Oim 9.1.0.1 to active directory using ssl

Hi,
I am working on OIM 9.1.0.1 and AD IS on WIN2K3 R2.
I successfully installed CA certificate in AD Server as given in AD Connector Document 9.1.0.1 given below.
Configuring SSL for Microsoft Active Directory
To configure SSL communication between Oracle Identity Manager and Microsoft Active Directory, you must perform the following tasks:
a) Installing Certificate Services
b) Enabling LDAPS
c) Setting Up the Target System Certificate As a Trusted Certificate
a) Installing Certificate Services
To install Certificate Services on the target system host computer:
Before you begin installing Certificate Services, you must ensure that Internet Information Services (IIS) is installed on the target system host computer.
Note:
1. Insert the operating system installation media into the CD-ROM or DVD drive.
2. Click Start, Settings, and Control Panel.
3. Double-click Add/Remove Programs.
4. Click Add/Remove Windows Components.
5. Select Certificate Services.
6. In the Windows Components Wizard, follow the instructions to start Certificate Services.
I selected Enterprise root CA as the CA type as said in AD connector Doc.
b) Enabling LDAPS
The target system host computer must have LDAP over SSL (LDAPS) enabled. To enable LDAPS:
1. On the Active Directory Users and Computers console, right-click the domain node, and select Properties.
2. Click the Group Policy tab.
3. Select Default Domain Policy.
4. Click Edit.
5. Click Computer Configuration, Windows Settings, Security Settings, and Public Key Policies.
6. Right-click Automatic Certificate Request Settings, and then select New and Automatic Certificate Request. A wizard is started.
7. Use the wizard to add a policy with the Domain Controller template.
At the end of this procedure, the certificate is created and LDAPS is enabled on port 636. You can use an LDAP browser utility to verify that LDAPS is working.
But my problem is i am not able to connect to AD over SSL through JExplorer LDAP Browser in AD Server itself.
its saying Socket closed and some times binding failed.
And Firewall is on and Telnet is happening to both 389 and 636 ports from outside AD Server and in AD Server
Please give the solution to overcome this issue.
regards
Ramu

Hi
From Apache Directory Studio i am able to connect over SSL (port 636) to AD and also imported certificate in oim.
In Diagnostic Dashboard Test Connectivy of AD i found the below error.
ITResource information values are not correct. Enter the correct values.
The root cause is . . .
java.lang.reflect.InvocationTargetException
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at com.thortech.xl.systemverification.tests.TestConnector.runInterfaceMethods(Unknown Source)
     at com.thortech.xl.systemverification.tests.TestConnector.execute(Unknown Source)
     at com.thortech.xl.systemverification.webapp.SystemVerificationServlet.doPost(Unknown Source)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:821)
     at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
     at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:176)
     at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3498)
     at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
     at weblogic.security.service.SecurityManager.runAs(Unknown Source)
     at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2180)
     at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2086)
     at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1406)
     at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
     at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Caused by: javax.naming.CommunicationException: simple bind failed: adr.oimad.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
     at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:197)
     at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2658)
     at com.sun.jndi.ldap.LdapCtx.(LdapCtx.java:287)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
     at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
     at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
     at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
     at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
     at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
     at javax.naming.InitialContext.init(InitialContext.java:223)
     at javax.naming.InitialContext.(InitialContext.java:197)
     at javax.naming.directory.InitialDirContext.(InitialDirContext.java:82)
     at com.thortech.xl.integration.ActiveDirectory.test.ADServerConnectorTest.getLDAPConnection(Unknown Source)
     at com.thortech.xl.integration.ActiveDirectory.test.ADServerConnectorTest.testBasicConnectivity(Unknown Source)
     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
     at java.lang.reflect.Method.invoke(Method.java:597)
     at com.thortech.xl.systemverification.tests.TestConnector.runInterfaceMethods(Unknown Source)
     at com.thortech.xl.systemverification.tests.TestConnector.execute(Unknown Source)
     at com.thortech.xl.systemverification.webapp.SystemVerificationServlet.doPost(Unknown Source)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
     at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
     at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
     at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
     ... 8 more
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1591)
     at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:187)
     at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:181)
     at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:975)
     at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
     at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
     at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1096)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:744)
     at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:75)
     at java.io.BufferedInputStream.fill(BufferedInputStream.java:218)
     at java.io.BufferedInputStream.read1(BufferedInputStream.java:258)
     at java.io.BufferedInputStream.read(BufferedInputStream.java:317)
     at com.sun.jndi.ldap.Connection.run(Connection.java:805)
     at java.lang.Thread.run(Thread.java:619)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:285)
     at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
     at sun.security.validator.Validator.validate(Validator.java:218)
     at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
     at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
     at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
     at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:954)
     ... 12 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
     at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
     at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
     at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)
     ... 18 more
regards
Ramu

