OID and MS Active Directory Synchronization

Hi,
I've read that these 2 LDAP services can be synchronized with the "Active Directory Connector" SO does this mean that if users and groups are stored in the MS active directory it is possible to have the users and groups synchronized with the OID so that these are available directly in Oracle Portal or do they still need to be added manually somehow into portal ??
Thanks in advance,
Brandon

You can find documentation at :
- http://www.oracle.com/technology/products/oid/oidhtml/sec_idm_training/html_masters/basics01.htm
- http://www.oracle.com/technology/products/oid/oidhtml/sec_idm_training/html_masters/basics02.htm
- Note 267153.1 (How To Setup OID Synchronization with Microsoft Active Directory Quick Start Guide) with related docs
Best regards,
Nicolas Stiévenard

Similar Messages

  • OID and MS Active Directory  LDAP information Synchronization

    Do you know have to do the integration between OID and MS active Directory? How to synchronize the LDAP information between two?

    Hi, I have the same question.
    Thanks,
    Malin

  • OID and MS Active directory integration in 9ias

    How to integrate OID with MS Active directory ?
    We have 9ias and Portal . How to use the username/password in MS AD for Portal authentication ? As far as I know 9ias is using OID , so the question comes down to how to replicate MS AD information to OID ?

    Hi, I have the same question.
    Thanks,
    Malin

  • User base Synchronization between SAP and MS Active Directory Server

    Dear all!
    I'm using Web AS 6.20 ABAP and MS Active Directory Server based on Win 2003 Server.
    i successfully implemented the synchronization of user data between SAP and the ADS.
    My question: Is there a way to customize the users on Active Directory Server in regard to their SAP authorization (roles auth. objects etc.)?
    Currently I don't have a clue how to do this.
    Regards,
    Christoph

    Have you searched on SDN for "Active Directory"? That turns up a number of results. I think your expectation might be backwards though, it's not how ADS exposes SAP specific data but how SAP uses ADS to store SAP specific data. My understanding (from quite some time ago so I am fuzzy on this) is that SAP can use ADS in much the same way it can use LDAP as an external user store.
    The Security Newsletter from November 04 [https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/documents/a1-8-4/sap security newsletter november 2004.pdf] mentions that a webinar is hosted on SDN about this exact topic, unfortunately I was unable to find a direct link.
    Regards,
    Marc g

  • Active Directory synchronization working, authentication not on CUBM BE5000 8.6(1a)

    I successfully set up Active Directory synchronization between my CUCM BE5000 appliance running 8.6(1a) and our Windows 2008 Server Active Directory.  Users are replicating successfully, but authentication is not working even though I am using the same LDAP manager distinguished name and password for both.  I have a suspicion to the cause of this problem but for the record, the following is my relevant configuration:
    System/LDAP/LDAP System:
    LDAP Server Type Microsoft Active Directory iPlanet or Sun ONE LDAP Server OpenLDAP Microsoft Active Directory Application Mode
    LDAP Attribute for User ID userPrincipalName sAMAccountName mail employeeNumber telephoneNumber
    LDAP Server Type: Microsoft Active Directory
    LDAP Attribute for User ID: userPrincipalName
    System/LDAP/LDAP Directory:
    LDAP Configuration Name: bgctnv.local
    LDAP Manager Distinguished Name: CN=cm.sync,OU=BGCTNV Users,DC=bgctnv,DC=local
    LDAP User Search Base: DC=bgctnv,DC=local
    LDAP Server Information: bgctnv.local, port 389 (to query any domain controller in DNS; I have also tried specific IP addresses)
    System/LDAP/LDAP Authentication:
    LDAP Manager Distinguished Name: CN=cm.sync,OU=BGCTNV Users,DC=bgctnv,DC=local
    LDAP User Search Base: LDAP user search base is formed using the User ID information (pre-populated, I cannot change this)
    LDAP Server Information: bgctnv.local, port 3268
    All of my Active Directory users are now populated and active under End Users.  However, I am not able to log into /ccmuser among other things using my valid domain credentials.  I am a super user as well as a standard end user.
    Curiously, invalid usernames (userPrincipalName in my case) return the error "Log on failed - Invalid User ID or Password" while a valid username, with or without the correct password, returns only "Log on failed."  That seems to imply that some part of the authentication or LDAP bind is taking place.
    Here's the catch.  The base domain here is bgctnv.local while we use bgctnv.org as a valid and acceptable alternative UPN suffix in Active Directory.  Every Microsoft and every third-party program I have used will accept [email protected], but I'm beginning to think that CM will not, or is having some sort of translation issue.  I read that alternative suffixes can cause problems in Active Directory forests with multiple trees, but this is a vanilla, single domain environment.
    I don't even know where to look to debug this issue.  Has anyone seen this before or can anyone tell me where to look for logs?
    Thanks,
    John

