4 Managing the Oracle Directory Integration Platform

4.1.1 Directory Integration Profiles

In Oracle Directory Integration Platform, you can create two types of profiles: a directory synchronization profile and a directory provisioning profile. A directory synchronization profile describes how synchronization is carried out between the Oracle back-end directory and a connected directory. You can create two types of directory synchronization profiles: an import profile and an export profile. An import profile imports changes from a connected directory to the Oracle back-end directory while an export profile exports changes from the Oracle back-end directory to a connected directory. A directory provisioning profile describes the nature of provisioning-related notifications that Oracle Directory Integration Platform sends to the directory-enabled applications. Sometimes a provisioning profile is also configured to notify the Oracle back-end directory about the changes happening in the application's data source. Multiple profiles can be used at the same time.

Each type of profile is special kind of directory integration profile, which is an entry in the Oracle back-end directory that describes how Oracle Directory Integration Platform communicates with external systems and what is communicated.

4.1.2 Oracle Directory Integration Platform Event Propagation in a Multimaster Oracle Back-end Directory Replication Environment

In a multimaster Oracle back-end directory environment, changes to directory synchronization profiles on one Oracle back-end directory node must be replicated or copied to any secondary nodes. This allows a directory synchronization profile to execute on a secondary node in the event of a problem on the primary node.

In a multimaster Oracle Universal Directory or Oracle Directory Server Enterprise Edition environment, if a suffix containing DIP meta-data is chosen for replication, the profiles are automatically replicated.

In a multimaster Oracle Internet Directory replication environment, however, changes to directory synchronization profiles on one Oracle Internet Directory node are not automatically replicated on other Oracle Internet Directory nodes. For this reason, you must copy the profiles on the primary node to any secondary nodes. For instructions, see the following section.

4.2.1 Viewing the Status of Oracle Directory Integration Platform Using the dipStatus Utility

The dipStatus utility, located in the ORACLE_HOME/bin directory, allows you to check the status of Oracle Directory Integration Platform and whether or not it is registered.

dipStatus -h HOST -p PORT -D wlsuser [-ssl -keystorePath PATH_TO_KEYSTORE
-keystoreType TYPE] [-help]

dipStatus -h myhost.mycompany.com -p 7005 -D login_ID

dipStatus -help

4.2.2 Viewing Oracle Directory Integration Platform Registration Information Using the ldapsearch Utility

To view registration information for the Oracle Directory Integration Platform component using the ldapsearch utility, perform a base search on its entry. For example:

ldapsearch -h oid_host -p port -D cn=orcladmin -q -s base -b
"cn=odisrv,cn=Registered Instances,cn=Directory Integration 
Platform,cn=Products,cn=OracleContext" objectclass=*

This example search returns the following:

Dn: cn=odisrv,cn=Registered Instances,cn=Directory Integration 
Platform,cn=Products,cn=OracleContext
userpassword: {SHA}+vk5wSvnVoXCBCRyBWJnH0S33zc= 
orclaci: access to entry by self (add,delete,browse,proxy); access to attr=(*) by 
self (search,read,write,compare) 
orclversion: 3.0 
cn: odisrv 
objectclass: orclodiserver; top; 
authpassword;oid: {SASL/MD5}2NOnGTWkSP9c1w7R/o9Djw== 
{SASL/MD5-DN}ezUTC3k7rSL41ZxdxhlXxw==;{SASL/MD5-U}kEQcl+/AZEXVukeA5YPnog==

4.3.1 Viewing Oracle Directory Integration Platform Runtime Information Using Fusion Middleware Control

To view runtime information for the Oracle Directory Integration Platform component using Oracle Enterprise Manager Fusion Middleware Control:

1. Open a Web browser and enter the Oracle Enterprise Manager Fusion Middleware Control URL for your environment. The format of the Oracle Enterprise Manager Fusion Middleware Control URL is: https://host:port/em.

2. Log in to Oracle Enterprise Manager Fusion Middleware Control.

3. In the navigation panel on the left, click or expand the Identity and Access entry and then select the DIP component that you want to view runtime information for. Oracle Enterprise Manager Fusion Middleware Control opens the Oracle Directory Integration Platform home page, which includes the following information:

   • Synchronization Profiles: Summary of the configured synchronization profiles.

   • Provisioning Profiles: Summary of the configured provisioning profiles.

   • Resource Usage: Charts showing percentages of CPU and Memory being utilized on the Oracle Directory Integration Platform host.

