OCS + authentication external LDAP

Is there anyone with experiences to use OCS in combination
with external authentication against an SunONE LDAP server?
I don't want to synchro the two LDAPs. I just want to use the usernames & passwords of the external LDAP.
Can you explain to me which procedures must I follow?
Is is necessary to create all the users of the external LDAP exists in the OID of OCS?
If not how does this work? For example how do I grant email/files rights to a user which is not in the OCS OID?
If the users must exists in the OID, which components must I configure within OCS? Must I write a pl/sql package for authentication to the external LDAP?
Thanks in advantage!

Hi Elvis!
What you need to do is to configure an OID plug-in that can be used to authenticate the users against the SUN LDAP. There are some examples in the OID admin guide.
The users must exist in the OID.
The users need to be administered in the OID as the CS needs the entries in the users tree as well as the emailservercontainer tree.
cu
Andreas

Similar Messages

  • Not authenticated from external ldap in a cluster

    I am having trouble getting authenticated from an Iplanet LDAP, when the weblogic is configured in a Cluster.
    -I can authenticate with Embedded LDAP domain wide
    -I can authenticate on the external LDAP if I send the request to Admin server
    Here is my cluster configuration (all with Weblogic 7.0 SP4)
    *Admin Server Port: 9209
    *Cluster server 1 : 7209
    *Cluster server 2 : 8209
    *Proxy server     : 9090 (configured with HttpClusteredServlet)
    http://myserver.com:9090/j_security_check fails
    http://myserver.com:9209/j_security_check works
    Please let me know what is wrong?

    "Bob" <[email protected]> wrote in message
    news:3f9fd466$[email protected]..
    I am having trouble getting authenticated from an Iplanet LDAP, when theweblogic is configured in a Cluster.
    -I can authenticate with Embedded LDAP domain wide
    -I can authenticate on the external LDAP if I send the request to Adminserver
    Here is my cluster configuration (all with Weblogic 7.0 SP4)
    *Admin Server Port: 9209
    *Cluster server 1 : 7209
    *Cluster server 2 : 8209
    *Proxy server     : 9090 (configured with HttpClusteredServlet)
    http://myserver.com:9090/j_security_check fails
    http://myserver.com:9209/j_security_check works
    Please let me know what is wrong?Are you sure that the ldap authentication is actually occuring? I would
    define the
    DebugSecurityAtn="true" attribute on the ServerDebug mbean for the cluster
    server members and then look at the log and the ldap_trace.log files to see
    what is happening with LDAP.

  • External LDAP for authentication

    Hi All,
    I want to use external ldap for authentication purpose with Access Manager.
    I tried adding this external ldap as a secondary ldap but couldn�t succeed.
    If I add this ldap in the primary ldap along with the AM�s own ldap, this also fails to authenticate users from the external ldap.
    How can I achieve this?
    I read many topics in this forum regarding this but none of them explain how it can be achieved.
    Please suggest.
    Thanks in advance.