    I found the following:
    http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/8x/directry.html
    As mentioned in the section on LDAP Synchronization, in order to support synchronization with an AD forest that has multiple trees, the UserPrincipalName (UPN) attribute must be used as the user ID within Unified CM. When the user ID is the UPN, the LDAP authentication configuration page within Unified CM Administration does not allow you to enter the LDAP Search Base field, but instead it displays the note, "LDAP user search base is formed using userid information."
    This may help in some situations where there are multiple trees in an AD forest, but it is definitely not the solution.  Even with multiple trees, it is common to use alternative UPN suffixes.  Nothing in AD requires or even recommends that you exclusively use your AD domain root as the UPN suffix.
    For example, company.local may use company.com as an alternative but primary UPN suffix to provide simplicity for users.  Users can then achieve more broad SSO capabilities by using their familiar email credentials when authenticating for company.local services.
    When using UserPrincipalName as the LDAP synchronization attribute for the CM User ID, the configuration requires that the search base for authentication be derived from the UPN suffix, regardless of whether it is a single domain or multiple trees within a forest.  This makes it impossible to authenticate by UPN unless your UPN is explicitly your root domain name.  From the example above, CM would try to bind [email protected] against DC=company,DC=com instead of the correct DC=company,DC=local.
    The logical solution would be to allow the administrator the option.  Why not have a choice of whether to generate the user search base from the userid (UPN) information, or be able to specify the search base as well like it allows with any other synchronization attribute?
    Would this be a feature request, bug report, or neither?  I'd really appreciate it if Cisco considered this but I don't know the proper channel.

  • SAP HCM/Active Directory synchronization

    Hi,
    I am trying to integrate SAP R/3 (master database) to Active Directory.
    And Active Directory will be used by rest all systems.Adding of new employee is done at SAP HCM and the same data should be created in Active Directory.
    I went through couple of forum threads but did not get the solution,
    Integrating SAP HR and active directory services
    LDAP/Active Directory synchronization
    http://forums.sdn.sap.com/click.jspa?searchID=47039448&messageID=7577288
    Please le me know how can achieve this.Your help is greatly appreciated...
    Regards,
    Rudradev Devulapelli

    It is a tool for user data synchronization, provisioning, compliance etc. It is an Java application so it is installed on AS Java.
    I have played with it only for a few days and I was able to use it to synchronize some data from AD and ERP. So I guess your scenario would be something like this:
    - HR adds new employee,
    - IDM synchronizes data between HCM and AD ie. it creates new user in AD,
    - user uses AD to authenticate to access, for example, file share.
    But IDM can do a lot of things besides this simple example. So I suggest you to go through "Technical Overview Presentation":
    http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/7037d982-40aa-2a10-e283-a76a9dfc93ab
    and "Working with Microsoft Active Directory":
    http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/40bba5aa-50f7-2a10-739d-e48e40730478

  • Integration of sap R/3 (4.7) and Microsoft active directory (2003)

    Hi All,
    I would like to know integration of sap R/3 (4.7) and Microsoft active directory (2003) and also SAP EP and Microsoft active directory. I have been working as a ep consultant with a local bank. I am new for this integration work, So please kindly provide me the steps for integrating these both directories.
    Pls help me with this issue.
    Thanks in advance,
    Regards,
    Raghav.

