The following table describes the ISW functionality that is also available in DIP.

DIP does not support high availability (HA) with ODSEE.

DIP supports the following features that are not available in ISW:

The following DIP functionality requires the ODSEE plug-in:

• On demand password synchronization from the connected directory (Active Directory) to the backend directory

• Translate password from the backend to the connected directory (Active Directory)

For both of these features, you must install the ODSEE plug-in, which is released with DIP. See Installing Oracle Directory Server Enterprise Edition Plug-in in Administrator's Guide for Oracle Directory Integration Platform.

Before you begin the transition, consider the following ISW parameters and configuration:

• Synchronization direction of passwords

  • If passwords are synchronized from Active Directory to Directory Server, you must configure the on-demand password synchronization. See Password Synchronization in Administrator's Guide for Oracle Directory Integration Platform.

  • If passwords are synchronized from Directory Server to Active Directory, you must configure the Translate Password feature. See Password Synchronization in Administrator's Guide for Oracle Directory Integration Platform.

  • If passwords are synchronized in both directions, both On Demand Password and Translate Password must be configured.

  These features require that you install and configure the ODSEE plug-in. You can find the ODSEE plug-in in one of the following locations in the Oracle Identity Management distribution package, depending on your platform:

  • On Windows systems: Disk1\utils\dip-plugin\dip-plugin.dll

  • On UNIX or Linux systems: Disk1/utils/dip-plugin/dip-plugin.so

  See Installing Oracle Directory Server Enterprise Edition Plug-in in Administrator's Guide for Oracle Directory Integration Platform.

• Synchronizing the creation of new users

  ISW enables you to not synchronize the creation of new users. DIP does not make any difference and considers an object creation as a synchronization. If the object does not exist, it will be created with the attributes defined in the mapping rules of the profiles. So all the attributes defined as mandatory in the schema need to have a mapping rules in the profile; if not, the first synchronization of the object (that is, creation) will fail.

  See Configuring Directory Synchronization in Administrator's Guide for Oracle Directory Integration Platform.

• Number of Windows domains

  There is no limitation in DIP. Many profiles can be created.

• High Availability (no changes lost when ISW goes down)

  When ISW is down, Message Queue keeps any changes already read. When ISW is up again, Message Queue and ISW synchronize the changes that occurred when ISW was down.

  To support high availability, DIP is deployed on an Oracle WebLogic Cluster that has at least two servers as a part of the cluster. Oracle WebLogic Cluster starts, stops, and monitors DIP in the cluster. See Oracle Directory Integration Platform High Availability in High Availability Guide.

• Security

  DIP, as ISW does, can manage connections over SSL, if SSL is required for your deployment.

• Bidirectional account lockout and unlockout synchronization

  For these features to work correctly, set the symmetric password policy at both ends (the same as recommended for ISW).

• Bidirectional group synchronization

  DIP enables you to manage group synchronization by using the uniquemenber attribute and dnconvert in the mapping rule.

• Multi-Master Replication (MMR) Deployment:

  This item will have consequences in the transition to DIP. If Identity Synchronization for Windows is configured as an MMR deployment, consider the number of Directory Server masters, hubs, and read-only replicas in the deployment.

  In a deployment with multiple Directory Servers, the Identity Synchronization for Windows Directory Server Plug-in must be installed on each master, hub, and read-only replica. When configuring Identity Synchronization for Windows, one Directory Server master is designated as the preferred master. The Directory Server Connector detects and applies changes at the preferred master if it is running. If the preferred master is down, the Connector can optionally apply changes at a second master.

You can configure DIP (through WebLogic Cluster) in high availability (HA) mode, but it will talk to the same ODSEE instance. However, DIP can handle two OUD instances, so to manage the second master, you must also plan a transition from ODSEE to OUD at the same time you are doing the transition from ISW to DIP.

The following table describes the differences in high availability (HA) and multi-master replication (MMR) deployments for ISW and DIP.

