Before the Oracle Key Vault administrator can create a connection to an LDAP directory server, the LDAP administrator must perform preparation tasks.

1. As the LDAP administrator (or a user who has the appropriate privileges), log in to the LDAP directory server.
2. Create or designate existing LDAP groups that you want to map to Oracle Key Vault.
3. Assign users to these LDAP groups.
   The group will determine the privileges that its member users will have in Oracle Key Vault when the connection configuration is complete. If a user must have specific privileges that are not covered by any existing LDAP groups, then create a specific group for this user.
4. Create a service directory user account if such an account does not yet exist, and then provide this account name and its password to the Oracle Key Vault administrator.
   This service directory user account will be used in the LDAP configuration that the Oracle Key Vault administrator will create. Oracle Key Vault will use this account to perform necessary LDAP actions, such as searches. If this user account changes in the future, then notify the Oracle Key Vault administrator immediately.
5. Obtain the trust certificate for the LDAP directory server and then provide this certificate to the Oracle Key Vault administrator.
   This certificate will be used in the LDAP configuration that the Oracle Key Vault administrator will create.

An Oracle Key Vault user who has the System Administrator role uses the Oracle Key Vault management console to create the LDAP connection.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
2. Select the System tab, then Settings from the left navigation bar.
3. In Network Services, click LDAP to display the Manage LDAP Configuration page.
4. Click Add to display the Add LDAP Configuration page.
5. Enter the following settings:
   • Configuration Name: Enter a name for the LDAP configuration. The maximum character length is 120 bytes.
   • Directory Type: Ensure that Microsoft Active Directory is selected from this list.
   • Service Directory User Name: Enter the service directory user account that the LDAP administrator provided. You can enter this name using any of the following formats:
     • NetBIOS Domain Name\Account Name: For example, global\johndoe
     • User principal name: For example, johndoe@example.com
   • Service Directory User Password: Enter the password that the LDAP administrator provided with the service directory user account. If the password changes in the LDAP directory server, you must update it in Oracle Key Vault.
   • Hostname: Enter either a host name or an IP address for the Microsoft Active Directory domain controller (server) that will service the client requests.
   • LDAPS Port: Enter the port number. 636, the default, is the standard port number for LDAP connections for Secure Sockets Layer (SSL) connections.
   • Trusted Certificate: Either paste the contents of the server trust certificate of the LDAP directory server that the LDAP administrator provided, or upload the certificate as a file.
   • Domain Name: This setting is auto-populated when you complete the preceding settings and click the Get Domain Name button. This is the name of the Microsoft Active Directory domain of which the specified host (domain controller) is a member. You cannot change this setting.
   • Search Base DN: This setting is auto-populated when you complete the preceding settings and click the Get Domain Name button. It represents a distinguished name of the search base object, which defines the location in the directory from which the LDAP search begins. This setting is useful for environments where the number of users and groups in a directory is very large, and if the users and groups that are relevant for managing Oracle Key Vault access are placed under this directory container. Setting the base DN to this directory container can help to improve performance for user and group searches. Optionally, modify this search base.
   • Defunct LDAP Users Grace Period (in days): Enter the duration in days after which the users deleted in LDAP directory server are automatically deleted from Oracle Key Vault. This value also defines the duration after which the users whose LDAP configuration no longer exists are deleted from Oracle Key Vault automatically. Enter a positive integer of 0 or higher. The default is 15 days.
6. Click Test Connection to ensure that the connection works.
7. Click Add to complete the configuration.
   The Manage LDAP Configuration page appears, with the new configuration listed under LDAP Configuration Name.

