OID External Authentication Plug-in and OVD

Hello, ppl.
I have success installed AD, OVD(11g), OID(10g), and BI Publisher with SSO (10g).
When i synchronize AD -> OID, and use External Auth Plug-in, synchronized users can success login to BI Publisher.
When i synchronize AD -> OID through OVD, and use External Auth Plug-in which look in the AD, synchronized users can success login to BI Publisher.
But when i synchronize AD -> OID through OVD, and switch External Auth Plug-in from AD to OVD, synchronize users can not login to BI Publisher.
How can i use External Auth Plug-in with OVD, did any one have solution?
In the future, OVD can contains multiple forests from AD's, now AD have one forest(dc).
Help :)
Thanks.
Jeff.

I write custom plug-in for OVD.
When user bind, then log write...
OVD bind command's
1) ldapbind -h <OVD_HOST> -p 6501 -D "[email protected]" -w Oracle10g
ldap_bind: Invalid credentials
2) ldapbind -h <OVD_HOST> -p 6501 -D "cn=smith,cn=users,dc=domain,dc=local" -w Oracle10g
bind successful
3) ldapbind -h <OVD_HOST> -p 6501 -D "cn=smith,cn=users,dc=domain,dc=local" -w Oracle10g2
ldap_bind: Invalid credentials
AD bind command's
1) ldapbind -h <AD_HOST> -p 389 -D "[email protected]" -w Oracle10g
bind successful
2) ldapbind -h <AD_HOST> -p 389 -D "cn=smith,cn=users,dc=domain,dc=local" -w Oracle10g
bind successful
In my log file for OVD bind command's, just second and third command written.
Did any one know, why first command not binded and why not logged?
public void bind(Chain chain, Credentials creds, DirectoryString dn, BinarySyntax password, Bool result) throws DirectoryException, ChainException {
//pre bind
try {
chain.nextBind(creds, dn, password, result);
} catch (DirectoryException e) {
try {
FileWriter out = new FileWriter("c://mylogs//bind_error.txt");
out.write("bind: " + dn.toString());
out.close();
} catch (IOException ioe) {
ioe.printStackTrace();
//post bind
try {
FileWriter out = new FileWriter("c://mylogs//bind.txt");
out.write("bind: " + dn.toString());
out.close();
} catch (IOException ioe) {
ioe.printStackTrace();
...

Similar Messages

  • AD External Authentication Plug-In verification issue

    We are working on a Proof of Concept instance to integrate MS AD with OID for the first time for E-Biz 11i.
    1) I completed the bulk load of all the existing users from AD to OID successfully
    2) completed enabling the syncrhonization profile
    3) Ran the txkrun.pl successfully
    4) However i wanted to check the External authentication plug-in and i get the below issue.
    How to debug ldapcompare ? Where is the logfile for ldapcompare ?
    ldapcompare -h OID_Host -p 389 -D "cn=orcladmin" -w ******* -b "cn=lastname\, firstname,ou=consultants,ou=users,ou=usaeast,dc=adadmin,dc=lps,dc=netsrv,dc=us" -a userPassword -v abcdefgh
    The value abcedefgh is not contained in the attribute userPassword in DN cn=lastname\, firstname,ou=consultants,ou=users,ou=usaeast,dc=adadmin,dc=lps,dc=netsrv,dc=us.
    An ldapbind on the same AD server is successful, but ldapcompare is failing.

    I get invalid credentials. Though the network password is correct. I feel its somewhere i messed up the 3rd party plug-in configuration. Is there a method to get debug information for ldapcompare command ?
    From metalink NOTE : 277382.1
    "When using the above command, ldapcompare binds to OID using the OID admin user (typically "cn=orclAdmin") and password. Then it provides the AD username and requests that the value supplied as AD-USER-PASSWORD be compared to whatever is stored in AD username's userPassword attribute. Because OID does not store a value in its own user entries/userPassword attributes for AD-synchronized entries, this ldapcompare call will cause OID to invoke the plug-in and verify the userPassword value in AD instead.
    If the plug-in works, the ldapcompare should return a message saying that the given password is contained in the userpassword attribute, e.g.
    "

