Lessons Learnt from Oracle Unified Directory implementation with Oracle E-Business Suite R12.2.5

© Tieto Corporation
PublicPublic
Lessons Learnt from Oracle Unified
Directory implementation
with Oracle E-Business Suite
R12.2.5
Andrejs Karpovs
Andrejs Prokopjevs

Public
About slide -
Andrejs K.
• Lead Oracle Apps DBA / Architect
• In Oracle DB/Middleware/EBS since 2008
• Works at Tieto
• Oracle Certified Master 11g
• Oracle ACE
• Speaker at worldwide conferences
• UKOUG since 2011,
• COLLABORATE since 2014,
• OUGH, UKOUG_IRE
• Social media
• Twitter: @AndrejsKarpovs
• Blog: adbaday.wordpress.com
2

Public
About slide -
Andrejs P.
3
Apps DBA from Riga, Latvia.
Speaking SQL since 2001.
In Oracle world since 2004.
“In love” with Oracle EBS since 2006.
Andrejs Prokopjevs
Lead Applications Database Consultant
At Pythian since 2011
@aprokopjevs
prokopjevs@pythian.com
https://www.pythian.com/blog/author/prokopjevs/

PublicPublic
Background
Theory

Public
Clearing out the alphabet soup :)
https://docs.oracle.com/middleware/11119/core/INOIM/under_in
stall.htm#INOIM1024
5
OHS

Public
Integration Architecture w/ E-
Business Suite 11i/R12.1
6
Oracle
Virtual
Directory

Public
Integration Architecture w/ E-
Business Suite R12.2
7
Oracle
Unified
Directory
or OID

Public
Oracle Unified Directory:
Brief description
• ldap v3 - Sun iPlanet Directory
• Unified Directory Services Solution
• Storage
• Directory Server
• Proxy
• Virtualization
• Virtual directory view of the different repositories
• Routes data to and from the repositories
• Replication
• Load Balancing
• OUD, OVD and DIP are part of ODS Plus
• Developed entirely in Java
• Embarks Java DB (OBDB JE), no need for extra Oracle DB
8

Public
Oracle Unified Directory:
Replication and High Availability
9

Public
Main differences
OUD OID
• Clustering concept
• Multiple local DBs repl. data
within repl. groups
• Runtime
• Java
• Tools
• No ldapadd anymore,
"ldapmodify --defaultAdd"
• Backup
• No PITR, full or incremental
initiated by “backup” utility
• SSL
• All Java requirements like JKS
keystores
10
• Clustering concept
• Multiple instances connects w/ single
Oracle DB
• Runtime
• C
• Tools
• ldapadd, ldapmodify, ldapdelete and
more.
• Backup
• Leveraging all Oracle Database
backup and recovery features
• SSL
• No special requirements or
associated complications

PublicPublic
Implementation w/
E-Business Suite

Public
Required Software Overview
• E-Business Suite R12.2.5+ (FMW 11.1.1.9, R12.AD.C.7+, patches
22098300, 21229697, 24008856)
• Oracle Directory Integration Platform 11g Release 1 Patch Set 7 (11.1.1.9)
for Oracle Fusion Middleware Identity Management
• Oracle Unified Directory 11g Release 2 Patch Set 3 (11.1.2.3)
• Oracle Directory Services Manager (ODSM) 11.1.2.3
• Weblogic Server 11g (10.3.6)
• Oracle ADF 11.1.1.9
• Oracle Access Manager 11.1.2.3
• Weblogic Server 11g (10.3.6)
• Repository Creation Utility 11.1.1.9
12

Public
Installation and Configuration
Architecture
1
3

Public
Documentation
Best Sources
• Integrating Oracle E-Business Suite Release 12.2 with Oracle Unified
Directory 11gR2 (Doc ID 2003483.1)
• Integrating Oracle E-Business Suite Release 12.2 with Oracle Access
Manager 11gR2 (11.1.2) using Oracle E-Business Suite AccessGate (Doc
ID 1576425.1)
• Oracle® Fusion Middleware Installation Guide for Oracle Identity
Management
• https://docs.oracle.com/middleware/11119/core/INOIM/under_install.ht
m#INOIM1024
14

