OAM 10g Authorization ldap query

Hi all
Please let me know if we can write a LDAP query in Authorization - Deny access to deny the users who are not a member of Usergroup 'X'.
If yes, please give me a sample. Please help.
Thanks

Hi,
Does the solution offered by Sagar (from the above link):
"If your requirement is to give access to all the members of a particular group then you don't require any ldap filters
All you have to do is in the authorization rule -> Allow access -> Select People (here you have to select group so click on the group tab, its little hard to see but its there in light blue color on dark blue tab) -> select the group you want to give access"
(which also applies to Denying access to groups) meet your needs?
Regards,
Colin
Edited by: ColinPurdon on Jun 27, 2011 9:20 AM

Similar Messages

OAM Authorization cache query

Hi
I have a resource protected with OAM 10g and am using a custom authorization plugin for this resource which makes a LDAP call and returns the result.
I want to know whether OAM user cache works with custom authorization plugins as well or not.
Please let me know your understanding.
Thanks

The authorization plugin result will not be cached and your plugin will be executed every-time authorization is requested.
If you are trying to make an LDAP call in the plugin a better way would be to use LDAP filters in the authorization expressions.
Hope this helps,
Sagar

URGENT: OAM 10g server and webgate certificates query

Hi experts,
There is an OAM 10g environment. OAM Access Server and Identity Server is installed and up and running. OAM servers are in CERT mode. So to install webgates residing in different machines from OAM servers, can we use the same OAM Access Server certificates for WebGate certificate while installing WebGate?
Thanks
IDM Team.
Edited by: 898990 on Mar 13, 2013 1:38 PM

Figured it out. The OAM proxy (AccessServerConfigProxy @port 5575) for 10g webgates was configured to listen in cert mode. I had to switch it to open mode. Not sure how it got switched, but got the webgate install going for now. Thanks.

OAM 10g - custom resource type issue

I've created a custom resource type, say, boolean with one operation: TRUE. Then I defined resources of type boolean in my domain: /folder, /folder/1
and /folder/2. I created a policy that sets TRUE for resources /folder, /folder/*, and the rule is some LDAP query, like ldap:///<my_suffix>??sub? (|(attr='A')(title='B')). Then when I run policy tester for a user (who I know has attribute I set in the LDAP query) and for example, resource /main/1, OAM tells me: policy name - correct name, rule - undefined, authorization - inconclusive. If anyone played with custom resource types, can you please advise? Why does it say "rule not found"?
Thanks,
-Alex

Hi Alex,
Doing the equivalent works for me - I suspect that it's a problem more with the resource syntax that the policy is protecting than with custom resource types. In my env I have:
- Policy Domain protecting resource of type boolean, resource /folder1
- Policy within the domain protecting url prefix /folder1, url pattern test/.../*, resource type boolean, resource operation TRUE
- authorisation rule (used in the Authorisation Expression for the policy) ldap:///dc=example,dc=com??sub?(|(uid=bjensen)(givenName=*ba*))
and the Access Tester shows the rule and expected results when testing url boolean:///folder1/test/whatever
Are you using the /.../* syntax in your policy?
Regards,
Colin

OAM 10g - obmygroups and nested dynamic groups

I've run into an issue with the obmygroups header action in OAM 10g, and I'm not sure whether this is by design or not.
The obmygroups will return static and dynamic group names for which the user is a member, and it will return static groups that contain nested static groups where the user is a member of the nested group. However, it doesn't seem to static groups with nested dynamic groups where the user is a member of the nested dynamic group.
Is that by design? Is there any way to nest dynamic groups so that obmygroups will return the parent group name? I'd like to have a group that contains both nested static and nested dynamic groups, and have the obmygroups action return the name of the parent group.
Thanks,
Matt

Return Attribute Action in authentication or authorization rules
obmygroups:<ldap_url> special attribute returns those groups to which the user belongs that also satisfy the criteria <ldap_url> filter specifies.
EX: "obmygroups:ldap:///cn=Groups,dc=myorg,dc=com??sub(group_type=role) returns all the groups in cn=Groups,dc=myorg,dc=com tree for which the logged-in user is a member and the group_type is role.
For more information check OAM Access Administration Guide