Similar Messages

  • Problem in provisioning user from oim to active directory using ssl

    hi,
    problem in provisioning user from oim to active directory using ssl i am getting following error while provisioning user to AD.
    15:18:12,984 ERROR [ADCS] Communication Errorsimple bind failed: 172.16.30.35:636
    15:18:12,984 ERROR [ADCS] The error occured in tcADUtilLDAPController::connectTo
    AvailableAD():simple bind failed: 172.16.30.35:636
    15:18:13,015 ERROR [SERVER] Class/Method: tcProperties/tcProperties encounter so
    me problems: Must set a query before executing
    com.thortech.xl.dataaccess.tcDataSetException: Must set a query before executing
    at com.thortech.xl.dataaccess.tcDataSet.checkExecute(Unknown Source)
    at com.thortech.xl.dataaccess.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.dataobj.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.dataaccess.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.dataobj.tcDataSet.executeQuery(Unknown Source)
    at com.thortech.xl.dataobj.util.tcProperties.<init>(Unknown Source)
    at com.thortech.xl.dataobj.util.tcProperties.initialize(Unknown Source)
    at Thor.API.tcUtilityFactory.getLocalUtility(Unknown Source)
    at Thor.API.tcUtilityFactory.getUtility(Unknown Source)
    at com.thortech.xl.integration.ActiveDirectory.tcADUtilLDAPController.co
    nnectToAvailableNextAD(Unknown Source)
    at com.thortech.xl.integration.ActiveDirectory.tcADUtilLDAPController.se
    archResultPageEnum(Unknown Source)
    at com.thortech.xl.schedule.tasks.ADLookupRecon.performReconciliation(Un
    known Source)
    at com.thortech.xl.schedule.tasks.ADLookupReconTask.execute(Unknown Sour
    ce)
    at com.thortech.xl.scheduler.tasks.SchedulerBaseTask.run(Unknown Source)
    at com.thortech.xl.scheduler.core.quartz.QuartzWrapper$TaskExecutionActi
    on.run(Unknown Source)
    at Thor.API.Security.LoginHandler.jbossLoginSession.runAs(Unknown Source
    at com.thortech.xl.scheduler.core.quartz.QuartzWrapper.execute(Unknown S
    ource)
    at org.quartz.core.JobRunShell.run(JobRunShell.java:203)
    at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.j
    ava:520)
    can any one help.
    Thanks and Regards,
    praveen,

    Are you able to connect to AD over SSL through some LDAP Browser ?
    Check the validity of Certificate ?
    Does your certificate appear in the list ?

  • Error while trying to provision OIM user to Active Directory using SSL

    Hi All,
    I am able to see the users through LDAP browser using SSL but am getting the following error while trying to provision OIM users to AD using SSL.
    I am using Microsoft Active Directory connector type 9.11.
    Response: Connection Error encountered
    Response Description: Error encountered while connecting to target system
    I did some testing using "Diagnostic Dashboard" and the following are the results.
    Test Name: Target System SSL Trust Verification: Passed
    Test Name: Test Basic Connectivity: Failed
    Exceptions:
    ITResource information values are not correct. Enter the correct values.
    java.lang.reflect.InvocationTargetException
    javax.naming.CommunicationException: simple bind failed:
    unable to find valid certification path to requested target.Test Name: Test Provisioning:Failed
    Note: Without SLL all the above tests got Passed.
    Can anybody help me out from this issue.
    Thanks in advance.
    Pradeep Kumar.