Public
OUD Integration Steps:
Configure OUD
$ echo "welcome1" > /tmp/oud_pwd
$ ./oud-setup --cli
--hostName myoud.domain.com --ldapPort 1389 --ldapsPort 1636
--adminConnectorPort 4461
--rootUserDN "cn=directory manager" --rootUserPasswordFile /tmp/oud_pwd
--generateSelfSignedCertificate --enableStartTLS
--baseDN dc=example,dc=com
--integration generic
--serverTuning 512m --offlineToolsTuning 512m
--no-prompt
• “generic” integration option allows you to complete the integration
for EBS by creating the necessary naming context.
15

Public
Configure Naming Context
• Very important as this will bring issues at later stages if not executed
• https://docs.oracle.com/cd/E52734_01/oud/OUDAG/eus.htm#BAB
GJFEE
• Locate the LDIF template file at
OUD_instance_dir/config/EUS/modifyRealm.ldif
• Edit and replace as per your configuration:
• dc=example,dc=com
$ ldapmodify -h localhost -p 1389 -D "cn=directory manager" -j pwd-file -f
modifyRealm.ldif
16

Public
• Enable the External Change Log
$ dsreplication enable-changelog -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -r 8989 -
b dc=example,dc=com --trustAll --no-prompt
$ dsreplication enable-changelog -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -r 8989 -
b cn=oraclecontext --trustAll --no-prompt
• Enforce Unique UID Attribute
$ dsconfig -p 4461 -h localhost -D "cn=directory manager" -j /tmp/oud_pwd -n --trustAll set-plugin-prop -
-plugin-name "UID Unique Attribute" --set enabled:true
$ dsconfig -p 4461 -h localhost -D "cn=directory manager" -j /tmp/oud_pwd -n --trustAll set-plugin-prop -
-plugin-name "UID Unique Attribute" --set base-dn:ou=people,dc=example,dc=com
• Configure DIP for OUD
$ $ORACLE_HOME/bin/dipConfigurator setup -wlshost localhost -wlsport 7001 -wlsuser weblogic -ldaphost
localhost -ldapport 1389 -ldapuser "cn=directory manager" -isldapssl false -ldapadminport 4461
• Add Access Control Instructions for OUD
• See MOS note for instructions
Further configuration
17

Public
Registration w/ EBS
• Start EBS Online Patching Cycle (adop phase=prepare)
• Run all the actions against patch_fs
• Registration script
• $FND_TOP/bin/txkrun.pl -script=SetSSOReg -registerldap=yes
-ldapadminuser="cn=directory manager"
• Update EBS Profile Options
• Applications SSO Enable OID Identity: Enabled
• Applications SSO Type: SSWA /wSSO
• Applications SSO Auto Link User: Enabled
• Autoconfig
• Cutover
• Side note: You can do this in hot mode - directly on run
• Multi-node: This isn’t required to be executed on all nodes as stated in the documentation.
18

Public
OAM Integration Steps:
Registration w/ EBS
• Start EBS Online Patching Cycle (adop phase=prepare)
• Run all the actions against patch_fs
• Install WebGate
• $FND_TOP/bin/txkrun.pl -script=SetOAMReg -installWebgate=yes -
webgatestagedir=/path/to/extracted/stage (where Disk1 is extracted)
• Recommendation: Apply WebGate patches now
• $PATCH_BASE/FMW_Home/Oracle_OAMWebGate1
• Deploy AccessGate
• perl $AD_TOP/patch/115/bin/adProvisionEBS.pl ebs-create-oaea_resources -
deployApps=accessgate
• Register OAM
• $FND_TOP/bin/txkrun.pl -script=SetOAMReg -registeroam=yes -ldapProvider=OUD
• Autoconfig
• Cutover
19