You can configure authorization for LDAP users in Oracle Key Vault by creating LDAP group mappings and granting them appropriate roles and privileges.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
2. Configure the Oracle Key Vault user groups that you want to map to the LDAP groups. You can grant wallet privileges to an LDAP group through Oracle Key Vault user group.
   Ensure that these user groups have the appropriate Oracle Key Vault privileges, and that you understand how privilege grants and revokes work for LDAP users.
3. Select the Users tab, and then Manage LDAP Mappings from the left navigation bar.
4. Click Create to display the Create LDAP Group Mapping page.
5. Enter the following settings:
   • Domain: From the list, select the domain that is associated with the LDAP directory server configuration for which you want to define the mapping.
   • LDAP Group: From the list, select the LDAP group. You can choose from the following:
     • Fetch All Groups provides a listing of all available groups that you can add. Select the group from the menu following this label. If the number of LDAP groups exceeds the number of objects that can be returned in a single search result, then an error is returned. Narrow down your LDAP group search by using either the Filter by CN (Common Name) or Specify DN (Distinguished Name) options.
     • Filter by CN (Common Name) enables you to select from a filtered list by CN. In the field that appears when you select this choice, enter the CN prefix, and in the list following it, select as needed. For example, to search for all the LDAP groups that start with the common name Admin, enter Admin. If the number of LDAP groups that match the Filter by CN (Common Name) criteria exceeds the number of objects that can be returned in a single search result, then an error is returned. Narrow down your LDAP group search by further refining the Filter by CN (Common Name) search or use the Specify DN (Distinguished Name) option.
     • Specify DN (Distinguished Name) enables you to select from a filtered list by DN. In the field that appears when you select this choice, enter the complete DN for the group, and in the list following it, select as needed.
   • Roles: Optionally, grant the Key Administrator role to the LDAP group. (Remember that you cannot grant a role that is different from the role you currently have. Also, you must have received the role with the Allow Forward Grant option.)

     If you want to grant the user the System Administrator or Audit Manager role, then a user who has the Key Administrator role first must create an LDAP group mapping (with or without mapping to any roles, privileges, and user groups). After the LDAP group mapping is created, a user who is granted the System Administrator or Audit Manager role with the Allow Forward Grant option then can edit the existing LDAP group mapping to map it with the corresponding administrative role.

   • Privileges: Optionally, select the Create Endpoint Group to assign privileges to LDAP group.

     If you want to grant the LDAP group the Create Endpoint privilege, then a user who has the Key Administrator role must first create an LDAP group mapping. After the LDAP group mapping is created, a user who is granted the System Administrator role then can edit the existing LDAP group mapping to map it with the Create Endpoint privilege.

   • Similarly, if you want to grant the LDAP group the Monitor privilege, then a user who has the Key Administrator role must first create an LDAP group mapping. After the LDAP group mapping is created, a user with the System Administrator role can then edit the existing LDAP group mapping to grant the Monitor privilege.
   • Access on Endpoint Groups Optionally, select the required endpoint group to grant the Manage Endpoint Group privilege for it to the LDAP group.

     If you want to grant the LDAP group the Manage Endpoint privilege on an endpoint, then a user who has the Key Administrator role must first create an LDAP group mapping. After the LDAP group mapping is created, a user who is granted the System Administrator role then can edit the existing LDAP group mapping to grant the Manage Endpoint privilege on an endpoint by selecting the endpoint from the Access on Endpoints area.

   • User Groups: Optionally, select the Oracle Key Vault user groups that you want to map to the LDAP group.

     You can find information about a user group by clicking its Details button.

6. Click Create.
   The LDAP Access Mappings page appears, where the new mapping is included in the list.
7. Define more LDAP group mappings as necessary.

After the LDAP directory server configuration with Oracle Key Vault is complete, LDAP users can log in to Oracle Key Vault if they have valid authorization.

The login is successful if:

• The user provides the correct LDAP credential.
• The user’s LDAP groups from the LDAP directory server map to at least one of the Oracle Key Vault administrative roles, endpoint or endpoint group privileges, or user groups.

At the login time, user's authorization is determined based on the LDAP groups of which this user is a member. The user is granted administrative roles, endpoint or endpoint group privileges, and the privileges of the user groups that are mapped to user's LDAP groups. When a user successfully logs into Oracle Key Vault for the first time, a new user account is automatically created in Oracle Key Vault. (Ensure that you understand how privilege grants work for LDAP users.)

In a multi-master cluster environment, an LDAP user can log in to any node in the cluster. The first time that the LDAP user logs in to a node, a single Oracle Key Vault-generated user account is created for this user. This account will apply to all nodes in the cluster.

Valid LDAP users can run the Oracle Key Vault RESTful services commands. Oracle Key Vault RESTful Services Administrator's Guide describes how to use the RESTful services utility.

An LDAP user who is a member of an LDAP group that has been mapped to any Oracle Key Vault administrative role, user group, or endpoint or endpoint group privileges can log in to the Oracle Key Vault management console.