If you need information about the ISW Console, see Identity Synchronization for Windows Console.

In the ISW Console, identify the following ISW Directory sources:

• Sun Directory Server on ISW for the DIP back-end directory (ODSEE): host, port, user, and password

• Active Directory on ISW for the DIP connected directory (Active Directory): host, port, user DN, and password.

Save this information in a table for the transition to DIP. For example:

ISW supports two types of attributes:

• Significant: attributes that are synchronized between systems when you create or modify user entries.

• Creation: attributes that are synchronized between systems only when you create user entries.

DIP synchronizes attributes between systems when you create or modify user entries. If a referenced object class requires the presence of a certain attribute, the object creation will fail if the attribute is not synchronized. This failure is caused when a mapping rule is not defined in the profile for the attribute. Once an attribute is defined in a mapping rule, it will be synchronized, and the object creation will succeed.

The goal of this section is to collect all the attribute mappings independently of the ISW types (creation and modification) and to sort them in the way that helps to create DIP profiles. So, consider the mapping of the following user attributes in the ISW configuration:

• Map Attributes for Synchronization

• Synchronization Flow

• Attributes Modification

• Groups Synchronization

srcAttrName:[ReqAttrSeq]:[SrcAttrType]:[SrcObjectClass]:[dstAttrName]:[DstAttrType]:[DstObjectClass]:[MappingFuntion]

# Mapping rules to map groups
cn           : : : groupofuniquenames:cn           : : groupofuniquenames :
member       : : : groupofuniquenames:member       : : orclgroup          :
uniquemember : : : groupofuniquenames:uniquemember : : orclgroup          :  
owner        : : : groupofuniquenames:owner        : : orclgroup          :

1. Make a copy of these export profile template files: activeexport.properties, activeexp.cfg.master, and activeexp.map.master and then rename them as ODSEEToAD.properties, ODSEEToAD.cfg, and ODSEEToAD.map, respectively.
2. Update the ODSEEToAD.properties file, as follows:

   • Profile name: ODSEEToAD

   • Information related to your Active Directory server, such as host and port:

     • odip.profile.condirurl: ad-examplehost.com:636:2

     • odip.profile.condiraccount: cn=Administrator,cn=Users,dc=mat,dc=com

     Copy this information from Table A-12.

   • File names for ODSEEToAD.cfg and ODSEEToAD.map:

     • odip.profile.configfile = ODSEEToAD.cfg

     • odip.profile.mapfile = ODSEEToAD.map

   • odip.profile.oidfilter = (no value)

3. Edit the ODSEEToAD.cfg file, as follows:

   Writer: oracle.ldap.odip.gsi.ActiveWriter

4. Update the ODSEEToAD.map file with the correct domain rules. Here is the structure of the map file:

   DomainRules
   %USERBASE%:%USERBASE%:
   AttributeRules
   srcAttrName:[ReqAttrSeq]:[SrcAttrType]:[SrcObjectClass]:[dstAttrName]:[DstAttrType]:[DstObjectClass]:[MappingFuntion]
   

   The %USERBASE% of the DomainRules section will be filled with the info collected in Table A-12 in Required Mapping Rules for the Export Profile,.

   For example:

   DomainRules:
   ou=people,dc=example,dc=com :ou=isw-ou,dc=mat,dc=com:
   

   One profile could be created for each ISW SUL, but because a profile contains many domain rules, it is possible to create one profile for many SULs that have the same mapping rules.

   The lines in the AttributesRules section are the mapping rules. For DIP, for each attribute you want to synchronize from ODSEE (or OUD) to Active Directory, you must write a mapping rule using the mapping rule format. See Configuring Mapping Rules in Administrator's Guide for Oracle Directory Integration Platform.

   See also Supported Attribute Mapping Rules and Examples in Administrator's Guide for Oracle Directory Integration Platform.