  • Error while Configuring AD external authentication plug in

    Hi
    While configuring Active directory external authentication plug I am getting following error
    OID Active Directory Plug-in Configuration
    Please make sure Database and OID are up and running.
    Please enter Active Directory host name: clmad101.ad.company.com
    Do you want to use SSL to connect to Active Directory? (y/n) n
    Please enter Active Directory port number [389]: 389
    Please enter DB connect string:SQLPLUS sys/manager1 @infradb.ad.company-.com @md61nthiims1.ad.company.com:1521
    Please enter ODS password:
    Please enter confirmed ODS password:
    Please enter OID host name: md61nthiims1.ad.company.com
    Please enter OID port number [389]: 389
    Please enter orcladmin password:
    Please enter confirmed orcladmin password:
    Please enter the subscriber common user search base [orclcommonusersearchbase]:
    CN=Users,dc=ad,dc=company,dc=com
    Please enter the Plug-in Request Group DN:
    Please enter the exception entry property [(!(objectclass=orcladuser))]: (|(!obj
    ectclass=orcladuser))(cn=orcladmin))
    Do you want to setup the backup Active Directory for failover? (y/n) n
    Installing Plug-in Packages ...
    Usage: SQLPLUS [ [<option>] [<logon>] [<start>] ]
    where <option> ::= -H | -V | [ [-C <v>] [-L] [-M <o>] [-R <n>] [-S] ]
    <logon> ::= <username>[<password>][@<connect_identifier>] | / | /NOLOG
    <start> ::= @<URL>|<filename>[.<ext>] [<parameter> ...]
    "-H" displays the SQL*Plus version banner and usage syntax
    "-V" displays the SQL*Plus version banner
    "-C" sets SQL*Plus compatibility version <v>
    "-L" attempts log on just once
    "-M <o>" uses HTML markup options <o>
    "-R <n>" uses restricted mode <n>
    "-S" uses silent mode
    Usage: SQLPLUS [ [<option>] [<logon>] [<start>] ]
    where <option> ::= -H | -V | [ [-C <v>] [-L] [-M <o>] [-R <n>] [-S] ]
    <logon> ::= <username>[<password>][@<connect_identifier>] | / | /NOLOG
    <start> ::= @<URL>|<filename>[.<ext>] [<parameter> ...]
    "-H" displays the SQL*Plus version banner and usage syntax
    "-V" displays the SQL*Plus version banner
    "-C" sets SQL*Plus compatibility version <v>
    "-L" attempts log on just once
    "-M <o>" uses HTML markup options <o>
    "-R <n>" uses restricted mode <n>
    "-S" uses silent mode
    Usage: SQLPLUS [ [<option>] [<logon>] [<start>] ]
    where <option> ::= -H | -V | [ [-C <v>] [-L] [-M <o>] [-R <n>] [-S] ]
    <logon> ::= <username>[<password>][@<connect_identifier>] | / | /NOLOG
    <start> ::= @<URL>|<filename>[.<ext>] [<parameter> ...]
    "-H" displays the SQL*Plus version banner and usage syntax
    "-V" displays the SQL*Plus version banner
    "-C" sets SQL*Plus compatibility version <v>
    "-L" attempts log on just once
    "-M <o>" uses HTML markup options <o>
    "-R <n>" uses restricted mode <n>
    "-S" uses silent mode
    Registering Plug-ins ...
    adding new entry cn=adwhencompare,cn=plugin,cn=subconfigsubentry
    adding new entry cn=adwhenbind,cn=plugin,cn=subconfigsubentry
    Done.
    Is there anythign wrong in the DB connect string??
    Thanks

    Did you check the debug information from the external auth plugin.?
    This is mentioned in metalink note https://metalink.oracle.com/metalink/plsql/showdoc?db=NOT&id=277382.1
    here an excerpt:
    D) Enabled plug in debugging at the database level. Reference documentation: Oracle Internet Directory Administrator's Guide 10g (9.0.4) Chapter 43 Integration with the Microsoft Windows Environment - Troubleshooting Integration with Microsoft Windows Under section "Debugging the Microsoft Active Directory External Authentication Plug-in"
    ...enable the plug-in debugging. To do this, enter:
    > sqlplus ods/odspassword @$ORACLE_HOME/ldap/admin/oidspdon.pls
    To check the plug-in debugging log, enter:
    > sqlplus system/manager
    SQL> select * from ods.plg_debug_log order by id;
    (To delete the plug-in debugging log:
    > sqlplus system/manager
    SQL> truncate table ods.plg_debug_log
    To disable the plug-in debugging:
    > sqlplus ods/ods @$ORACLE_HOME/ldap/admin/oidspdof.pls
    E) Dump the plug-in profile to make sure it is enabled and configured correctly:
    > ldapsearch -h <OID host> -p <OID port> -D "cn=orcladmin" -w <orcladmin password> -b "cn=plugin,cn=subconfigsubentry" -L -s sub "(objectclass=*)" "*"
    please take also a look into the DIPTESTER tool available in
    http://www.oracle.com/technology/sample_code/products/oid/java_diptester.tar
    regards
    --Olaf                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                       

