OIM 11g high availability - is LDAP required for Weblogic credential store

Question

Hi all,
Trying to understand whether we need an LDAP in an HA architecture with [OIM/SOA] - [OIM/SOA/Admin]?
The HA guide: http://docs.oracle.com/cd/E14571_01/core.1111/e10106/imha.htm#CDEFECJF
Does not mention this requirement, in fact it specifically says you only need an LDAP if: "only for LDAPSync-enabled Oracle Identity Manager installations and for Oracle Identity Manager installations that integrate with Oracle Access Manager. "
However I have seen mention of issues with viewing tasks in SOA from OIM:
How To : ORABPEL-30504: After Oim 11g Installation, Approval Tasks Cannot Be Read Through OIM Console
Stating then when using OIM, SOA and an isolated Admin server, you need to switch to a proper LDAP as a credential and policy store:
http://docs.oracle.com/cd/E17904_01/core.1111/e12036/net.htm#CIHIDJCC
"2.4 LDAP as Credential and Policy Store
With Oracle Fusion Middleware, you can use different types of credential and policy stores in a WebLogic domain. Domains can use stores based on XML files or on different types of LDAP providers. When a domain uses an LDAP store, all policy and credential data is kept and maintained in a centralized store. However, when using XML policy stores, the changes made on managed servers are not propagated to the Administration Server unless they use the same domain home.
An Oracle Fusion Middleware SOA Suite Enterprise Deployment Topology uses different domain homes for the Administration Server and the managed server as described in the Section 2.3, "Shared Storage and Recommended Directory Structure." Derived from this, and for integrity and consistency purposes, Oracle requires the use of an LDAP as policy and credential store in context of Oracle Fusion Middleware SOA Suite Enterprise Deployment Topology. To configure the Oracle Fusion Middleware SOA Suite Enterprise Deployment Topology with an LDAP as Credential and Policy store, follow the steps in Section 11.1, "Credential and Policy Store Configuration."
So which is it does anyone know?
Thanks,
Wayne.
Edited by: wblacklock on May 17, 2012 6:12 AM

Answer 1

Note that you can use the internal LDAP that comes with WebLogic, for your users and groups if you want.
When you have multiple domains, you have a problem with this set-up as the internal LDAP is coupled to
a specific domain. This means that users you created in one domain are not visible in the other. When using
a separate LDAP that contains the users. You can configure in each domain an authenticator that points
to the LDAP. In this way you can share to user accross multiple domains.
When you are planning to use one domain you can stick with the internal LDAP if you want.
An example set-up (that uses access manager not identity manager) can be found here: http://middlewaremagic.com/weblogic/?p=7819,
which might help you in how to proceed.