1. Open a web browser.
2. Connect using an HTTPS connection and the IP address of Oracle Key Vault.
   For example, to log in to a server whose IP address is 192.0.2.254, enter:

   https://192.0.2.254

3. After the login screen appears, enter the following credentials:
   • Domain: From the list, select the domain of the LDAP user.
   • User Name: Enter your user name using one of the following formats:
     • NetBIOS Domain Name\Account Name: For example, global\johndoe

       For convenience, when a user specifies the user name in the NetBIOS Domain Name or User Principal Name format (described next), the domain name in the drop-down list is automatically selected based on the pattern matching of the NetBIOS domain name or the domain name of the user principal name with the names of the configured domains. You can select the domain manually, as needed. The domain name Local is not an Active Directory domain. The use of the domain Local indicates that the user account was created locally.

     • User principal name: For example, johndoe@example.com
     • Login name: For example, johndoe. This name must match the sAMAccountName attribute of the LDAP user account.
   • Password: Enter your password.
4. Click Login.

A user who has the System Administrator role can enable an LDAP configuration.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
2. Select the System tab, then Settings from the left navigation bar.
3. In Network Services, click LDAP to display the Manage LDAP Configuration page.
4. Select the check box for the LDAP configuration and then click the Enable button.
5. In the confirmation window, click OK.

A user who has the System Administrator role can modify an LDAP configuration.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
2. Select the System tab, then Settings from the left navigation bar.
3. In Network Services, click LDAP to display the Manage LDAP Configuration page.
4. Select the LDAP configuration name to display the Edit LDAP Configuration page.
5. Modify the following settings as necessary:
   • Configuration Name: Update the name of the configuration.
   • Service Directory User Name: Update the service directory user name.
   • Service Directory User Password: Update the service directory user's password.
   • Trusted Certificate: Either paste the contents of the server trust certificate of the LDAP directory server that the LDAP administrator provided, or upload the certificate as a file.
   • Search Base DN: Update the base DN that is used for searching users and groups
   • Defunct LDAP Users Grace Period (in days): Enter a new grace period value. The default is 15.
   • Under Servers, do the following:
     • To add a new server, click Add and then provide the Hostname, Port, and Service Directory User Password. To test the connection, click Test Server. Then click Add. You can only select a server that is in the same domain as the current server.
     • To remove a server, select its check box and then click Delete.
6. Click Test Connection(s) to ensure that the new configuration settings work.
7. Click Save.

   Note:

   Do not add the same LDAP server (domain controller) more than once using different host names and IP addresses. You should add an LDAP server only once. At the cluster or node-specific configuration level, Oracle Key Vault does not allow the addition of a server with the duplicate host name. However, it cannot prevent the addition of the multiple server entries for the same server using different values for the host name. For example, you may add the server once using its host name and another time using its IP address. Such configuration is not recommended.

A user who has the System Administrator role can test an LDAP configuration.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
2. Select the System tab, then Settings from the left navigation bar.
3. In Network Services, click LDAP to display the Manage LDAP Configuration page.
4. Select the LDAP configuration name to display the Edit LDAP Configuration page.
5. Click Test Connection(s).

A user who has the System Administrator role can disable an LDAP configuration.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
2. Select the System tab, then Settings from the left navigation bar.
3. In Network Services, click LDAP to display the Manage LDAP Configuration page.
4. Select the check boxes for the configurations to disable, and then click Disable.
5. In the confirmation window, click OK.

A user who has the System Administrator role can delete an LDAP configuration.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
2. Select the System tab, then Settings from the left navigation bar.
3. In Network Services, click LDAP to display the Manage LDAP Configuration page.
4. Select the check boxes for the LDAP configurations that you want to delete and then click one of the following buttons:
   • Click Delete if there are no mappings defined in Oracle Key Vault for any LDAP groups associated with the LDAP configuration.
   • Click Force Delete if there are group mappings defined for this LDAP configuration. You must have both the System Administrator and Key Administrator role to perform this operation. Otherwise, first delete all LDAP group mappings defined for the LDAP configuration before a user with the System Administrator role deletes the LDAP configuration.
5. In the confirmation window, select OK.

The LDAP group can be mapped to Oracle Key Vault administrator roles, endpoint and endpoint group privileges, and user groups.

