Insert a hashed password into OID

I have the need to migrate all user accounts (stored in a custom table) into OID as we are moving over all login to Single Sign On
Within our custom table, we store the Application username and password (hashed using DBMS_OBFUSCATION_TOOLKIT.MD5 function)
What I would like to do is migrate these hashed passwords into OID so the users can keep the same passwords as are been currently used in the Application
I have been playing around with the "No Encryption" option in OID as well as the "Userpassword reversable Encryption" attribute in the Password Policy for Realm area but with no real joy
Any suggestions would be welcome otherwise I will have to issue new passwords to all users
Regards
Duncan

If you only need plain SSO you probably can get this to work. LDAP allows storing hashed passwords, and MD5 if I am not mistaken should be supported on OID. EUS (Database authentication) wont probably work, but SSO should be fine.
See note 261780.1, you need to prepend the hash type, and it needs to be base64 encoded. On a LDIF file it should look like this:
userpassword: {MD5}IUg245aBlYtKEGVI1N1gfg==
I never tested this, so good luck. But if you cannot get it to work you can do this the hard way, store the hash on some other attribute, like pager or facsimiletelephonenumber, and implement a ldapcompare and ldapbind plugin to replace the password validation with a custom package.
Regards,
Luis

Similar Messages

Hash password for OID

Hi,
I have created a procedure that will update a users password in OID. I have used this hashing algorithm to perform the hashing:
v_HashedPassword := orasso.wwsso_utl.hash_pwd(p_Password);
The password gets hashed but when the user tries to log on to Portal authentication fails. I assume that this is the wrong way to hash the OID password. Does anyone know how I am supposed to do this??
Regards,
Anniken

Hi,
The problem is solved. I did not need to hash the password before inserting it into OID. The OID did the hashing.
Regards,
Anniken

How to transfer passwords from Oracle DB into OID?

We need to find a way to move our users passwords into OID. We will use OID with Oracle SSO and we wish to consolidate our passwords so that the users only have one (they currently login to forms against their DB username/password). Also, going forward we would like for OID's user's passwords to be syncrhonized with the DB passwords. We are already planning to use LDIF/ldapadd to add username/roles from the DB to OID and we did not see any way to get passwords in from this..

Database authentication (database) and Web authentication (OAM) are different things. The good thing is that nowadays there is ways of integrating Web authentication with database authentication.
How this integration will be done totally depends on your requirements and current technologies/applications. There is a lot of different ways of propagating user credentials from application server to database. So you have to understand the whole picture to get to a conclusion of which implementation is best for your case.
There is no way of giving you a direct response without knowing your requirements and current situation. So I would suggest you to look at a few database concepts (EUS, client_identifier) to get a better understanding of what you could be using.

Hashed password import into LDAP

hello,
is it possible to import MD5 hashed password direct into LDAP instead of creating a new one?
Any help would be appreciated.
Ales Hrncarek
[email protected]

Hello
I'm also interrested in the same topic.
We are working on a project that require programatic registration of portal users.
We found out that the best way to register a new portal user was going directly into ldap.
The only problem i have is finding the right way to encrypt the passwords.
I tried to set the password in clean text, but ofcourse it didn't work (i didn't actually think it would either ;) )
How do you encrypt the password? Is there a java api i can use?
Regards
Per-Jarle Sfther

[BEGINNER] Checking for username and password in OID

Hi all !
I have the requirement to move USER/PASSWORD credentials from DB into OID. I have
created the Organization structure and users now I need to validate user/password.
I'd like to authenticate programmatically with JNDI Java Api so that the code is portable across different AS.
The problem is that, when I issue a search against uid and password:
Attributes matchAttrs = new BasicAttributes(true);
matchAttrs.put(new BasicAttribute("uid", "[email protected]"));
matchAttrs.put(new BasicAttribute("userpassword", "fmarchioni1"));
NamingEnumeration results = ldapContext.search("dc=NDC,dc=Acme,dc=it",matchAttrs);
I get as result:
javax.naming.OperationNotSupportedException: [LDAP: error code 53 - Function not implemented
I suppose it's not allowed to search the userpassword attribute, anyway how can I check the user credentials ?
Thanks
Francesco

The simple way to solve the problem is just to bind to the LDAP server with the login and the password that you want to check.
The more complex is to see if you can get the password hash out of OID, hash the test password using the same algorithm and then compare the values.
Best regards
/Martin

