Step 8: Configuring the IBM Tivoli Directory Server External Authentication Plug-in

Integrating with Novell eDirectory or OpenLDAP 22-3 expressSyncSetup are only intended as a starting point for you to use when deploying your integration of Oracle Internet Directory and Novell eDirectory or OpenLDAP. Because the default synchronization profiles are created using predefined assumptions, you must further customize them for your environment by performing the following steps in the order listed: ■ Step 1: Planning Your Integration ■ Step 2: Configuring the Realm ■ Step 3: Customizing the Search Filter to Retrieve Information from Novell eDirectory or OpenLDAP ■ Step 4: Customizing the ACLs ■ Step 5: Customizing Attribute Mappings ■ Step 6: Customizing the Novell eDirectory or OpenLDAP Connector to Synchronize Deletions ■ Step 7: Specifying Synchronization Parameters for the Advanced Configuration Information Attribute ■ Step 8: Configuring the OpenLDAP Connector to Synchronize Passwords ■ Step 9: Synchronizing in SSL Mode ■ Step 10: Configuring the Novell eDirectory or OpenLDAP External Authentication Plug-in ■ Step 11: Performing Post-Configuration and Administrative Tasks

22.3.1 Step 1: Planning Your Integration

Plan your integration by reading Chapter 16, Third-Party Directory Integration Concepts and Considerations , particularly Novell eDirectory and OpenLDAP Integration Concepts on page 16-30. Be sure to create a new profile by copying the existing eDirectory or OpenLDAP template profile by following the instructions in Creating Synchronization Profiles on page 7-1.

22.3.2 Step 2: Configuring the Realm

Configure the realm by following the instructions in Configuring the Realm on page 17-7. 22.3.3 Step 3: Customizing the Search Filter to Retrieve Information from Novell eDirectory or OpenLDAP By default, the Novell eDirectory or OpenLDAP Connector retrieves changes to all objects in the container based on the modifytimestamp attribute. If you are interested in retrieving changes to specific types of objects, such as changes to users and groups, then you should configure an LDAP search filter. This filter screens out changes that are not required when the Novell eDirectory or OpenLDAP Connector queries Novell eDirectory or OpenLDAP. The filter is stored in the connected directory matching filter attribute orclodipcondirmatchingfilter in the synchronization profile. The Novell eDirectory and OpenLDAP sample import profiles are configured to retrieve changes to users, groups, and container objects from Novell eDirectory and OpenLDAP, respectively. Computers are not retrieved. The value of the searchfilter attribute is set as follows: 22-4 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform searchfilter=modifiersname=connected_dir_account |objectclass=domainobjectclass=organizationalunit objectclass=organizationobjectclass=person objectclass=groupofnames You use the update operation of the manageSyncProfiles command to update the searchfilter attribute if you want to synchronize entries other than users or groups. For example, the following command updates the searchfilter attribute to synchronize only users and groups: manageSyncProfiles -operation update -profile profile_name odip.profile.condirfilter searchfilter= |objectclass=groupofnamesobjectclass=person

22.3.4 Step 4: Customizing the ACLs

Customize ACLs as described in Customizing Access Control Lists on page 17-8.

22.3.5 Step 5: Customizing Attribute Mappings

When integrating with Novell eDirectory, the following attribute-level mapping is mandatory for all objects: GUID:1: : :orclNDSObjectGUID: :orclndsObject:bin2b64guid Modifytimestamp:1 : : :orclsourcemodifytimestamp: :orclndsobject: Createtimestamp:1 : : :orclsourcecreatetimestamp: :orclndsobject: Targetdn:1: : :orclsourceobjectdn: : orclndsobject: When integrating with OpenLDAP, the following attribute-level mapping is mandatory for all objects: entryuuid:1: : : orclOpenLdapEntryUUID: : orclOpenLdapObject Modifytimestamp:1 : : :orclsourcemodifytimestamp: : orclOpenLdapObject Createtimestamp:1 : : :orclsourcecreatetimestamp: : orclOpenLdapObject Targetdn:1: : :orclsourceobjectdn: : orclOpenLdapObject: Example 22–1 Attribute-Level Mapping for the User Object in Novell eDirectory or OpenLDAP Cn:1: : :person: cn: :person: sn:1: : :person: sn: :person: Notes: ■ All attributes specified in the searchfilter attribute should be configured as indexed attributes in Novell eDirectory or OpenLDAP. ■ Refer to Managing Synchronization Profiles Using manageSyncProfiles on page 7-15 for more information about the manageSyncProfiles command. See Also: The appendix on the LDAP filter definition in Oracle Fusion Middleware Administrators Guide for Oracle Internet Directory for instructions on configuring an LDAP search filter