By default, the Novell eDirectory or OpenLDAP Connector retrieves changes to all objects in the container based on the modifytimestamp attribute. If you are interested in retrieving changes to specific types of objects, such as changes to users and groups, then you should configure an LDAP search filter. This filter screens out changes that are not required when the Novell eDirectory or OpenLDAP Connector queries Novell eDirectory or OpenLDAP. The filter is stored in the connected directory matching filter attribute (orclodipcondirmatchingfilter) in the synchronization profile.

The Novell eDirectory and OpenLDAP sample import profiles are configured to retrieve changes to users, groups, and container objects from Novell eDirectory and OpenLDAP, respectively. Computers are not retrieved. The value of the searchfilter attribute is set as follows:

searchfilter=(&(!(modifiersname=connected_dir_account))
(|(objectclass=domain)(objectclass=organizationalunit)
(objectclass=organization)(objectclass=person) (objectclass=groupofnames)))

You use the update operation of the manageSyncProfiles command to update the searchfilter attribute if you want to synchronize entries other than users or groups. For example, the following command updates the searchfilter attribute to synchronize only users and groups:

manageSyncProfiles -operation update -profile profile_name odip.profile.condirfilter searchfilter= (|(objectclass=groupofnames)(objectclass=person))

When integrating with Novell eDirectory, the following attribute-level mapping is mandatory for all objects:

GUID:1: : :orclNDSObjectGUID: :orclndsObject:bin2b64(guid)
Modifytimestamp:1 : : :orclsourcemodifytimestamp: :orclndsobject:
Createtimestamp:1 : : :orclsourcecreatetimestamp: :orclndsobject:
Targetdn:1: : :orclsourceobjectdn: : orclndsobject:

When integrating with OpenLDAP, the following attribute-level mapping is mandatory for all objects:

entryuuid:1: : : orclOpenLdapEntryUUID: : orclOpenLdapObject:
Modifytimestamp:1 : : :orclsourcemodifytimestamp: : orclOpenLdapObject:
Createtimestamp:1 : : :orclsourcecreatetimestamp: : orclOpenLdapObject:
Targetdn:1: : :orclsourceobjectdn: : orclOpenLdapObject:

In the preceding examples, Cn and sn from Novell eDirectory or OpenLDAP are mapped to cn and sn in the Oracle back-end directory.

Customize the attribute mappings by following the instructions in "Customizing Mapping Rules".

Synchronizing deletions from Novell eDirectory or OpenLDAP in the Oracle back-end directory is handled with the reconciliation approach, as described in "About Synchronization from Novell eDirectory or OpenLDAP to the Oracle Back-end Directory". Because the reconciliation process is time and CPU intensive, by default, reconciliation occurs at a 3600 second (or 1 hour) interval. You can modify the length of this interval according to your environment by using the manageSycnProfiles command and -params option to modify the odip.profile.reconciliationtimeinterval parameter.

To avoid decreased performance on the server when synchronizing deletions from Novell eDirectory or OpenLDAP in the Oracle back-end directory, you can customize the comparison to search specific subsets of the DIT. You specify the subset search criteria as part of the map file by using the ReconciliationRules keyword.

The default reconciliation rules for Novell eDirectory are as follows:

inetorgperson:cn:*
groupofnames:cn:*

The default reconciliation rules for OpenLDAP are as follows:

inetorgperson:cn:*
groupofuniquenames:cn:*

The preceding rules specify that the search criteria be applied in the following two steps:

Defining reconciliation rules generates search filters that query Novell eDirectory or OpenLDAP to determine the number of deleted entries. For example, with the myobjclass and attr reconciliation rule example in the previous section, the following search filters are generated in Novell eDirectory or OpenLDAP:

• (&(objectclass= myobjclass) (createtimestamp<=orclodipreconciliationtimestamp) (myattr=val1))

• (&(objectclass= myobjclass) (createtimestamp<= orclodipreconciliationtimestamp) (myattr=val2))

• (&(objectclass= myobjclass)(createtimestamp<= orclodipreconciliationtimestamp)(myattr=val3))

The reconciliation rule and mapping rule also generate corresponding filters in the Oracle back-end directory. For example, the following Oracle back-end directory filters are generated for the myobjclass and attr reconciliation rule:

• (&(objectclass= objclass) (orclndsobjectguid=*)(orclSourceCreateTimeStamp<= orclodipreconciliationtimestamp)(attr=val1))

• (&(objectclass= objclass) (orclndsobjectguid=*)(orclSourceCreateTimeStamp<= orclodipreconciliationtimestamp)(attr=val2))

• (&(objectclass= objclass) (orclndsobjectguid=*)(orclSourceCreateTimeStamp<= orclodipreconciliationtimestamp)(attr=val3))

For Novell eDirectory and OpenLDAP, you can also use the parameters listed in Table 25-1 to specify additional configuration information.

You cannot synchronize passwords from Novell eDirectory to the Oracle back-end directory. You can, however, synchronize passwords from OpenLDAP to the Oracle back-end directory.

Going the other direction, the Oracle Directory Integration Platform can synchronize password changes from the Oracle back-end directory to Novell eDirectory or OpenLDAP only when the directories are running SSL server-side authentication and only when the Oracle back-end directory is Oracle Internet Directory.

Perform the following tasks to synchronize passwords from OpenLDAP to the Oracle back-end directory: