OID 2 WAY LDAP replication

Has anyone been able to create a multi master replication environment between 3 OID servers using LDAP 2 way replication between each?
Scenario
oid1 --> oid2
oid1 --> oid3
oid2 --> oid1
oid2 --> oid3
oid3 --> oid1
oid3 --> oid2
I can get oid1 to replicate to both oid2 & oid3, but not oid2 replicating to both oid1 & oid3 and vice versa.
Any help would be appreciated...........
Thanks
J

No, this kind of scenario is not supported.
regards,
--olaf

Similar Messages

Help! : Install and configuration of OID and LDAP

Hi,
I'm trying to install OID and run a LDAP server.
I installed OID in my 9iR2 database, it seems ok.
When I try to connect in ODM, it says 'LDAP server not running'... I don't find in Control panel/services any service naming like 'LDAP' (I just find "ODS_sid" who is runnig), is there something I forgot to install ??
In the same way I haven't any tables in ODS/ODS@my_sid, is it normal ??
Thanks in advance,
Sandrine

Hi Diego,
The maximum number of concurrent users logged on allowed by the current license keys has been reached.
Attempt to log on later after other users have logged off, or upgrade the license keys.
Or you can get in touch with your Accounts Manager to check the license keys, whether they have been expired, or need to be upgraded.
-Shreyash

OID and LDAP

Im investigating the implementation of LDAP or OID. Can anyone tell me wht aditional finctionality does OID have above the standard LDAP schema. I am particularly interested in the customization of entities and if OID support relationships other than in a tree structure. Thanks

What version of the Oracle AS are you running,
I was looking at this using oracle 9ias but after lots
of effort including going through Oracle themselves I came to the conclusion that it wasn't in fact possible to Connect Lotus LDAP and OID in any meaningful way without at least going to the expense of having some sort of Metadirectory imposed above both.
I discovered an LDAP Sychronisation tool but was unable to replicate certain fields particularly encrypted Passwords etc.
If you do get any further or success or come across a solution then I would be interested in hearing about it.

Error while configuring SSL in OID 11g - LDAP 50 Insufficient Access rights

HI,
I am trying to configure SSL in OID 11g.As per the doc http://download.oracle.com/docs/cd/E12839_01/oid.1111/e10029/ssl.htm#CBHGBGAF ,i tried creating a Self-Signed Wallte using Fusion Middleware control,But i am getting an error LDAP 50: Insufficient access rights".I logged into Fusion Middle Ware control as Weblogic user.Is anybody faced this issue?.Thanks in advance.

I am not sure how you tried, but I would recommend to do the following...
1. Add the 'user1' to "OU=Franchisees,ou=People,dc=company,dc=com"
2. Delete the 'user1' from 'OU=Internal,ou=People,dc=company,dc=com'

Has anyone succcessfuly implemented oid = iplanet ldap integration using ODM

I am trying to configure the execution and mapping tab in ODM but don't know what 'agent execution command' is. Also do I need to have admin type of account on the remote ldap to import into OID?

I am trying to do the same thing.
The agent execution command should be empty as per the documentation refer to C.34 OID Admin guide R 9.2.
As for the user this is what the Documentation says
"Connected Directory Account -
(orclodipConDirAccessAccount)
Valid user account on iPlanet Directory Server that the iPlanet Connector uses to access iPlanet Directory Server. If the changes are to be imported from iPlanet Directory Server to Oracle Internet Directory, then this user account should have read privilege in the iPlanet change log container. If the changes in Oracle Internet Directory are to be exported to iPlanet
Directory Server, then the user must have add/modify privileges to the synchronization domain.
Note: Create a user account in iPlanet exclusively for the iPlanet connector for synchronizing. "
Let me know if u r successfull. Hope this helps.
Vinodh R.

Basic question: Can OID map LDAP query to custom SQL query?

Hi all,
I have custom data in my Oracle Database and I wat to give them
LDAP interface. Is it possible to use OID to achieve this or OID
is for other purposes?
To be more specific: I have schema MYSCHEMA and table
MYSCHEMA.MYTABLE. Is it possible to configure OID to select from MYSCHEMA.MYTABLE for specific LDAP queries? And the same for update queries? Is there some OID manager console to map LDAP queries against Oracle tables and views?
Thanx for any suggestions,
Rob

Rob,
take a look at the Directory Integration Platform. We provide synchronization of data from an DB tables to OID.
see "Synchronization with Relational Database Tables" http://download-west.oracle.com/docs/cd/B14099_14/idmanage.1012/b14085/odip_db.htm#i1042820
another option could be to use the OID Plugin framework together with a PLSQL procedure to access the DB data
http://download-west.oracle.com/docs/cd/B14099_14/idmanage.1012/b14087/svrplgin.htm#i741028
regards,
--Olaf

OID - OperationalNotSupportedException: [LDAP: error code 53 - Server ... ]

Hi,
I'm using JNDI (Java Native Directory Interface) accessing OID, and I received a javax.naming.OperationalNotSupportedException: [LDAP: error code 53 - Server currently in read only mode. Update operations not allowed];
I am not sure what's wrong.
I tried the following command
"./ldapsearch -b "" -s base "objectclass=*" orclservermode" The returned result is "orclservermode=rw"
So it is in read-write mode. I'm not sure what's wrong.
This started happen after I apply the 10.1.4.2.0 patch.