Public
OAM Integration Steps:
Registration w/ EBS (II)
• Side note: You can do this in hot mode too - directly on run.
• But beware of Bug 19817016 !!!
• oaea_server1 (AccessGate) port conflict between run and patch
during the fs_clone.
• Solution:
• Stop oaea_server1.
• Run fs_clone.
• Restart oaea_server1.
• Next fs_clone executions will not have this conflict anymore.
20

PublicPublic
Issues faced while
implementing OUD

Public
Issue #1:
Configure Naming Context
• OUD_instance_dir/config/EUS/modifyRealm.ldif
• Documentation bug
$ ls -l $ORACLE_INSTANCE/config/EUS/modifyRealm.ldif
ls: cannot access /u01/app/oracle/product/fmw11g_oud/instances/OUD_instance/config/EUS/modifyRealm.ldif: No such file or directory
$ ls -l $ORACLE_HOME/config/EUS/modifyRealm.ldif
-rw-r-----. 1 oracle oinstall 1608 Nov 15 2013 /u01/app/oracle/product/fmw11g_oud/Oracle_OUD1/config/EUS/modifyRealm.ldif
$
• What does it fix?
# cn=Common,cn=Products,cn=OracleContext
orclSubscriberSearchBase: dc=com
orclSubscriberNickNameAttribute: dc
orclDefaultSubscriber: dc=example,dc=com
# cn=Common,cn=Products,cn=OracleContext,dc=example,dc=com
orclCommonUserSearchBase: ou=people,dc=example,dc=com
orclCommonGroupSearchBase: ou=groups,dc=example,dc=com
• Side note: Handled automatically in 11.1.2.3.161018
22

Public
Issue #2:
No Subscriber found
• Let’s query the naming context we created.
$ ldapsearch -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd -b "dc=example,dc=com" -s one
"(objectclass=*)" "dn”
dn: cn=OracleContext,dc=example,dc=com
$
• Where is my naming context base entry?
$ ldapsearch -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd -b "dc=example,dc=com" -s
base "(objectclass=*)" "dn”
SEARCH operation failed
Result Code: 32 (No Such Entry)
Additional Information: The entry dc=example,dc=com specified as the search base does not exist in the
Directory Server
$
23

Public
• Let’s query the naming context we created.
$ ldapmodify -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd –defaultAdd
dn: dc=example,dc=com
orclversion: 90600
dc: example
orclsubscriberfullname: example
objectClass: top
objectClass: domain
objectClass: orclSubscriber
aci: (targetattr != "userpassword || authpassword || aci") (version 3.0; acl "Anonymous read access to
dc=example, dc=com"; allow (read,search,compare) userdn = "ldap:///anyone";)
$
• Optional: Add read-only ACI permission for non-super-user access (except
password attributes). Example.
Issue #2:
Fix
24

Public
Issue #3:
User and Group Base DNs
• Let’s query the naming context again.
$ ldapsearch -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd -b "dc=example,dc=com" -s one "(objectclass=*)" "dn”
dn: cn=OracleContext,dc=example,dc=com
$
• Where are my user and group base DNs?
• Fix:
$ ldapmodify -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd –defaultAdd
dn: ou=people,dc=example,dc=com
ou: people
objectClass: top
objectClass: organizationalUnit
dn: ou=groups,dc=example,dc=com
ou: groups
objectClass: top
objectClass: organizationalUnit
$
25