DIP fails loading dynamic groups into OID

Hello,
we're trying to load groups from OeBS into OID and associate them via dynamic groups feature with user records that was loaded earlier as follows:
personid=18630,cn=dev,cn=hrsyncusers,cn=users,dc=ic,dc=lan
orcltimezone=Asia/Yekaterinburg
displayname=NOT ASCII
employeetype=NOT ASCII
givenname=NOT ASCII
postalcode=628484
orcldateofbirth=19610404000000
orclgender=F
departmentnumber=342
uid=18630
mail=HRNULL
cn=NOT ASCII
initials=NOT ASCII
street=NOT ASCII
employeenumber=4824
middlename=NOT ASCII
l=NOT ASCII
orclhiredate=20051107000000
sn=NOT ASCII
personid=18630
c=Russia
title=NOT ASCII
objectclass=inetorgperson
objectclass=person
objectclass=organizationalperson
objectclass=orcluserv2
objectclass=kapitalperson
objectclass=country
objectclass=residentialperson
objectclass=locality
objectclass=top
Among other attributes each user entity has 'departmentNumber' that indicates number of his/her department.
Now trying to load list of departments as dynamic groups with the following config
files:
*** DevHRAgentGroups.cfg ***
[SELECT]
SELECT psv.version_number
, pos.name hierarchyname
, hou.organization_id depno
, poe.organization_id_parent parent_id
, REPLACE(hou2.name, '"') parentname
, poe.organization_id_child child_id
, REPLACE(hou.name, '"') orgname
, ldap://idm01.ic.lan:389/cn=DEV,cn=HRSyncUsers,cn=Users,dc=ic,dc=lan??sub?(depar
tmentnumber='||hou.organization_id||')' ldapuri
, hrl.meaning org_type
FROM per_organization_structures pos
, per_org_structure_versions psv
, per_org_structure_elements poe
, hr_all_organization_units hou
, hr_all_organization_units hou2
, hr_lookups hrl
WHERE pos.business_group_id = psv.business_group_id
AND pos.organization_structure_id = psv.organization_structure_id
AND pos.primary_structure_flag = 'Y'
AND psv.date_to IS NULL
AND poe.org_structure_version_id = psv.org_structure_version_id
AND poe.business_group_id = hou.business_group_id
AND poe.organization_id_child = hou.organization_id
AND poe.business_group_id = hou2.business_group_id
AND poe.organization_id_parent = hou2.organization_id
AND hrl.lookup_code = hou.type
AND hrl.enabled_flag = 'Y'
AND hrl.lookup_type = 'ORG_TYPE'
AND hrl.lookup_code NOT IN (30,40)
AND TRUNC(SYSDATE) BETWEEN hou.date_from AND NVL(hou.date_to, TO_DATE('31.12.4712','dd.mm.yyyy'))
AND hou.last_update_date >= to_date(:BINDVAR,'YYYYMMDDHH24MISS')
*** DevHRAgentGroups.map ***
DomainRules
NONLDAP:cn=DEV,cn=HRSyncGroups,cn=Groups,dc=ic,dc=lan:departmentID=%,cn=DEV,cn=HRSyncGroups,cn=Groups,dc=ic,dc=lan
AttributeRules
orgname:1: : :cn: :groupOfUniqueNames
depno:1: : :departmentID: :kapitalDepartment
ldapuri: : : :labeledURI: :orclDynamicGroup
We're getting the following error in ?/ldap/odi/log/DevHRAgentGroups.trc during HRAgent execution at mapping phase:
Normalized DN : departmentid=82,cn=dev,cn=hrsyncgroups,cn=groups,dc=ic,dc=lan
Changetype is 5
Processing modifyRadd Operation ..
Entry Not Found. Converting to an ADD op..
Processing Insert Operation ..
Performing createEntry..
Exception creating Entry : javax.naming.NamingException: [LDAP: error code 1 - Dynamic group cache update failed.]; remaining name 'departmentid=82,cn=dev,cn=
hrsyncgroups,cn=groups,dc=ic,dc=lan'
[LDAP: error code 1 - Dynamic group cache update failed.]
javax.naming.NamingException: [LDAP: error code 1 - Dynamic group cache update failed.]; remaining name 'departmentid=82,cn=dev,cn=hrsyncgroups,cn=groups,dc=i
c,dc=lan'
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3028)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2934)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(LdapCtx.java:2740)
at com.sun.jndi.ldap.LdapCtx.c_createSubcontext(LdapCtx.java:777)
at com.sun.jndi.toolkit.ctx.ComponentDirContext.p_createSubcontext(ComponentDirContext.java:319)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:248)
at com.sun.jndi.toolkit.ctx.PartialCompositeDirContext.createSubcontext(PartialCompositeDirContext.java:236)
at javax.naming.directory.InitialDirContext.createSubcontext(InitialDirContext.java:176)
at oracle.ldap.odip.gsi.LDAPWriter.createEntry(LDAPWriter.java:1162)
at oracle.ldap.odip.gsi.LDAPWriter.insert(LDAPWriter.java:425)
at oracle.ldap.odip.gsi.LDAPWriter.modifyRadd(LDAPWriter.java:822)
at oracle.ldap.odip.gsi.LDAPWriter.writeChanges(LDAPWriter.java:349)
at oracle.ldap.odip.engine.AgentThread.mapExecute(AgentThread.java:655)
at oracle.ldap.odip.engine.AgentThread.execMapping(AgentThread.java:376)
at oracle.ldap.odip.engine.AgentThread.run(AgentThread.java:237)
DIP_LDAPWRITER_ERROR_CREATE
Error in executing mapping DIP_LDAPWRITER_ERROR_CREATE
DIP_LDAPWRITER_ERROR_CREATE
Please, note. Loading is successful if we commenting out mapping line for labeledURI attribute (that's loading static groups).
Loading is also successful when labeledURI is mapped to
'ldap://idm01.ic.lan:389/cn=DEV,cn=HRSyncUsers,cn=Users,dc=ic,dc=lan??sub?(objec
tclass=person)' but this definetly is not what we are going to get.
I don't have ideas what's wrong for example with the following generated 'labeledURI' attribute:
ldap://idm01.ic.lan:389/cn=DEV,cn=HRSyncUsers,cn=Users,dc=ic,dc=lan??sub?(departmentnumber=82)
Any help is appreciated
Thanks,
Edward