OAM 10g attribute is not visible in object class in Identity System console

Hi All,
This is about OAM 10g environment with OID used as user/config/policy store. There are one custom user object class and custom attributes defined in Identity System console already. Now there is a requirement to add another custom attribute to that already existing custom user object class.
I have created the attribute in schema through ldap command and I am able to see it in LDAP browser as well. However even after restarting OAM identity server and webpass services, the attribute is not visible in Identity System console -> Common Configuration -> Objectclasses -> Custom object class.
Appreciate any help. Please treat this as urgent.
Thanks
Mahendra.

The solution is to add the attributes in OVD schema as OVD is the user store.

OAM 10g reinstall issue

We're having a problem reinstalling OAM 10g.
We had an OAM 10g install with config and user data stored in OID. All the OAM components were uninstalled from a testing server, the oblix schema objects, attributes and oblix branch were deleted from OID. The ID server and webpass were reinstalled and the ID server web config step carried out, but after that the ID server will not restart because it can't find an ID. When we look at the new oblix branch in the ldap there isn't much there and specifically the DBAgents entry is missing.
The suggestions for the error all point to it being that this isn't the first ID server to be installed in the ldap. We've uninstalled the first one and tried to remove everything from the ldap. Can anyone suggest what we may have left behind in the ldap because something is retaining a reference to the previous install.
Thanks for any help.

If a component installation terminates (or is terminated by you) after component files were extracted to the designated installation directory, you should run the Uninstaller for that component and then remove the installation directory before attempting to reinstall in the same location.
If you simply delete the installation directory and attempt to reinstall the component in the same location, the vpd.properties file is left in an inconsistent state and reinstalling will not work.
For example, suppose you terminate a WebGate installation after component files were extracted, then you remove the installation directory manually rather than using the WebGate uninstaller.
In this case, the extracted files are deleted but the vpd.properties file is not. This leaves the vpd.properties file in an inconsistent state that prevents successful installation.
Reinstalling Oracle Access Manager with Oracle Internet Directory
If Oracle Access Manager will be removed and reinstalled with the same directory instance, only the Oracle Access Manager configuration tree(s) need be deleted.
In this case, there is no need to remove the Oracle Access Manager schema from the directory instance.
When reinstalling the Identity Server, select "No" when asked if you want to update the schema (which is already present). Selecting "Yes" results in an an error message "schema already exists".
You remove the Oracle Access Manager configuration tree from the directory server instance using tools and instructions from your directory vendor.
For Oracle Internet Directory, for example, you may use the Oracle Internet Directory Administration Console.
However, you cannot simply delete the parent object because there are dependencies and recursive deletes are not possible.
Oracle recommends that you do not remove the Oracle Access Manager schema from Oracle Internet Directory using the Console.
Instead, Oracle recommends that you use the LDIF files in Component_install_dir\identity\access\oblix\data.ldap\common. For example:
OID_oblix_schema_index_delete.ldif : Oracle Access Manager attrbitue index cleanup file drops the Oracle Access Manager indexes before or after you clean up the schema.
OID_user_schema_delete.ldif—Oracle Access Manager user data cleanup file for Oracle Internet Directory—removes user data that resides on a separate directory instance from configuration data
OID_oblix_schema_delete.ldif—Oracle Access Manager configuration data cleanup file for Oracle Internet Directory—removes both user and configuration data when both reside on the same directory instance
When user data and configuration data reside in the same directory instance, only the OID_oblix_schema_delete.ldif needs to be used with the because it will also remove the user schema objects.
However, when a separate directory instance hosts only user data the OID_user_schema_delete.ldif should be used. In either case, however, you must use the OID_oblix_schema_delete.ldif to remove the attribute index.
For steps, see Chapter 20, "Removing Oracle Access Manager".