    I am able to connect to AD using 636 port number from LDAP browser and as the following test got Passed i think that my certificatee should be correct.
    Test Name: Target System SSL Trust Verification.
    Input Parameters
    Target System: idm.orademo.com
    Port: 636 Certificate Store
    Location: /usr/java/jdk1.6.0_14/jre/lib/security/cacerts
    Result : Passed
    ITResource Values:
    ADAM LockoutThreshold Value     
    ADGroup LookUp Definition     Lookup.ADReconciliation.GroupLookup
    Admin FQDN     cn=Administrator,cn=Users,dc=orademo,dc=com
    Admin Password     *******
    Allow Password Provisioning     yes
    AtMap ADGroup     AtMap.ADGroup
    AtMap ADUser     AtMap.AD
    Invert Display Name     no
    Port Number     636
    Remote Manager Prov Lookup     AtMap.AD.RemoteScriptlookUp
    Remote Manager Prov Script Path     
    Root Context     dc=orademo,dc=com
    Server Address     idm.orademo.com
    Target Locale: TimeZone     GMT
    UPN Domain     orademo.com
    Use SSL     yes
    isADAM     no
    isLookupDN     no
    isUserDeleteLeafNode     no
    Thansk & Regards,
    Pradeep Kumar.

  • OIM 11gR2 user not provisioning to Active Directory (11.1.1.5 connector)

    Hello all,
    I'm trying to set up an OIM 11gR2 instance to work with Active Directory with the Active Directory 11.1.1.5.0 connector. I've full installed both OIM and AD on separate servers, and I've installed the AD 11.1.1.5 connector on OIM. I have configured Active Directory properly (connector on OIM and the connector server on the AD server-side), and have set up the two IT Resources on OIM. I can run, for example, the Active Directory Organization Lookup Recon job and have it return results in the Lookup window.
    My problem is that I cannot get it to provision to a user. I've created an Application Instance and Form for Active Directory, attached the Form, associated them with the appropriate resources (AD User), and added them to the Catalog, and then gone through the process of adding an account to the user, selecting the Application Instance, adding it to the cart, checking out, filling out the fields (Password, User ID, UPN, First Name, Last Name, Common Name, and Organization Name), and then submitting the request. This is all done as the xelsysadm admin user, but it still results with the account stuck on "Provisioning" because the "Create User" task failed due to a Connector Error (the reason stated is just a repeat of "Create Object" failed).
    Anyone know what I'm missing here?
    Thank you!
    Edited by: 939908 on Nov 12, 2012 6:36 AM

    Hey 833249, thanks for your reply
    The organization field attribute is filled in correctly, in that the OU I selected exists in AD.
    These are the errors listed in the connector server log:
    +11/9/2012 9:07:07 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception occured during the creation of directory entry.+
    +11/9/2012 9:07:07 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception Message : Logon failure: unknown user name or bad password.+
    +11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryUtils Method -> GetDirectoryEntry, Message -> Exception Stack Trace : at System.DirectoryServices.DirectoryEntry.Bind(Boolean throwIfFail)+
    at System.DirectoryServices.DirectoryEntry.Bind()
    at System.DirectoryServices.DirectoryEntry.get_NativeObject()
    at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.GetDirectoryEntry(String path, ActiveDirectoryConfiguration configuration) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1423
    +11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryConnector Method -> Create, Message -> Encountered Excetion: Unable to get the Directory Entry+
    +11/9/2012 9:07:08 PM <ERROR>: Class-> ActiveDirectoryConnector Method -> Create, Message -> Stack Trace: at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.GetDirectoryEntry(String path, ActiveDirectoryConfiguration configuration) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1456+
    at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryUtils.DirectoryEntryExists(String path) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryUtils.cs:line 1512
    at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryConnector.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryConnector.cs:line 219
    ConnectorServer.exe Error: 0 : Org.IdentityConnectors.Framework.Common.Exceptions.ConnectorException: Unable to get the Directory Entry
    at Org.IdentityConnectors.ActiveDirectory.ActiveDirectoryConnector.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_oimcp\idc\bundles\dotnet\ActiveDirectory\ActiveDirectoryConnector\ActiveDirectoryConnector.cs:line 368
    at Org.IdentityConnectors.Framework.Impl.Api.Local.Operations.CreateImpl.Create(ObjectClass oclass, ICollection`1 attributes, OperationOptions options) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\ApiLocalOperations.cs:line 388
    at Org.IdentityConnectors.Framework.Impl.Api.Local.Operations.ConnectorAPIOperationRunnerProxy.Invoke(Object proxy, MethodInfo method, Object[] args) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\ApiLocalOperations.cs:line 244
    at ___proxy1.Create(ObjectClass , ICollection`1 , OperationOptions )
    at Org.IdentityConnectors.Framework.Impl.Server.ConnectionProcessor.ProcessOperationRequest(OperationRequest request) in c:\ADE\aime_icf\icf\framework\dotnet\FrameworkInternal\Server.cs:line 609
    I'm not sure why the username/password error could be occurring, as those fields in the AD IT Resource are correct (I've run AD recon jobs that have connected properly). Is there something I'm missing?