  • Oracle Virtual Directory vs. Oracle External Authentication Plug-in

    I am working in Windows 2003 Server platform and I have Oracle Portal 10g R2 with Oracle Single Sign On 10g R2 setup. I also have Microsoft Active Directory setup. I want to use Microsoft Active Directory users from Oracle Portal and as per my understanding I could use Oracle External Authentication Plug-in or Oracle Virtual Directory for this purpose. I would like to use Oracle Virtual Directory if possible. Could someone please tell me if I could use Oracle Virtual Directory or not?
    Thanks.

    Yeah, I could use Oracle External Authentication Plug-in, but I am having issues with running the oidspadi.sh script on my Windows 2003 server environment. I am running this script using Cygwin's latest software, but for some reason I get the following error message.
    : command not found8:
    : command not found8:
    : command not found3:
    : command not found7:
    : command not found1:
    : command not found8:
    : command not found9:
    : command not found0: clear
    OID Active Directory Plug-in Configuration
    Please make sure Database and OID are up and running.
    : command not found7:
    : command not found0:
    oidspadi.sh: line 103: syntax error near unexpected token 'fi'
    'idspadi.sh: line 103:' fi
    Therefore, I was trying to find an alternative solution, which will be using Virtual Directory. Right now, I have installed Oracle Virtual Directory on my testing system and I have both Active Directory server and OID server part of LDAP Browser. My goal is to using Oracle Portal to log-in and first look for the user in OID if not found then look in Active Directory. Can this be accomplished using Oracle Virtual Directory?
    Please let me know.

  • OracleAS SSO - Microsoft Active Directory External Authentication Plug-in

    hi ,
    I recently inherited support of a Oracle SSO/OID environment where we use AD and a external Authentication Plug-
    in to talk to it as user credentials are managed in AD,
    We have a lot of domain controllers for AD in our env , so my questions is
    1) How do I find out which AD server is the plugin currently referring to ,
    I need to know this info ASAP as lot of AD servers are getting decomissioned and I want to make sure the SSO env
    is not talking to a AD server that would get decomissioned soon

    hi,
    Look in the integration part in oidadmin. ActiveChgImp
    $ORACLE_HOME/bin/oidadmin
    or look for ad2oid.properties
    or look at this URL http://www.oracle.com/technology/obe/obe_as_10g/im/ads_import/import.htm
    is what I used to configure ours
    Regards

  • AD external authentication plug-in

    Is it possible to authenticate the users stored in AD just by configuring the external authentication plug-in, or it is necessary to populate OID with users and groups stored in AD?
    All the user information is in AD, and we don't want, if possible, to replicate the users in both places.

    I am planning to do the same. We'd like to use the passwords stored in the AD to authenticate our users. We do not want to store and maintain the passwords ourselves.
    Celso -- Could you tell me more about your experience on installation of the AD external authentication plug-in? Do you use the PL/Sql program in book "OID ADMIN Guide" chapter 47? How much work is involved with populate OID with users and groups stored in AD? Is the whole installation hard or easy?
    Partrick -- Could I not populate OID from AD, instead, create user via OID itself (oiddas)? I am trying to avoid any "non plug-in related" work.
    Thanks,
    Xiaoyun

  • Plug-in Request Group field into the external authentication plug-in

    Hi all,
    I'd like to know if anyone has already tried to filter who can have the permission to call the external authentication plug-in setting it into Plug-in Request Group field.
    I've made some tests adding some users into groups OracleDASAdminGroup, OracleUserSecurityAdmins and groups that I've created under my DC settings. Unfortunatly, I've had no success.
    Is possible to do this?
    Thank you.
    Message was edited by:
    user571491

