Managing Identity Virtualization Library libOVD Adapters

10-10 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager You can use this command to remove modifierDNFilter param from Changelog plug-in, as shown: removePluginParamadapterName=CHANGELOG_ldap1, pluginName=Changelog, paramKey=modifierDNFilter, contextName=oim

10.6 Configuring LDAP Authentication When LDAP Synchronization is Enabled

Use the following procedure to be able to use LDAP for authentication when LDAP synchronization is enabled. 1. Add a dynamic group in Oracle Internet Directory OID. a. Create an oimusers.ldif file that defines a dynamic group. The format of the LDIF file should be similar to the following: dn: cn=oimusers, group search base objectclass: orclDynamicGroup objectclass: groupOfUniqueNames labeleduri:ldap:LDAP_HOST:LDAP_PORTUserSearchBase??sub?objectclass=in etOrgPerson For example: dn: cn=oimusers,cn=Groups,dc=us,dc=oracle,dc=com objectclass: orclDynamicGroup objectclass: groupOfUniqueNames labeleduri: ldap:LDAP_HOST:3060cn=Users,dc=us,dc=oracle,dc=com??sub?objectclass=ine tOrgPerson b. Use the ldapadd command to upload the oimusers.ldif file to OID. The command should have the following format: ldapadd -h LDAP_HOST -p LDAP_PORT -D root dn -w password -f oimusers.ldif For example: ldapadd -h LDAP_HOST -p 3060 -D cn=orcladmin -w welcome1 -f oimusers.ldif c. Use the ldapsearch command to validate group members. The command should have the following format: ldapsearch -h LDAP_HOST -p LDAP_PORT -D root dn -w password -b cn=oimusers,groupsearchbase -s base objectclass= See Also: Creating Adapters in Oracle Virtual Directory in the Oracle Fusion Middleware Installation Guide for Oracle Identity Management for detailed information about creating the OVD adapters for Oracle Identity Manager change log and user management Note: This procedure does not enable the following functionality: ■ Forced password changes, including first login, administrator password reset, and expired passwords ■ Forced setting of challenge responses Enabling LDAP Synchronization 10-11 For example: ldapsearch -h LDAP_HOST -p 3060 -Dcn=orcladmin -wwelcome1 -b cn=oimusers,cn=Groups,dc=us,dc=oracle,dc=com -s base objectclass= 2. Configure the LDAP Authenticator in WLS. a. Log in to WebLogic Administrative Console. b. Go to Security Realms, myrealm, Providers.

c. Click New. Give a name and choose OracleInternetDirectoryAuthenticator as

type. d. Set the Control Flag to SUFFICIENT. e. Click the Provider Specific settings and configure the OID connection details. f. In Dynamic groups section, enter the following values: Dynamic Group Name Attribute: cn Dynamic Group Object Class: orcldynamicgroup Dynamic Member URL Attribute: labeleduri User Dynamic Group DN Attribute: GroupOfUniqueNames

g. Click the Providers tab and then click Reorder. Reorder the LDAP

authenticator so this is placed before the OIM Authenticator. 3. Restart all servers. 4. Validate role memberships. a. Login to WebLogic Admin Console. b. Go to Security Realms, myrealm, User and Groups.

c. Click users to display all the users in the LDAP user search base. If the LDAP

users are not displayed, it means that there is an error with the LDAP connection, and the details are specified in OID Authenticator provider specific settings. d. Click on any user and then to the corresponding group entry. Oimusers should be one of the listed entries. If this validation fails, please go through the LDAP authenticators provider-specific details. 10-12 Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager