The LDAP Adapter configuration wizard enables you to attach request controls along with an operation.The Attach Control screen operates in the following manner:

• By default, only the controls applicable to an operation and supported by the connected directory server are listed in the wizard.

• Example: assertionRequest and SubtreeDelete are controls applicable to the delete operation; but if the target directory server does not support the subtree delete operation, only the assertionRequest is listed.

• You can choose to add from other supported controls. These controls are treated as generic and you should test these controls thoroughly as the runtime behavior of these controls is not well-defined.

To see attributes related to an item, double-click the selected entry.

The Attribute viewer displays in a two-column layout. The left column contains the attribute descriptions (or names), the right column contains the attribute values. Each line represents a name-value pair. The section immediately previous, the attributes table displays the distinguished name of the current entry. See Figure 12-4.

Figure 12-4 The LDAP Configuration Wizard Browser Attribute Viewer

Description of "Figure 12-4 The LDAP Configuration Wizard Browser Attribute Viewer"

1. Select the Add Operation from the Operation Type Screen. The LDAP Adapter Configuration Wizard Add Screen appears.

   Figure 12-8 The LDAP Adapter Configuration Wizard Add Screen

   
   Description of "Figure 12-8 The LDAP Adapter Configuration Wizard Add Screen"
2. Select either Use existing entry as a template, or Define structure of the entry to be added (the default). If you choose Use existing entry as a template, click the rectangle to the right to browse for an existing template. If you select Use existing entry as a template, all object classes and attributes of the existing entry are used to define the add request. You can add/remove objectclasses/attributes to modify the add request format.
3. In the Select Object Class to Add section, the list on the left displays all the Object Classes to add. Select an object class to add in the column on the left and move to the right hand column. You can select one or more object classes. On Add, the selected object classes are displayed in the right. You can select object classes you want to remove by selecting and clicking the Remove arrow button for that class.
4. You can select more attributes from the Attributes list. You can add mandatory attributes of the selected object classes to the selected attributes automatically. When you select of an item from the selected object classes, attributes belonging to that object class is displayed in the available attributes item list.

   Attributes that do not have any of the corresponding object classes included are automatically removed. You can remove attributes using the remove arrow button.

5. The Add Suppress Entry Screen appears. Use the Add Suppress Entry Screen to ensure that if an entry exists, and if you are trying to add the entry again, you can suppress such errors.
6. Click Next.
7. The Finish screen displays the names of the LDAP Service WSDL, xsd and jca files.

1. Select the Delete Operation from the Operation Type Screen. The Delete (Suppress Entry) screen appears.

   Figure 12-9 The LDAP Adapter Configuration Wizard Delete Screen

   
   Description of "Figure 12-9 The LDAP Adapter Configuration Wizard Delete Screen"
2. The Delete Screen appears. Select the Suppress entry doesn't exist checkbox if you do not want errors to appear if the entry to delete does not exist. Click Next.
3. The Attach Controls screen appears. See Figure 12-10.

   The Attach Controls Screen provides you the ability to attach controls to provide additional constraints to the Delete operation. You can either Attach Controls or Click Next. If you want to attach controls, that are supported by LDAP Adapter and the target directory server, select the Is Attached check box, to include the control along with the delete request operation. If you need more information about controls, refer to the controls section of LDAP Adapter configurations.

   Figure 12-10 The LDAP Configuration Wizard Delete Attach Controls Screen Showing Delete Controls Added

   
   Description of "Figure 12-10 The LDAP Configuration Wizard Delete Attach Controls Screen Showing Delete Controls Added"
4. Click Next. The Finish screen displays the names of the LDAP Service WSDL, xsd and jca files.

The LDAP Modify operation alters an existing entry in the Directory Server.

Types of alterations performed with Modify include: Add, Delete, and Replace.

• Add: Creates the attribute if it does not exist, and adds the specified values. If the attribute already exists, the specified value is added to the attribute values. The Add operation must contain at least one value, and all values of the attribute must be unique.

• Delete: Deletes specified values from the attribute. If no values are specified, or if all existing values of the attribute are specified, the attribute is removed. Mandatory attributes cannot be removed.

• Replace: Creates the attribute if necessary, and replaces all existing values of the attribute with the specified values. If you want to keep any existing values of a multi-valued attribute, you must include these values in the replace operation. A replace operation with no value removes the entire attribute if it exists, and is ignored if the attribute does not exist.No changes are made to the directory unless all the operations succeed. If the connection fails during a modification, it is unpredictable if the modification occurred.

