Creating Users and Groups for Oracle Identity Manager

10-12 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management

10.4.4 Creating Users and Groups for Oracle Identity Manager

If you plan to implement Oracle Identity Manager in your topology, you must seed the Identity Store with the xelsysadm user and assign it to an Oracle Identity Manager administrative group. You must also create a user outside of the standard cn=Users location to be able to perform reconciliation. This user is also the user that should be used as the bind DN when connecting to directories with Oracle Virtual Directory. To do this, perform the following tasks on IDMHOST1: 1. Set the Environment Variables: MW_HOME, JAVA_HOME, IDM_HOME and ORACLE_ HOME . Set IDM_HOME to IDM_ORACLE_HOME. Set ORACLE_HOME to IAM_ORACLE_HOME. 2. Create a properties file, called oim.props, with the following contents: IDSTORE_HOST: idstore.mycompany.com IDSTORE_PORT: 389 IDSTORE_BINDDN: cn=orcladmin IDSTORE_USERNAMEATTRIBUTE: cn IDSTORE_LOGINATTRIBUTE: uid IDSTORE_USERSEARCHBASE: cn=Users,dc=mycompany,dc=com IDSTORE_GROUPSEARCHBASE: cn=Groups,dc=us,dc=oracle,dc=com IDSTORE_SEARCHBASE: dc=mycompany,dc=com POLICYSTORE_SHARES_IDSTORE: true IDSTORE_SYSTEMIDBASE: cn=systemids,dc=mycompany,dc=com IDSTORE_OIMADMINUSER: oimLDAP IDSTORE_OIMADMINGROUP: OIMAdministrators Where: ■ IDSTORE_HOST and IDSTORE_PORT are, respectively, the host and port of your Identity Store directory. If you are using a non-OID directory, then specify the Oracle Virtual Directory host which should be IDSTORE.mycompany.com. If your Identity Store is in Oracle Internet Directory, then IDSTORE_HOST should point to Oracle Internet Directory, even if you are fronting Oracle Internet Directory with Oracle Virtual Directory. ■ IDSTORE_BINDDN is an administrative user in the Identity Store directory. ■ IDSTORE_OIMADMINUSER is the user that Oracle Identity Manager uses to connect to the Identity store. ■ IDSTORE_OIMADMINGROUP Is the name of the group you want to create to hold your Oracle Identity Manager administrative users. ■ IDSTORE_USERSEARCHBASE is the location in your Identity Store where users are placed. See Also: Oracle Fusion Middleware Integration Overview for Oracle Identity Management Suite for more information about the idmConfigTool command. Note: This command also creates a container in your Identity Store for reservations. Preparing Identity and Policy Stores 10-13 ■ IDSTORE_GROUPSEARCHBASE is the location in your Identity Store where groups are placed. ■ IDSTORE_SYSTEMIDBASE is the location in your directory where the Oracle Identity Manager reconciliation user are placed. ■ POLICYSTORE_SHARES_IDSTORE is set to true if your Policy and Identity stores are in the same directory. If not, it is set to false. 3. Configure the Identity Store by using the command idmConfigTool, which is located at: IAM_ORACLE_HOMEidmtoolsbin The syntax of the command on Linux is: idmConfigTool.sh -prepareIDStore mode=OIM input_file=configfile The syntax on Windows is: idmConfigTool.bat -prepareIDStore mode=OIM input_file=configfile For example: idmConfigTool.sh -prepareIDStore mode=OIM input_file=oim.props When the command runs, you are prompted to enter the password of the account you are connecting to the Identity Store with. You are also asked to specify the passwords you want to assign to the accounts: ■ IDSTORE_OIMADMINUSER ■ xelsysadm It is recommended you set this to the same value as the account you create as part of the Oracle Identity Manager configuration. Sample command output: Enter ID Store Bind DN password: Creation of oimLDAP Apr 5, 2011 4:58:51 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidoim_user_template.ldif Enter User Password for oimLDAP: Confirm User Password for oimLDAP: Apr 5, 2011 4:59:01 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidoim_group_template.ldif Apr 5, 2011 4:59:01 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidoim_group_member_ template.ldif Apr 5, 2011 4:59:01 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidoim_groups_acl_ template.ldif Apr 5, 2011 4:59:01 AM oracle.ldap.util.LDIFLoader loadOneLdifFile Note: When you run the idmConfigTool, it creates or appends to the file idmDomainConfig.param. This file is generated in the same directory that the idmConfigTool is run from. To ensure that each time the tool is run, the same file is appended to, always run the idmConfigTool from the directory: IAM_ORACLE_HOME idmtoolsbin 10-14 Oracle Fusion Middleware Enterprise Deployment Guide for Oracle Identity Management INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidoim_reserve_ template.ldif Creation of Xel Sys Admin User Apr 5, 2011 4:59:01 AM oracle.ldap.util.LDIFLoader loadOneLdifFile INFO: - LOADING: u01apporacleproductfmwiamidmtoolstemplatesoidoam_user_template.ldif Enter User Password for xelsysadm: Confirm User Password for xelsysadm: The tool has completed its operation. Details have been logged to homeoracleidmtoolsoim.log 4. Check the log file for any errors or warnings and correct them. The file with the name automation.log is created in the directory from where you run the tool.

10.4.5 Creating Users and Groups for Oracle WebLogic Server