    Hi all,
    I'd like to know if anyone has already tried to filter who can have the permission to call the external authentication plug-in setting it into Plug-in Request Group field.
    I've made some tests adding some users into groups OracleDASAdminGroup, OracleUserSecurityAdmins and groups that I've created under my DC settings. Unfortunatly, I've had no success.
    Is possible to do this?
    Thank you.
    Message was edited by:
    user571491

  • Invoking 'active directory external authentication plug-in'  from login.jsp

    Hi
    I am using the Oracle AS 10g on Unix. We have a web application in JAVA based on OC4J Framework.
    Currently user use application url for accessing the login page, enters credentials and then the authentication is done through LDAP.
    Now we have to remove the login page from application. i.e. once user is successfully logged in Windows on his pc, and tries to access our application through it's url, he must be automatically authenticated using the credentials entered in windows and display the welcome page of application. Same as any intranet application.
    For this requirement, we have 'active directory external authentication plug-in' installed on server.
    What we need to know is how this process will work and changes required in our jsp page to invoke this plug-in and authenticate user by accessing windows-credentials automatically.
    kindly let me know

    Hi
    I am currently using NTLM to fetch the windows username and then creating an anonymous connection with the LDAP Server.
    Then i serach using the user name in ldap directory.
    NTLM is no longer required , instead we have 'active directory external authentication plug-in' installed on LDAP.
    as far as i know the plug-in will process the kerberos ticket generated by windows to automatically authenticate.

  • Question on External Authentication Plug-in

    I have 2 windows domains with no global catalog server. The documentation shows how to setup external authentication plug-in when you have just one domain. Can anyone provide a link on how to setup the plug-in when you have more than one domain? Thanks for your help.

    Yes it is possible,
    >i want to know if its possible or not in a very easy and efficiant way<
    ……well I think so, but one could argue about the „easy & efficient” part of it……..
    Anyway here are a few possibilities:
    https://help.apple.com/logicpro/mac/10/#lgcp215834c2
    ……don’t know of any trial possibilities………
    Cheers!

  • OID external authentication - having trouble excuting oidspadi.sh

    Hi all,
    I am setting up External Authentication for OID, and have trouble with it. My version is Oracle application server infrastructure 10.1.2 (OID 10.1.2) on windows.
    hailie@Server1 /cygdrive/e/oracle/OraInfra/ldap/admin
    $ export ORACLE_HOME="E:\oracle\OraInfra"
    hailie@Server1 /cygdrive/e/oracle/OraInfra/ldap/admin
    $ sh oidspadi.sh
    oidspadi.sh: line 28: $'\r': command not found
    oidspadi.sh: line 38: $'\r': command not found
    oidspadi.sh: line 43: $'\r': command not found
    oidspadi.sh: line 47: $'\r': command not found
    oidspadi.sh: line 51: $'\r': command not found
    oidspadi.sh: line 58: $'\r': command not found
    oidspadi.sh: line 59: $'\r': command not found
    oidspadi.sh: line 60: $'clear\r': command not found
    OID Active Directory Plug-in Configuration
    Please make sure Database and OID are up and running.
    oidspadi.sh: line 67: $'\r': command not found
    oidspadi.sh: line 70: $'\r': command not found
    oidspadi.sh: line 103: syntax error near unexpected token `fi'
    'idspadi.sh: line 103: ` fi
    Edited by: Hailie on Jan 16, 2009 8:05 AM
    Edited by: Hailie on Jan 16, 2009 8:45 AM
    Edited by: Hailie on Jan 16, 2009 11:32 AM

    After I removed all the blank lines in oidspadi.sh:
    hailie@Server1 /cygdrive/e/oracle/OraInfra/ldap/admin
    $ sh oidspadi.sh
    oidspadi.sh: line 53: $'clear\r': command not found
    OID Active Directory Plug-in Configuration
    Please make sure Database and OID are up and running.
    oidspadi.sh: line 91: syntax error near unexpected token `fi'
    'idspadi.sh: line 91: `fi
    Thank you for your help.
    Hailie
    Edited by: Hailie on Jan 16, 2009 8:43 AM
    Edited by: Hailie on Jan 16, 2009 8:46 AM
    Edited by: Hailie on Jan 16, 2009 11:36 AM