Unfortunately I am not an OID expert so I can't really comment on the OID server part of the problem.
What I actually have plenty of experience of is the JNDI package and there has been a number of times when the error messages produced by JNDI have been cryptic or simply wrong. I would recommend sniffing the LDAP connection and check what error messages are actually created by the OID server.
Good luck!
/M

Messaging services with ldap replication

using JES2004_q2
Every single component is working fine. Now I am trying to establish the replication with other LDAP for user data. To achieve this I deleted the current ou=People and ou=Groups under my default domain o=xyz.com. And created and initialized NewSubsuffix with the same data for ou=people and ou=Groups under the o=xyz.com on configuration>data.
Replication is working fine with other ldap and as well the search. But messaging is not. On imsimta test come out �5.1.1 unknown or illegal alises� but I can see the user entry in search also I can see the entry msg-admin-test.xyz.com-20040824154024Z, which is required to host the domain and run the messaging services.
Any idea why messaging is not working?

As I indicated replication and search for user entry is working fine as we can see all attributes for entry.
Acess logs at directory server is like that when I try to run ./imsimta test
30/Aug/2004 12:25:00 -0500     86     113     115     RESULT err=0 tag=101 nentries=1 etime=11
30/Aug/2004 12:25:00 -0500     86     108     110     RESULT err=0 tag=101 nentries=1 etime=14
30/Aug/2004 12:25:00 -0500     86     114     116     SRCH base="cn=config" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="nsslapd-accesslog nsslapd-accesslog-list"
30/Aug/2004 12:25:00 -0500     86     114     116     RESULT err=0 tag=101 nentries=1 etime=0
30/Aug/2004 12:25:00 -0500     86     112     114     RESULT err=0 tag=101 nentries=1 etime=12
30/Aug/2004 12:25:00 -0500     86     115     117     SRCH base="cn=config" scope=0 filter="(|(objectClass=*)(objectClass=ldapsubentry))" attrs="nsslapd-maxdescriptors nsslapd-reservedescriptors"
30/Aug/2004 12:25:00 -0500     86     115     117     RESULT err=0 tag=101 nentries=1 etime=0
30/Aug/2004 12:25:05 -0500     88     -1     -1     fd=59 slot=59 LDAP connection from 10.0.17.254 to 10.0.17.254
30/Aug/2004 12:25:05 -0500     88     0     1     BIND dn="cn=msg-config, cn=Sun ONE Messaging Suite, cn=Server Group, cn=testwebmail.xyz.com, ou=fsl.org.jm, o=NetscapeRoot" method=128 version=2
30/Aug/2004 12:25:05 -0500     88     0     1     RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=msg-config,cn=sun one messaging suite,cn=server group,cn=testwebmail.xyz.com,ou=fsl.org.jm,o=netscaperoot"
30/Aug/2004 12:25:05 -0500     88     1     2     SRCH base="cn=configuration,cn=msg-config,cn=sun one messaging suite,cn=server group,cn=testwebmail.xyz.com,ou=fsl.org.jm,o=netscaperoot" scope=2 filter="(objectClass=*)" attrs=ALL
30/Aug/2004 12:25:06 -0500     88     1     2     RESULT err=0 tag=101 nentries=31 etime=1
30/Aug/2004 12:25:06 -0500     89     -1     -1     fd=63 slot=63 LDAP connection from 10.0.17.254 to 10.0.17.254
30/Aug/2004 12:25:06 -0500     89     0     1     BIND dn="cn=msg-config, cn=Sun ONE Messaging Suite, cn=Server Group, cn=testwebmail.xyz.com, ou=fsl.org.jm, o=NetscapeRoot" method=128 version=2
30/Aug/2004 12:25:06 -0500     89     0     1     RESULT err=0 tag=97 nentries=0 etime=0 dn="cn=msg-config,cn=sun one messaging suite,cn=server group,cn=testwebmail.xyz.com,ou=fsl.org.jm,o=netscaperoot"
30/Aug/2004 12:25:06 -0500     89     1     2     SRCH base="cn=configuration,cn=msg-config,cn=sun one messaging suite,cn=server group,cn=testwebmail.xyz.com,ou=fsl.org.jm,o=netscaperoot" scope=2 filter="(objectClass=*)" attrs=ALL
30/Aug/2004 12:25:06 -0500     89     1     2     RESULT err=0 tag=101 nentries=31 etime=0
30/Aug/2004 12:25:06 -0500     89     2     3     UNBIND
30/Aug/2004 12:25:06 -0500     89     2     -1     closing - U1
30/Aug/2004 12:25:07 -0500     89     -1     -1     closed.
30/Aug/2004 12:25:12 -0500     88     -1     -1     closing - B1
30/Aug/2004 12:25:12 -0500     88     -1     -1     closed.
30/Aug/2004 12:25:23 -0500     90     -1     -1     fd=59 slot=59 LDAP connection from 10.0.17.254 to 10.0.17.254
30/Aug/2004 12:25:23 -0500     90     0     1     BIND dn="uid=msg-admin-testwebmail.xyz.com-20040727154027Z, ou=People, o=fsl.org.jm,o=fsl.org.jm" method=128 version=3
30/Aug/2004 12:25:23 -0500     90     0     1     RESULT err=0 tag=97 nentries=0 etime=0 dn="uid=msg-admin-testwebmail.xyz.com-20040727154027z,ou=people,o=fsl.org.jm,o=fsl.org.jm"
30/Aug/2004 12:25:23 -0500     90     1     2     SRCH base="o=fsl.org.jm" scope=2 filter="(&(objectClass=sunManagedOrganization)(|(associatedDomain=testwebmail.xyz.com)(sunPreferredDomain=testwebmail.xyz.com)))" attrs=ALL
30/Aug/2004 12:25:23 -0500     90     1     2     RESULT err=0 tag=101 nentries=0 etime=0
30/Aug/2004 12:25:23 -0500     90     2     3     SRCH base="o=fsl.org.jm" scope=2 filter="(&(objectClass=sunManagedOrganization)(|(associatedDomain=fsl.org.jm)(sunPreferredDomain=fsl.org.jm)))" attrs=ALL
30/Aug/2004 12:25:23 -0500     90     2     3     RESULT err=0 tag=101 nentries=0 etime=0
and when I try to loging via http. I can see these error on http loggong under messaging server
[30/Aug/2004:12:31:50 -0500] testwebmail httpd[10960]: Account Notice: [10.x.x.x:2075] domain not found
[30/Aug/2004:12:31:50 -0500] testwebmail httpd[10960]: Account Notice: badlogin: [10.x.x.x.:2075] plaintext testuser : user not found
consumer ldap is not using messaging so we don't need to do the replication of PAB
I know Configuration data is tricking. After deleting the ou=People and ou=Groups under o=xyz.com I can see these ou but once I created these as subsuffix under o=xyz.com I can see the entry for ou=People and Ou=Groups with all the intialized entries under Directory tab > o=xyz.com