Hi Frank,
there is something wrong with departmentnumber attribute of user records. Searching users with ldapsearch using "departmentnumber=*" filter fails with the following error:
ldap_search: DSA is unwilling to perform
ldap_search: additional info: Function Not Implemented
I think this is probably the cause of failing creation of dynamic groups.
Searching on other user attributes (cn, uid, employyenumber) works fine.
Still don't understand what's wrong with this particular attribute.

Best way to insert millions of records into the table

Hi,
Performance point of view, I am looking for the suggestion to choose best way to insert millions of records into the table.
Also guide me How to implement in easier way to make better performance.
Thanks,
Orahar.

Orahar wrote:
Its Distributed data. No. of clients and N no. of Transaction data fetching from the database based on the different conditions and insert into another transaction table which is like batch process.Sounds contradictory.
If the source data is already in the database, it is centralised.
In that case you ideally do not want the overhead of shipping that data to a client, the client processing it, and the client shipping the results back to the database to be stored (inserted).
It is must faster and more scalable for the client to instruct the database (via a stored proc or package) what to do, and that code (running on the database) to process the data.
For a stored proc, the same principle applies. It is faster for it to instruct the SQL engine what to do (via an INSERT..SELECT statement), then pulling the data from the SQL engine using a cursor fetch loop, and then pushing that data again to the SQL engine using an insert statement.
An INSERT..SELECT can also be done as a direct path insert. This introduces some limitations, but is faster than a normal insert.
If the data processing is too complex for an INSERT..SELECT, then pulling the data into PL/SQL, processing it there, and pushing it back into the database is the next best option. This should be done using bulk processing though in order to optimise the data transfer process between the PL/SQL and SQL engines.
Other performance considerations are the constraints on the insert table, the triggers, the indexes and so on. Make sure that data integrity is guaranteed (e.g. via PKs and FKs), and optimal (e.g. FKs should be indexes on the referenced table). Using triggers - well, that may not be the best approach (like for exampling using a trigger to assign a sequence value when it can be faster done in the insert SQL itself). Personally, I avoid using triggers - I rather have that code residing in a PL/SQL API for manipulating data in that table.
The type of table also plays a role. Make sure that the decision about the table structure, hashed, indexed, partitioned, etc, is the optimal one for the data structure that is to reside in that table.

Error Code 112 when trying to change password through OID

Hi
When I try to change the passwrod of any user by going into OID( I am logged in as orcladmin user) it says Modify failed, error code 112 and details unknown.
Somewhere I founf out that this could be beacuse of Password Policy entries and so when I tried to change the policy entries, it again displayed the same error. So basically I am not able to modify any entry in OID
Immediate help in this regard will be very helpful
Regards
Prateek

I also got this, and was able to work around it by opening the Oracle Directory Manager, logging in as orcladmin, going to the relevant entry and then:
1. Creating another copy of it (using the create copy button), renaming it and its cn slightly
2. Deleting the original
3. Creating yet another copy of the copy, this time naming it what the original was
3. Deleting the first copy.
I think it might have had something to do with the fact that I imported in my entries using bulkload and then was trying to edit them as orcladmin.... making the new versions as above changes the modifier etc to be orcladmin.... but I'm new at this stuff so who knows :)
Good luck,
Heather