4.3.2 Starting Oracle Directory Integration Platform with Fusion Middleware Control

To start Oracle Directory Integration Platform by using Oracle Enterprise Manager Fusion Middleware Control:

1. Open a Web browser and enter the Oracle Enterprise Manager Fusion Middleware Control URL for your environment. The format of the Oracle Enterprise Manager Fusion Middleware Control URL is: https://host:port/em.

2. Log in to Oracle Enterprise Manager Fusion Middleware Control.

3. In the navigation panel on the left, click or expand the Identity and Access entry and then select the DIP component that you want to start.

4. Click the DIP Server menu, point to Control, and then click Start.

4.3.3 Stopping Oracle Directory Integration Platform with Fusion Middleware Control

To stop Oracle Directory Integration Platform by using Oracle Enterprise Manager Fusion Middleware Control:

1. Open a Web browser and enter the Oracle Enterprise Manager Fusion Middleware Control URL for your environment. The format of the Oracle Enterprise Manager Fusion Middleware Control URL is: https://host:port/em.

2. Log in to Oracle Enterprise Manager Fusion Middleware Control.

3. In the navigation panel on the left, click or expand the Identity and Access entry and then select the DIP component that you want to stop.

4. Click the DIP Server menu, point to Control, and then click Stop.

5. When the confirmation dialog appears, click Yes.

4.3.4 Managing the Oracle Directory Integration Platform Server Configuration

To configure the Oracle Directory Integration Platform Server Refresh Interval and settings for the connection to the Oracle back-end directory using Oracle Enterprise Manager Fusion Middleware Control:

1. Open a Web browser and enter the Oracle Enterprise Manager Fusion Middleware Control URL for your environment. The format of the Oracle Enterprise Manager Fusion Middleware Control URL is: https://host:port/em.

2. Log in to Oracle Enterprise Manager Fusion Middleware Control. Oracle Enterprise Manager Fusion Middleware Controls opens the Home Page.

3. In the navigation panel on the left, click or expand the Identity and Access entry and then select the DIP component that you want to manage.

4. Click the DIP Server menu, point to Administration, and then click Server Properties.

   The DIP Server Configuration page appears.

   The following list describes the fields and options on the DIP Server Configuration page:

   • Server Refresh Interval (sec): The time interval (amount of time in seconds) that controls how often the Oracle Directory Integration Platform server refreshes profile configuration details.

   • OID Connection Settings / OUD Connection Settings / ODSEE Connection Settings: Enter the host name and port of the Oracle back-end directory where you want to save the Oracle Directory Integration Platform configuration.

   • OID connect SSL Mode / OUD connect SSL Mode / ODSEE connect SSL Mode: Specify the mode Directory Integration Platform uses to connect to the Oracle back-end directory.

     Note:

     For Oracle Internet Directory, you cannot specify no-SSL (mode 0) as the mode Directory Integration Platform uses to connect to the Oracle back-end directory using Oracle Enterprise Manager Fusion Middleware Control.

     For Oracle Unified Directory and Oracle Directory Server Enterprise Edition, you can specify no-SSL (mode 0).

     The supported options are:

     • No-auth (mode 1): Directory Integration Platform connects to the Oracle back-end directory using only SSL encryption.

       This option is only available if Oracle Internet Directory is your Oracle back-end directory. It is not available if Oracle Unified Directory or Oracle Directory Server Enterprise Edition is your Oracle back-end directory.

     • Server Only (mode 2): Directory Integration Platform connects to and is authenticated only by the Oracle back-end directory.

       Note:

       If you select the Server Only (mode 2) option, you must configure Oracle Directory Integration Platform for SSL Mode 2 server-only authentication from the command line. Refer to "Configuring Oracle Directory Integration Platform for SSL Mode 2 Server-Only Authentication" for more information.

5. Optionally, click Test Connection to test the connection to the target Oracle back-end directory.

6. Make the desired changes and click the Apply button.

4.3.5 Managing Oracle Directory Integration Platform Logging Using Fusion Middleware Control

Oracle Enterprise Manager Fusion Middleware Control allows you to list, search, and configure log files across Oracle Fusion Middleware components. You can view log files from Oracle Enterprise Manager Fusion Middleware Control or download log files and view them using another tool. You can also list and search log files using the WLST command-line tool.

4.3.6 Auditing Oracle Directory Integration Platform Using Fusion Middleware Control

Oracle Directory Integration Platform utilizes the Common Audit Framework of the Oracle Application Server 11g infrastructure for compliance, monitoring, and analytics purposes. Using Oracle Enterprise Manager Fusion Middleware Control, you can view, search, and manage audit data and event settings for Oracle Directory Integration Platform. Refer to the Oracle Fusion Middleware Application Security Guide for complete information on auditing.

