Add oidpwdcn to the end of the Notification Packages entry in the HKEY_

19-8 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory

a. Click the Advanced tab, click Active_Directory_to_inetOrg, and then click the

Apply button to deploy the mapping.

b. Click the Adapter tab, click the adapter for the Enterprise User Security

administrative group, click the Plug-ins tab, click the Create Mapping button, select ActiveDirectorytoinetOrg.py, enter a unique mapping name, and then click OK.

c. Click the Create Plugin button, click the Select button, select the

EUSMemberDNMapping plug-in, click OK, enter a unique plug-in name, create the localDomainDN and remoteDomainDN parameters, and then click OK . Where localDomainDN is the domain DN that you see from Oracle Virtual Directory and remoteDomainDN is the domain DN in your back-end directory. Note that the localDomainDN and remoteDomainDN may be different if you have DN mapping configured.

d. Click the Apply button.

10. Update the realm information with Root Oracle Context by performing the following steps: a. Edit the modifyRealm.ldif file to use your Active Directory domain name. If you use DN mappings between Oracle Virtual Directory and Active Directory, use the mapped DN in Oracle Virtual Directory. b. Update the realm information using the following command: ORACLE_HOME binldapmodify –h Oracle_Virtual_Directory_Host –p port \ -D bindDN -q –v –f modifyRealm.ldif The steps to configure Oracle Virtual Directory for integration with Enterprise Security and for use with Microsoft Active Directory are complete. Continue the integration process and configure Enterprise User Security by referring to the Oracle Database Enterprise User Administrators Guide.

19.2.2.2 User Identities in Microsoft Active Directory and Metadata in Oracle Internet Directory

Perform the following steps to integrate Oracle Virtual Directory with Enterprise User Security when user identities are stored in Active Directory and to store metadata in Oracle Internet Directory: Note: You may not see the group membership changes immediately after your changes in Active Directory. This is because of Active Directory’s group membership refresh interval configuration. Note: To update the Active Directory-Oracle Virtual Directory configuration, edit the modifyRealm.ldif file and execute ldapmodify with the updated modifyRealm.ldif file. Note: If you are using Kerberos authentication in the integration, do not perform steps 6 and 7 in the following procedure. Configuring Oracle Virtual Directory for Integrated Directory Solutions 19-9 1. Create a back-up copy of the ORACLE_HOMEovdeus directory. All the configuration files required for the Enterprise User Security integration are in the eus directory. Making a back-up copy of the eus directory enables you to edit the template-like files in the original eus directory based on your environment, and still keep copies of the original files. 2. If one does not already exist, create an LDAP listener that is secured with SSL by referring to Chapter 11, Creating and Managing Oracle Virtual Directory Listeners. . 3. Create and add the Dynamic Groups plug-ins as global server plug-ins. Refer to Managing Global Server Plug-ins on page 13-4 for steps on creating server plug-ins. 4. Make a back-up copy of your Active Directory image. The schema extensions inside of Active Directory are permanent and cannot be canceled. The back-up image enables you to restore all your changes if required. 5. Load the Enterprise User Security required schema into Active Directory using the Java classes included in Oracle Virtual Directory by executing the following command. You can use the java executable in the ORACLE_HOMEjdkbin directory. java extendAD -h Active_Directory_Host_Name -p Active_Directory_Port -D Active_Directory_Admin_DN -w Active_Directory_Admin_Password –AD Active_Directory_Domain_DN -commonattr 6. Install the Oracle Internet Directory Password Change Notification plug-in, oidpwdcn.dll, by performing the following steps: a. Locate the oidpwdcn.dll file and copy it to the Active Directory WINDOWS\system32 directory. b. Use regedt32 to edit the registry and enable the oidpwdcn.dll. Start regedt32 by entering regedt32 at the command prompt. c. Add oidpwdcn to the end of the Notification Packages entry in the HKEY_ LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\ registry, for example: RASSFM KDCSVC WDIGEST scecli oidpwdcn d. Restart the Active Directory system after making these changes. 7. Verify the Oracle Internet Directory Password Change Notification plug-in by performing the following steps: a. Change the password of an Active Directory user. b. Search Active Directory for the user you changed the password for. Verify the orclCommonAttribute attribute contains the generated hash password value. Note: An example of a valid Active Directory domain DN is: dc=oracle,dc=com 19-10 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory This value adds the orclCommonAttribute attribute definition in Active Directory. c. Reset the password for all the Active Directory users, allowing the plug-in to acquire the password changes and generate and store password verifiers. 8. If you are using Kerberos authentication on Windows 2000 or Windows 2003 with Oracle Database Advanced Security, you must configure it now by referring to the Oracle Database Advanced Security Administrators Guide. After you configure the Kerberos authentication, make sure you can log in to the database using your Active Directory user credential before proceeding to the next steps. 9. Extend the Oracle Internet Directory LDAP attribute and objectclass using the following command: ORACLE_HOME binldapmodify -h OID_Host_Name -p OID_Port -D bindDN \ -q -v -f OIDSchema.ldif 10. Create four new LDAP Adapters using the following settings and by entering the Oracle Internet Directory host information. Refer to Creating LDAP Adapters on page 12-3 for information on creating LDAP Adapters. For the first three new LDAP Adapters: ■ Use the Oracle_Internet_Directory adapter template. ■ The Adapter Remote Base and Mapped Namesapce for the first adapter must be cn=OracleContext. ■ The Adapter Remote Base and Mapped Namesapce for the second adapter must be cn=OracleSchemaVersion ■ The Adapter Remote Base and Mapped Namespace for the third adapter must be cn=subschemasubentry. For the fourth new LDAP Adapter: ■ Use the EUS_OID adapter template. ■ The Adapter Remote Base and Mapped Namesapce for the fourth adapter must be cn=oraclecontext,your_OID_realm. 11. Create a new Local Store Adapter using the following settings. Refer to Creating Local Store Adapters on page 12-23 for information on creating Local Store Adapters. ■ Use the Local_Storage_Adapter template. ■ The Adapter Suffix must be dc=com, unless your Oracle Internet Directory realm is something like dc=example,dc=net, in which case the Adapter Suffix must be dc=net. 12. Update realmRoot.ldif to use your namespaces, including the dn, dc, o, orclsubscriberfullname, and memberurl attributes in the file. If you have a DN mapping between Active Directory and Oracle Virtual Directory, use the DN that you see from Oracle Virtual Directory.