An Oracle Key Vault user who has the Key Administrator role can create an LDAP group mapping. At the creation time, the Key Administrator can also optionally map the LDAP group to certain roles and privileges that the Key Administrator is authorized to grant. Depending upon the specific roles and privileges that you want to grant to the LDAP group, users with different administrator roles may need to perform the authorization grant to the LDAP group after the LDAP group mapping is created.

Local Oracle Key Vault users cannot be members of an LDAP group.

After you have created an LDAP configuration, you can create one or more LDAP group mappings.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
2. Select the Users tab, then Manage LDAP Mappings from the left navigation bar.
3. In the LDAP Group Mappings page, click Create.
   The Create LDAP Group Mapping page appears.
4. Enter the following settings:
   • Domain: From the list, select the domain that is registered with Oracle Key Vault.
   • LDAP Group: From the list, select the LDAP group. You can choose from the following:
     • Fetch All Groupsprovides a listing of all available groups that you can add. Select the group from the menu following this label. If the number of LDAP groups exceeds the number of objects that can be returned in a single search result, then an error is returned. Narrow down your LDAP group search by using either the Filter by CN (Common Name) orSpecify DN (Distinguished Name) options.
     • Filter by CN (Common Name) enables you to select from a filtered list by CN. In the field that appears when you select this choice, enter the CN prefix, and in the list following it, select as needed. For example, to search for all the LDAP groups that start with the common name Admin, enter Admin. If the number of LDAP groups that match the Filter by CN (Common Name) criteria exceeds the number of objects that can be returned in a single search result, then an error is returned. Narrow down your LDAP group search by further refining the Filter by CN (Common Name) search or use the Specify DN (Distinguished Name) option.
     • Specify DN (Distinguished Name) enables you to select from a filtered list by DN. In the field that appears when you select this choice, enter the complete DN for the group, and in the list following it, select as needed.
   • Roles: Optionally, select one or more Oracle Key Vault roles to map to the LDAP group.
   • Audit Manager
   • Key Administrator:
   • System Administrator
   Note the following:

   • Allow Forward Grant check box: For each role that you select, a check box forAllow Forward Grant appears. If you want the LDAP group members to be able to grant or revoke the administrative role to and from other users, then select the Allow Forward Grant check box. Only the users who are granted a specific role with the Allow Forward Grant option can grant this role to others including granting it to LDAP users through an LDAP group mapping.

     Remember that you cannot grant a role that is different from the role you currently have. Also, you must have received the role with the Allow Forward Grant option to be able to grant it to an LDAP group mapping.

   • If your site follows strict separation-of-duty guidelines and the user with the Key Administrator role does not have the System Administrator and Audit Manager roles, then granting the System Administrator or Audit Manager role to an LDAP group is a two step-process:
     1. A user who has the Key Administrator role must first create an LDAP group mapping (with or without mapping any roles or privileges).
     2. After the LDAP group mapping is created, a user who is granted the System Administrator or Audit Manager role with the Allow Forward Grant option then can edit the existing LDAP group mapping to map it with the corresponding administrative role and also optionally select the Allow Forward Grant option.

   • Privileges: Optionally, select Create Endpoint or Create Endpoint Group privilege to map to the LDAP group.
     You need to have the System Administrator role to grant the Create Endpoint privilege. If the user creating the LDAP group mapping does not have the System Administrator role, then granting the Create Endpoint privilege to an LDAP group is a two step-process:

     1. A user who has the Key Administrator role must first create an LDAP group mapping.
     2. After the LDAP group mapping is created, a user who is granted the System Administrator role then can edit the existing LDAP group mapping to map it with the Create Endpoint privilege.
   • Access on Endpoints and Endpoint Groups: Optionally, select the required endpoints or the endpoint groups to grant the Manage Endpoint or Manage Endpoint Group privilege on them to the LDAP group. You need to have the System Administrator role to grant the Manage Endpoint privilege on an endpoint. If the user creating the LDAP group mapping does not have the System Administrator role, then granting the Manage Endpoint privilege on an endpoint to an LDAP group is a two step-process:
   1. A user who has the Key Administrator role must first create an LDAP group mapping.
   2. After the LDAP group mapping is created, a user who is granted the System Administrator role then can edit the existing LDAP group mapping to grant the Manage Endpoint privilege on an endpoint by selecting the endpoint from the Access on Endpoints.

