Run the expressSyncSetup command and verify that users and groups are synchronizing:

To configure the realm, do the following:

Mapping rules, an important part of the synchronization profile, determine the directory information to be synchronized and how it is to be transformed when synchronized. You can change mapping rules at run time to meet your requirements.

Each sample synchronization profile includes default mapping rules. These rules contain a minimal set of default user and group attributes configured for out-of-the-box synchronization.

Mapping rules govern the way data is transformed when a source directory and a destination directory are synchronized. Customize the default mapping rules found in the sample profiles when you need to do the following:

• Change distinguished name mappings. The distinguished name mappings establish how the connected directory DIT maps to the Oracle back-end directory DIT.

• Change the attributes that need to be synchronized.

• Change the transformations (mapping rules) that occur during the synchronization.

You can perform any mapping if the resulting data in the destination directory conforms to the schema in that directory.

Once you have established a working synchronization between the Oracle back-end directory and a connected directory, you can customize the attribute mapping rules for your synchronization profiles to meet the needs of your deployment.

To customize the attribute mapping rules for your synchronization profiles:

For example, synchronizing public data does not require SSL, but synchronizing sensitive information such as passwords does. To synchronize password changes between the Oracle back-end directory and a connected directory, you must use SSL server authentication mode.

Securing the channel requires:

• Enabling SSL between the Oracle back-end directory and the Oracle Directory Integration Platform

• Enabling SSL between the Oracle Directory Integration Platform and the connected directory

Although you can enable SSL either between the Oracle back-end directory and the Oracle Directory Integration Platform, or between that server and the connected directory, Oracle recommends that you completely secure the channel before you synchronize sensitive information. In certain cases, such as password synchronization, synchronization can occur only over SSL.

Configuring SSL requires the following:

• Running the Oracle directory server in SSL mode as described in the chapter on Secure Sockets Layer (SSL) in Oracle Fusion Middleware Administrator's Guide for Oracle Internet Directory.

• Running the Oracle Directory Integration Platform in the SSL mode as described in Security Features in Oracle Directory Integration Platform. The SSL mode for Directory Integration Platform must be the same mode used when the the Oracle back-end directory server started. SSL mode 1 is no authentication and SSL mode 2 is server authentication.

  Note:

  • If the Oracle back-end directory is Oracle Internet Directory, then Oracle Directory Integration Platform supports both No Authentication SSL mode (SSL mode 1) and SSL Server Authentication (SSL mode 2). If Oracle Unified Directory or Oracle Directory Server Enterprise Edition is your Oracle back-end directory, then SSL Server Authentication (SSL mode 2) is the only SSL option.

  • Oracle does not recommend using No Authentication (SSL Mode 1).

• Running the connected directory server in SSL mode. Communication with a connected directory over SSL requires SSL server authentication. This requires that both the Oracle back-end directory and the Oracle Directory Integration Platform be run in SSL server authentication mode.

Perform the following steps to configure communication with a connected directory in SSL mode:

1. Generate a certificate for the connected directory. Only the trust point certificate from the server is required. Put the certificate in the connected directory's certificate store.

2. Export the trusted Certificate Authority (CA) certificates to Base 64 encoded format.

3. Import the trusted CA certificates to the Java KeyStore (JKS) using the keytool command. If Oracle Directory Integration Platform is already using an existing JKS, identify the location of it using the -keystore PATH_TO_JKS option. If Oracle Directory Integration Platform does not already have a JKS to use, keytool will create one at the location identified by the -keystore PATH_TO_JKS option.

   For example:

   keytool –importcert –trustcacerts –alias mycert –file PATH_TO_JKS \ 
   -keystore PATH_TO_JKS
   

   If this is the first time you are using the JKS identified by the -keystore PATH_TO_JKS option, you must provide its password and also perform the following steps 3.a and 3.b:

   1. Update the Directory Integration Platform configuration with the location and password used in step 3 by using the manageDIPServerConfig command. For example:

      manageDIPServerConfig set -h HOST –p PORT -D WLS_USER \
      -attribute keystorelocation -value PATH_TO_JKS
      

   2. Update the credential in the Credential Store Framework (CSF) using the following WLST command and replacing the PASSWORD variable with the password used when the keystore was created:

      createCred(map="dip", key="jksKey", user="jksUser", 
      password="PASSWORD",desc="jks password")
      

4. Modify the connected directory connection information, including the host name, profile, and connectedDirectoryURL attribute, using the modify operation of the manageSyncProfiles command.

   manageSyncProfiles update -profile profile_name -file myMapFile
   

   When you configure the connectedDirectoryURL attribute, use the following format:

   host:port:sslmode
   

   Supported values for sslmode are as follows:

   Table 20-1 Supported Values for sslmode in connectedDirectoryURL Attribute

   Supported sslmode Value	Description
   0	No SSL mode. Supported for all directory types.
   1	No Authentication mode. No certificate. Supported only for Oracle Internet Directory. Note: Oracle does not recommend using No Authentication (SSL Mode 1).
   2	Server-Only Authentication mode. Requires certificate. Supported for all directory types.