    This is what the amconsole log says:
    ERROR: ConsoleServletBase.onUncaughtException
    java.lang.NullPointerException
         at com.sun.identity.idm.plugins.ldapv3.LDAPv3Repo.constructFilter(LDAPv3Repo.java:3126)
         at com.sun.identity.idm.plugins.ldapv3.LDAPv3Repo.search(LDAPv3Repo.java:1996)
         at com.iplanet.am.sdk.AMDirectoryManager.search(AMDirectoryManager.java:1938)
         at com.sun.identity.idm.AMIdentityRepository.searchIdentities(AMIdentityRepository.java:221)
         at com.sun.identity.console.idm.model.EntitiesModelImpl.getEntityNames(EntitiesModelImpl.java:139)
         at com.sun.identity.console.idm.EntitiesViewBean.getEntityNames(EntitiesViewBean.java:222)
         at com.sun.identity.console.idm.EntitiesViewBean.beginDisplay(EntitiesViewBean.java:177)
         at com.iplanet.jato.taglib.UseViewBeanTag.doStartTag(UseViewBeanTag.java:149)
         at jsps.console._idm._Entities_jsp._jspService(_Entities_jsp.java:86)
         at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:107)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:908)
         at com.iplanet.ias.web.jsp.JspServlet$JspServletWrapper.service(JspServlet.java:687)
         at com.iplanet.ias.web.jsp.JspServlet.serviceJspFile(JspServlet.java:459)
         at com.iplanet.ias.web.jsp.JspServlet.service(JspServlet.java:375)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:908)
         at org.apache.catalina.core.ApplicationDispatcher.invoke(ApplicationDispatcher.java:772)
         at org.apache.catalina.core.ApplicationDispatcher.doForward(ApplicationDispatcher.java:471)
         at org.apache.catalina.core.ApplicationDispatcher.forward(ApplicationDispatcher.java:382)
         at com.iplanet.jato.view.ViewBeanBase.forward(ViewBeanBase.java:340)
         at com.iplanet.jato.view.ViewBeanBase.forwardTo(ViewBeanBase.java:261)
         at com.sun.identity.console.base.AMViewBeanBase.forwardTo(AMViewBeanBase.java:133)
         at com.sun.identity.console.base.AMPrimaryMastHeadViewBean.forwardTo(AMPrimaryMastHeadViewBean.java:149)
         at com.sun.identity.console.idm.HomeViewBean.forwardTo(HomeViewBean.java:109)
         at com.sun.identity.console.realm.RealmPropertiesBase.nodeClicked(RealmPropertiesBase.java:90)
         at com.sun.web.ui.view.tabs.CCTabs.handleTabHrefRequest(CCTabs.java:129)
         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:585)
         at com.iplanet.jato.view.command.DefaultRequestHandlingCommand.execute(DefaultRequestHandlingCommand.java:183)
         at com.iplanet.jato.view.RequestHandlingViewBase.handleRequest(RequestHandlingViewBase.java:308)
         at com.iplanet.jato.view.ViewBeanBase.dispatchInvocation(ViewBeanBase.java:802)
         at com.iplanet.jato.view.ViewBeanBase.invokeRequestHandlerInternal(ViewBeanBase.java:740)
         at com.iplanet.jato.view.ViewBeanBase.invokeRequestHandlerInternal(ViewBeanBase.java:760)
         at com.iplanet.jato.view.ViewBeanBase.invokeRequestHandler(ViewBeanBase.java:571)
         at com.iplanet.jato.ApplicationServletBase.dispatchRequest(ApplicationServletBase.java:957)
         at com.iplanet.jato.ApplicationServletBase.processRequest(ApplicationServletBase.java:615)
         at com.iplanet.jato.ApplicationServletBase.doGet(ApplicationServletBase.java:459)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:787)
         at javax.servlet.http.HttpServlet.service(HttpServlet.java:908)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:247)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:193)
         at com.sun.mobile.filter.AMLController.doFilter(AMLController.java:163)
         at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:213)
         at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:193)
         at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:280)
         at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:509)
         at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:212)
         at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:509)
         at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:209)
         at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:509)
         at com.iplanet.ias.web.connector.nsapi.NSAPIProcessor.process(NSAPIProcessor.java:161)
         at com.iplanet.ias.web.WebContainer.service(WebContainer.java:580)

  • Authentication in weblogic portal server 8.1 sp2 using external LDAP

    Hi,
    I am trying to use external LDAP for authentication.
    I have configured the ActiveDirectoryAuthenticator giving the necessary
    values
    ( and added
    "-Dcom.bea.p13n.usermgmt.AuthenticationProviderName=ActiveDirectoryAuthentic
    ator" in startWeblgoic.cmd )
    and can see the users and the groups from my LDAP provider in the admin
    console and in the admin portal's "users and groups".
    A set of users are given permission to access the restricted site and those
    users are visible in the global role with the permission.
    The web.xml is configured for BASIC auth-method, and the role is
    <externally-defined/> in weblogic.xml.
    Now when I access a restricted page, I am shown a dialog prompt to key in
    the username and password.
    Even when I key in the valid credentials, the restricted page is not shown
    and an "Unauthorized xxx" 401 access error is thrown.
    Any clue, on what i am missing.?
    Please let me know if any suggestion / idea.
    Regards,
    Arun.