   • User Groups: Under user groups select the Oracle Key Vault user groups that you want to map to the LDAP group.
   You can find information about a user group by clicking its Details button.
5. Click Create.
   After the LDAP group mapping is created, mapped roles, privileges and user group mappings take effect when an LDAP group member user logs into Oracle Key Vault. Changes in the LDAP group mapping do not affect the authorization granted to the users in their existing sessions.

You can modify an LDAP group mapping to change its mapped roles, endpoint or endpoint group privileges, and user groups.

1. Log in to the Oracle Key Vault management console as a user who has the necessary authorization to grant the role or privileges to others. For example, to map the Audit Manager role to an LDAP group, you must have the Audit Manager role with the Allow Forward Grant option.
2. Select the Users tab, then Manage LDAP Mappings from the left navigation bar.
3. Under LDAP Group Mappings, find the LDAP group whose privileges you want to change.
4. Select the Edit button for this LDAP group to display the Edit LDAP Group Mapping page
5. Modify the following settings, as necessary:
   • Roles: Optionally, select one or more Oracle Key Vault roles to map to the LDAP group.

     Remember that you cannot grant or revoke a role that is different from the role you currently have. Also, you must have received the role with the Allow Forward Grant option to be able to grant it to an LDAP group mapping.

     To grant the admin roles to the LDAP group mapping, select the corresponding check boxes from the available roles:

   • Audit Manager
   • Key Administrator
   • System Administrator

   Note the following:

   • Allow Forward Grant check box:For each role that you select, a check box for Allow Forward Grant appears. If you want the LDAP group members to be able to grant or revoke the administrative role to and from other users, then select the Allow Forward Grant check box. Only the users who are granted a specific role with the Allow Forward Grant option can grant this role to others including granting it to LDAP users through an LDAP group mapping.

     To revoke the admin roles previously granted to the LDAP group mapping, deselect the check boxes for the corresponding roles. If you want to only revoke the Allow Forward Grant option, then deselect the corresponding Allow Forward Grant check box.

   • Privileges: Optionally, you may grant or revoke the Create Endpoint, Create Endpoint Group, or Monitor privilege to and from the LDAP group mapping.

     You need the System Administrator role to grant or revoke the Create Endpoint privilege or Monitor privilege, and the Key Administrator role to grant, or revoke the Create Endpoint Group privilege.

     To grant the Create Endpoint, Create Endpoint Group, or Monitor privilege, select the check box for the corresponding privilege.

     To revoke the Create Endpoint, Create Endpoint Group, or Monitor privilege, deselect the check box for the corresponding privilege.

   • Access on Endpoints and Endpoint Groups: Optionally, you may grant or revoke the Manage Endpoint or Manage Endpoint Group privilege on one or more endpoints or endpoint groups to and from the LDAP group mapping.

   You need the System Administrator role to grant or revoke the Manage Endpoint privilege and the Key Administrator role to grant or revoke the Manage Endpoint Group privilege.

   To grant the Manage Endpoint privilege on endpoints:

   1. In the Access on Endpoints area, select the endpoints for which you want to revoke the Manage Endpoint privilege.
   2. Click Remove.
   3. Click OK to confirm in the dialog box. After changes are successfully saved, the control stays in the Edit LDAP Group Mapping page.

   To revoke the Manage Endpoint Group privilege on endpoint groups:

   1. In the Access on Endpoint Groups area, select the endpoint groups for which you want to revoke the Manage Endpoint Group privilege.
   2. Click Remove.
   3. Click OK to confirm in the dialog box. After changes are successfully saved, the control stays in the Edit LDAP Group Mapping page.

   • User Groups: Optionally, you may grant or revoke the wallet access by adding or removing the user groups mapping of the LDAP group.

     You need the Key Administrator role to map the user groups.

     To add the Oracle Key Vault user group mapping:

     1. In the User Groups area, select from the available Oracle Key Vault user groups to associate with this LDAP group.
     2. Click Save

     To revoke the Manage Endpoint Group privilege on endpoint groups:

     1. In the User Groups Mapped area, select the user groups for which you want to remove the mapping.
     2. Click Remove User Groups.