How to Synchronize EBS Responsibilities into OID

Hi,
We have SSO enabled on EBS using OAM/OID. Want to find out how can we synchronize EBS Responsibilities into OID. Any feedback is appreciated.
Thanks

Hi,
Please see:
Changes to OID Users Are Not Being Provisioned to E-Business Suite (EBS) FND_USER Table (Doc ID 1129023.1)
Troubleshooting the E-Business Suite Integration with Oracle Internet Directory (OID) and Oracle Access Manager (OAM) - Part 1 OID (Doc ID 1450231.1)
How to Change an SSO User Password in EBS when Integrated with OID (Doc ID 1358433.1)
In addition, please also review:
Integrating Oracle E-Business Suite Release 12 with Oracle Internet Directory and Oracle Single Sign-On 10gR3 (10.1.4.3) (Doc ID 376811.1)
Registering Oracle E-Business Suite Release 11i with Oracle Internet Directory 11gR1 and Single Sign-On (Doc ID 1536984.1)
Thanks &
Best Regards,

Logging into oid with certs

Does anyone have any working code that shows how to log into OID(using DirContext object) that uses a certificate instead of a password.

Check out the security section at following url
http://labserver01.zhwin.ch/oracle/8.1.6/network.816/a77230/concepts.htm#1022903
You can also check the chapters on security and SSL authentication in OID Admin guide at following URL :
http://download-west.oracle.com/docs/cd/A97329_03/manage.902/a95192/toc.htm
Chandar

How do I insert my Edge Animation into Wordpress as an animated/interactive graphic

How do I insert my Edge Animation into Wordpress as an animated/interactive graphic?

Hi ColleenSyron,
Can you check out this video: http://tv.adobe.com/watch/create-like-crazy-with-adobe-edge/episode-5-spice-up-your-wordpr ess-site-with-edge-animate/
Thanks,
Preran

SharePoint List Form using InfoPath 2010 "Cannot insert the value NULL into column 'tp_DocId', table 'Content_SP_00003.dbo.AllUserData'; column does not allow nulls"

I am experiencing issue with my SharePoint site , when I am trying to add new Item in List . Error given below :--> 02/03/2015 08:23:36.13 w3wp.exe (0x2E04) 0x07E8 SharePoint Server Logging Correlation Data 9gc5 Verbose Thread change; resetting trace
level override to 0; resetting correlation to e2e9cddc-cf35-4bf8-b4f3-021dc91642da c66c2c17-faaf-4ff9-a414-303aa4b4726b e2e9cddc-cf35-4bf8-b4f3-021dc91642da 02/03/2015 08:23:36.13 w3wp.exe (0x2E04) 0x07E8 Document Management Server Document Management 52od
Medium MetadataNavigationContext Page_InitComplete: No XsltListViewWebPart was found on this page[/sites/00003/Lists/PM%20Project%20Status/NewForm.aspx?RootFolder=&IsDlg=1]. Hiding key filters and downgrading tree functionality to legacy ListViewWebPart(v3)
level for this list. e2e9cddc-cf35-4bf8-b4f3-021dc91642da 02/03/2015 08:23:36.17 w3wp.exe (0x1B94) 0x1A0C SharePoint Server Logging Correlation Data 77a3 Verbose Starting correlation. b4d14aec-5bd4-4fb1-b1e3-589ba337b111 02/03/2015 08:23:36.17 w3wp.exe (0x1B94)
0x1A0C SharePoint Server Logging Correlation Data 77a3 Verbose Ending correlation. b4d14aec-5bd4-4fb1-b1e3-589ba337b111 02/03/2015 08:23:36.31 w3wp.exe (0x2E04) 0x07E8 SharePoint Foundation Database 880i High System.Data.SqlClient.SqlException: Cannot insert
the value NULL into column 'tp_DocId', table 'Content_SP_00003.dbo.AllUserData'; column does not allow nulls. INSERT fails. The statement has been terminated. at System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) at
System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) at System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject
stateObj) at System.Data.SqlClient.SqlDataReader.ConsumeMetaData() at System.Data.SqlClient.SqlDataReader.get_MetaData() at System.Data.SqlClient.SqlCommand.FinishExecuteReader(SqlDataReader ds, RunBehavi... e2e9cddc-cf35-4bf8-b4f3-021dc91642da 02/03/2015
08:23:36.31* w3wp.exe (0x2E04) 0x07E8 SharePoint Foundation Database 880i High ...or runBehavior, String resetOptionsString) at System.Data.SqlClient.SqlCommand.RunExecuteReaderTds(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream,
Boolean async) at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior, RunBehavior runBehavior, Boolean returnStream, String method, DbAsyncResult result) at System.Data.SqlClient.SqlCommand.RunExecuteReader(CommandBehavior cmdBehavior,
RunBehavior runBehavior, Boolean returnStream, String method) at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior, String method) at System.Data.SqlClient.SqlCommand.ExecuteReader(CommandBehavior behavior) at Microsoft.SharePoint.Utilities.SqlSession.ExecuteReader(SqlCommand
command, CommandBehavior behavior,

