Provisioning Status Transitions Understanding User Provisioning Statuses

12-16 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

12.6.4 User Provisioning from an External Source

The majority of deployments are expected to provision users from an external source, such a third-party enterprise user repository. In these types of deployments, the third-party repository bootstraps Oracle Internet Directory. Oracle Directory Integration Platform will provide ongoing synchronization between Oracle Internet Directory and the third-party repository. Example of third-party user repositories include Oracle Human Resources and LDAP directories such as Microsoft Active Directory, Oracle Directory Server Enterprise Edition previously Sun Java System Directory Server, Novell eDirectory, IBM Tivoli Directory Server, and OpenLDAP. The Oracle Directory Synchronization Service will create the user entry in Oracle Internet Directory. Because the information coming from the external source may not be sufficient to provision the user in various applications, the application defaults will be used to create the application information. User creation by the Oracle Directory Synchronization Service occurs as follows: 1. The Oracle Directory Synchronization Service evaluates the provisioning policies specified by the applications to determine whether the user should be provisioned in the application. 2. The Oracle Directory Synchronization Service evaluates any other plug-ins that the application has registered. 3. The Oracle Directory Integration Platform Service invokes the PLSQL plug-in or the Data Access Java plug-in to deliver the user information to the application. 4. The provisioning status of the user is returned by the application using the event interfaces. 5. The Oracle Directory Integration Platform Service updates the provisioning status of the user for the application. 12.7 How Are Administrative Privileges Delegated? Administrative rights in Oracle Delegated Administration Services vary according to the privileges delegated to each administrator. An administrator can be granted rights Table 12–3 Provisioning Profile Fields Field Name Description Profile Name The name of the profile you are editing. You cannot edit a profile name after it is created. This field is provided only to identify the profile you are editing. Application Name The name of the application the provisioning profile applies to. Profile Version The version of the provisioning profile. Application to OID Options to set the provisioning profile as Configured and Enabled in the Application to Oracle Internet Directory relationship. OID to Application Options to set the provisioning profile as Configured and Enabled in the Oracle Internet Directory to Application relationship. Scheduled Interval HH:MM:SS Specifies the number of hours, minutes, and seconds between provisioning attempts between a connected directory and Oracle Internet Directory. Last Execution Shows the status SuccessFailed and execution time of the last provisioning attempt. Understanding the Oracle Directory Integration Platform for Provisioning 12-17 to manage and provision users, manage applications, or any combination of these privileges, as described in the following scenarios: ■ Provisioning Administration Model ■ Oracle Delegated Administration Services Privileges ■ Provisioning Administration Privileges ■ Application Administration Privileges ■ Oracle Delegated Administration Services and Provisioning Administration Privileges ■ Application Administration and Oracle Delegated Administration Services Privileges ■ Provisioning and Application Administration Privileges ■ Oracle Delegated Administration Services, Provisioning, and Application Administration Privileges

12.7.1 Provisioning Administration Model

The following types of provisioning information is managed in Oracle Internet Directory: ■ Base user information. ■ Application-specific information. ■ User provisioning status in each provisioning-integrated application; this information is stored in the base user entry but is administered separately. Administrators and users each require the following types of privileges: ■ Administrators require privileges for managing base user attributes and application-specific information. ■ Users require privileges for managing their own base attributes and application-specific information. User accounts with administrative privileges are represented by the group entry cn=User Provisioning Admins,cn=Groups,cn=OracleContext. To manage application-specific information, the application must grant privileges to the cn=User Provisioning Admins,cn=Groups,cn=OracleContext group. If an application already defines a group with administrative privileges, then the application needs to add this group as a member of the group.

12.7.2 Oracle Delegated Administration Services Privileges

For administrators with privileges for Oracle Delegated Administration Services administration, Create, Delete, and Edit buttons are available in the Provisioning Console for performing user creation, deletion, and modification. When an administrator who only has administrative rights for Oracle Delegated Administration Services clicks one of these buttons, single-step procedures are used for performing the function. Note: Oracle Directory Integration Platform 11g Release 1 11.1.1 interoperates with and supports Oracle Delegated Administration Services release 10.1.4.3.0 and higher.