Log Levels Loggers Configuring and Enabling Logging

9-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager 10 Enabling LDAP Synchronization 10-1 10 Enabling LDAP Synchronization In earlier release of Oracle Identity Manager, LDAP synchronization can be enabled only at the time of installing Oracle Identity Manager, and postinstallation enablement of LDAP synchronization is not allowed. Oracle Identity Manager 11g Release 1 11.1.1 supports postinstallation enablement of LDAP synchronization. When Oracle identity Manager with Oracle Internet Directory OID or iplanet ODSEE or Active Directory AD is selected during installation, the virtualization functionality of Oracle Virtual Directory OVD is utilized. Oracle Identity Manager includes the Identity Virtualization Library libOVD instead of the stand-alone OVD server. Oracle Identity Manager deployment can be with or without Identity Virtualization Library libOVD. With Identity Virtualization Library libOVD included in Oracle Identity Manager, the common library is used by Oracle Identity Manager without running its own instance of OVD. Without Identity Virtualization Library libOVD, Oracle Identity Manager must use an instance of OVD separately. When you select LDAP synchronization in the Oracle Identity Manager installer, you can select any one of the AD, iPlanet ODSEE, OID, and OVD options. If you select any of AD, iPlanet ODSEE, or OID, then Oracle Identity Manager is installed with Identity Virtualization Library libOVD. If you select OVD, then LDAP synchronization is enabled, and no manual configuration steps for enabling LDAP synchronization is required. However, postinstall manual configuration to enable LDAP synchronization is required when LDAP synchronization has not been enabled at the time of installing Oracle Identity Manager. This chapter describes the following configurations for postinstallation enablement of LDAP synchronization: ■ Enabling Postinstallation LDAP Synchronization ■ Enabling SSL Between Identity Virtualization Library libOVD and the Directory Server In addition, this chapter contains the following sections: ■ Provisioning Users and Roles Created Before Enabling LDAP Synchronization to LDAP ■ Disabling LDAP Synchronization ■ Managing Identity Virtualization Library libOVD Adapters ■ Configuring LDAP Authentication When LDAP Synchronization is Enabled See Also: Integration Between LDAP Identity Store and Oracle Identity Manager in Oracle Fusion Middleware Users Guide for Oracle Identity Manager for more information about LDAP synchronization 10-2 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager

10.1 Enabling Postinstallation LDAP Synchronization

To enable LDAP synchronization after Oracle Identity Manager has been deployed: 1. Set the OIM_HOME environment variable to the directory on which Oracle Identity Manager is deployed. 2. Copy the following files from the MDS to a temporary staging directory, such as tmp: ■ The following metadata files used for configuring reconciliation profile and reconciliation horizontal table entity definition for LDAP user, role, role hierarchy, and role membership reconciliation: dbLDAPUser dbLDAPRole dbLDAPRoleHierarchy dbLDAPRoleMembership dbRA_LDAPROLE.xml dbRA_LDAPROLEHIERARCHY.xml dbRA_LDAPROLEMEMBERSHIP.xml dbRA_LDAPUSER.xml dbRA_MLS_LDAPROLE.xml dbRA_MLS_LDAPUSER.xml These files must be copied to a temporary location before importing, or you might corrupt your instance because oim-config.xml is also present in the same location. ■ The LDAP event handlers. The predefined event handlers are in the dbldapMetadataEventHandlers.xml file. ■ The LDAPContainerRules.xml consisting of the container information for users and roles to be created. Note: In Oracle Identity Manager 11g Release 1 11.1.1, the idmConfigTool must be run to preconfigure LDAP synchronization. Running the LDAPConfigPreSetup script to preconfigure LDAP synchronization generates errors. See Preparing Third-Party Directories in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management for information about using the idmConfigTool. Note: It is mandatory to create a separate staging directory. The OIM_ORACLE_HOMEservermetadata directory cannot be used as the staging directory because it contains some other files. If these files are imported inadvertently, then it might corrupt the Oracle Idenitity Manager instance. Enabling LDAP Synchronization 10-3 3. Edit the LDAPContainerRules.xml. To do so, open LDAPContainerRules.xml, and replace DefaultUserContainer and DefaultRoleContainer with appropriate user and role container values. For example, replace: ■ DefaultUserContainer with a value, such as cn=ADRUsers,cn=Users,dc=us,dc=oracle,dc=com ■ DefaultRoleContainer with a value, such as cn=ADRGroups,cn=Groups,dc=us,dc=oracle,dc=com 4. Perform the import. To do so: a. Using the MDS utilities, such as weblogicImportMetadata.sh, available in the OIM_HOMEbin directory, import all the files listed in step 2. b. Navigate to the OIM_HOMEbin directory. c. In a text editor, open the weblogic.properties file. Provide values for the following properties: – wls_servername=oim_server1 wls_servername is the name of the Oracle WebLogic Server on which Ora- cle Identity Manager is deployed. – application_name=oim If you are importing or exporting any default event handlers, the value is oim. For rest of the predefined metadata, value is OIMMetadata. If you are importing or exporting any custom data, then use application name as OIMMetadata. – metadata_from_loc=tmp This is the directory location from which XML file is to be imported. For example, if you want to import User.xml and it is in the location scratcUSERtempoimfileUser.xml, then you can specify location value as scratcUSERtempoim. Make sure that no other files exist in Note: The LdapContainerRules.xml file can contain rules by using only those attributes that are mapped to the directory. A rule cannot be written by using attributes from foreign objects or attributes that are not part of the entity. This is true for both user and role entities. For example, Role Email cannot be used for rules for roles, and users Organization Name cannot be used for user entity. Note: ■ See MDS Utilities and User Modifiable Metadata Files in the Oracle Fusion Middleware Developers Guide for Oracle Identity Manager for information about the MDS utilities. ■ Make sure that EventHandlers.xml is in the dbldapMetadata directory when imported into MDS. ■ MDS import utility imports everything in the staging directory, and therefore, only the files that are to be imported must be kept there. Otherwise, the Oracle Identity Manager instance can get corrupted. 10-4 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager this directory or in its subdirectories. Import utility tries to recursively import all the files from location directory. This property is only used by weblogicImportMetadata.sh. d. Run the following command to import the configuration files into MDS: sh .weblogicImportMetadata.sh You are prompted for WebLogic login information. Provide the following information: Please enter your username [weblogic] :weblogic Please enter your password [weblogic] :PASSWORD Please enter your server URL [t3:localhost:7001] :t3:localhost:8003 This imports the configuration files. 5. Edit IT Resource configuration in Oracle Identity Manager. To do so: a. Login to the Oracle Identity Manager Administrative and User Console by using administrator credentials, and navigate to Advanced Administration. b. In the Welcome page of the Advanced Administration, under Configuration, click Manage IT Resource. Alternatively, click the Configuration tab, click Resource Management, and then select Manage IT Resource. c. Search for the Directory Server IT resource. d. Update the IT resource with Search base and Reservation container values. The suggested value for Search base is the root suffix or the BaseDN, for example, dc=us,dc=oracle,dc=com. e. If you want to configure Oracle Identity Manager with OVD server, then enter the values for ServerURL with the OVD server host and port details. If you want to configure Oracle Identity Manager with Identity Virtualization Library libOVD, then do not enter the values for ServerURL. It must be empty. f. Enter the values for the bind credentials, as shown: bind dn: cn=oimadmin bind password: 1111111111 Note: Similarly, to export the files, such as EventHandlers.xml, the path dbldapMetadataEventHandlers.xml must be used. The value of metadata_files in weblogic.properties must be: metadata_files=dbldapMetadataEventHandlers.xml OIM_HOMEmetadata contains two directories, db and ldapReconJobs. The metadata_from_loc location pointing to this directory results in import of both the directories into MDS. Note: The Oracle Identity Manager proxy user DN is in the following format: PROXY_USER,cn=system,ROOT_SUFFIX For example: cn=oimadmin,cn=system, dc=us,dc=oracle,dc=com