Verifying Synchronization Requirements for Oracle Directory Server Enterprise Edition

21-2 Oracle Fusion Middleware Administrators Guide for Oracle Directory Integration Platform

21.2 Configuring Basic Synchronization with IBM Tivoli Directory Server

You use the expressSyncSetup command to quickly establish synchronization between Oracle Internet Directory and IBM Tivoli Directory Server. The expressSyncSetup command uses default settings to automatically perform all required configurations, and also creates two synchronization profiles, one for import and one for export. To use the expressSyncSetup command to synchronize with IBM Tivoli Directory Server, refer to Creating Import and Export Synchronization Profiles Using expressSyncSetup on page 17-2.

21.3 Configuring Advanced Integration with IBM Tivoli Directory Server

When you install Oracle Directory Integration Platform, sample import and export synchronization profiles are automatically created for each of the supported third-party directories. The sample synchronization profiles created for IBM Tivoli Directory Server are: ■ TivoliImport—The profile for importing changes from IBM Tivoli Directory Server to Oracle Internet Directory ■ TivoliExport—The profile for exporting changes from Oracle Internet Directory to IBM Tivoli Directory Server You can also use the expressSyncSetup command to create additional synchronization profiles. The import and export synchronization profiles created during the install process or with expressSyncSetup are only intended as a starting point for you to use when deploying your integration of Oracle Internet Directory and a IBM Tivoli Directory Server. Because the default synchronization profiles are created using predefined assumptions, you must further customize them for your environment by performing the following steps in the order listed: ■ Step 1: Planning Your Integration ■ Step 2: Configuring the Realm ■ Step 3: Customizing the ACLs ■ Step 4: Customizing Attribute Mappings ■ Step 5: Customizing the IBM Tivoli Directory Server Connector to Synchronize Deletions ■ Step 6: Synchronizing Passwords ■ Step 7: Synchronizing in SSL Mode ■ Step 8: Configuring the IBM Tivoli Directory Server External Authentication Plug-in ■ Step 9: Performing Post-Configuration and Administrative Tasks

21.3.1 Step 1: Planning Your Integration

Plan your integration by reading Chapter 16, Third-Party Directory Integration Concepts and Considerations , particularly IBM Tivoli Directory Server Integration Concepts on page 16-28. Be sure to create a new profile by copying the existing IBM Tivoli Directory Server template profile by following the instructions in Creating Synchronization Profiles on page 7-1. Integrating with IBM Tivoli Directory Server 21-3

21.3.2 Step 2: Configuring the Realm

Configure the realm by following the instructions in Configuring the Realm on page 17-7.

21.3.3 Step 3: Customizing the ACLs

Customize ACLs as described in Customizing Access Control Lists on page 17-8.

21.3.4 Step 4: Customizing Attribute Mappings

When integrating with IBM Tivoli Directory Server, the following attribute-level mapping is mandatory for all objects: targetdn: : :top:orclSourceObjectDN: :orclTDSObject: Example 21–1 Attribute-Level Mapping for the User Object in IBM Tivoli Directory Server Cn:1: :person: cn: :person: sn: : :person: sn: :person: Example 21–2 Attribute-Level Mapping for the Group Object in IBM Tivoli Directory Server Cn:1: :groupofname: cn:groupofuniquenames In the preceding examples, Cn and sn from IBM Tivoli Directory Server are mapped to cn and sn in Oracle Internet Directory. If you specify anything other than the RDN attribute as a required attribute in the mapping file, those changes will not be synchronized. This is due to a limitation in IBM Tivoli Directory Server where changes do not appear as deletions in the changelog when tombstones are enabled. Customize the attribute mappings by following the instructions in Customizing Mapping Rules on page 17-9.

21.3.5 Step 5: Customizing the IBM Tivoli Directory Server Connector to Synchronize Deletions

If you want to synchronize deletions, you must ensure tombstones are not enabled in IBM Tivoli Directory Server. To check if tombstones are enabled, execute the following command: ldapsearch -h connected_directory_host -p connected_directory_port \ -D binddn -q \ -b cn=Directory, cn=RDBM Backends, cn=IBM Directory, cn=Schemas, cn=Configuration -s base objectclass= ibm-slapdTombstoneEnabled This command returns information on all deleted entries. Note: You will be prompted for the password.