  • OID External Authentication issue

    Hi..
    I have configured synchronization profile to import users from TDS to OID using DIP but it does not work as change log is not enabled on TDS side.
    Now i have configured External Authentication Plugin and i craeted same users in in TDS and also in OID but external authenctication does not work.
    Can you please point out if i missing some point or is synchronization profile is must for External Authentication.
    Find the product version details -
    OID 11.1.1.6
    Tivoli Directory Server 6.1
    Regards
    Santosh
    Edited by: user601746 on Jan 8, 2013 1:02 AM

    Got the solution.
    I used bootstrap loading to create users from TDS to OID then configure external authentication..works fine... :)

  • OID External Authentication Plugin - Conceptual question

    Hi-
    Does anyone know the answer to this: If I enable the External Authentication Plugin for OID (to AD) does that mean that if I have any accounts in OID which do not exist in AD, they won't be able to authenticate?
    Also, if anyone knows of some conceptual documentation on this, please let me know. All I could find was how to install it, but not how it works. (do I need to match users on CN or uid or what?)
    Thanks

    Hi,
    Once you are done with user accounts synchorinzation successfully using dipassistant tool from edirectory to OID. Inorder to update/flush the user accounts password that which are synchronized to OID, in such case OID eDirectory External Authenctiation plugin will be used (oidspediri.sh file) located under <ORACLE_HOME>ldap/admin. Provide th neccessary eDirectory Details.
    Regards,
    ABP

  • External Instrument plug-in and SysEx

    Hi
    Am I right in thinking that the External Instrument plug-in filters out SysEx during MIDI playback?
    cheers
    zib

    I don't know offhand without checking it, but it wouldn't surprise me too much if it did, as there seem to be some limitation in the MIDI data that audio instrument channels pass.
    If it does, you'll need to make up a regular instrument set to your external instrument's port/channel and put that on a track below your external instrument track, and move the sysex to that...

  • OID Configure external authentication plug-in in OID

    Hi,
    How to authenticate Apps 11i/R12/12i Users against AD password?
    How to know if your E-Business Suite is integrated with SSO/OID?
    Thanks

    Hi,
    I believe all your questions are answered in these documents.
    Note: 437822.1 - How to integrate Active Directory with Applicactions 11i , with SSO/OID enable?
    Note: 233436.1 - Installing Oracle Application Server 10g with Oracle E-Business Suite Release 11i to configure 11i with Oracle Internet Directory.
    Note: 376811.1 - Integrating Oracle E-Business Suite Release 12 with 10g AS Oracle Internet Directory and Oracle Single Sign-On
    Note: 444573.1 - Basic checks for user integration when using Oracle E-Business Suite 11i with Oracle AS 10g
    Regards,
    Hussein

  • Reconfigure Active Directory External Authentication plug in to use ssl

    Assuming this is the proper place to post this question:
    I've quickly gone through the IM integration documentation trying to find out how to reconfigure the ad external auth plugin to use ssl and have come up empty handed. Does anyone know how to do this? Should I just rerun oidspadi.sh?
    Also, where can i view the configuration information that was entered the last time this was configured?
    thanks for any help!
    chris

    Rerun oidspadi.sh and select SSL option. You can get adwhencompare and adwhenbind plug-ins detail under plug-in management in Oracle directory manager.

Maybe you are looking for

  • How to change Bulk Insert statement from MS SQL to Oracle

    Hi All, Good day, I would like to bulk insert the content of a file into Oracle db. May I know how to change the below MS SQL syntax to Oracle syntax? Statement statement = objConnection.createStatement(); statement.execute("BULK INSERT [TBL_MERCHANT

  • Line item display for Segment Clearing GL account

    In my scenario, document splitting is activated and zero balance is set for profit centre and segment.  I have assigned a GL account for automatic posting for segment clearance for posting.  I have posted few transactions and the document shows the p

  • HT201401 Power button stuck

    I can't turn my iphone 4s off.  The power button got stuck and no matter how hard i press it, the phone won't turn on nor off.  Can anyone help me please?

  • Title Bar not showing transparency?

    My title bar is not showing the transparency in leopard. I am wondering if I am the only one experiencing this problem. title bar: http://www.flickr.com/photos/14619753@N05/2079776248/in/photostream/ (I am running on a PPC processor, and maybe that i

  • Leopard Install Disc won't restart into installer.

    I have a G5 quad core and am trying to install Leopard from my family pack installation disc. My superdrive is malfunctioning and will not accept any discs (spins as though it's loading, clicks and tries again, only to spit the disc back out). I purc