Public
Issue #4:
Write permissions for DIP profiles
• Documentation states that we need to apply these ACIs
changetype: modify
add: aci
aci: (target=" ldap:///dc=example,dc=com" )(version 3.0; acl "Entry-level DIP permissions"; allow
(all,proxy) groupdn=" ldap:///cn=odisgroup,cn=DIPadmins,cn=Directory Integration
platform,cn=Products,cn=oraclecontext"; allow (all,proxy) groupdn="
ldap:///cn=dipadmingrp,cn=DIPadmins,cn=Directory Integration Platform,cn=Products,cn=oraclecontext";)
-
add: aci
aci: (targetattr="*")(version 3.0; acl "Attribute-level DIP permissions"; allow (all,proxy) groupdn="
ldap:///cn=odisgroup,cn=DIPadmins,cn=Directory Integration Platform,cn=Products,cn=oraclecontext"; allow
(all,proxy) groupdn=" ldap:///cn=dipadmingrp,cn=DIPadmins,cn=Directory Integration
Platform,cn=Products,cn=oraclecontext";)
• But DIP runtime still fails on writes
• DIP profile DNs are actually running with “odipgroup” App DNs
26

Public
Issue #4:
Fix
$ ldapmodify -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd
changetype: modify
add: aci
aci: (target="ldap:///dc=example,dc=com" )(version 3.0; acl "Entry-level DIP permissions"; allow
(all,proxy) groupdn=" ldap:///cn=odipgroup,cn=DIPadmins,cn=Directory Integration
platform,cn=Products,cn=oraclecontext";)
-
add: aci
aci: (targetattr="*")(version 3.0; acl "Attribute-level DIP permissions"; allow (all,proxy) groupdn="
ldap:///cn=odipgroup,cn=DIPadmins,cn=Directory Integration Platform,cn=Products,cn=oraclecontext";)
• Still an open issue with OID BUNDLE PATCH
11.1.1.9.160719
27

Public
Issue #5: OUD restrictions on
unindexed search
• There are limits when OUD allows non-super-user to do
unindexed searches
• None of Oracle specific attributes are indexed, like it is in
OID
• Example:
[27/Apr/2016:01:25:45 -0700] SEARCH RES conn=381168 op=514 msgID=515 result=50 message="You do not have
sufficient privileges to perform an unindexed search Operation 'SEARCH' failed in participant 'user' for
entry 'ou=people,dc=example,dc=com' Operation 'SEARCH' failed in participant 'user' for entry
'ou=people,dc=example,dc=com'" nentries=0 authzDN="orclodipagentname=AD_DIP_PROFILE,cn=subscriber
profile,cn=changelog subscriber,cn=directory integration platform,cn=products,cn=OracleContext" etime=0
28

Public
Issue #5:
Fix
• Fix: give a permission to your required DIP App DN.
ldapmodify -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd
dn: orclodipagentname=AD_DIP_PROFILE,cn=subscriber profile,cn=changelog subscriber,cn=directory
integration platform,cn=products,cn=OracleContext
changetype: modify
add: ds-privilege-name
ds-privilege-name: unindexed-search
-
add: ds-privilege-name
ds-privilege-name: proxied-auth
29

Public
Issue #6:
cn=changelog data timeout
• By default, purge delay for replication in OUD is set to 1 day. Set it at least
to 1 week
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -w password -n get-replication-server-prop --
provider-name "Multimaster Synchronization" --advanced --property replication-purge-delay
Property : Value(s)
------------------------:---------
replication-purge-delay : 1 d
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -w password -n set-replication-server-prop --
provider-name "Multimaster Synchronization" --set replication-purge-delay:1w
• Historical replication data retention also can be tuned
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -w password -X -n
set-replication-domain-prop --provider-name "Multimaster Synchronization"
--domain-name dc=example,dc=com --set conflicts-historical-purge-delay:7200m
30

PublicPublic
Issues faced while
implementing OAM

Public
Issue #1:
EBS registration
• txkrun.pl -script=SetOAMReg -registeroam=yes -ldapProvider=OUD
Successfully registered the WebGate with OAM
Copying registration artifacts to WebGate configuration directory
Automating the policy configurations...
*** Log File = /u01/prod/fs1/inst/apps/prod_ebsapp01/logs/appl/rgf/TXK/txkSetOAMReg_Wed_Nov_23_15_23_46_2016.xml
Failed while doing policy configurations
• In the log file this will be the only actual information.
<class>oracle.apps.fnd.txk.oam.UserIdentityStoreConf</class>
<message>Test connection to identity server is failed. Please verify the settings and try
again.</message>
<class>oracle.apps.fnd.txk.oam.RegisterOAM</class>
<message>Failed while updating the configurations in OAM console</message>
32