    Assuming your application is a WebLogic Portal application, then yes you would definitely need to install WLP 8.1. WLP version 8.1 is the only version of WLP that will run on WLS/WLW version 8.1.
    In order to obtain the product installer, you'll need to contact Oracle Support and file a request. It is not available for download from any Oracle public site. Only version 10.3 is available for download.
    Brad

  • Shared Services External Authentication using LDAP in 9.3.1

    Hi,
    I have installed Hyperion Shared Services with native directory. And now planning to setup external authentication using LDAP. I need some guidance to understanding how the external authentication works.
    Questions:
    1. Is it possible to setup Shared Services to use both Native and LDAP user directory? What I mean is some users will be able to login using Native directory, and some others will need to login using User Directory (external authentication).
    2. For User Directory (say we use LDAP), when the user is added into Shared Services, can they be assigned with Groups created in Native directory? We want to explore to use just the external authentication and define all of the groups within shared services.
    If not possible, can we manage the Groups of the User directory using shared services? How is the groups work with external authentication?
    Any feedback would be much appreciated.
    Thanks,
    Lian

    Hi,
    Yes you can use both Native and external authentication. When you add the external provider the native is left by defaut anyway.
    Yes you can add your external users to native groups. You can also provision the groups in the AD if you wish.
    Gee

  • Set User Description by external ldap authenticator

    Hi,
    I used a customized iplanet Authentication Providers to authenticate the user.
    After the system is started and I goes to "Security Realms > myrealm > Users and Groups -> Users", I am able to see a list of user from Ldap server. Name field is username. But description is empty. How could I populate description field by field in External Ldap server?
    Thanks,

    Hi,
    I used a customized iplanet Authentication Providers to authenticate the user.
    After the system is started and I goes to "Security Realms > myrealm > Users and Groups -> Users", I am able to see a list of user from Ldap server. Name field is username. But description is empty. How could I populate description field by field in External Ldap server?
    Thanks,

  • Server App not seeing external LDAP users & groups

    I have a clean 10.8.2 + Server install set up with our standard external LDAP directory (Novell's eDirectory in our case) configuration that is known to support Lion & Mountain Lion client LDAP authentication. With this same configuration on OS X 10.8.2 Server both Directory Utility and WGM can see all the LDAP users and groups as expected.
    When I look for the external users & groups in the LDAP domain under the Server App "Accounts" heading I cannot see any entries in either users or groups lists. Should I be able to or is this a Server App quirk?
    I can add individual LDAP users to a local group and enable access to individual services. How can I give access to services to all LDAP users without having to build & maintain a massive "All LDAP Users" local group?
    Is there a published list of required LDAP attributes for users & groups for Mountain Lion Server? I suspect there are new requirements over and above those for 10.6 server but I have failed to find a good reference. I've noticed I get different behaviours for LDAP templates that includes a mapping for GeneratedUID to one which does not for example.
    This is all so much more opaque than our superbly reliable Snow Leopard servers!
    TIA

    Ok, and again:
    You want to see Users and Groups , which are stored in an third Party directory service like OpenLDAP, in your Server.app? This is what you have to do:
    Connect the third party ldap to your server
    Have all your external LDAP entries made so you can see them in the Workgroup Manager and are able to Login with them
    When you see your LDAP-entry in the Directory Manager, change it from "From Server" to "RFC2307"
    Edit the entry, add the following mapping to it:GeneratedUUID maps to apple-generateduuid
    To your group and user entries in the external LDAP add the follwing attribute:apple-generateduuid gets the value taken from the output of "uuidgen"
    Feel lucky
    And there ist ist; now you are able to use The accounts taken from an external LDAP.