1. Make a copy of these import profile template files located in ORACLE_HOME/ldap/odi/conf: activechgimp.properties, activechgimp.cfg and activechgimp.map and then rename them as ADToODSEE.properties, ADToODSEE.cfg, and ADToODSEE.map, respectively.
2. Update the ADToODSEE.properties file, as follows:

   • Profile name: ADToODSEE

   • Information related to your Active Directory server, such as host and port:

     • odip.profile.condirurl: ad-examplehost.com:636:2

     • odip.profile.condiraccount: cn=Administrator,cn=Users,dc=mat,dc=com

       Copy this information from Table A-15.

   • File names for ADToODSEE.cfg and ADToODSEE.map:

     • odip.profile.configfile = ADToODSEE.cfg

     • odip.profile.mapfile = ADToODSEE.map

   • odip.profile.oidfilter = orclObjectGUID

3. Edit the ADToODSEE.cfg file as follows:

   Reader: oracle.ldap.odip.gsi.ActiveChgReader

4. Edit the ADToODSEE.map file with the correct domain rules.

   The %USERBASE% of the DomainRules section will be filled with the information collected in Table A-17. For example:

   DomainRules
   ou=isw-ou,dc=mat,dc=com:ou=people, dc=example, dc=com :
   

   The mapping rules in the AttributeRules section are filled with content from Table A-17. For example:

   AttributeRules
   # Attribute rules for Windows organizationalunit
   objectguid     : :binary:top  :orclobjectguid:string:orclADObject   :bin2b64(objectguid)
   cn             : :      : User:cn            :      : inetorgperson :
   sAMAccountName : :      : User:uid           :      : inetorgperson :
   sn             : :      : User:sn            :      : person        :
   

   Here are considerations for the writing the mapping rules in Table A-17.

   • Password Synchronization

     The following mapping rule is specific, because it uses a mapping function, OnDemandPassword.

     pwdLastSet : : : user : orclODIPPwdLastSet : : top : onDemandPassword(pwdLastSet)
     

     The orclSourceObjectDN attribute is needed by the plug-ins. It belongs to several objectClasses: orclSunOneObject, orclADObject, orclNDSObject, orclOpenLDAPObject, and orclTDSObject. A rule assigning this value must be included in the (import) profile, although the templates already include it. For example:

     targetdn: : :top:orclSourceObjectDN: :orclADObject:
     

     See Password Synchronization Mechanism in Administrator's Guide for Oracle Directory Integration Platform.

     If you are synchronizing passwords (OnDemand Password feature), you will need to install the ODSEE plug-in, which is part of DIP delivery, on the ODSEE backend. (For OUD, the plug-in is part of OUD). See Configuring Oracle Directory Integration Platform.

   • Group Synchronization

     The following mapping rules must be added:

     # Mapping rules to map groups
     cn           : : :groupofuniquenames:cn           : :groupofuniquenames :
     member       : : :groupofuniquenames:member       : :orclgroup          :
     uniquemember : : :groupofuniquenames:uniquemember : :orclgroup          :
     owner        : : :groupofuniquenames:owner        : :orclgroup          :
     

     See Supported Attribute Mapping Rules and Examples in Administrator's Guide for Oracle Directory Integration Platform.

   • Account Activation/Inactivation

     The mapping rule is specific, as it is using a mapping function, AccountDisable ****. It depends on the backend.

     If ODSEE is the backend:

     userAccountControl:1:::nsAccountLock::top:AccountDisable(userAccountControl)
     

     If OUD is the backend:

     userAccountControl:1:::ds-pwp-account-disabled::top:AccountDisable(userAccountControl)
     

     See Account Disabling Synchronization in Administrator's Guide for Oracle Directory Integration Platform.

Several considerations about DIP profiles are:

• One DIP profile must be created for one ISW Synchronization User List (SUL).

• One DIP profile is for one direction: source to destination. If synchronization is done in both directions, two profiles must be created and associated.