Active Directory Oid 11g Synchronization Log
Leave a Comment:
34 comments
Configure Java External Authentication Plugins in OID 11g Posted on 2017 by Balamurugan C Assume that we have configure AD-OID user synchronization using DIP. Integrating Microsoft Active Directory and Oracle Internet Directory with Database Logins. Establish OID sync with AD using dipassistant –gui Verify accounts. Integrating Microsoft Active Directory and Oracle Internet Directory with Database Logins: Enterprise User Security.
July 10, 2013Can we achieve the same thing wihtout synch
password synch connector?
Like using OIM with OAM/ESSO/OID?
Thanks,
Mann
Password change from AD to OIM can be achieved only via password sync connector.
Other option for password sync could be AD -> OID -> OIM (where password sync from AD to OID using AD-OID integration and then from OID to OIM using LDAPSync) – This will be less preferred route .
Password Sync is better way as this is immediate , why don’t you want to use password sync ?
ReplyAtul Thanks for your reply.
It really helps as always
Actually our Active Directory team is not happy with internal architecture of ‘password synch connector’. During password change it put internal lock which is not considered good here.
One last suggestion.
I was thinking in below direction but do not have experience on any other product other than OIM.
Like I integrate anyone componenet of eSSO with AD so that esSSO password and AD password get in synch. Then integrating OIM with eSSO.
Process might be password from AD >> eSSO>>OIM.
Kindly ignore my ignorance and suggest.
Thanks Again!
Atul,
How about the other way around? OIM to AD sync. Our set up is as follows.
Our college maintains an Oracle ID for every past, current of course future students, faculty, staff, etc.
Our department is currently managing authentication to our department lab systems in AD. This involves importing users each session into AD and setting a temp passwords with a require password change first log in.
This works great except the user accounts are based on the college’s eID. Meaning the samaccountname is the same as the name in the college’s ID management system.
This actually causes a lot of confusion since everyone typically chooses two different passwords for the same user name.
So I was wondering if it is possible to set up a one way password sync from the Oracle IDM to AD.
Seeing as our department only has a small subset of the overall users this makes even more sense to me.
This is how I am hoping it would work. I get registration data for our department. I import new users based on their eID, set a default password for each new user, set user account control not to require password change, never expire. Then behind the scenes the through the connector server on the DC each users password is updated with the password stored in OIM.
That way users can authenticate to our lab systems using the same password they use for everything else throughout the college.
I have seen many examples of syncing like you initially show but none so far the way I am hoping to get things to work.
Is this possible?
Thanks,
Don
Reply@ Don,
From your comment it is not clear which product with in IDM stack do you use to sync data from Oracle to AD. There are two things I can think of OID & OIM and both support password sync from OID/OIM to AD .
Tell me which Oracle Product you use for authentication (where username/password is store) so I can tell you how to sync password from that source to AD or vice versa.
ReplyAtul,
Sorry for the delayed response. I was waiting to hear back what product we are running from our service center. I though we had moved up to Oracle but we still are currently on Sun Identity manager 5.2 patch 4.
Don
ReplyCan any one help me in installing AD PASSWORD Sync for 11gR2.
Reply@ Praveen, What help do you need to install AD password SYNC for 11gR2 ? Password Sync is still 9.1.1.5 Patch Set 7 (9.1.1.5.7) (as of Aug 2013) which is available at http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/connectors-101674.html
Documentation is available at http://docs.oracle.com/cd/E11223_01/doc.910/e11218/install_config.htm#CBDJFBCA Install Password Sync Connector on every Domain Controller Server in AD
ReplyThanks Atul its working fine…
ReplyWhat about part 2???
ReplyAzure Active Directory Synchronization
October 10, 2013I’m looking for part 2 as well. Do you have a link for it? I can’t find it when i do a web search.
Thanks.
Reply@Pranav,
I am going to publish it next week
What type of privileges/role should the OIM service account have to allow password change? Can it be part of the Administrators?
ReplyTo add/delete account in AD. Yes it can be part of Administrators (but neeed to be – Just create/delete/modify)
ReplyI assume this is OIM administrators group but what would be the minimum Active Directory rights required for this account to synchronize the passwords between AD to OIM and vice versa?
Reply[…] Microsoft Windows, Microsoft Exchange, and Password Synchronization), I also posted about Password Synchronization for Active Directory that must be installed on all Microsoft Active Directory Domain Controllers, and is used to sync […]
ReplyAtul,
Can you please suggest how to configure Password Sync connector on a clustered environment, we have more then 2 OIM servers configured. Can we configure OHS server for Password Sycn.
Kindly suggest or provide any link to understand the configuration before implementing it.
Reply@ Ravi,
If you have more than one OIM managed server then either configure OHS server (mod_wl_ohs) or load balancer in front of OIM managed servers and ensure that you can access
http(s)://OHS_or_LBR:ohs_or_lbr_listen_port/spmlws/OIMProvisioning
During password sync connector install on domain controllers (you must install PWD sync on all DCs) when prompted for OIM Host and Port, use OHS or LBR listen host and list port number
Rest all is same as single node OIM password sync
ReplyIf you configure OHS then in OHS mod_wls_ohs there must be
mapping of /spmlws in mod_wl_ohs to OIM server /spmlws