  • Steps to connect an external LDAP

    Dear Gurus,
    What are the steps to connect an external LDAP like ADS.
    Pls let me know the step by step procedure e.g.
    creating the admin,guest and ??? users in Portal.Deleting the same from the LDAPs and so on.
    Thanks for the help.
    Nirmal

    Hi,
      Check the below link for LDAP connectivity...
    Integrated Windows Authentication with SAP EP 6.0 SP 3 and higher Part 1 of 2
    Regards
    Vasu

  • Address Lookup in External LDAP

    I did changes in my $OH/j2ee/OC4J_UM/config/oc4j.properties file in order to Lookup in a external LDAP:
    toolkit.ldap.dir.1.label=Contacts
    toolkit.ldap.dir.1.url=ldap://OtherLinuxHost.mydomain.com:389
    toolkit.ldap.dir.1.searchbase=ou=Contacts,dc=mydomain,dc=com
    toolkit.ldap.dir.1.filter=objectClass=inetOrgPerson
    toolkit.ldap.dir.1.attribute.mail=mail
    toolkit.ldap.dir.1.attribute.lname=sn
    toolkit.ldap.dir.1.attribute.fname=givenName
    toolkit.ldap.dir.1.attribute.alias=uid
    In my Collaboration Suite - Messages when I am creating
    New Message, click in Blue Torch,
    Select from list the "Contactss" directory
    Select "Email Address" "contains" * => Go
    UM shows the contacts from the External Ldap, but when I try to bcc, or cc or to, it is not updating my destination fileds (bcc/ cc/ to). But if instead of select the List "Contacts" I select the Internal Directory (OID) it works fine?
    Which argument I miss ? or how I configure UM for export the email address from the AddrLookup Window to the Message_compose Window in the destination fields (bcc or cc or to) ?
    Thanks alot for any help.

    It is happening to us as well, we have OCS release 2 9.0.4.2 on Linux trying to access an external OpenLDAP linux server for shared contacts.
    After we get the results of the search on the external LDAP, no button works on the Address Lookup window except "Close". It doesn't matter is we select the "Corporate Book" or other Oracle internal address books; we have to close the window and open it again to do a new search.
    Are you seeing the same behavior?
    I will have a phone conference today (5/11/05) with Oracle support to talk about this issue, we have had a TAR open for about 20 days now.
    I'll keep you posted with the results.

  • Error while configuring external LDAP user store with weblogic

    Hi,
    I have weblogic 10.3 installed and I can access weblogic admin console using weblogic (admin) user. I want to use external ldap user store to access admin console with users present in external ldap.
    To do this, I have configured authentication provider and provided all the required details to connect to ldap.
    For example:
    Base DN: cn=admin,cn=Administrators,cn=dscc (user with which we will connect to LDAP)
    User DN: ou=People,dc=test,dc=com
    Group DN: ou=Groups,dc=test,dc=com
    This authentication provider is set to SUFFICIENT mode. I have deleted the default authentication provider.
    In the boot.properties file I have given the user name and password of the user with which LDAP instance was created something like below.
    password=xxxxxxx
    username=admin
    Now while starting the admin weblogic server, I am getting the below error:
    <Jul 25, 2012 2:22:28 PM IOT> <Critical> <Security> <BEA-090402> <Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.>
    <Jul 25, 2012 2:22:28 PM IOT> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializationException: Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.
    weblogic.security.SecurityInitializationException: Authentication denied: Boot identity not valid; The user name and/or password from the boot identity file (boot.properties) is not valid. The boot identity may have been changed since the boot identity file was created. Please edit and update the boot identity file with the proper values of username and password. The first time the updated boot identity file is used to start the server, these new values are encrypted.
    at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.doBootAuthorization(CommonSecurityServiceManagerDelegateImpl.java:960)
    at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1054)
    at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
    at weblogic.security.SecurityService.start(SecurityService.java:141)
    at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
    Truncated. see log file for complete stacktrace
    Caused By: javax.security.auth.login.FailedLoginException: [Security:090304]Authentication Failed: User admin javax.security.auth.login.FailedLoginException: [Security:090302]Authentication Failed: User admin denied
    at weblogic.security.providers.authentication.LDAPAtnLoginModuleImpl.login(LDAPAtnLoginModuleImpl.java:261)
    at com.bea.common.security.internal.service.LoginModuleWrapper$1.run(LoginModuleWrapper.java:110)
    at java.security.AccessController.doPrivileged(Native Method)
    at com.bea.common.security.internal.service.LoginModuleWrapper.login(LoginModuleWrapper.java:106)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    Truncated. see log file for complete stacktrace
    >
    <Jul 25, 2012 2:22:28 PM IOT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FAILED>
    <Jul 25, 2012 2:22:28 PM IOT> <Error> <WebLogicServer> <BEA-000383> <A critical service failed. The server will shut itself down>
    <Jul 25, 2012 2:22:28 PM IOT> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN>
    Can anyone please suggest how to resolve this problem? If, anyone can suggest the exact steps to configure external ldap store to manage admin console via ldap users.
    Regards,
    Neeraj Tati.

