UserManagement Plug-In Understanding the General Purpose Plug-Ins

4-28 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory directoryType Identifies the type of source LDAP directory server. Supported values are OID, ActiveDirectory, and SunOne. The default value is OID. ssladapter The ssladapter parameter, which is operational only when the directoryType parameter is set to ActiveDirectory, identifies the name of the adapter to which the UserManagement plug-in routes requests when userPassword or unicodePwd is contained in requests. If unicodePwd is contained in the request, the request must also contain the useraccountControl attribute with a proper value. The adapter identified by the ssladapter parameter must have: ■ The same local base as the adapter the UserManagement plug-in is configured on ■ Its Routing Visibility set to Internal If no value is set for ssladapter, the current adapter is used by default. mapAttribute Defines the attribute translation in the form of OVD-attribute=OIM-attribute, for example: orclGUID=objectGuid. You can set the mapAttribute configuration parameter multiple times to define translations for multiple attributes. mapPassword True or False. When the directoryType configuration parameter is set to ActiveDirectory, the mapPassword parameter controls whether to convert the user password to the unicodePwd attribute. The default value is false. mapRDNAttribute Defines the RDN attribute translation in the form of OVD-RDNattribute=OIM-RDNattribute, for example: uid=cn. pwdMaxFailure Identifies the maximum number of failed logins the source LDAP directory server requires to lock an account as defined by the password policy effective on the user entries being exposed through the adapter on which this plug-in is deployed. mapObjectclass Defines the objectclass value translation in the form of OVD-objectclass=OIM-objectclass, for example: inetorgperson=user. You can set the mapObjectclass configuration parameter multiple times to define translations for multiple objectclasses. addAttribute In the form of attribute=value pairs, this parameter identifies attributes to be added before returning the get operation result. You can prefix the attribute name with objectclass, to add the attribute and value to a specific objectclass. You can also surround a value with to reference other attributes. For example, specifying the value user,samaccountname=cn assigns the value of cn to samaccountname Note: The directoryType parameter for the UserManagement plug-in and the changelog plug-in must have identical values. Note: The mapObjectclass parameter for the UserManagement plug-in and the changelog plug-in must have identical values. Understanding Oracle Virtual Directory Plug-Ins 4-29 when the entry objectclass=user. Specifying the value samaccountname=jdoe adds attribute samaccountname with value jdoe to all the entries.

4.2.20 Changelog Plug-Ins

4.2.20.1 Deploying the Release 11.1.1.4.0 Changelog Plug-In

When deploying the single Changelog plug-in, you must: ■ Set the adapters Remote Base to an empty value; that is blank, nothing. ■ Set the adapters Mapped Namespace to: cn=changelog. ■ If the back-end is Oracle Directory Server Enterprise Edition, be sure to enable change logging on Oracle Directory Server Enterprise Edition.

4.2.20.2 Deploying Changelog Plug-Ins from Prior Releases

If you are using a version of Oracle Virtual Directory that was released prior to 11.1.1.4.0, you must use the following changelog plug-ins to standardize changelog information from source directories into a suitable format for Oracle Identity Manager. For Oracle Internet Directory Use the oidchangelog plug-in with Oracle Internet Directory. When deploying the oidchangelog plug-in, you must set the adapter’s Remote Base to an empty value; that is, blank, nothing. For Oracle Directory Server Enterprise Edition Use the sunonechangelog plug-in with Oracle Directory Server Enterprise Edition. When deploying the sunonechangelog plug-in, you must: ■ Set the adapter’s Remote Base to an empty value; that is, blank, nothing. ■ Ensure change logging is enabled on the Oracle Directory Server Enterprise Edition. ■ Set the adapter’s Mapped Namespace to: cn=changelog Note: Prior to release 11.1.1.4.0, Oracle Virtual Directory had three changelog plug-ins: ■ oidchangelog for use with Oracle Internet Directory ■ sunonechangelog for use with Oracle Directory Server Enterprise Edition ■ adchangelog for use with Microsoft Active Directory These three plug-ins are deprecated in release 11.1.1.4.0 and a new, single Changelog plug-in is now available. You can use this plug-in with Oracle Internet Directory, Oracle Directory Server Enterprise Edition, and Microsoft Active Directory. Note: These plug-ins will not work with Oracle Virtual Directory release 11.1.1.4.0. 4-30 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory For Microsoft Active Directory Use the adchangelog plug-in with Microsoft Active Directory. When deploying the adchangelog plug-in, you must: ■ Set the adapter’s Remote Base to an empty value; that is, blank, nothing. ■ Set the adapter’s Mapped Namespace to: cn=changelog

4.2.20.3 Configuration Parameters

Each of the changelog plug-ins have the following configuration parameters: oamEnabled True or False: Indicates whether Oracle Access Manager is deployed with Oracle Identity Manager. By default, Oracle Access Manager is not deployed, therefore the default setting for this parameter is false. directoryType Identifies the type of source LDAP directory server. Supported values are OID, ActiveDirectory, and SunOne. The default value is OID. mapObjectclass Defines the objectclass value translation in the form of OIM-objectclass=Source-Directory-objectclass, for example: inetorgperson=user. You can set the mapObjectclass configuration parameter multiple times to define translations for multiple objectclasses. In the Oracle Identity Manager use case, the following parameters are configured out-of-the-box: ■ For Active Directory : inetorgperson=user, orclidxperson=user, and groupOfUniqueNames=group ■ For Oracle Directory Server Enterprise Edition : container=nsContainer and changelog=changelogentry ■ For Oracle Internet Directory : container=orclContainer sizeLimit Identifies the maximum number of changelog entries to be returned. A zero 0 or a negative value means no size restriction. If the incoming search request specifies a size constraint, then the smaller value is used. For example, if you specify the plug-ins sizeLimit as 100, and the search requests count limit is 200, then the actual size limit of the request is reset to 100. Note: The oamEnabled parameter for the UserManagement plug-in and the changelog plug-in must have identical values. Note: The directoryType parameter for the UserManagement plug-in and the changelog plug-in must have identical values. Note: The mapObjectclass parameter for the UserManagement plug-in and the changelog plug-in must have identical values.