To use the LDAP Configuration Wizard Modify operation:

1. Select the Modify Operation from the Operation Type Screen. The Modify Operation screen appears.

   Figure 12-11 The LDAP Configuration Wizard Modify Select Object Classes Page

   
   Description of "Figure 12-11 The LDAP Configuration Wizard Modify Select Object Classes Page"

2. Select from the list of Object classes on this page. From the list of Available attributes to Modify, select attributes that can be modified, and move them to Selected. You can also remove them from selected by using the left arrow key. Click Next.

3. The Attach Controls Page appears. See Figure 12-12.

   Use the green plus to add custom controls, or controls provided by the target Directory Server. An example is shown below. Select controls needed, and provide values by entering in the Values column.

   Note:

   Consult your target directory server documentation for supported controls. Check the relevant operation in this chapter before attaching a control. The LDAP Adapter might not support all controls supported by the target directory server.

   Figure 12-12 The LDAP Configuration Wizard Modify Attach Controls Page

   
   Description of "Figure 12-12 The LDAP Configuration Wizard Modify Attach Controls Page"

4. Click Next. The Modify Finish screen displays the names of the LDAP Service WSDL, xsd and jca files.

1. Select the ModifyDN Operation from the Operation Type screen.The LDAP Adapter Configuration Wizard ModifyDN Screen appears. See Figure 12-13.

   Figure 12-13 The LDAP Adapter Configuration Wizard ModifyDN Screen

   
   Description of "Figure 12-13 The LDAP Adapter Configuration Wizard ModifyDN Screen"
2. Select the Delete old RDN check box if you want to delete the old RDN. If you want to modify the DN, but do not want to delete the old RDN, do not check this box. Click Next after either choice.
3. The Attach Controls page appears. See Figure 12-14.

   The Attach Controls screen provides you the ability to choose and attach controls to provide additional constraints to modifying the DN.

   Available controls are specific to your Directory Server. If you choose to attach controls, select the green plus symbol to add controls. Select controls you need, and provide values by entering them in the Values column. Consult your target Directory Server documentation for supported controls. Check the relevant operation in the “controls section of LDAP Adapter configurations” before attaching a control. The LDAP Adapter may not support all controls supported by the target directory server.

4. When this chooser appears, you can either add controls that are supported by your target Directory Server, or you can add custom controls.

   Figure 12-14 LDAP Adapter Configuration Wizard Attach Controls Chooser Screen

   
   Description of "Figure 12-14 LDAP Adapter Configuration Wizard Attach Controls Chooser Screen"
5. Choose either controls supported by the target Directory Server or a Custom Control.

   If you have chosen to attach controls, a page similar to the following appears, which shows both the custom new control and a control that matches those available on the Directory Server ("MatchedValues...") added as controls.

   Figure 12-15 LDAP Configuration Wizard Attach Controls Page

   
   Description of "Figure 12-15 LDAP Configuration Wizard Attach Controls Page"
6. Click Next.
7. The Finish screen displays the names of the LDAP Service WSDL, xsd and jca files.

1. Select the Compare Operation from the LDAP Adapter Operation Type screen.

   Figure 12-16 LDAP Configuration Wizard Operation Type Screen, showing Compare Selected

   
   Description of "Figure 12-16 LDAP Configuration Wizard Operation Type Screen, showing Compare Selected"
2. Click Next.
3. The Finish screen displays the names of the LDAP Service WSDL, xsd and jca files.

1. Select the Search operation from the Operation Type screen. See Figure 12-17.

   Figure 12-17 LDAP Configuration Wizard Operation Type Page with Search Selected

   
   Description of "Figure 12-17 LDAP Configuration Wizard Operation Type Page with Search Selected"
2. The LDAP Configuration Wizard Search Configuration Page appears. See Figure 12-18.

   Use the Search (Request Configuration) Page to provide search information relating to search scope, search referrals, and search alias dereferencing.

   Figure 12-18 The LDAP Adapter Configuration Search Configuration Wizard Search Request Configuration Page

   
   Description of "Figure 12-18 The LDAP Adapter Configuration Search Configuration Wizard Search Request Configuration Page"
3. At the top of the screen, above the other sections, indicate the default search base and default search filter. Provide the search base in the Default Search base text box. Note that Default Search BaseDN and Default Search Filter are considered only when these attributes are not defined in the LdapSearchRequest.
   The following is added in Search Operation schema xsd.