  • How to save HR data in Active Directory using ABAP i.e thru LDAP Connector

    Hi All,
           Can any one please help me out how
           to save HR data in Active directory
           using LDAP Connector ?             
           Please help ASAP as it is very urgent .
    Thanks
    Jitendra

    There are 100 of such scripts are there online.
    here are few tips and codes. you will get more.  
    https://gallery.technet.microsoft.com/scriptcenter/Feeding-data-to-Active-0227d15c
    http://blogs.technet.com/b/heyscriptingguy/archive/2012/10/31/use-powershell-to-modify-existing-user-accounts-in-active-directory.aspx
    http://powershell.org/wp/forums/topic/ad-import-csv-update-attributes-script/
    Please mark this as answer if it helps

  • How to save hr data in Active directory  using abap

    Hi all
    can any one please help me out how to save hr data in Active directory using LDAP connector
    please help as this is very urgent requirement
    thanks in advance
    Thanks
    Chanti

    What form do you have the user's name in ?
    ANTIPODES\alberteString searchFilter = "(&(objectClass=user)(samAccountName=alberte))";[email protected] searchFilter = "(&(objectClass=user)(userPrincipalName=[email protected]))";Albert EinsteinString searchFilter = (&(objectClass=user)(givenName=Albert)(sn=Einstein))";or using Ambiguous Name Resolution (anr)String searchFilter = "(&(objectClass=user)(anr=Albert Einstein))";or it's even clever enough to useString searchFilter = "(&(objectClass=user)(anr=Einstein Albert))";

  • OIM 9.1.0 Integration with Active Directory 2008 R2

    Hi,
    My customer is running Root/Child AD structure based on windows 2003 w/SP2, OIM 9.1.0 deployed under one of the child domains, and integrated with child domains controllers which runs windows server 2003 as well.
    My customer has decided to upgrade his AD to Windows Server 2008 R2 domain controllers across the entire AD Forest and still wants to integrate the current OIM v9.1.0 with AD for all of his Users provisioning and password synchronizations.
    Am not sure if current OIM version of OIM 9.1.0 is compatible and supported by OIM v9.1.0 under active directory version 2008 / R2, and not sure if it can be integrated with such AD version.
    Any guidance is really appreciated.
    Also I was thinking of such scenario but also not sure of its support ability and if OIM will keep working on such scenario, the scenario is to upgrade only the AD root domain to Windows 2008 R2 while keeping the child domain holding the OIM 9.1.0 at Windows 2003 version.
    Is this a working and supported scenario by OIM v9.1.0 ?

    I believe you question should be if the connector supports this architecture. Check out the versions supported for the connector you are using and you should be good.
    -Bikash

  • OIM - Provisioning of a Group to Active Directory

    Hallo,
    When I provision a AD Group resource I get the following exception:
    08/06/02 11:44:40 Running Get Attribute Map
    08/06/02 11:44:40 Running Get Path
    08/06/02 11:44:40 Running Create Group
    ERROR,02 Jun 2008 11:44:41,600,[XL_INTG.ACTIVEDIRECTORY],Problem creating object: javax.naming.directory.InvalidAttributeValueException: [
    LDAP: error code 21 - 00000057: LdapErr: DSID-0C090B38, comment: Error in attribute conversion operation, data 0, vece^@]; remaining name
    'cn=Xellerate Users'
    I am using the standard form that is provided with the Connector for Microsoft Active Directory 9.0.4.
    Thanks

    The group name wasn't too long. There was a problem in Lookup Definition of the Group Type. I could solve this problem.
    Best regards

  • Saving the password of a user in active directory using java

    Hello, i am trying to use java to build a class that creates a user in Active directory 2012.But the problem is that when the user is created the password is not being saved.
    Can anybody help on this knowing that i tried to save in the fields userPassword and unicodePwd.
    Thanks.