Public
• MOS reference
• OAM Registration With EBS 12.2.4 Fails : ERRORMSG: Failed while
automating policy configurations. (Doc ID 2186398.1)
• States to check hosts / network and validate your LDAP directory
connectivity from OAM, but our connection is fine.
• Only LDAP tracing helped
[25/Nov/2016:13:50:35 +0200] CONNECT conn=1939 from=10.10.10.187:13771 to=10.10.10.160:1389 protocol=LDAP
...
[25/Nov/2016:13:50:35 +0200] UNBIND REQ conn=1939 op=1 msgID=2
...
...
[25/Nov/2016:13:50:36 +0200] SEARCH REQ conn=1940 op=1 msgID=2 base="ou=people,dc=example,dc=com" scope=sub filter="(uid=*)"
attrs="ALL”
[25/Nov/2016:13:50:36 +0200] SEARCH RES conn=1940 op=1 msgID=2 result=0 nentries=0 etime=1
[25/Nov/2016:13:50:36 +0200] SEARCH REQ conn=1940 op=2 msgID=3 base="ou=groups,dc=example,dc=com" scope=sub filter="(cn=*)"
attrs="cn”
Issue #1:
EBS registration (II)
33

Public
• User Base DN and Group Base DN should have at least 1 user and 1
group created. Otherwise the OAM registration fails during the User
Identity Store creation
ldapmodify -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd --defaultAdd
dn: cn=testuser1,ou=people,dc=example,dc=com
objectClass: person
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: top
givenName: John
sn: Tester
cn: testuser1
uid: testuser1
userpassword: welcome1
mail: test@test.com
dn: cn=admins,ou=groups,dc=example,dc=com
cn: testgroup
objectClass: groupOfNames
objectClass: top
Issue #1:
Fix
34

Public
Issue #2:
Config in User Identity Store
• Not an issue, actually. More a recommendation
• User Filter Object Classes: person
• Group Name Attribute: cn
• Group Filter Classes: groupofnames
• Inactivity Timeout (in seconds): 60
35

PublicPublic
Unified Directory
Features

Public
Usage of SSL in DIP for LDAPS (I)
• OID 11.1.1.9 + DIP standard configuration handles the SSL configuration
out-of-the-box. You can access OID in SSL by just changing the port field
in Enterprise Manager.
• Hardened procedure in OUD requires extra DIP configuration
• Obtain certificate
$ openssl s_client -connect myoud.domain.com:1636 -verify 5
verify depth is 5
...
Server certificate
-----BEGIN CERTIFICATE-----
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
-----END CERTIFICATE-----
37

Public
Usage of SSL in DIP for LDAPS (II)
• Create the keystore and configure it
$ keytool -importcert -trustcacerts -alias OUD -file /tmp/saved_base64_ssl_certificate.txt -keystore
$ORACLE_INSTANCE/config/DIP_JKS/dip.jks
$ wlst.sh
> connect('weblogic', 'password','t3://localhost:7001')
> createCred(map="dip", key="jksKey", user="jksuser", password="changeit")
> exit()
$ $ORACLE_HOME/bin/manageDIPServerConfig set -h localhost -p 7005 -D weblogic -attribute keystorelocation
-val /u01/app/oracle/product/fmw11g/dip_inst1/config/DIP_JKS/dip.jks
$ $ORACLE_HOME/bin/manageDIPServerConfig set -attribute sslmode -val 2 -h localhost -p 7005 -D weblogic
$ $ORACLE_HOME/bin/manageDIPServerConfig set -attribute backendhostport -val localhost:1636 -h localhost
-p 7005 -D weblogic
• For any external directory integration similar SSL trust certificate
has to be imported into the DIP configured keystore
38

