Implementing Fallback Authentication Configuring Windows Native Authentication

Integrating with Microsoft Active Directory 18-19

18.7 Switching to a Different Microsoft Active Directory Domain Controller in the Same Domain

This section explains how to change the Microsoft Active Directory domain controller to which changes are exported. There are two methods, one for the USN-Changed approach and the other for the DirSync approach. How to Change the Microsoft Active Directory Domain Controller by Using the USN-Changed Approach If you are using the USN-Changed approach, then perform the following: 1. Disable the current running profile. Modify the Microsoft Active Directory host connection information, that is, host, port, user, password, to point to the new host. Usually, the host name is the only item that you need to update. 2. Obtain the current value of the highestCommittedUSN by searching the new domain controllers root DSE for the current highest USNChanged value attribute value of the highestCommittedUSN attribute of the root DSE: ldapsearch -h host -p port -b -s base -D binddn -q \ objectclass= highestCommittedUSN 3. Use Oracle Directory Integration Platform to run a full synchronization from Microsoft Active Directory. a. Run ldifde, the command to dump entries from Microsoft Active Directory to Oracle Internet Directory, using the intended LDAP search scope and search filter. Normally, the search filter should be the same as that specified in the running profile. For example, the following search filter is set in the sample properties file. Note that ldifde can be run only from a Microsoft Windows environment. searchfilter=|objectclass=userobjectclass=organizationalunitobje ctclass=group Essentially, run ldifde with a search scope and search filter that retrieve all Oracle Internet Directory objects entries that were configured to be synchronized with Microsoft Active Directory by the running profile. b. Run Oracle Directory Integration Platform to upload the LDIF file generated in Step a using the same profile. 4. After the full synchronization is completed, update the lastchangenumber attribute with the highestCommittedUSN value obtained in Step 2. 5. Resume the normal synchronization, that is, incremental synchronization from Microsoft Active Directory using USNChanged attribute. How to Change the Microsoft Active Directory Domain Controller by Using the DirSync Approach If you are using the DirSync approach, perform the following steps: 1. Stop the current profile that is running. 2. Use the copy operation of the manageSyncProfiles command to create a new profile exactly the same as the profile already being used. In the newly created Note: You will be prompted for the password. 18-20 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform profile, modify the Microsoft Active Directory host connection information, that is, host, port, user, password, to point to the new host. Usually, the host name is the only item you need to update. 3. Resume normal synchronization with the modified profile. Note that all the domain controllers must be in the same Microsoft Active Directory domain. 18.8 Configuring the Microsoft Active Directory Connector for Microsoft Active Directory Lightweight Directory Service The Microsoft Active Directory connector can be used for synchronizing the entries between Microsoft Active Directory Lightweight Directory Service AD LDS, which was previously known as Active Directory Application Mode or ADAM, and Oracle Internet Directory.

18.9 Configuring the Microsoft Active Directory Connector for Microsoft Exchange Server

The Microsoft Active Directory Connector can provision users in Microsoft Exchange in deployments that have Microsoft Active Directory Server 2000 or later as their identity store. You can use either of the following methods to configure the Microsoft Active Directory connector for Microsoft Exchange Server: ■ Use the Oracle Enterprise Manager Fusion Middleware Control user interface ■ Use the manageSyncProfiles command at a command line See the following sections for details. To further customize your integration with Microsoft Exchange, follow the instructions in Configuring Advanced Integration with Microsoft Active Directory on page 18-2.

18.9.1 To Enable Microsoft Exchange User Synchronization From the User Interface

1. Use the Oracle Enterprise Manager Fusion Middleware Control to create a

synchronization profile, as described in Creating Synchronization Profiles on page 7-1. On the General tab, set the Use DIP-OID as? field to Source and select MS Exchange Server from the Type list. On the Mapping tab, in addition to creating domain mapping rules, you need to create two attribute mapping rules. Following are instructions on how to create the mapping rules.

2. On the Mapping tab, click Create in the Attribute Mapping Rules section.

The Add Attribute Mapping Rule dialog box opens.

3. Create the first of two attribute mapping rules using the following steps:

a. Select inetorgperson from the Source ObjectClass drop-down menu.

b. Select the Single Attribute option, then select uid from the Source Attribute

drop-down menu.

c. Select User from the Destination ObjectClass drop-down menu.

See Also: Oracle Application Server MS Office Developers Guide