Have OAM authenticate/authorize users against diff dir servers

Hi folks,
Is there a way to have OAM authenticate/authorize users against diff dir server under single OAM instance?
We have standalone OAM 10_1_4_3_0 w OHS11g installed on linux and connected to a particular directory server (sun ldap). We also have an OAM-protected app which authenticate/authorizes users against the same dir server. Can we somehow configure rules/policies/etc, so that users accessing app B will be authenticated/authorized against dir server B; users accessing app C will be authenticated/authorized against dir server c; etc, without having multiple OAM instances?
Any help is greatly appreciated
Thank you, Roman

OVD will not be able to figure out what directory servers its getting authenticated to. OVD is a virtual directory server which can talk to different data sources and fetch a match according to the request.
For instance, if OVD is configured to AD, SunOne LDAP, OID and Oracle DB. When you call OVD for authentication, it will make a call to all the data sources (AD/OID/LDAP/DB) and gets a match and provides to OAM. If you have 2 Auth modules one with Sun LDAP and other with Oracle DB, OVD will not remember to which data source it should make a call. All it does is dynamically makes calls to all the configured data source and gets a matching results.
To tell you in more detail - Consider App A is configured to authenticate against SunOne LDAP and App B is configured to get authenticate against Oracle DB. When user tries to login to App A; OAM makes a call to OVD and OVD [OVD don't have capability of maintaining the info of users and where they reside] will make a call to both SunOne LDAP and Oracle DB and when SunOne returns a matching record, OVD sends the authentication info to OAM.
For better results, try to maintain the same set of schema across all your data sources.

OAM 10g Reset Password Issue in Password Policy Management

Hi,
We are using OAM 10g and we have configured password policy for our application with selecting "Change on Reset" Check Box.
We have created new user in create user identity tab and when we are logging with new user for the first time, it is not redirecting to the reset password page.
Can someone shed light on this issue?
Thanks,
Ganesh

Hi Colin,
As you said, We have configured obpasswordchangeflag in Create User Workflow by setting the default value true.
We have created new user in create user tab and checked in LDAP Browser as it is showing obpasswordchangeflag =true in newly created user's profile.
Now, when we are trying to login with new user, it is still not redirecting to the Reset Password Page.
please find below the url which we have configured in Password Policy Change Redirect URL:
/identity/oblix/apps/lost_pwd_mgmt/bin/lost_pwd_mgmt.cgi?program=redirectforchangepwd&login=%loginid%%userid%&backURL=%HostTarget%%RESOURCE%&STLogin=%applySTLogin%&target=top&style=style1
Can you please help me on this issue?
Thanks,
Ganesh

OIM 9.1 and OAM 10g integration document

Hi,
Could you please provide me any link or document for OIM 9.1.0.2 integration with OAM 10g ?
Thanks
Sandy

Best Practices Document:
http://download.oracle.com/docs/cd/E14899_01/doc.9102/e14761/oamsso.htm#sthref78
Within OIM, once you have configured OAM to pass a header variable, it's just 2 parameters that change in the OIM xlconfig.xml file.
-Kevin

MMP using wrong search base when doing LDAP query.

Hi all,
I installed a new MMP (sun java communication suite v5 on Redhat linux x86).
When an imap user connects to MMP, the MMP does an ldap query for attributes "MailHostAttrs mailHost".
This query fails because the search base is
SRCH base="dc=my,dc=domain,dc=com,o=my.domain.com"
instead of simply "o=my.domain.com"
When I ran 'configure' I specified the Organization DN to be o=my.domain.com
And I've specified the following in the ImapProxyAService.cfg file:
LdapUrl "ldap://ldap1.my.domain.com:389/o=my.domain.com"
UserGroupDN "o=my.domain.com"
DefaultDomain my.domain.com
So why does it use "dc=my,dc=domain,dc=com,o=my.domain.com"?
I must be missing something but I can't find it.

