing Views appear.

To create a View: a. Click the Add New View button. The Add New View dialog box appears. b. Enter a name for the View in the View Name field and click the OK button to create the new View. The new View appears in the list of existing Views. Perform the following steps to configure a View. To configure a View: a. Click the name of the View to configure in the list of existing Views. A screen appears where you can configure the DNs and IP Addresses for the View. To add a DN or IP address to the View, click the create button in the appropriate field, enter a value, and click the Apply button. To delete a DN or IP address from the View, select the value you want to delete and click the Delete button.

3.2.10 Include Binds From and Exclude Binds From

The Include Binds From and Exclude Binds From settings allow the administrator to indicate adapters which can share each others credentials. The Include Binds From and Exclude Binds From settings also help the adapter determine whether the user credentials or the adapters proxy account should be passed through on an operation. For example, consider different LDAP Adapters proxying two different domain controllers within a Microsoft Active Directory forest. To Oracle Virtual Directory, a user credential from one domain does not appear to be part of another domain. Also, because both domains are from the same forest, you know that the second domain can in fact accept a credential from another domain. The Include Binds From and Exclude Binds From settings allow the administrator to instruct Oracle Virtual Directory on how to handle these situations. When deciding whether a user credential can be passed through, Oracle Virtual Directory considers the following two conditions: ■ whether the supplied credentials are under the current adapter root Understanding Oracle Virtual Directory Routing 3-11 ■ whether the user credentials map under an adapter listed in the Include Binds From field, and also, whether the user credential maps under an excluded adapter listed in the Exclude Binds From field. Consider the following example with adapter root ou=admin,o=depts,dc=oracle,dc=com. A user credential may either:

1. Case A

: Map within the namespace of ou=admin,o=depts,dc=oracle,dc=com

2. Case B

: Not map within the namespace of ou=admin,o=depts,dc=oracle, dc=com for example, the credential has DN ends with ou=sales,o=depts, dc=oracle,dc=com. Case A User credential ends with ou=admin,o=depts,dc=oracle,dc=com: If the Exclude Binds From field is not empty, then the users credential must be checked to see if they are a child of an excluded adapter. If it is, then the Proxy credential must be used instead of passing through the clients credential. If the users credential does not belong to an excluded adapter, then the users credential may be passed through the current adapter. This scenario most often occurs when two LDAP Adapters are defined where the second adapter is a child of the first or parent adapter. A credential that is part of the child adapter could also erroneously be considered to be part of the parent adapter. Using the Exclude Binds From setting helps correct the problem where the credential from the child adapter would be incorrectly passed through to the parent adapter. Using the Exclude Binds From setting allows Oracle Virtual Directory to understand that certain child DNs do not map to the parent adapters credential set. Case B User credential ends with root different from ou=admin,o=depts, dc=oracle,dc=com: If the Include Binds From field is not empty, but has adapters defined as shared, the user credential must be checked to see if it maps to a shared adapter. If it does, the credential is mapped by the shared adapter and returned to the original adapter. The original adapter is then able to pass through the credential mapped by the shared adapter. If the credential does not map to the current adapter, or any of the shared adapters, then the proxy credential must be used rather than passing through the provided credential. An example of this is an Oracle Virtual Directory that proxies multiple Microsoft Active Directory domains. User credentials may have different roots, but since all proxies go to the same forest, it is possible that one domain controller can authenticate a DN from another domain controller. In this situation, credentials from either adapter can be shared in common across both adapters. For example, Domain A adapter proxies Domain A, Domain B adapter proxies Domain B. Domain A and B are in the same forest. Therefore, on both the Domain A and Domain B adapter, you can set the Include Binds From setting to Domain A, Domain B and both adapters are able to pass through each-others credentials.