ActiveDirectory Password Plug-In Active Directory Ranged Attributes Plug-In

4-40 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory The Active Directory Ranged Attributes plug-in detects attributes that Active Directory or ADAM has ranged and automatically retrieves all values. If the Active Directory Ranged Attributes plug-in is not enabled, the LDAP Adapter’s dn-attribute configuration option is not applied because the range of values are appended to the attribute name.

4.4.2.1 Configuration Parameters

The Active Directory Ranged Attributes plug-in has no configuration parameters. To enable the Active Directory Ranged Attributes plug-in, add it to a plug-in chain.

4.4.3 InetAD Plug-In

The InetAD plug-in combines the functionality of the ObjectClass Mapper Plug-In , Active Directory Ranged Attributes Plug-In , and ActiveDirectory Password Plug-In to allow one single plug-in to be configured to handle multiple unique Active Directory features. The InetAD plug-in utilizes the ObjectClass Mapping plug-in because most LDAP directories use the inetOrgPerson and groupOfUniqueNames object classes for users and groups, while Active Directory uses the user and group objectClasses with attributes specific to Active Directory’s NOS requirements. The InetAD plug-in allows Oracle Virtual Directory to make an Active Directory or ADAM directory server appear to have inetOrgPerson schema. Based on the parameter configuration, the InetAD plug-in can rename attributes and object classes and add attributes for a user in Active Directory to have all needed attributes. If no configuration parameters are used, the InetAd plug-in makes an Active Directory user or group appear to be an inetOrgPerson or groupOfUniqueNames object class.

4.4.3.1 Configuration Parameters

The following is a list and description of the InetAD plug-in configuration parameters: directoryType The directory type to use when performing user activation. Supported values are SunOne, eDirectory, ADAM, and ActiveDirectory. For example: Parameter Name: directoryType Parameter Value: ActiveDirectory Important: The Active Directory Ranged Attributes plug-in determines what attributes on an adapter are marked as dn-attributes and performs the appropriate base mapping. You can only use the Active Directory Ranged Attributes plug-in as an adapter plug-in on an LDAP Adapter. Note: Where attribute mapping relationships occur, the client- prefix indicates client side and the source- prefix indicates data source side. For example, mapping Active Directory server user to represent it as InetOrgPerson would imply Active Directory is the source side and InetOrgPerson is the client side. Understanding Oracle Virtual Directory Plug-Ins 4-41 activationAttribute Use the activationAttribute parameter when an application has no knowledge of the underlying directorys user activation system. The activationAttribute parameter informs Oracle Virtual Directory which incoming attribute contains the user activation flag, which is then mapped to a directory specific attribute and flag. For example: Parameter Name: activationAttribute Parameter Value: myuseraccountcontrol deactivationValue Comma separated list of attribute values specified in activationAttribute that indicate this user should be marked as inactive. activationValue Comma separated list of attribute values specified in activationAttribute that indicate this user should be marked as active. mapObjectClass An objectClass to be mapped in the form of client-ObjectClass = AD-ObejctClass . For example: Parameter Name: mapObjectClass Parameter Value: inetOrgPerson=user You can use the mapObjectClass parameter multiple times for multiple mappings. The default values are groupOfUniqueNames=group, inetOrgPerson=user. addAttribute[-objectclassvalue] Adds attributes for a user during the add process. An optional objectclass value may be added to the configuration name to add the attribute only for certain objectclasses. For example, to add a userAccountControl attribute to only the user objectclass, use: Parameter Name: addAttribute-user Parameter Value: userAccountControl=546 filterAttribute[-objectclassvalue] Comma-separated list of attributes to be removed during the add operation and from all returned entries. A conditional objectclass value may be added to the name of the parameter to filter out attributes for a specific objectclass. For example: Parameter Name: filterAttribute Parameter Value: objectsid,memberof,samaccountname mapAttribute An attribute to be mapped in the form of client-Attribute=AD-attribute. For example: Parameter Name: mapAttribute Note: An additional attribute value may be substituted as an expression by supplying its name surrounded by the percentage character . The default configuration is: addAttribute-user: useraccountcontrol=544, addAttribute-group:samaccountname=cn, addAttribute-group: grouptype=-2147483646