5. If you used a new JKS in step 3, you must restart the Oracle Directory Integration Platform in SSL mode. If you used an existing JKS in step 3, go to step 6 now.

6. Add a test user and verify that it synchronizes successfully. If the test user does not synchronize successfully, then troubleshoot your SSL configuration.

Oracle Internet Directory supports Java-based external authentication plug-ins. Oracle recommends that you use the Java plug-ins instead of the older, PL/SQL-based plug-ins, which only support Microsoft Active Directory and Oracle Directory Server Enterprise Edition / Sun Java System Directory Server.

The configuration tool for the plug-ins is a Java program called oidexcfg. You use it to configure Java-based external authentication plug-ins for Microsoft Active Directory, Oracle Directory Server Enterprise Edition (Sun Java System Directory Server), Novell eDirectory, IBM Tivoli Directory Server, and OpenLDAP.

To configure an external authentication plug-in, perform the following steps:

To set up an external authentication plug-in to work with multiple external authentication domains, you must perform some manual instructions after you run the external configuration tool. Proceed as follows:

1. Configure the external authentication plug-in as described in "Configuring External Authentication Plug-ins".

2. Search for the plug-in configuration entries created by the configuration tool in step 1, and redirect the search output to a file. Use an ldapsearch command similar to this:

   ldapsearch -p 3060 -D binddn -q -s sub -L \
       -b "cn=plugin,cn=subconfigsubentry" cn="oidexplg_*_ad" >> output.ldif
   

   Note:

   You will be prompted for the password.

   The example shows an Microsoft Active Directory cn. Use the correct plug-in cn for the type of plug-in you configured, as shown in Table 20-2. You can use * as a wildcard, as shown in the example.

   Note:

   For multiple Microsoft Active Directory domains or server external authentication plug-ins, you must synchronize each Microsoft Active Directory server set of users into separate Oracle Internet Directory containers or trees and ensure that appropriate DN is listed in the corresponding plug-in's orclpluginsubscriberdnlist value.

   For example, default plug-ins like cn=oidexplg_bind_ad,cn=plugin,cn=subconfigsubentry and cn=oidexplg_compare_ad,cn=plugin,cn=subconfigsubentry must include orclpluginsubscriberdnlist=cn=ad1,cn=users,dc=mycompany,dc=com.

   New plug-ins like cn=oidexplg_bind_ad2,cn=plugin,cn=subconfigsubentry and cn=oidexplg_compare_ad2,cn=plugin,cn=subconfigsubentry must have orclpluginsubscriberdnlist=cn=ad2,cn=users,dc=mycompany,dc=com.

   You can keep the default names for the default plug-ins and provide a unique name for the new plug-ins.

   Table 20-2 Distinguished Names of External Authentication Plug-ins

   Plug-in Type	DN
   Microsoft Active Directory	cn=oidexplg_compare_ad, cn=plugin,cn=subconfigsubentry cn=oidexplg_bind_ad, cn=plugin,cn=subconfigsubentry
   Oracle Directory Server Enterprise Edition (Sun Java System Directory Server)	cn=oidexplg_compare_iplanet, cn=plugin,cn=subconfigsubentry cn=oidexplg_bind_iplanet, cn=plugin,cn=subconfigsubentry
   Novell eDirectory	cn=oidexplg_compare_Novell eDirectory, cn=plugin,cn=subconfigsubentry cn=oidexplg_bind_Novell eDirectory, cn=plugin,cn=subconfigsubentry
   OpenLDAP	cn=oidexplg_compare_openldap, cn=plugin,cn=subconfigsubentry cn=oidexplg_bind_openldap, cn=plugin,cn=subconfigsubentry

3. Examine the output file. For an Microsoft Active Directory plug-in, the output file resembles the following:

   dn: cn=oidexplg_compare_ad,cn=plugin,cn=subconfigsubentry
   cn: oidexplg_compare_ad
   objectclass: orclPluginConfig
   objectclass: top
   orclpluginname: oidexplg.jar
   orclplugintype: operational
   orclpluginkind: Java
   orclplugintiming: when
   orclpluginldapoperation: ldapcompare
   orclpluginsecuredflexfield;walletpwd: password
   orclpluginsecuredflexfield;walletpwd2: password
   orclpluginversion: 1.0.1
   orclpluginisreplace: 1
   orclpluginattributelist: userpassword
   orclpluginentryproperties: (!(&(objectclass=orcladobject)(objectclass=orcluserv2)))
   orclpluginflexfield;host2: myhost.us.example.com
   orclpluginflexfield;port2: 636
   orclpluginflexfield;isssl2: 1
   orclpluginflexfield;host: myhost.us.example.com
   orclpluginflexfield;walletloc2: /location/wallet
   orclpluginflexfield;port: 389
   orclpluginflexfield;walletloc: /tmp
   orclpluginflexfield;isssl: 0
   orclpluginflexfield;isfailover: 0
   orclpluginclassreloadenabled: 0
   orclpluginenable: 0
   orclpluginsubscriberdnlist: cn=users,dc=us,dc=oracle,dc=com
   
   dn: cn=oidexplg_bind_ad,cn=plugin,cn=subconfigsubentry
   cn: oidexplg_bind_ad
   objectclass: orclPluginConfigobjectclass: top
   orclpluginname: oidexplg.jar
   orclplugintype: operational
   orclpluginkind: Java
   orclplugintiming: when
   orclpluginldapoperation: ldapbind
   orclpluginversion: 1.0.1
   orclpluginisreplace: 1
   orclpluginentryproperties: (!(&(objectclass=orcladobject)(objectclass=orcluserv2)))
   orclpluginclassreloadenabled: 0
   orclpluginflexfield;walletloc2: /location/wallet
   orclpluginflexfield;port: 389
   orclpluginflexfield;walletloc: /tmp
   orclpluginflexfield;isssl: 0
   orclpluginflexfield;isfailover: 0
   orclpluginflexfield;host2: myhost.us.example.com
   orclpluginflexfield;port2: 636
   orclpluginflexfield;isssl2: 1
   orclpluginflexfield;host: myhost.us.example.com
   orclpluginenable: 0
   orclpluginsecuredflexfield;walletpwd: password
   orclpluginsecuredflexfield;walletpwd2: password
   orclpluginsubscriberdnlist:
   cn=users,dc=us,dc=oracle,dc=com
   

4. Create a new LDIF file from the output file as follows:

   1. Change the entry names. In the example shown in the previous step, you would change cn=oidexplg_compare_ad,cn=plugin, cn=subconfigsubentry to cn=oidexplg_compare_ad1, cn=plugin,cn=subconfigsubentry and cn=oidexplg_bind_ad, cn=plugin,cn=subconfigsubentry to cn=oidexplg_bind_ad1, cn=plugin,cn=subconfigsubentry.

   2. Change the value for orclpluginenable. Use value 1 if you want to enable it, and use value 0 if you want to disable it.

   3. Change the values for orclpluginflexfield;host and orclpluginflexfield;port for the external directory host name and port number.

   4. Change the value for orclpluginflexfield;isssl. Use value 1 if you want to enable the SSL connection against the external directory, and use value 0 if you want to disable. If you use value 1, you will also need to change the value of orclpluginflexfield;walletloc and orclpluginsecuredflexfield;walletpwd for the wallet location and password.

   5. Change orclpluginflexfield;isfailover. Use value 1 if to set up the failover against a backup external directory. If you use value 1, then you must also change the value of orclpluginflexfield;host2, orclpluginflexfield;port2 for the host name and port number. To use an SSL connection against the backup directory server, you must to change the value for orclpluginflexfield;walletloc2 and orclpluginsecuredflexfield;walletpwd2.

   6. Modify orclpluginsubscriberdnlist for the plug-in invocation naming context.

   7. Modify orclPluginRequestGroup for the plug-in request group. If this attribute is missing in the search output, then just add the attribute and value in the LDIF file.

5. Add the modified plug-in configuration entries to the Oracle Internet Directory server. Use a command similar to the following:

   $ORACLE_HOME/ldap/bin/ldapadd -h host -p port -D binddn -q \
         -v -f input.ldif

   Note:

   You will be prompted for the password.

Perform the following steps to write an inbound connector:

1. Implement the Reader. The Reader generally extends the target system connector class and implements the DISReadInterface. The different methods of the DISReadInterface are specified in its the javadoc.

   Refer to "Sample Reader for Inbound Connectors" to see an example Reader implementation.

2. Create a sample config file. The following is a typical config file:

   [INTERFACEDETAILS]
   Reader: Complete_classname_including_packageName
   SkipErrorToSyncNextChange: false
   SearchDeltaSize: 500
   UpdateSearchCount: 100
   

3. Create a mapfile containing a set of mapping rules.

4. Create a properties file by setting the configfile, mapfile, and filter parameters.

To test the inbound connector:

Perform the following steps to write an outbound connector:

1. Implement the Writer. The Writer generally extends the target system connector class and implements the DISWriteInterface. The different methods of the DISWriteInterface are specified in its Javadoc.

   Refer to "Sample Writer for Outbound Connectors" to see an example Reader implementation.

2. Create a sample config file. The following is a typical config file:

   [INTERFACEDETAILS]
   Reader: Complete_classname_including_packageName
   SkipErrorToSyncNextChange: false
   SearchDeltaSize: 500
   UpdateSearchCount: 100
   

3. Create a mapfile containing a set of mapping rules.

4. Create a properties file by setting the configfile, mapfile, and filter parameters.

To test the outbound connector: