Backward Compatibility Reconciliation Architecture

Deployment Configurations 4-23

4.3 Integration Between LDAP Identity Store and Oracle Identity Manager

Oracle Identity Manager users and roles are stored in Oracle Identity Manager database. However, when a user, role, or role membership change takes place in Oracle Identity Manager, this information is propagated to LDAP identity store. If user, role, or role membership change takes place in LDAP directly, then these changes are synchronized into Oracle Identity Manager. The synchronization involves: ■ User creation, modification, deletion, change in enable or disable states, and password change are made in LDAP in addition to the internal Oracle Identity Manager tables. ■ Role creation, modification, and deletion actions update the LDAP groups, including membership changes. ■ Initial load of users, roles, and role memberships are synchronized. ■ Direct changes to user profile in LDAP are reconciled to Oracle Identity Manager. ■ Direct changes to roles and role memberships in LDAP are reconciled to Oracle Identity Manager. When changes are made in the user and role data, the actual operation is performed with the help of the kernel handlers. These handlers go through an orchestration lifecycle of various stages, such as validation, preprocessing, action, and postprocessing. For more information about the various stages of kernel orchestration, see Oracle Fusion Middleware Developers Guide for Oracle Identity Manager. Oracle Identity Manager kernel orchestration connects to the Entity Manager, which in turn connects to the LDAP provider. The LDAP provider connects to Oracle Virtual Directory OVD. The OVD is an interface to various directory systems, such as Oracle Internet Directory, iPlanet, and Active Directory. The LDAP provider reaches the LDAP data by using OVD. Figure 4–8 shows the communication between Oracle Identity Manager and LDAP: Figure 4–8 Oracle Identity Manager and LDAP The integration configuration and synchronization of data between Oracle Identity Manager and the LDAP identity store are described in the following sections: ■ Configuring the Integration with LDAP ■ Provisioning Data From Oracle Identity Manager to LDAP Identity Store See Also: Managing Reconciliation Events for more information about the Reconciliation Manager in the Oracle Fusion Middleware Administrators Guide for Oracle Identity Manager.