DynamicEntryTree Plug-In Understanding the General Purpose Plug-Ins

4-16 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory

4.2.10 FlatTree Plug-In

The FlatTree plug-in, as with the DynamicEntryTree, performs dynamic mapping of the virtual directory tree. The FlatTree plug-in compresses a directory source so that all entries appear directly under the root of the adapter. FlatTree plug-in operates in two deployed modes: ■ as part of any existing adapter to flatten the existing namespace ■ as part of a Custom Adapter deployment As part of a Custom Adapter deployment, you can use the FlatTree plug-in’s adapter parameter to retrieve data from the designated adapter so that the data appears as part of the namespace of the Custom Adapter. When deployed this way, the adapter root object is not defined. This type of deployment can be useful if you want to overlay multiple adapters on top of a parent adapter without creating duplicate parent nodes.

4.2.10.1 Configuration Parameters

The following is a list and description of the FlatTree plug-in configuration parameters: criteria Criteria defines an LDAP filter that restricts the entries that can be searched for through the FlatTree plug-in. For example, if criteria was set to objectclass=user, then only user objects would be returned through the FlatTree plug-in. adapter If the adapter parameter is not defined, the FlatTree plug-in assumes data will be retrieved through its parent adapter. When defined, the adapter parameter must be the name of another adapter in the Oracle Virtual Directory configuration and the FlatTree plug-in retrieves data from this adapter and maps the entries to its parent adapters root. If the adapter parameter is defined the root object is not returned—only the child entries are returned.

4.2.11 DynamicGroups Plug-In

The DynamicGroups plug-in enables Oracle Virtual Directory to process LDAP objectclasses that are both groupofuniquenames and groupofurls referred to as a dynamic group and convert it into a virtual static group, or groupofuniquenames equivalent. The plug-in works by monitoring returned LDAP objects and detects objects where the memberurl attribute is present and the objectclass is both groupofuniquenames and groupofurls. When detected, the plug-in automatically processes any memberurl values and adds the results to the uniquemember attribute. This dynamic object processing allows administrators to define groups that hold both static members and dynamic members while maintaining compatibility with applications that may not normally support the groupofurls objectclass. Example 4–1 shows an example query when the Dynamic Groups plug-in is not enabled. Two groups are returned and the first group holds two static members and has a memberurl defining a particular directory subtree to also be members. Example 4–1 Example Query When Dynamic Groups Plug-in Is Not Enabled C:\ldapsearch -D bindDN -q -b ou=groups,ou=airius,o=yourcompany.com -s sub memberurl= Understanding Oracle Virtual Directory Plug-Ins 4-17 cn=test,ou=groups,ou=airius,o=yourcompany.com cn=test memberurl=ldap:ou=accounting,o=yourcompany.com??sub?objectclass=personobj ectclass=organizationalperson objectclass=groupofuniquenames objectclass=groupofurls objectclass=top uniquemember=cn=Paul Jacobs,ou=People,ou=Airius,o=yourcompany.com uniquemember=cn=Wendy Verbaas,ou=People,ou=Airius,o=YourCompany.com cn=TestCheck,ou=groups,ou=airius,o=yourcompany.com memberurl=ldap:ou=alt bind,o=yourcompany.com??sub?userprincipalname= objectclass=groupofuniquenames objectclass=groupofurls cn=TestCheck Example 4–2 shows the results of the same query as in Example 4–1 , however, the Dynamic Groups plug-in is enabled: Example 4–2 Example Query When Dynamic Groups Plug-in is Enabled C:\ldapsearch -D bindDN -q -b ou=groups,ou=airius,o=yourcompany.com -s sub cn=test cn=test,ou=groups,ou=airius,o=yourcompany.com memberurl=ldap:ou=accounting,o=yourcompany.com??sub?objectclass=personobj ectclass=organizationalperson objectclass=groupofuniquenames objectclass=groupofurls objectclass=top cn=test uniquemember=cn=Paul Jacobs,ou=People,ou=Airius,o=yourcompany.com uniquemember=cn=Wendy Verbaas,ou=People,ou=Airius,o=YourCompany.com uniquemember=cn=Vipi Velasquez,ou=accounting,o=yourcompany.com uniquemember=cn=Preston Pena-Fernandez,ou=accounting,o=yourcompany.com uniquemember=cn=Andreas OHara,ou=accounting,o=yourcompany.com uniquemember=cn=Chitra Guenette,ou=accounting,o=yourcompany.com ... uniquemember=cn=Jim Ward,ou=accounting,o=yourcompany.com The Dynamic Group plug-in expands the memberURL value that is, it executes an LDAP search query with the base, scope, and filter specified in the memberURL and adds the returned DNs to the member attribute if, and only if, the search filter specified in the client request does not return any entries from a remote back-end server. To illustrate this point, assume the LDAP entry shown in Example 4–3 exists in a remote LDAP server configured with Oracle Virtual Directory. Example 4–3 LDAP Entry on a Remote LDAP Server with Oracle Virtual Directory dn:cn=admingroup,dc=groups,dc=acme,dc=com uniqueMember:cn=mark,cn=users,dc=acme,dc=com memberURL:ldap:cn=users,dc=acme,dc=com??sub?|cn=johncn=smith objectClass:groupOfUniqueNames objectClass:groupOfUrls The following LDAP search returns the entry as is; without expanding the memberURL value. Base DN: dc=groups,dc=acme,dc=com