    DirContext ctx = new InitialDirContext(pr);
              BasicAttributes entry = new BasicAttributes(true);
              String entryDN = "cn=CharbelHad,ou=test users,dc=test,dc=dev";
              Attribute cn = new BasicAttribute("cn", "ChHad");
              Attribute street = (new BasicAttribute("streetAddress", "Ach"));
              Attribute loginPreW2k = (new BasicAttribute("sAMAccountName", "[email protected]"));
              Attribute login = (new BasicAttribute("userPrincipalName", "[email protected]"));
              Attribute sn = (new BasicAttribute("sn", "Chl"));
              Attribute pwd = new BasicAttribute("unicodePwd", "\"Ch@341\"".getBytes("UTF-8"));
    Attribute userAccountControl = new BasicAttribute("userAccountControl", "512");
              Attribute oc = new BasicAttribute("objectClass");
              oc.add("top");
              oc.add("person");
              oc.add("organizationalPerson");
              oc.add("user");
              // build the entry
              entry.put(cn);
              entry.put(street);
              entry.put(sn);
              entry.put(userAccountControl);
              entry.put(pwd);
              entry.put(login);
              entry.put(loginPreW2k);
              entry.put(oc);
              ctx.createSubcontext(entryDN, entry);

  • Filtering Groups on Windows Active Directory using LDAP Authentication

    Hi All,
    I have small module that filters the groups from the Windows AD using LDAP attributes and flushes the data into the DB[code below].
    This module was developed and tested on weblogic 8.1[on windows]and works fine.
    Now the same is moved to another environment- Websphere on Linux Suse. The code fails to retreieve any value from the Windows AD.
    Please note no exception is aslo thrown.
    env.put(Context.INITIAL_CONTEXT_FACTORY,ldapCtxFactory);
              //set security credentials, note using simple cleartext authentication
              env.put(Context.SECURITY_AUTHENTICATION,authentication);
              env.put(Context.SECURITY_PRINCIPAL,adminName);
              env.put(Context.SECURITY_CREDENTIALS,adminPassword);
              //connect to my domain controller
              env.put(Context.PROVIDER_URL, domainController);
              // Create the initial directory context
              try {
                                  dirCtx = new InitialDirContext(env);
                   // Create the search controls           
                   SearchControls searchCtls = new SearchControls();
                   //Specify the attributes to return
                   String returnedAtts[]={"member"};
                   searchCtls.setReturningAttributes(returnedAtts);
                   //Specify the search scope
                   searchCtls.setSearchScope(SearchControls.SUBTREE_SCOPE);
                   int totalResults = 0;
                   int iteration=0;
                   // Search for objects using the filter
                   NamingEnumeration results = ctx.search(searchBase, searchFilter, searchCtls);
    In the above code the method exits even before the try block[i could detect this using Sysout's]
    Below is the property file from which the values are read.
    admin=username
    password=password
    #AD search attributes
    searchBase=DC=domainname,DC=domainname
    searchFilter=(&(objectClass=group) (CN=value*))
    #JNDI context attributes
    ldapCtxFactory=com.sun.jndi.ldap.LdapCtxFactory
    authentication=simple
    domainController=ldap://address
    groupPattern=pattern
    Please Assit,
    Thanks in Advance
    Message was edited by:
    radiant
    Message was edited by:
    radiant

    Assuming it is the same Active Directory environment and only your Java platform has changed, the I can only assume that if no exception is thrown, and no data is returned, then the credentials you are using on the new Java platform are being mapped to an anonymous user (perhaps a blank password ?). By default, Windows Server 2003 domains, do not return any results to anonymous users.