   <element name="searchRequest">
   	<complexType>
   		<sequence>
   			<element name="baseDN" type="string" default="dc=oracle,dc=com"/>
   			<element name="searchFilter" type="string" default="(objectClass=*)"/>
   		</sequence>
   	</complexType>
   </element>

   Select the Browse button to open the directory information tree browser dialog, which can help you specify a search base. See LDAP Browser for more information.

   This is the base DN that defines the source of events. Selecting this DN means you want to notify events under it.

4. In the Default Search filter text box, supply a Search filter to filter the entries that can be returned for a search operation. The filter can be a string representation of a search filter.
5. Search scope defines the Search scope within the tree. This has to be defined at service deployment to control any malignant search request from controlling server resources.

   Check with your Directory Server before using this option. Scope can be:

   • Whole subtree-Select this to indicate a scope of all entries within the subtree.

   • First child only-Select this to indicate a scope of one level below the search base only.

   • Root only-Select this to indicate one event only at the search base.

6. The next section is Search Referrals. A referral is a response returned to the LDAP Adapter that instructs the Adapter to contact another LDAP server to perform the search operation the LDAP Adapter requested.

   In the Referrals section, select one of the following:

   • Ignore-Select to have the LDAP Adapter ignore the referral and returns whatever search operation on the local sever returned.

   • Throw Exception-Select to have the LDAP server not chase the referral, nor does it complete the search by returning results from the local server. Instead, the Server throws an exception on which an action can be initiated.

   • Follow-Select to follow a referral server. These are alternate locations where additional entries may be searched/matched as part of a search request. By default, the LDAP Adapter ignores all referral suggestions unless explicitly asked to follow or throw an exception. (This search can potentially take longer duration and should be a non-blocking activity.)

   • Hop Limit - Select to indicate number of alternate locations participating in search referral. This should be a positive integer. The default value is 1.

7. The next section, which deals with the LDAP server behavior for handling alias entries while processing the search, specifically with dereferencing alias entries, is Search alias dereferencing. Select one of the following:

   • Never-Select this to indicate the server should not dereference any aliases that it encounters.

   • Searching- Select this to indicate that the server should dereference any aliases that it might encounter while examining candidate entries, but it should not dereference the base entry if it happens to be an alias entry.

   • Finding-Select this to indicate that the server should dereference the base entry if it happens to be an alias entry, but it should not dereference any alias entries that may be encountered while examining candidate entries.

   • Always-Select this to indicate that the server should dereference the base entry if the entry happens to be an alias entry, and should dereference any entries that might be encountered while examining candidates.

   Click Next to proceed to the next Page or Finish to finish the Search Operation configuration.

8. If you clicked Next, the LDAP Search (Response Attributes) Page is displayed. See Figure 12-19.

   Use the Search (Response Attributes) Page to configure the Search operation response parameters, using the object classes available on the target LDAP Directory Server.

   Figure 12-19 The LDAP Adapter Configuration Wizard Search (Response Attributes) Page

   
   Description of "Figure 12-19 The LDAP Adapter Configuration Wizard Search (Response Attributes) Page"
9. Select an object class or classes from the Available object classes list box, which displays all object classes available in the schema of the connected target Directory Server.
10. All attributes belonging to the selected object class or classes are displayed in the Available attributes list box. Select from Available attributes and click the arrow to move an available attribute or attributes to Selected.

    If you selected more than one object class, the union of all the attributes are displayed; common attributes are not displayed twice.

    Figure 12-20 shows an example.

    Figure 12-20 LDAP Adapter Configuration Wizard Search (Response Attributes) Page Example Use

    
    Description of "Figure 12-20 LDAP Adapter Configuration Wizard Search (Response Attributes) Page Example Use "
11. Click Next. The Search Configuration Parameters Page appears. See Figure 12-21.

    Figure 12-21 The LDAP Adapter Configuration Wizard Search Configuration Parameters Page

    
    Description of "Figure 12-21 The LDAP Adapter Configuration Wizard Search Configuration Parameters Page"
12. Indicate the following configuration parameters on this page:

    • Attributes Delimiter-Provide a string literal value to delimit the attributes selected by the user.

    • Time Limit-Maximum time the server should wait before returning the results. This is an integer value in seconds with default value as 0 for no time limit.

    • Size Limit-Maximum number of events or entries that could be returned in search results. This is an integer value with the default value as 1000. Set –1 for no limits on the number of events or entries in search results.

    • Types only-Select this checkbox if you want to return only the name of the attributes and not both names and values of attributes.