Hi,
kevin_sysadmin wrote:
So why does it use "dc=my,dc=domain,dc=com,o=my.domain.com"?
I must be missing something but I can't find it.The first step the MMP will do to resolve the base DN for a hosted domain is a directory search along the lines of (this is for schema 2 which is the default for a new install):
[26/Oct/2007:16:46:23 +1000] conn=3152 op=1 msgId=2 - SRCH base="dc=aus,dc=sun,dc=com" scope=2 filter="(&(objectClass=sunManagedOrganization)(|(associatedDomain=aus.sun.com)(sunPreferredDomain=aus.sun.com)))" attrs=ALL
So in my case I have default:LdapUrl "ldap://server.aus.sun.com/dc=aus,dc=sun,dc=com" and default:DefaultDomain aus.sun.com
So you will probably find that you have a hosted domain configured under "dc=my,dc=domain,dc=com,o=my.domain.com" which got created during installation but not propagated with users.
Regards,
Shane.

Pop up warning when creating policy domain in OAM 10g

Has anyone seen below pop up warning when creating a policy domain in OAM 10g Policy manager?
Warning:
This policy domain controls the access to the URI you are currently accessing
/access/oblix/apps/policyservcenter/bin/policyservcenter.cgi
Are you sure you want to commit these changes?

Hi,
Does Note 842378.1 look like a match for you? Maybe the obcompounddata attribute is missing for some odd reason.
Regards,
Colin

Using LDAP Query in Active Directory to see what users are still logged ?

any suggestions for a LDAP query that I can use in AD to see who is still logged into the network?
It would be great to distinguish who's logged in with a screen lock which means they aren't really at their PC vs what users are actually using their PCs.
Thanks in advance!

I recently posted a framework for checking all machines to see who is logged into them. You can take that and adjust it as you need.
https://social.technet.microsoft.com/Forums/en-US/fb2ef90a-ba15-41bf-8e6c-95d32256225b/how-do-i-run-this-query-from-a-text-file-list?forum=ITCG
Don't retire TechNet! -
(Don't give up yet - 13,085+ strong and growing)

Log-Entry: 'Warning: LDAP: query accept could not be found'

I found many entries like this:
Thu Mar 13 12:45:30 2008 Warning: LDAP: query accept could not be foundin our log 'mail.current'.
We don't use LDAP (anymore). Where do I have to check if we have missed something what should be de-activated?
In the GUI 'System Administration', 'LDAP' I have the following entry:
Server Profile Host Name Port Queries
Profilename 1.2.3.4.,1.2.3.5 389 None configured
How can we prevent this warning-entries in the logfile?

On the GUI interface, go to "Network > Listeners".
Select the inbound listener. At the bottom, make sure the LDAP queries are all set to None. You may also want to delete your ldap profiles if you're not using them anymore. "System Administration > LDAP"
If that doesn't address the warnings, contact Technical Support so they can further investigate it.
I found many entries like this:Thu Mar 13 12:45:30 2008 Warning: LDAP: query accept could not be foundin our log 'mail.current'.
We don't use LDAP (anymore). Where do I have to check if we have missed something what should be de-activated?
In the GUI 'System Administration', 'LDAP' I have the following entry:
Server Profile Host Name Port Queries
Profilename 1.2.3.4.,1.2.3.5 389 None configured
How can we prevent this warning-entries in the logfile?

Getting group members using ldap query

I need help writing an LDAP query for iPlanet to retrieve all the members of a group. I can do it on Active Directory using the following :
(memberof=CN=SundanceGroup,CN=Users,DC=Test,DC=com)
But I am not able to do it with iPlanet. Please let me know how to do it.
Thanks,
Binu

"memberof" attribute is not supported by iPlanet. try using "uniquemember" attribute instead. Also the users in iPlanet are generally created under "ou=people" and not "cn=users". try changing ur filter as(uniquemember=CN=SundanceGroup,ou=people,DC=Test,DC=com).
BTW
does anyone know how to query different servers with a common filter to get the groups of a user.

OAM 10g Authorization ldap query

Similar Messages

Maybe you are looking for