    Hi,
    Please refer the below content that I found for Oracle 11g in the docs.
    "If an LDAP Authentication provider is the only configured Authentication provider for a security realm, you must have the Admin role to boot WebLogic Server and use a user or group in the LDAP directory. Do one of the following in the LDAP directory:
    By default in WebLogic Server, the Admin role includes the Administrators group. Create an Administrators group in the LDAP directory, if one does not already exist. Make sure the LDAP user who will boot WebLogic Server is included in the group.
    The Active Directory LDAP directory has a default group called Administrators. Add the user who will be booting WebLogic Server to the Administrators group and define Group Base Distinguished Name (DN) so that the Administrators group is found.
    If you do not want to create an Administrators group in the LDAP directory (for example, because the LDAP directory uses the Administrators group for a different purpose), create a new group (or use an existing group) in the LDAP directory and include the user from which you want to boot WebLogic Server in that group. In the WebLogic Administration Console, assign that group the Admin role."
    Now in my LDAP directory, setup is in such a way that Administrators is a group created under following heirarchy " cn=Administrators,ou=Groups,dc=test,dc=com" and there is one user added in this Administrators group.
    The problem that I am having is when I modify the Admin role in which Administrators group should be added what exaclty I should give in Admin role. Whether I should give only Administrators or full DN: cn=Administrators,ou=Groups,dc=test,dc=com ???
    When i give full DN, it takes every attribute as different, i mean cn=Administrators as different and ou=Groups as different and shows a message that cn=Administrators does not exist.
    Here not sure what to do.
    Also if external ldap authentication provider is the only provider then I need to give the user information in boot.properties file also for weblogic to boot properly. Now, what should I give there in user? still complete DN ??
    Regards,
    Neeraj Tati.

  • Use of external LDAP server in Weblogic Commerce Server

    I'm using the following software:
    Iplanet Directory Server v5
    Weblogic Application Server v6
    Weblogic Commerce v3.5
    I need to configure Weblogic Commerce Server to use Iplanet Directory Server directory
    services. How do I do that?
    I have a couple of questions related to this:
    1) As Weblogic Commerce Server runs on top of Weblogic v6, does it mean that to
    use an external LDAP server, I need to configure weblogic v6 to do that and not
    Weblogic Commerce Server?
    2) Whatever may be the case above, how do I do that?
    3) config.xml (weblogic application server v6) contains information that needs
    to be modified to point to an external JNDI source provider but what information
    do I need to modify?
    I'd really appreciate if someone can help me out here. Thanks!

    "JP" <[email protected]> wrote in message news:[email protected]..
    Hi,
    I'm looking for someone who has used the Lotus LDAP server for WLP7
    authentication.
    I connect my portal to the Domino LDAP, User and Groups are working
    fine, but the membership of a user to a group is not.
    I assume that it's related to the parameters I use (especially the
    membership.filter ?):
    "user.filter=(&(uid=%u)(objectclass=person));
    user.dn=O=Apac;
    membership.filter=(&(uniquemember=%M)(objectclass=groupOfNames));
    group.filter=(&(cn=%g)(objectclass=groupOfNames));
    server.host=jpgal01.apac.bea.com;
    group.dn="
    Any help would be appreciate, because I just don't where to look for.
    Try setting the com.netscape.ldap.trace property.
    \* When -D command line option is used, defining the property with
    * no value will send the trace output to the standard error. If the
    * value is defined, it is assumed to be the name of an output file.
    * If the file name is prefixed with a '+' character, the file is
    * opened in append mode.
    This will create a ldap trace file of the requests that WLS is making on the
    LDAP server. You can then see
    where the filters are not returning the correct value for the group
    membership.

  • How to authenticate CXF-Webservice against external LDAP in WebLogic?