  • Changing user password in Active Directory using the JNDI GSS-API/Kerberos5

    Hello,
    I am trying to the JNDI GSS-API to change a user password on an Active Directory Server 2003. I have seen a variation of this using SSL on the thread [*http://forums.sun.com/thread.jspa?threadID=592611&start=0&tstart=0*|http://forums.sun.com/thread.jspa?threadID=592611&start=0&tstart=0]
    but I can't seem to make this work using the GSS-API. I can successfully create a javax.security.auth.login.LoginContext.LoginContext and then call the login method on it to log in as a user. I then call the javax.security.auth.Subject.doAs() method which calls the run method in a class extending the javax.security.PrivilegedActionClass. But when I actually try to change the password using InitialDirContext.modifyAttributes(), I get the exception:
    *javax.naming.OperationNotSupportedException: [LDAP: error code 53 - 00002077: SvcErr: DSID-03190DC9, problem 5003 (WILL_NOT_PERFORM), data 0*
    *If anyone can help me figure out why it doesn't work, that would be great!*
    P.S: I know the error seems to suggest that there might be some active directory setting that is preventing this from working, but I've checked all relevant settings on the Windows 2003 server Active Directory that I can think of: In the User properties->Account->Account options, I've made sure the user can change password. Also, in the Group Policy->Computer Configuration->Windows Settings->Security Settings->Account Policies->Password Policy, Maximum password age is zero and so is minimum password age.
    Here's my java code:
    {code}import javax.naming.*;
    import javax.security.auth.*;
    import java.security.PrivilegedAction;
    import java.io.UnsupportedEncodingException;
    public void changeSecret((String uid, String oldPassword, String newPassword)
         throws NamingException, ACException{
    try {
         K5CallbackHandler cb = new K5CallbackHandler(uid, oldPassword);
         LoginContext lc = new LoginContext("marker", cb);
         lc.login();
         Subject.doAs(lc.getSubject(), new ChangePasswordAction(rz.getName(), oldPassword, newPassword));
         catch(LoginException e) {
         try {
              lc.logout();
         catch(LoginException e) {
    }ChangePasswordAction.java is:import javax.naming.*;
    import javax.naming.naming.directory.*;
    import java.io.UnsupportedEncodingException;
    private class ChangePasswordAction implements PrivilegedAction {
         private String uid;
         private String quotedOldPassword;
         private String quotedNewPassword;
         public ChangePasswordAction(String uid, String oldPassword, String newPassword) {
              this.uid = uid;
              quotedOldPassword = "\"" + oldPassword + "\"";
              quotedNewPassword = "\"" + newPassword + "\"";
         public Object run() {
              Hashtable env = new Hashtable(11);
              env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
              env.put(Context.PROVIDER_URL, "ldap://ad2k3:389");
              env.put(Context.SECURITY_AUTHENTICATION, "GSSAPI");
              try {
                   DirContext ctx = new InitialDirContext(env);
                   ModificationItem[] mods = new ModificationItem[2];
                   byte[] oldPasswordUnicode = quotedOldPassword.getBytes("UTF-16LE");
                   byte[] newPasswordUnicode = quotedNewPassword.getBytes("UTF-16LE");
                   mods[0] = new ModificationItem(DirContext.REMOVE_ATTRIBUTE, new BasicAttribute("unicodePwd", oldPasswordUnicode));
                   mods[1] = new ModificationItem(DirContext.ADD_ATTRIBUTE, new BasicAttribute("unicodePwd", newPasswordUnicode));
                   ctx.modifyAttributes(uid, mods);
                   ctx.close();
              } catch (NamingException e) {
              } catch (UnsupportedEncodingException e) {
              return null;
    }K5CallbackHandler is:import javax.security.auth.callback.*;
    final class K5CallbackHandler
    implements CallbackHandler {
         private final String name;
         private final char[] passwd;
         public K5CallbackHandler(String nm, String pw) {
              name = nm;
              if(pw == null) {
                   passwd = new char[0];
              else {
                   passwd = pw.toCharArray();
         public void handle(Callback[] callbacks)
         throws java.io.IOException, UnsupportedCallbackException {
              for(int i = 0; i < callbacks.length; i++) {
                   if(callbacks[i] instanceof NameCallback) {
                        NameCallback cb = (NameCallback) callbacks;
                        cb.setName(name);
                   else {
                        if(callbacks[i] instanceof PasswordCallback) {
                             PasswordCallback cb = (PasswordCallback) callbacks[i];
                             cb.setPassword(passwd);
                        else {
                             throw new UnsupportedCallbackException(callbacks[i]);
    }The relevant entry in the JAAS.conf file that is referred to as "marker" in the LoginContext constructor is:
    marker {
    com.sun.security.auth.module.Krb5LoginModule required client=TRUE;