4.5.1 Syntax for manageDIPServerConfig

manageDIPServerConfig

manageDIPServerConfig {get | set} -h HOST -p PORT -D wlsuser -attribute {sslmode |
refreshinterval | quartzthreadcount | quartzdbretryinterval | oidhostport |
keystorelocation} [-ssl -keystorePath PATH_TO_KEYSTORE -keystoreType TYPE] 
[-value ATTRIBUTE_VALUE] [-help]

4.5.2 Arguments for manageDIPServerConfig

get | set

Operation to perform.

• get: Displays the current value of the config parameter in DIP configuration file

• set: Updates the value of the config parameter in DIP configuration file.

-h | -host

Oracle WebLogic Server host where Oracle Directory Integration Platform is deployed

-p | -port

Listen port of Oracle WebLogic Managed Server where Oracle Directory Integration Platform application is deployed.

-D | -wlsuser

Oracle WebLogic Server login ID.

-attr | -attribute

Identifies the attribute that manageDIPServerConfig performs the operation on. The following is a list and description of the attributes manageDIPServerConfig can perform operations on:

• sslmode: The SSL mode Oracle Directory Integration Platform uses to connect to the Oracle back-end directory. Supported values are 1 and 2. Use 1 to connect to the Oracle back-end directory using SSL Mode 1 (No Authentication). (SSL Mode 1 is only supported if Oracle Internet Directory is your Oracle back-end directory.) Use 2 to connect to the Oracle back-end directory using SSL Mode 2 (Server Only Authentication).

• refreshinterval: The time interval (amount of time in seconds) that controls how often the Oracle Directory Integration Platform server refreshes profile configuration details.

• quartzthreadcount: Controls how many profiles can be scheduled in parallel. The default value is 15. If you have more than 15 profiles, increase the quartzthreadcount attribute accordingly.

• quartzdbretryinterval: Controls how often Oracle Directory Integration Platform's Quartz scheduler attempts to reconnect to the Oracle back-end directory database.

• oidhostport: Identifies the host and port of the Oracle back-end directory associated with Oracle Directory Integration Platform. Specify values for the oidhostport attribute in the form of host:port.

• keystorelocation: Specifies the absolute path to the Java Keystore (JKS) based on the host where Oracle Directory Integration Platform is deployed. When you specify the value for the keystorelocation attribute, be sure you use the appropriate path separators (that is, / for UNIX and Linux platforms, and \ for Windows platforms).

-ssl

Executes the command in SSL mode.

-keystorePath

The full path to the keystore.

-keystoreType

The type of the keystore identified by -keystorePath. For example: -keystorePath jks or -keystorePath PKCS12

-val | -value

The value to set for the attribute This parameter is required with the set operation.

-help

Provides usage help for the command.

4.5.3 Tasks and Examples for manageDIPServerConfig

manageDIPServerConfig get -h myhost.mycompany.com -p 7005 -D login_ID \
   -attr sslmode

manageDIPServerConfig set -h myhost.mycompany.com -p 7005 -D login_ID \
   -attr sslmode -val 2

manageDIPServerConfig set -h myhost.mycompany.com -p 7005 -D login_ID \
   -attr oidhostport -value OID_host:OID_SSL_port

4.6.1 To Configure Oracle Internet Directory for SSL Server-Auth Authentication

Complete the following steps before configuring the Oracle Directory Integration Platform software to use SSL mode. If you have already configured the Oracle Internet Directory software for SSL authentication, skip this section and proceed to Section 4.6.2.

Oracle recommends creating a new OID component and configuring it for SSL server-authentication mode instead of changing the default configuration of oid1.

1. Create a new Oracle Internet Directory component.

   Follow the steps in the "Creating an Oracle Internet Directory Component by Using opmnctl" section, which is located in the Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.

   Name the new Oracle Internet Directory component oid2 (or something similar).

2. Configure SSL for the new Oracle Internet Directory component (oid2).

   Follow the steps in the "Configuring SSL by Using Fusion Middleware Control" section, which is located in the Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.

4.6.2 To Configure the Oracle Directory Integration Platform for SSL Authentication

This procedure describes how to configure the Oracle Directory Integration Platform for SSL authentication with Oracle Internet Directory. For instructions about how to configure Oracle Directory Integration Platform for SSL authentication with other directories, see Section 4.6.3, "To Configure Oracle Directory Integration Platform for SSL Authentication With Directories Other Than OID,".