Are you trying to setup P2P? Could you explain the process you followed completely? By anychance you create the backup and then created the publication?
Regards, Ashwin Menon My Blog - http:\\sqllearnings.com

Inserting a associative array into a table

Hi,
I am working on a process where I want to store the temporary results in an associative array. At the end of the process I plan to write the contents of the array into a table that has the same structure. (the array is defined as a %rowtype of the table)
Is it possible to execute ONE sql statement that transfers the array into the table? I am on 10g (10.2.0.4.0)
Here's what I have now:
declare
type t_emp is table of emp%rowtype index by pls_integer;
v_emp t_emp;
begin
-- a process that fills v_emp with lots of data
for i in v_emp.first .. v_emp.last
loop
    insert into emp values v_emp(i);
end loop;
end;But it would be better if the loop could be replaced by sql one statement that inserts all of v_emp into emp. Is that possible?
Thanks!
PS: I'm not sure whether it's a good idea to use this approach... building a table in memory and inserting it into the database at the end of the process. Maybe it's better to insert every record directly into the table... but in any case I'm curious to see if it is possible in theory :)
Edited: Added version info

True, SQL cannot access the PL/SQL type.
So you can not do something like this:
insert into emp
select * from table(v_emp)That is not possible.
But FORALL is possible:
FORALL i in v_emp.first .. v_emp.last
    insert into emp values v_emp(i);FORALL makes just one "round trip" to SQL bulk binding the entire contents of the array.
It is much more efficient than the normal FOR loop, though it is mostly a PL/SQL optimization - even the FORALL actually inserts the rows "one at the time", it just hands the entire array to the SQL engine in one go.
If the logic has to be done procedurally, FORALL is efficient.
If the logic can be changed so arrays can be avoided completely and everything done in a single "insert into ... select ..." statement, that is the most efficient.

When I insert an audio CD into my iMac, it automatically starts playing

When I insert an audio CD into my iMac, it automatically starts playing, and I can't figure out why, nor how to stop this behavior. When I click in the upper right corner of my screen where it says "Finder", it shows the Finder as the only application running, and yet SOMETHING must be causing the CD to play. If it is an Extension that is being loaded, is it possible to terminate the Extensions one by one without restarting the computer to see which one is playing the CD?
Is the OS9.1 operating system supposed to automatically play audio CD's when they are inserted into the iMac? Or could it be an Extension that is doing it?And if so, why is no means provided to actually CONTROL the playing of the CD (such as a control panel with PLAY, STOP, SKIP, etc. buttons)?
On a PC, I can press Control/Alt/Delete to bring up the "Task List" that will show me ALL applications and processes currently running, and then terminate apps and processes one by one without having to restart the computer to see which one is playing the CD. Is there an equivalent way to display this information on an iMac that will show me which application or process or extension might be causing the audio CD to play, and allow me to terminate them one by one without restarting the computer until I can see which one is the "problem"?
Jerry

Hi, Jerry -
Welcome to Apple's Discussions.
Finder uses QuickTime in the background to do that, hence no specific app is shown in the Application menu (the far right item in the main menu bar) in addition to Finder.
To unset automatic playing of CDs (and DVDs) -
Open the QuickTime Settings control panel (Apple menu > Control Panels > QuickTime Settings).
In that control panel, select AutoPlay from the pulldown menu in the control panel. Uncheck both the items shown in the new window. Close the control panel.
No restart should be needed in order to make the change effective.
Doing this will also guard against the (now ancient) AutoPlay virus, which could still be lurking somewhere on the net.

My ipods disabled and it needs to connect to itunes. During the restore a window pops up and says i need to type the password into my ipod but i can't. what do i do?

My ipods disabled and it needs to connect to itunes. During the restore a window pops up and says i need to type the password into my ipod but i can't. what do i do?

Then try DFU mode and then restore.
How to put iPod touch / iPhone into DFU mode « Karthik's scribblings

Insert a hashed password into OID

Similar Messages

Maybe you are looking for