    Hi there,
    I'm trying to integrate our Camel-application into WebLogic 12c. All the incoming endpoints are CXF-based webservices. These are secured by "UsernameToken Timestamp" with the WSS4JInInterceptor configured like this:
    <bean id="wss4jInInterceptor" class="org.apache.cxf.ws.security.wss4j.WSS4JInInterceptor">
              <constructor-arg>
                   <map>
                        <entry key="action" value="UsernameToken Timestamp" />
                        <entry key="passwordType" value="PasswordDigest" />
                        <entry key="passwordCallbackClass"
                             value="de.mycompany.camel.cxf.UserTokenCallbackHandler" />
                   </map>
              </constructor-arg>     
    </bean>
    My problem is: WSS4JInInterceptor expects the UserTokenCallbackHandler to return the password of the user delivered in the header <wsse:Username>. Is there any way to retrieve this from an external LDAP configured in WebLogic? I've already managed to retrieve the users, groups etc with JMX (javax.management.MBeanServerConnection and weblogic.security.providers.authentication.LDAPAuthenticatorMBean), but I can't figure out how to authenticate the user against the LDAP, i. e. retrieve the password.
    Or am I heading in a completely wrong direction and this is not the way to achieve authentication for CXF-Webservices in WebLogic?
    Please give me a hint (code-snippets preferred ;-) ) how to solve this.
    Regards,
    Frank

    I have run into the exact same situation ? Did you ever get around this ? If so, how ? Please let me know.

  • Identity Server using external LDAP

    anyone have idea whether ID Server can use external an LDAP server for authentication, like the Policy Server in Portal Server 3 ?
    Wilson.

    You typically need to use our JNDI store. We strongly recommend this for
    performance reasons..
    You can use the JNDI To LDAP bridge which is available from the sun web
    site.
    Michael Girdley
    BEA Systems Inc
    "Jack Archer" <[email protected]> wrote in message
    news:[email protected]..
    I'm trying to find out if it is possible to re-direct JNDI calls to the WL
    server to an external LDAP server. I know you can install an external LDAP
    server for security purposes, but I would like to use an external LDAP
    server to handle all JNDI lookups (like for JNDI EJB name location, etc.).
    Is this possible?

  • RoleMapper with an external LDAP

    Dear friends,
    We use an external LDAP to store information related to users, groups and roles. We have managed to configure an out of box LDAP Authenticator within our realm for authentication. We wanted some guidance on configuring or writing RoleMapper.
    1) What is good practise in terms of storing and managing roles? Is it a common practise to store roles in an external LDAP or do people use Admin console to created roles within the embedded LDAP? The advantage with the Embedded LDAP is definitely that you could use out of the box RoleMapper and the disadvantage is that we could not extend LDAP schema to store hierarchical roles.
    2) If we store and manage roles in an external LDAP store, the same one where we store users and groups, could we still use the out of the box role mapper? If not, could someone provide a sample role mapper that uses an external LDAP store.
    3) Why WebLogic doesn't provide an out of the box Role Mapper that connects to an external LDAP?

    All Users Filter: (&(&(uid=*)(objectclass=person))(!(quitdate=*)))
    User From Name Filter: (&(&(uid=%u)(objectclass=person))(!(quitdate=*)))
    User Name Attribute: uid
    Here you're configuring that uid is the key of your users in OID. And in your case user A and B has the same uid, so the webcenter can login using user B, but when realize a search uid=jack ldap returns the first one.
    Make any sense for you?
    Hope that I help you

  • External LDAP connection for Jive forum webcenter Discussion

    Hi All,
    We could successfully configure external LDAP with Webcenter Discussion forum. In turns Jive forum.
    Problem we are facing : It is authenticating for display name instead of actual userid.
    EX:
    John Paul (display name)
    [email protected] (email id)
    John.paul (userid)
    It is accepting John Paul as username instead of john.paul. This is issue as there can be duplicate display names.
    Which parameter and where to configure to make sure Authentication is done for userid only.

    I think jive is used in webcenter discussions?
    You may have the wrong forum... this is for Webcenter Interaction Products.
    For help with Webcenter Discussion, blogs, and wiki's (part of webcenter services), you want to ask your question here:
    http://forums.oracle.com/forums/forum.jspa?forumID=733

Maybe you are looking for