Before you begin, verify that Oracle Internet Directory is configured for SSL Server-Auth authentication. If necessary, complete the steps in Section 4.6.1 before attempting the steps in this section.

1. Run the following command to export the trusted certificate from the Oracle Internet Directory wallet.

   orapki wallet export -wallet Path_to_OID_wallet -dn Subject_DN_of_trusted_certificate -cert path_to_certificate_file

   The Oracle Internet Directory wallet is available in the following location when created using the Fusion Middleware user interface: $ORACLE_INSTANCE/OID/admin/wallet_name

   For example:

   orapki wallet export
-wallet /home/Middleware/asinst_1/OID/admin/oidwallet
-dn "cn=ldap.oracle.com"
-cert /home/Middleware/asinst_1/OID/admin/oidcert.txt

2. Create a Java Keystore (JKS) using the keytool, and import the trusted certificate exported in the previous step into the JKS.

   keytool -importcert -trustcacerts -alias Some_alias_name
-file Path_to_certificate_file -keystore path_to_keystore

   For example:

   keytool -importcert -trustcacerts -alias OID2
-file /home/Middleware/asinst_1/OID/admin/oidcert.txt -keystore /home/Middleware/dip.jks

   The system will prompt for a keystore password. Type a new password for this keystore.

   Notes:

   • If you use the -keystore option and the keystore does not exist, keytool creates the keystore.

3. Run the following command to update the Java Keystore location in Oracle Directory Integration Platform.

   manageDIPServerConfig set -attr keystorelocation
-val full_path_to_keystore -h weblogic_host -p weblogic_managed_server_port -wlsuser weblogic_user

   Note:

   full_path_to_keystore represents the absolute path to the Java Keystore (JKS) based on the host where Oracle Directory Integration Platform is deployed. When you specify the absolute path to the JKS, use the appropriate path separators (that is, / for UNIX and Linux platforms, and \ for Windows platforms).

   For example:

   manageDIPServerConfig set -attr keystorelocation
-val /home/Middleware/dip.jks -h host -p 7005
-wlsuser weblogic

   The system will prompt for the WebLogic password.

4. Run the following commands to create a CSF credential and update the Java Keystore password:

   1. Open the WLST prompt by running the following command:

      $ORACLE_HOME/common/bin/wlst.sh

   2. Connect to the WebLogic Admin Server:

      connect('Weblogic_User', 'Weblogic_password',
't3://Weblogic_Host:Weblogic_AdminServer_Port')

   3. Create the credential and update the Java Keystore password:

      createCred(map="dip", key="jksKey", user="jksuser", password="JKS_password_created_previously_in_step_2")

5. Log in to the Fusion Middleware user interface and update the Oracle Directory Integration Platform SSL configuration.

   Choose DIP > Server Properties, then set SSL Mode to 2 and the port value to the Oracle Internet Directory SSL port.

6. Restart the Oracle WebLogic managed server.

   Oracle Directory Integration Platform will now connect to Oracle Internet Directory in SSL Server authentication mode.

4.6.3 To Configure Oracle Directory Integration Platform for SSL Authentication With Directories Other Than OID

This section describes how to configure Oracle Directory Integration Platform for SSL authentication with non-OID directories, including Oracle Directory Server Enterprise Edition (previously Sun Java System Directory Server), and Oracle Universal Directory (OUD).

1. Export the trusted certificate from the directory and save it to a file.

2. Import the trusted certificate from the directory into the Java Keystore (JKS).

   keytool -importcert -trustcacerts -alias Some_alias_name
-file Path_to_certificate_file -keystore path_to_keystore

   For example:

   keytool -importcert -trustcacerts -alias sunone
-file /home/Middleware/sunone.cert -keystore /home/Middleware/dip.jks

   Notes:

   • If you use the -keystore option and the keystore does not exist, keytool creates the keystore.

3. During profile creation, select the SSL option and provide the third-party directory SSL port.

4.7.1 Detecting and Removing an Expired Certificate

You can use the keytool utility in the $JAVA_HOME/bin directory to detect and remove expired certificates for Oracle Directory Integration Platform.

To list the valid dates for a trusted certificate in the keystore, execute the keytool utility as follows:

$JAVA_HOME/bin/keytool -list -v -keystore PATH_TO_KEYSTORE

To delete a trusted certificate from the keystore, execute the keytool utility as follows:

$JAVA_HOME/bin/keytool -delete -alias mycert -keystore PATH_TO_KEYSTORE

For general information about certificate expiration, see Chapter 7, "Managing Keystores, Wallets, and Certificates," of the Oracle Fusion Middleware Administrator's Guide.