   Optionally, select the Details button of the Oracle Key Vault group to modify the user group's settings and privileges.

In the event that LDAP groups change in the LDAP directory server, a user who has the Key Administrator role can validate their mappings in Oracle Key Vault.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
2. Select the Users tab, then Manage LDAP Mappings from the left navigation bar.
3. Under LDAP Group Mappings, select the check boxes for the group mappings that you want to validate.
4. Select the Validate button.
5. In the confirmation window, click OK.

A user who has the Key Administrator role can delete one or more LDAP groups and associated mappings from Oracle Key Vault.

1. Log in to the Oracle Key Vault management console as a user who has the Key Administrator role.
2. Select the Users tab, then Manage LDAP Mappings from the left navigation bar.
3. In the LDAP Group Mappings page, select the check boxes for the LDAP groups that you want to delete.
4. Click Delete.
5. In the confirmation window, click OK.

The LDAP user account in Oracle Key Vault is an automatically created account that is based on the LDAP user account in the configured LDAP directory server.

Oracle Key Vault creates this account the first time that the LDAP user logs in to Oracle Key Vault, capturing the first name, last name, and email attributes of the user. These values cannot be changed in Oracle Key Vault; they can only be changed in their LDAP directory server corresponding account by a privileged LDAP administrator. If these values change, then Oracle Key Vault updates the user account with these values the next time the LDAP user logs in to Oracle Key Vault. Except for granting and revoking wallet privileges to and from this user from Oracle Key Vault, the Oracle Key Vault administrator cannot make any changes to this account.

In a multi-master cluster environment, there is no need for user name conflict resolution because the uniqueness of the account is guaranteed by the LDAP directory server where the LDAP user account exists. If the LDAP user logs in to different nodes in the cluster, then an identical user account is created, and this account is uniform across the cluster. Each of these account creations is timestamped. The Oracle Key Vault synchronization process keeps the most recent account creation timestamp value (that is, from the node where this user was created last). Hence, throughout the cluster environment, the timestamp value is the same as the most recent user account creation timestamp.

You can find information about the Oracle Key Vault-generated LDAP user accounts.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator, Key Administrator, or Audit Manager role.
2. Select the Users tab, and then Manage Users from the left navigation bar.
3. In the Manage Users page, scroll down to Manage LDAP Users area. You can find the following information for each LDAP user.
   You can find the following information:

   • The user's distinguished name (DN)
   • User status
   • Setup Time
   • LDAP Configuration Name
   • Domain Name
4. Click the user name of an LDAP user to see its detailed information including granted administrative roles, endpoint or endpoint group privileges, and user group mappings.

You can find if an LDAP user account that is associated with the Oracle Key Vault-generated LDAP user account is a valid account.

• About the Validation of Oracle Key Vault-Generated LDAP Users
  An Oracle Key Vault-generated user account still exists in Oracle Key Vault if the LDAP user account has been deleted in the source LDAP directory server.
• Validating Oracle Key Vault-Generated LDAP Users
  A user who has the System Administrator role can manually validate Oracle Key Vault-Generated LDAP users.

Users who have either the Key Administrator role or regular users who have privileges to manage wallets can modify the wallet privileges of Oracle Key Vault-generated LDAP user account.

• About Modifying an Oracle Key Vault-Generated LDAP User Account Wallet Privileges
  The wallet privileges that you can change are Read Only, Read and Modify, or Manage Wallet.
• Modifying an Oracle Key Vault-Generated LDAP User Account Wallet Privileges (Key Administrators)
  A user who has the Key Administrator role can grant and revoke wallet privileges for any wallet to LDAP users in Oracle Key Vault.
• Modifying an Oracle Key Vault-Generated LDAP User Account Wallet Privileges (Regular Users)
  A regular user who has privileges to manage wallets can grant and revoke privileges for these wallets to LDAP users in Oracle Key Vault.

A user who has the System Administrator role can delete an LDAP user account from Oracle Key Vault.

1. Log in to the Oracle Key Vault management console as a user who has the System Administrator role.
2. Select the Users tab, then Manage Users from the left navigation bar.
3. In the Manage Users page, scroll down to the Manage LDAP Users section.
4. Select the check box of the LDAP users that you want to remove.
5. Click Delete.
6. In the confirmation window, click OK.
   The user account is deleted immediately.