    Click Next to proceed to the next page.

13. The Attach Controls Page is displayed. Here you can attach controls to provide further constraints to the LDAP Search Operation. Use the plus to add custom controls, or the controls provided by the target Directory Server. Attach controls that are needed, and provide values by entering in the Values column.

    Note:

    Consult your target directory server documentation for supported controls. Check the relevant operation in the “controls section of LDAP Adapter configurations” before attaching a control. The LDAP Adapter might not support all controls supported by the target directory server.
14. The Finish screen displays the names of the LDAP Service WSDL, xsd and jca files.

DSML operations express LDAP requests and responses as XML document fragments. Use the LDAP Adapter DSML screen to specify an execute a DSML request and to optionally enter a Maximum request size for that DSML request on the LDAP Operations Screen.

To use the DSML Execute Request:

1. Specify DSML on the LDAP Operation Type Screen.

2. The DSML Screen appears. See Figure 12-22.

   On this screen, optionally enter the Maximum DSML Request Size. Set this property if you want to control the maximum number of requests that can participate in a DSML batch request. The incoming DSML request is executed if and only if the total number of contained requests is less than this number.

   Figure 12-22 The LDAP Adapter Configuration DSML Configuration Page

   
   Description of "Figure 12-22 The LDAP Adapter Configuration DSML Configuration Page"

3. Click Next. The DSML Operation Finish screen appears, showing the LDAP WSDL, jca and xsd files.

Entry Change Notification enables you to obtain entries that are created or modified on a source directory server. The result contains the modified entry along with information about the type of modification.

This mechanism is based on a timestamp-based search; it does not require any external configuration and is supported by most Directory Servers. With time-based search, a search is done for all entries after a base time stamp. The base time stamp is updated for subsequent timestamp-based searches.

In search, the LDAP Adapter returns results up unto the latest time stamp, it then updates the base time stamp to the latest time stamp. The time interval you configured indicates when the next iteration of the timestamp-based search for all events next occurs.

Time stamp-based search only provides notifications of added or modified entries. With Entry Change Notification, there is no provision to find out deleted entries. This mechanism only notifies about the changed entry that is, it indicates if an entry has been changed, and does not divulge details of the changes that occurred.

There is no way to differentiate between a modify and modifyDN operation as there is no provision to find out deleted entries.

Specifically, Entry Change Notification does not provide notification when an entry enters or leaves the scope of a result set due to a modifyDN operation or when a Modify operation acts on a attribute value that is used in a search filter.

Time-stamp based search does not work with multi-master setups of the Directory Server because the time stamp is generated using the clock on each of the servers and can therefore appear in a non-linear order on a given replica.

Because Entry Change Notification uses Timestamp-based search, which is based on the operational attributes createTimestamp and modifyTimestamp, these attributes should be available, indexed and functional in the directory server for timestamp based search to work properly.

You might see the Unavailable Critical Extension exception in the LDAP Adapter client logs, if any of these attributes are not indexed and functioning correctly.

Refer to your directory server documentation to help ensure these attributes are indexed properly, so they are available during the time stamp search.

The Change Log Notification event provides a detailed log of modifications that were done on entries in Directory Server.

The event includes change details and reconstructs the request message that was executed on the source server that led to this change. This event is particularly useful if the same request is to be replayed on a target server. The Change Log Notification is a very powerful feature in that it provides details on activities.

You can use Change Log Notification to incrementally synchronize a source LDAP directory with other sub-systems. As this mechanism is not part of the LDAP specification, you should check your Directory Server's implementation and the Oracle certification matrix before using this feature, as it might require specific configuration on the source Directory Server before you can use it.

Change Log Notification is not available on a server instance that is configured as either a dedicated directory server or a dedicated replication server.

1. Open the Connection Pool in WebLogic console.
2. Navigate toDeployments, LdapAdapter, Configuration, Outbound Connection Pools, expand javax.resource.cci.ConnectionFactory, and select the pool that you created.
3. Click on theAuthentication tab and ensure that Resource Authentication Source is set to Container.
   If it is not Container and you set it now, click Save.
4. Navigate toDeployments, LdapAdapter, Security, and Outbound Credential Mappings .
5. Click New, and check the ConnectionFactory JNDI for which you want to configure the credentials.
6. Select Default User and select Next.
7. Enter the Enterprise Information System User name as the bindDN information, for example, cn=Directory Manager and enter the password for the bindDN. for example, welcome.
8. Click Finish.
9. Update the LdapAdapter Deployment.