    Hi,
    First You should read:
    https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/bc72b890-0201-0010-3a8d-e31e3e266893
    Regards,
    Jarek

  • SCCM report to show last logged on user and the Active Directory department attribute of that user.

    I need to create an SCCM report to show last logged on user on all machines and the Active Directory department attribute of that last logged on user.

    You problem is here.
    right
    join v_R_User USR on USR.ResourceID
    = CS.ResourceID
    USR.ResourceID != CS.ResourceID, you need to map the username to the user logon to the PC. By using the user’s department information you will
    end up with unreliable results.
    Anyways you need to make these changes to your query.
    left
    join v_R_User USR on USR.Unique_User_Name0
    = CS.UserName0
    http://www.enhansoft.com/

  • Oracle Discoverer 10G and mapping Active Directory to use SSO/OID

    Could anybody point me please to the right direction?
    1. I've setup Oracle 10gIAS but turned off SSO and my users running discoverer /portals with no SSO.
    2. My goal is to turn on SSO and synchronize it with Active directory on the windows box.
    Thanks you in advance

    Hi Randy;
    As you mention all notes refer to SSO&OID for Active Directory integration.AFAIK there is no way to do it, please log a Sr and confirm this wiht oracle support
    Regard
    Helios

  • AADSync and Azure Active Directory Device Registration Service

    Now I try to implement Azure Active Directory Device Registration Service with AADSync.
    According to step-by-step guide, it has to execute "Enable-MSOnlineObjectManagement" cmdlet.
    Step-by-Step Guide for On-premises Conditional Access using Azure Active Directory Device Registration Service
    https://msdn.microsoft.com/en-us/library/azure/dn788908.aspx
    Unfortunately, AADsync doestn't have "Enable-MSOnlineObjectManagement", and can't find similar cmdlet.
    I'm looking for cmdlet for device object synchronization.
     Does anyone know alternate cmdlet?

    Hi,
    Thanks for your post.
    You need to use the command import-module DirSync in PowerShell, then running the command "get-command -m Microsoft.Online.Conexistence.PS.config", you will find the cmdlet "Enable-MSOnlineObjectManagement"
    Regards.
    Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • CMC Authentication Active Directory Synchronization Updates Drops Users

    We are using SAP Business Objects on a Windows Server 2008 box and have configured single sign-on using Active Directory. We schedule the Active Directory in the Authentication tab to synchronize every day. Yesterday not all of the users updated and actually were dropped from the CMC. We think it was because one of the domain controllers went down for a group of users during the last CMC Active Directory Update. My question is, are there any log files we can look at for the active directory synch to see if there were any errors detected during the synchronization. It would be nice too, to be able to see a list of what actually happened during the Active directory synch like what groups, users and user group associations where added and deleted.
    The result was when the users were dropped we lost any manual security setups and the user lost their favorites and preferences settings because they were dropped. Is there anyway we can insulate our Acitve Directory updates from accidentally dropping users when something goes wrong with the Active Directory Synch Update?
    Any best practices would be greatly appreciated.
    Thanks,
    Bill

    Hi Bill,
    Usually, if a group has been deleted or renamed in the AD controller, the group is deleted from the CMC. If a DC is not available, the group shouldn't have been deleted.
    As far as I know, there are no options for debugging the action of the schedule. If you suspect that this can happen again, you can enable/disable traces on your CMS programming the creation/copy of CMS_trace.ini when the AD graph/alias schedule is going to happen.
    There is an Idea that you can vote to avoid users being deleted when the group is accidentally deleted from the CMC:
    https://cw.sdn.sap.com/cw/ideas/2645
    In the meantime, you can also create Enterprise alias for your AD users, so even if the problem appears again, the security, inboxes and favourites will still be there.
    1401058 - How to create Enterprise aliases for LDAP or AD accounts
    [https://service.sap.com/sap/support/notes/1401058]
    Regards,
    Julian

  • Oracle Non-Windows DB and MS Active Directory

    Question:
    How can one configure a Microsoft Active Directory (LDAP-compliant directory
    service) with an Oracle Database when the Database resides on a unix server
    without the need of the Oracle LDAP? Is it possible ? If yes, please explain.