    This is one of the two Active Directory operations I have never solved using Java/JNDI. (FYI the other one is Cross Domain Move).
    My gut feel is that the underlying problem (which happens to be common to both Change Password & X-Domain Move) is that Java/JNDI/GSSAPI does not negotiate a sufficiently strong key length that allows Active Directory to change passwords or perform cross domain moves when using Kerberos & GSSAPI.
    Active Directory requires at a minimum, 128 bit key lengths for these security related operations.
    In more recent Kerberos suites and Java versions, support for RC4-HMAC & AES has been introduced, so it may be possible that you can negotiate a suitably string key length.
    Make sure that your Kerberos configuration is using either RC4-HMAC or AES and that Java is requesting a strong level of protection. (You can do this by adding //Specify the quality of protection
    //Eg. auth-conf; confidentiality, auth-int; integrity
    //confidentiality is required to set a password
    env.put("javax.security.sasl.qop","auth-conf");
    //require high strength 128 bit crypto
    env.put("javax.security.sasl.strength","high"); in your ChangePasswordAction class.
    You may also want to enable sasl logging in your app to see what exactly is going on and you may also want to check on the Java Security forum how to configure/enforce/check both RC4-HMAC or AES is used as the Kerbeos cipher suite and that a string key length is being used.
    Good luck.

  • How to set up authentication against Active Directory using custom account

    Hi All,
    Our development BPC server (version 7.0.112, MSSQL Server 2005) was installed using a local user in domain X. It is a single-server installation (meaning all services were installed on that server). The dev server always has the latest data/users by restoring the production backup on the dev server. For testing purpose, I need to allow a user of domain X to log in and do a testing.
    Is there a way to configure the dev server to authenticate against an Active Directory in domain X using a special user in the domain X? If yes, how can I configure the dev server?
    Thanks.

    The installation user must be a domain user with rights to browse domain X.
    Otherwise you are not able to add users fom domain.
    In your case installation was done with a local user which means you willnot be able to use domain users.
    It can be an workaround if you will change the identity for 2 COM+ components to be a domain user instead to be that local user.
    Any way I don't advice you to do this. It will be better to reinstall the dev using a domain user.
    The COM+ which has to be changed are:
    OsoftAdminServer
    OsoftUserManage
    Attention domain user used must be added into administartor group of BPC server and also to have sys admin right to SQL Server.
    I hope this will help you.
    Regards
    Sorin Radulescu

  • Authentication on Active Directory using JNDI (A Proffessional Appraoch)

    I am using following code for getting authenticated on Active Directory by user logon name.
    Can any one tell me a more proffessional and fool proof appraoch for authenticating a user on Active Dir through my web interface ???
    thanks in advance
    * Created on Nov 10, 2004
    package auth;
    import java.util.Hashtable;
    import javax.naming.AuthenticationException;
    import javax.naming.Context;
    import javax.naming.NamingEnumeration;
    import javax.naming.NamingException;
    import javax.naming.directory.DirContext;
    import javax.naming.directory.InitialDirContext;
    import javax.naming.directory.SearchControls;
    import javax.naming.directory.SearchResult;
    * @author Tushar Agrawal
    * Created On Nov 10, 2004
    public class UserAuthentication {
         public UserAuthentication() {
              super();
         public NamingEnumeration loginToActiveDirectory(
              String logonName,
              String password,
              String domain) {
              boolean success = false;
              NamingEnumeration attrs = null;
              Hashtable env = new Hashtable(11);
              env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
              env.put(Context.SECURITY_AUTHENTICATION, "simple");
              env.put(Context.PROVIDER_URL, "ldap://domain:389/dc=SECLORE,dc=com");
              env.put(Context.SECURITY_PRINCIPAL, logonName + "@" + domain);
              env.put(Context.SECURITY_CREDENTIALS, password);
              //env.put(Context.SECURITY_PROTOCOL, "ssl");
              env.put("java.naming.ldap.version", "3");
              env.put(Context.REFERRAL, "follow");
              try {
                   String base = "";
                   DirContext ctx = new InitialDirContext(env);
                   SearchControls controls = new SearchControls();
                   controls.setSearchScope(SearchControls.SUBTREE_SCOPE);
                   controls.setReturningAttributes(
                        new String[] {
                             "sAMAccountName",
                             "userPrincipalName",
                             "displayName",
                             "memberOf",
                             "objectSid",
                             "title" });
                   NamingEnumeration e =
                        ctx.search(base, "sAMAccountName=" + logonName, controls);
                   if (e.hasMore()) {
                        SearchResult r = (SearchResult) e.next();
                        attrs = r.getAttributes().getAll();
                        /*while (attrs.hasMore()) {
                             System.out.println(attrs.next());
                        ctx.close();
              } catch (AuthenticationException e) {
                   System.err.println("Problem getting attribute: " + e);
                   success = false;
              } catch (NamingException e) {
                   System.err.println("Problem getting attribute: " + e);
                   success = false;
              return attrs;
    tushar agrawal