How to configure security groups creation in OID through LDAP sync

Hello,
I am on OIM 11.1.2.1.0. I created a new role and assigned the role to a user. The user was added to the corresponding group in OID.
This was the result I observed:
Role created in OIM: PIPELINE-18010-DEC~LEAVIERWER
There is a corresponding group created in OID under cn=Groups. The user was successfully added to the group.
However, I would like the new group to be created under cn=Groups,cn=PIPELINE.
How can I achieve this? Is there any documentation on how to use ldap sync in OIM?
Thanks
Khanh

When I set the container rules for user with the expression using Organization, it did not work.
If I copied the example from the documentation, it worked (for <expression>Country=US, Locality Name=AMER</expression>).
I tried to change the Organization to be 1 word only, but it did not work.
Is it limited to certain fields in the USR profile (meaning it only worked for certain fields but not all of them)?
Default works for sure.
Could someone please let me know?
Thanks
Khanh

One way AD replication

I need to set up a test environment within an existing AD infrastructure. I want my test DC to replicate data from other domain controllers but never to sync any changes with the remaining servers. I will be testing some GPOs and they may mess up my domain
if they replicate to the AD.
Does any one know a way to do it? I will be modifying some general GPOs and a separate GP OU will not allow me to test all the solutions I want to.

Greetings!
What are you trying to accomplish exactly?
You can disable Outbound\Inbound replication traffic on a particular DC using commands but GPO's are completely different story. Replicating active directory objects is responsibility of Active Directory replication but GPO replication is responsibility
of DFS or FRS on earlier editions.
Which one you are aiming for?
Mahdi Tehrani |
|
www.mahditehrani.ir
Please click on Propose As Answer or
to mark this post as
and helpful for other people.
This posting is provided AS-IS with no warranties, and confers no rights.
How to query members of 'Local Administrators' group in all computers?
Well I would just like to add that GPOs are stored both in AD (The GP Object) and in the SYSVOL (The GP Template) a GPO would not apply to the client if it can't read the GPO off AD, hence it has know knowledge that the GPO exists.
In general:
Playing with disable/enable replication isn't a god way to test out GPOs - filtering the scope of the GPO using a Security Group that contains test computers/users and/or creating a test OU would be more sufficient.
Enfo Zipper
Christoffer Andersson – Principal Advisor
http://blogs.chrisse.se - Directory Services Blog

Intaract with oid and bring the all groups resides in oid through ldap

Hi,
i would like to intaract with oid and bring the all groups which were resides in
oracle intrnet directory through ldap. can u please give me the procedure
that i can follow or else suggest me a documentation regarding this .
regards,
srinivas

try this (behaviour not garranteed):
For local groups (groups within the Portal's group install base) you can program a loop on the table PORTAL.WWSEC_GROUP$ then read the column NAME.
For non local groups, use the (unsupported) API wwsec_oid (function get_group_name_from_dn(wwsec_group$.dn) ) instead of reading the NAME column.
If the result is incomplete (synchro issues with OID for instance due to DIP) you'll have to use ldap request with DBMS_LDAP package.(or java alternative, of course)
Patrick.

LDAP Replication - Two suppliers no consumers

Simply put I just want to set up a load balanced LDAP environment where any two servers could be leveraged for updaing or querying. Is this the same thing as setting up a multi-master replication but with no consumer configuration?

I'll assume that you're using version 5.2. If not, then I'll rephrase my answer and provide a different link.
You'll setup a multi-master agreement between each server. When this is complete, changes made to one will be replicated to the other. Queries against each one will show the same data. (assuming that the replication is marked as "Always in sync".
Here's a link that might be helpful.
http://docs.sun.com/source/816-6698-10/replicat.html#14776

Idsync with LDAP replication

I have 2 LDAPs set up in a replication. LDAP2 is the failover for LDAP1. Will I be able to set up password synchronization on both of them from a single AD?
The need is if LDAP1 goes down, LDAP 2 should be able to server the apps along with the synchronization taking place. Has anyone done this setup.

I have 2 LDAPs set up in a replication. LDAP2 is the failover for LDAP1. Will I be able to set up password synchronization on both of them from a single AD?
The need is if LDAP1 goes down, LDAP 2 should be able to server the apps along with the synchronization taking place. Has anyone done this setup.

IDM in multi-master LDAP Replication

Hi,
We got two functional SUN Java Directory Server in multi-master replication setup. Both server have their own IDM's.
When I change password/uid from any IDM , straightaway changes get done on both LDAP servers and I can see changes on another IDM.
Problem is when I create new user from IDM of one server, user doesn't show up in second server IDM unless I run manually Accounts-->Load from resource.
Even full reconciliation doesn't pickup the new user on that IDM. What need to be done so IDM picks new users straight away in multi-master setup.
Thanks,
Farhan
Edited by: rozzx on May 5, 2009 11:32 PM
Edited by: rozzx on May 5, 2009 11:34 PM

Any help guys? Whey IDM is not getting update when I add/delete new user in Directory Server. I have to do Load from Resource to get new entries everytime.
And If I delete any user from LDAP, it still stays in IDM.

LDAP Replication and Indexing on DS5.1SP4

Dear experts,
>
We are helping customer to setup a replica directory server that we will replicate data from a master directory server. The master directory server contains 13GB data with index built. We found that search operation failed even we initialized data from master to replica. We need to rebuild index in replica node in order to make search operations work. We have several questions would seek for some help.
1. Is it a must to rebuild index at replica node after initializing data from master ldap console?
2. If indexes are created in consumer node before initialize consumer, do we need to rebuild indexes after consumer initialization?
3. If we export data (db2ldif -r) from master and import data (ldif2db) to replica, do we need to rebuild index at replica node in order to make ldapsearch work?
4. Which one is the best practice?
Any help would be appreciated. Thx.
Kindly regards,
AY

Hi
1. If the index was configured prior to the initialization, it does not need to be rebuilt. However, DS 5.1(SP4) is a pretty old version of DS and there might still be some bug in the indexing code (I know some got fixed in 5.2patch2 or 3).
2. No you shouldn't.
3. No you do not need.
4. Best practice is to configure the Consumer replica before initializing. This should bring the Consumer replica up to date and fully operational.
Another best practice is to use the most recent version of Directory Server (6.0).
Regards,
Ludovic

OID 2 WAY LDAP replication

Similar Messages

Maybe you are looking for