    Question: I have been looking at examples of using the LDAP packages but I am not sure if the examples are explaining the ldap_base and groups for MS AD OR an example for Oracle OID.
    Can you explain is this Oracle OID
    GC$ldap_user VARCHAR2(256) := 'cn=orcladmin';
    GC$ldap_passwd VARCHAR2(256) := 'welcome1';
    GC$ldap_base VARCHAR2(256) := 'cn=my_cn,dc=my_dc,dc=fr';
    Can you give an example for MS AD?

  • Oracle Enterprise User, OVD and MS Active Directory (AD)

    Hi,
    I need to authenticate Oracle Users from MS Active Directory.
    If I create an Oracle Enterprise User, can I just use OVD or do I need also OID ?
    If the answer is YES, I just need OVD do I need just to install OVD or do I need any other installation from OIM in order for it to work?
    Thanks in advance for answering this post : )
    CMT

    Hi,
    I am not sure that you are correct.
    In the meantime, some one mentioned a white paper to read: "Directory Services Integration with Database Enterprise User Secuirty. In page 10 it mentions a scenario: EUS deployment using Active Directory and OVD
    (without OID).
    The cons mentioned are: Need to extend AD schema to include EUS meta-data (which I am not sure how its done).

  • OAM and MS Active Directory Integration on Non-Windows Server envrionment

    I will start by saying that I am dealing with a heterogeneous environment here where multiple systems are run by different levels of management. Our Oracle systems chose to go all *nix (Oracle Solaris and Red Hat Linux) and hence we do not have a single Windows Server in our Oracle services area and would really like to keep it that way as we prefer to keep a uniform platform across our Oracle servers.  However, the desktop side of our department has chosen to use Microsoft Active Directory and now we wish to integrate and perform authentication against it for our OAM protected sites.  We are in the initial setup phase but we have no desire to implement a critical server such as OAM on the Windows platform and would rather tie OAM running on a Red Hat Linux server to Active Directory.  We will also be using OID as we run Portal but do not want to use it as our authentication authority for Oracle Products (local policy is that Active Directory is the only valid credential authority on site as we are moving to true Single Sign On across our desktops and web applications).  I have a few questions.
    1. Can it be done natively or would we have to run the Windows version of OAM?
    2. If you must run OAM on Windows to use AD for authentication, Is there some way to setup the Windows version of OAM as sort of an interface for our main OAM server running on Red Hat Linux to do the AD Auth?
    3. Can it be done using some sort of an interface such as Oracle Virtual Directory to interface with the LDAP interface to MS Active Directory?

    Hi David,
    Answers in-line
    1. Can it be done natively or would we have to run the Windows version of OAM?
    You can run all of the OAM Servers on *nix, and simply point to AD as an OAM data source on the machine:port that AD is running on. There is no need for the OAM components to be on Windows.
    2. If you must run OAM on Windows to use AD for authentication, Is there some way to setup the Windows version of OAM as sort of an interface for our main OAM server running on Red Hat Linux to do the AD Auth
    As above, this is not necessary.
    3. Can it be done using some sort of an interface such as Oracle Virtual Directory to interface with the LDAP interface to MS Active Directory?
    Yes, this is entirely possible. Even though it is not necessary in your situation, it often provides more flexibility to front-end the user store with OVD, for example when adding/renaming Windows domains, or specifying specific branches for users and so on.
    Regards,
    Colin

  • Oracle account and microsoft active directory password synchronisation

    Hi
    We are migrating our application to use windows active directory authentication. We have separate oracle account for
    each logged in user in the application, and these oracle credentials have to be the same as the windows active directory
    credentials.
    Also, a password change on windows Active directory should change the oracle account password.
    Is there a tool available to manage and synchronize the microsoft active directory and oracle account.
    We use oracle 10g and application is hosted on Windows 2008 server.
    Thanks
    Karthik

    There's an OOTB connector for Password Synch between AD -> OIM. Please use that.
    http://www.oracle.com/technetwork/middleware/id-mgmt/downloads/connectors-101674.html
    For password synch, OIM- AD/Oracle, you can use triggers.
    Enabling update for provisioned user in OIM11g

Maybe you are looking for