    You''l find more info at :
    http://jakarta.apache.org/tomcat/tomcat-5.5-doc/catalina/funcspecs/fs-jndi-realm.html
    http://jakarta.apache.org/tomcat/tomcat-4.0-doc/realm-howto.html
    That's the right way to do it.

  • How to update users to Active Directory using Hyena Active Task List?

    Kevin,
    thanks for your input. I was able to firgured it out. It need the full path. with the CN=John Doe
    Working like a charm!! thx!!

    http://www.systemtools.com/HyenaHelp/active_editor.htm"Each Active Directory object is identifiable by its directory path, called the ADsPath. A special symbol, %ADSPATH%, can be inserted in the field order list that can be associated with the directory path in the import file. The ADsPath doesNOThave to be one of the attributes for the directory objects in the Editor if the ADsPath is used as the Key Field in the import file.Using an ADsPath as a match field can be difficult, as it is a long and complex string, and if special characters are used in some directory fields, Active Directory will automatically insert additional special characters into the ADsPath. One method of getting the ADsPath into a file for directory objects is to use Hyena's Edit Copy dialog. A special symbol, %ADSPATH%, can be added to any Active Directory copied...

  • Add user to Active directory using SAP ABAP

    Hi Experts,
    I am currently working on a security refractor project where we are planning on automating the user creation process in business object and Oracle Hyperion using GRC-BW.
    Our Hyperion user management is based on active directory/LDAP groups.
    So say for example - we have a new user say ABC and in GRC he select the SAP-BW role 'HYP_FINANCE_USA' then I want to write a program in BW which will see who all users are assigned to 'HYP_FINANCE_USA' role and will go an update the active directory distribution list group named 'HYP_FINANCE_USA'.
    Has anyone written a ABAP program or used standard function modules/BADI's etc to add/delete user from active directory/LDAP group ?

    Would you post your code? I have yet to see any working jndi code to add a user to AD. Thanks.

Maybe you are looking for

  • Adobe Digital Editions will not launch on my Windows 8.1 laptop

    Adobe Digital Editions will not launch on my Windows 8.1 laptop I have uninstalled and re-installed several times. I have successfully used previous versions of ADE on this laptop in the past.

  • Mainstage 2.1.3 going silent

    I'm using Mainstage [b]2.1.3[/b] on a MacBook [b]OSX 10.5.8[/b] Just spents untold hours programming patches and now as I'm rehearsing, Mainstage suddenly goes silent on the patch I'm using and some others too.  Have to re-boot Mainstage to get sound

  • Database connection error in Visual Studio 2013

    I am using Visual Studio 2013 and have installed MS SQL Server 2014. I am trying to generate my database from a model (edmx) but I get the following error: Cannot connect to <Database>. An incompatible SQL Server version was detected (Microsoft.Visua

  • Conditional Build Tags Break Links

    Hi all, I have a solid, 3-years old, RHX5 project that works fine. Delivering a part of it using conditional build tags, I found out that some of links are broken. The topics configuration looks like this: Parent topic - with a link to several child

  • Extended controller bypassed when new regions, AM, VO, CO's attached

    Hi All, I am trying to customise iSupport pages.i.e. UnMatached Invoice page. Requirement is like to default values in Remit to and Cutomer Tax payer id LOV regions(populated all associated fields like form values, items etc). We had this logic in ex