ObjectClass Mapper Plug-In Understanding the General Purpose Plug-Ins

Understanding Oracle Virtual Directory Plug-Ins 4-23 ability is useful when an application is expecting a particular objectClass and attributes but the directory does not support that objectClass or attributes. The ObjectClass Mapper plug-in can perform several different types of manipulation based on configuration parameters you select, including: ■ attribute mapping ■ objectclass mapping ■ adding attributes conditional on objectclass ■ removing attributes ■ filtering auxiliary classes ■ handling activation and deactivation Where attribute mapping relationships occur, the prefix client- indicates client side and source- indicates data source side. For example, mapping Active Directory server user to represent it as InetOrgPerson would imply that Active Directory is the source side and InetOrgPerson is the client side.

4.2.13.1 Configuration Parameters

The following is a list and description of the ObjectClass Mapper plug-in configuration parameters: directoryType The directory type to use when performing user activation. Supported values are SunOne, eDirectory, ADAM, and ActiveDirectory. For example: Parameter Name: directoryType Parameter Value: ActiveDirectory activationAttribute Use the activationAttribute parameter when an application has no knowledge of the underlying directorys user activation system. The activationAttribute parameter informs Oracle Virtual Directory which incoming attribute contains the user activation flag, which is then mapped to a directory specific attribute and flag. For example: Parameter Name: activationAttribute Parameter Value: myuseraccountcontrol deactivationValue Comma separated list of attribute values specified in activationAttribute that indicate this user should be marked as inactive. activationValue Comma separated list of attribute values specified in activationAttribute that indicate this user should be marked as active. mapObjectClass An objectClass to be mapped in the form of client-ObjectClass=source-ObejctClass . For example: Parameter Name: mapObjectClass Parameter Value: inetOrgPerson=user You can use the mapObjectClass parameter multiple times for multiple mappings. 4-24 Oracle Fusion Middleware Administrators Guide for Oracle Virtual Directory addAttribute[-objectclassvalue] Adds attributes for a user during the add process. An optional objectclass value may be added to the configuration name to add the attribute only for certain objectclasses. For example, to add a userAccountControl attribute to only the user objectclass, use: Parameter Name: addAttribute-user Parameter Value: userAccountControl=546 filterAttribute[-objectclassvalue] Comma-separated list of attributes that are removed during the add operation and from all returned entries. A conditional objectclass value may be added to the name of the parameter to filter out attributes for a specific objectclass. For example: Parameter Name: filterAttribute Parameter Value: objectsid,memberof,samaccountname mapAttribute An attribute to be mapped in the form of client-Attribute=source-attribute. For example: Parameter Name: mapAttribute Parameter Value: uniqueMember=member You can use the mapAttribute parameter multiple times for multiple mappings. filterAuxiliaryClass Comma separated list of objectclasses that must be removed on an add operation. An example is Microsoft Active Directory for Windows 2000 does not allow auxiliary object classes to be listed while adding an entry, while Microsoft Active Directory and ADAM for Windows Server 2003 does allow for auxiliary classes to be listed. For example: Parameter Name: filterAuxiliaryClass Parameter Value: person,myorgPerson filterObjectClassOnModify Comma-separated list of attributes that are removed during the modify operation for a specific objectclass. For example: Parameter Name: filterObjectClassOnModify Parameter Value: objectsid,memberof,samaccountname

4.2.14 Sub-Tree Plug-In

The Sub-Tree plug-in was originally developed to support early versions of IBMs Tivoli Access Manager product, which had a requirement where it stored policy information about a persons entry under the persons entry, thereby changing the Note: An attribute value may be referenced on the value side of the expression by supplying the attribute name surrounded by the percentage character . For example: Parameter Name: addAttribute-group Parameter Value: samaccountname=cn Understanding Oracle Virtual Directory Plug-Ins 4-25 person entry from its typical leaf model to be a branch. Some directories did not support such a model or did not want to populate their enterprise directory this way. The Sub-Tree plug-in enables you to store these sub-tree entries in a different adapter while presenting the expected directory tree view to the application—in this case Tivoli Access Manager. The requirement to add entries under a normal leaf entry is uncommon. The more common case is to make a data-store appear as a branch under an existing data-store and any adapter can perform this by properly setting its root namespace value.

4.2.14.1 Configuration Parameters

The following is a list and description of the Sub-Tree plug-in configuration parameters: storeadapter The adapter to store the user subtree objects in. storeroot The location in the store adapter where you want to store the user subtree objects. subtreematch Identifies the subtree distinguished name DN component that the Sub-Tree plug-in should intercept and redirect to the store adapter. The default value is secAuthority=Default. matchdn Numbered parameters that specify distinguished names DN under which user objects are found and the user object RDN. For example: 0=ou=People,o=Airius.com\:uid

4.2.15 Performance Monitor Plug-In

The Performance Monitor plug-in enables you to monitor the performance of a specific adapter. To use the Performance Monitor plug-in, attach it to an adapter and then perform operations against that adapter. To view the adapter performance, you must perform a specific type of base level LDAP search on the adapters root namespace with a filter of vdeSearchtime=. The search returns results similar to Example 4–6 , where all time measurements are in milliseconds: Example 4–6 Example of Data Returned with the Performance Monitor Plug-In dn: dc=demo,dc=com vdeNumSearches: 4 vdeNumEntries: 5 vdeMinSearchTime: 0 vdeMaxSearchTime: 16 vdeTotalSearchTime: 16 vdeAverageSearchTime: 4 vdeMinEntryTime: 0 vdeMaxEntryTime: 0 vdeTotalEntryTime: 0 vdeAverageEntryTime: 0 vdeMinSearchCompleteTime: 0 vdeMaxSearchCompleteTime: 203 vdeTotalSearchCompletionTime: 219 vdeAverageSearchCompletionTime: 54