Public
Usage of SSL in OUD for external
LDAPS connections
• Same case
• Add external SSL trust certificates to OUD keystore
$ keytool -importcert -trustcacerts -alias MY_EXTERNAL_LDAPS -file
/tmp/saved_base64_ssl_certificate.txt -keystore $ORACLE_INSTANCE/OUD/config/keystore
39

Public
External password plugins in OUD
• Use case: Active Directory – passwords are not directly synced by DIP
• OID has a cool feature – external password plugin
• Java based module which forwards the BIND requests to external
LDAP directories for authentication
• OUD does not have these kind of modules, however
• OUD 11.1.2.2+
• Pass Through Authentication (OUD PTA)
• OUD 11.1.2.3+
• On-Demand Password
• Password Translate
• OUD / DIP Synchronization with Active Directory (Doc ID 1534241.1)
40

Public
PTA (I)
• How it works:
• You have your Local Naming Context dc=example,dc=com
with synced user entries by DIP (no userpassword /
orclpassword attributes).
• You configure a new Proxy Workflow and mount external LDAP
Base DN.
• A Workflow Element will merge both sources and use local
context as user provider and external proxy context as
authentication provider.
41

Public
PTA (II)
• Configure OUD LDAP extension
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -X -n create-
extension
--type ldap-server
--extension-name proxy_extension_pta_ext_ldap
--set remote-ldap-server-read-only:true
--set remote-ldap-server-address:myad.example.com
--set remote-ldap-server-port:389
--set remote-ldap-server-ssl-port:636
--set remote-ldap-server-ssl-policy:always
--set ssl-trust-all:true
--set ssl-trust-manager-provider:JKS
--set enabled:true
42

Public
PTA (III)
• Configure OUD Proxy Workflow elements
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -X -n create-workflow-element
--set client-cred-mode:use-specific-identity
--set enabled:true
--set ldap-server-extension:proxy_extension_pta_ext_ldap
--set remote-ldap-server-bind-dn:cn=system_user,ou=ad_system_accounts,dc=example,dc=com
--set remote-ldap-server-bind-password:password
--set remote-root-dn:cn=system_user,ou=system_accounts,dc=ad,dc=example,dc=com
--set remote-root-password:password
--type proxy-ldap
--element-name wf_element_auth_pta_ext_ldap
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -X -n create-workflow-element
--set auth-provider-workflow-element:wf_element_auth_pta_ext_ldap
--set enabled:true
--set user-provider-workflow-element:userRoot # our default naming context created in OUD
--set pta-suffix:ou=people,dc=example,dc=com
--set pta-auth-suffix:ou=people,dc=example,dc=com
--set pta-user-suffix:ou=people,dc=example,dc=com
--type pass-through-authentication
--element-name wf_element_pta_ext_ldap
43

Public
PTA (IV)
• Configure OUD Proxy Workflow
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -X -n create-workflow
--workflow-name pta_ext_ldap_wf
--set base-dn:ou=people,dc=example,dc=com
--set enabled:true
--set workflow-element:wf_element_pta_ext_ldap
• Enable the new configuration
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -X -n set-network-group-prop
--group-name network-group
--set enabled:true
--add workflow:pta_google_openldap_wf
44

Public
PTA (V)
• Configure OUD Proxy Workflow
$ ldapsearch -h localhost -p 1389 -D "cn=user1,ou=people,dc=example,dc=com" -b
"cn=user1,ou=people,dc=example,dc=com" -s base "(objectclass=*)" "orclSourceObjectDN”
Password for user 'cn=user1,ou=people,dc=example,dc=com':
dn: cn=user1,ou=people,dc=example,dc=com
orclSourceObjectDN: cn=user1,ou=People,dc=example,dc=com
• It works
45

Public
On-Demand Password (I)
46
• Configure DIP plugin
$ORACLE_HOME/bin/dipConfigurator setupPlugin -wlshost localhost -wlsport 7001 -wlsuser weblogic -ldaphost
myad.example.com -ldapport 636 -ldapuser "cn=Directory Manager" -isldapssl true
• Create an attribute mapping rule using the Oracle Enterprise
Manager Fusion Middleware Control (or cli)

Public
On-Demand Password (II)
47

Public
48
On-Demand Password (III)

Public
On-Demand Password (IV)
• There used to be a mistake in documentation
• https://docs.oracle.com/middleware/11119/dip/administer/odip_sync_p
rof_confg.htm#OIMIG3331
49

Public
Password Translate (I)
• Configure DIP plugin
• $ORACLE_HOME/bin/dipConfigurator setupPlugin -wlshost localhost -wlsport 7001 -wlsuser weblogic -
ldaphost oudhost -ldapport 389 -ldapuser "cn=Directory Manager" -isldapssl false -ldapadminport
4444
• Do not run if already run during On-Demand setup
• Enable PasswordTranslation
• $ORACLE_HOME/bin/dipConfigurator setupPasswordTranslation -wlshost localhost -wlsport 7001 -wlsuser
weblogic -ldaphost oudhost -ldapport 389 -ldapuser "cn=Directory Manager" -isldapssl false -
ldapadminport 4444
50

Public
Password Translate (II)
• Configure mapping attributes (same workflow as for On-
Demand option)
51

Public
Password Translate (III)
• Didn’t succeed out-of the box
• Unrecognized token in attribute mapping rule
"orclODIPTranslatePassword"
52

Public
Password Translate (IV)
• Password Sync / Translate Using DIP 11gR2PS7
(11.1.1.9.0) shows "Unrecognized token in attribute mapping
rule "xxxxx"" (Doc ID 2013518.1)
• Password Sync / Translate Using DIP 11gR2PS7
(11.1.1.9.0) shows "Unrecognized token in attribute mapping
rule "xxxxx"" (Doc ID 2013518.1)
• None of them really worked
• Maybe another documentation bug, need to verify
53

Public
OUD Access Log
• OUD has access log tracing similar to Apache.
• It tracks everything and YOU SHOULD LOVE IT!
• $ORACLE_INSTANCE/OUD/logs/access
[25/Nov/2016:13:50:35 +0200] BIND REQ conn=1939 op=0 msgID=1 type=SIMPLE dn="cn=directory manager" version=3
[25/Nov/2016:13:50:35 +0200] BIND RES conn=1939 op=0 msgID=1 result=0 authDN="cn=Directory Manager,cn=Root
DNs,cn=config" etime=1
[25/Nov/2016:13:50:35 +0200] UNBIND REQ conn=1939 op=1 msgID=2
[25/Nov/2016:13:50:35 +0200] DISCONNECT conn=1939 reason="Client Disconnect”
[25/Nov/2016:13:50:36 +0200] BIND REQ conn=1940 op=0 msgID=1 type=SIMPLE dn="cn=directory manager" version=3
[25/Nov/2016:13:50:36 +0200] BIND RES conn=1940 op=0 msgID=1 result=0 authDN="cn=Directory Manager,cn=Root
DNs,cn=config" etime=0
[25/Nov/2016:13:50:36 +0200] SEARCH REQ conn=1940 op=1 msgID=2 base="ou=people,dc=domain,dc=com" scope=sub
filter="(uid=*)" attrs="ALL”
[25/Nov/2016:13:50:36 +0200] SEARCH REQ conn=1940 op=2 msgID=3 base="ou=groups,dc=domain,dc=com" scope=sub
filter="(cn=*)" attrs="cn”
54

Public
Virtual Attributes
• An attribute which is more like a function
• The best example: isMemberOf
• Is true if a user is a member of a defined group
• The most useful place to use: LDAP filters
• Example:
• OAM User Identity Store filter to allow only specific group to access
your EBS
• KEY_LDAP_FILTER:
(&(uid={KEY_USERNAME})(isMemberOf=cn=ebs_sso_allowed_users
,ou=groups,dc=example,dc=com))
55

Public
• How Java parameters are managed for OUD (like memory)
• $ORACLE_INSTANCE/OUD/config/java.properties
• Contains JDK home, parameters for runtime, parameters for offline
tools, like same ldapsearch
• Once the changes are applied, execute dsjavaproperties, which will
apply all the changes into the executables
• Example
default.java-home=/u01/app/oracle/product/jdk/jre
start-ds.java-args=-Xms256m -Xmx512m -d64 -XX:+UseCompressedOops -server -XX:MaxTenuringThreshold=1 -
XX:+UseConcMarkSweepGC -XX:CMSInitiatingOccupancyFraction=55
OUD Java Parameter Management
56

PublicPublic
Performance

Public
Overview
• Performance is a feature :)
• Overall the OUD performance is very good
• The more memory you configure – the more you get into the
cache
• Apply 11.1.2.3.161018. Many performance related bugs are
resolved per the change log. “isMemberOf” is the top
mention.
• Some real problems may start only when your data size
exceeds hundreds of thousands, like 400 000 user accounts.
58

Public
Indexes
• Use case: DIP ApplicationToOID profile is doing Root DN sub-search
looking for entries with required orclGUID, to confirm it exists
• With large directories it can spin the CPU a lot
• Can be indexed
dsconfig -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -X -n create-local-db-index --
element-name userRoot --index-name orclguid --set index-type:equality
rebuild-index -h localhost -p 4461 -D "cn=directory manager" -j /tmp/oud_pwd -X -b "dc=example,dc=com" -i
orclguid
• If DIP bootstrap synchronized a huge amount of user accounts (ex from
external directory) – full index rebuild is highly recommended
rebuild-index -b "dc=example,dc=com" --rebuildAll
59

Public
Root DN based search
• Same use case: DIP ApplicationToOID
ldapsearch -h localhost -p 1389 -D "cn=directory manager" -j /tmp/oud_pwd -b ""
"(orclguid=XXXXXXXXXXXXXXXXXXXXXX)" "*"
• OUD will also look into cn=changelog as it interprets it as non-hidden
naming context.
• Fix: No fix. This is how OUD works
• Recommendation: evaluate the data size, and put the memory enough
to cache as maximum as possible.
• https://blogs.oracle.com/sduloutr/entry/oud_external_change_log_and
• OUD - Bad Performance of a Subtree Search on the Root DSE if the
External Changelog is Enabled. (Doc ID 1676998.1)
60

Public
Root DN based search (II)
• If you have external directory using PTA, your search effort
will be doubled, and also will become depended externally.
• Root DN searches are processing every Workflow Element
enabled for the network group.
• Cache !
61

Public
Data cache tuning
• If your LDAP data is 1 GB in size, you can configure your
OUD instance to 2 GB memory and set data cache to utilize
50 %
$ dsconfig -h localhost -p 4461 -D "cn=directory manager" -w password set-workflow-
element-prop --element-name userRoot --set db-cache-percent:50
62

PublicPublic
Summary

Public
OUD Implementation Considerations
• OUD is an interesting lightweight product
• Hard to say if it’s better or worse than OID. Both OUD and OID
have their own pros and cons
• OUD – is a replacement product. OID is going away soon (Dec
2018 / Dec 2021).
• Comparing to 11gR1, where OUD was not usable at all for Oracle
stack integrations, it is now more less ready. Of course, with some
nuances mentioned.
• Simplified setup and configuration
• It takes time to tune everything. Let us be patient
64

PublicPublic

Lessons Learnt from Oracle Unified Directory implementation with Oracle E-Business Suite R12.2.5

More Related Content

What's hot (20)

Viewers also liked (6)

Similar to Lessons Learnt from Oracle Unified Directory implementation with Oracle E-Business Suite R12.2.5 (20)

More from Andrejs Karpovs (7)

Recently uploaded (20)

Lessons Learnt from Oracle Unified Directory implementation with Oracle E-Business Suite R12.2.5