OIM AD password Sync connector. Connection to AD through SSL

Hi.
I am trying to configure AD password sync connector 9.1.1.5 with patch 14627510 to connecto to AD through SSL.
At this moment, connector is able to connect to OIM through SSL but not to the AD. If i set AD port number to 389 on the connector configuration, everything works fine.
If i set it to 636, it is not able to connect to the AD.
I've imported the AD SSL certificate to <connector install directory>\OIMADPasswordSync\_jvm\lib\security\cacerts and restarted the domain controller but still no luck.
To test that the certificate and everything else is OK, i've also installed a jxplorer and imported the same certificate into <jexplorer install directory>\jxplorer321\security\cacerts. Jxplorer is able to connect to the AD through SSL on port 636 so user credentials, certificate, etc.. are ok
Connector documentation doesn't mention anything regarding SSL connection to AD, it only describes SSL connection to OIM.
Anyone has donde this before? Is there any additional step i should follow to enable SSL connection from AD password sync connector to AD? Does the connector support SSL connection to AD?
Regards.

have you tried importing the cert in cacerts under $JAVA_HOME?

Similar Messages

  • AD Password Sync connector 9.1.1 With OIM 11g R2 - ERROR OVER SSL

    I have set up AD password sync with from AD to OIM 11G R2
    The password syncs from AD to OIM 11G R2 on non ssl port 389.
    But if fails on SSL Port 636.
    Errors in OIMMain.Log:_
    Debug [10/11/2012 10:49:34 AM] Inside ConnectToADSI
    Debug [10/11/2012 10:49:34 AM]
    ldap_connect failed with
    Debug [10/11/2012 10:49:34 AM] Server Down
    Debug [10/11/2012 10:49:34 AM]
    Steps Carried Out thus far:_
    AD is up and running.
    Configured AD Password Sync Connector on 636 and selected ssl.
    Created Certificate on OIM host, configured custom identity key store on weblogic. Restarted Weblogic.
    Imported Certificate to AD. After this, restarted the AD
    I can Telnet port 636 from OIM Box and also connect to AD through LDAP Browser on 636 and view OU and CN, so this seems fine.
    Provisioning from OIM through Connector Server to AD works over SSL and this works fine.
    Help would be appreciated.
    Many Thanks

    This question is now been fixed.
    Instead of explicitly stating 636 for SSL,
    Use the same port 389 for ssl and also configured oim port to be 140001 which is the ssl port for oim in the configuration of OIM Password Sync.
    Export Certificates from AD to java security keystore and to weblogic keystore
    Export .pem certificate created on OIM host machine to AD.
    Restart weblogic, oim and AD
    Everything would work fine.
    For all the other information, refer to doc.
    Thanks

  • OIM Password sync connector installation issue

    Hi All,
    I am trying to configure password synchronziation between OIM & Active Directory. while installing AD Password Sync connector on AD Host it is returniing following.
    Error occurred while uploading prepAD.ldif. , please refer to %TEMP%\oimpwdsync.log. Please upload
    prepAD.ldif to Active Directory Domain Controller before applying ACLs.
    Kindly suggest me on this.
    Regards,
    Madhu

    I'm also getting the same error.
    This is the content of the log file :
    (Apr 14, 2011 6:19:27 AM), Install, com.oracle.installshield.adpwd.pathValidator, dbg, Directory does not exists, will get created at the installation time
    (Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, attempting to use the current JVM
    (Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.actions.UninstallerJVMResolution, dbg.jvm, searching for a JVM
    (Apr 14, 2011 6:19:38 AM), Install, com.installshield.product.service.product.PureJavaProductServiceImpl$Installer, err, ProductException: (error code = 601; message="JVM not found")
    STACK_TRACE: 8
    ProductException: (error code = 601; message="JVM not found")
         at com.installshield.product.actions.JVMResolution.install(JVMResolution.java:171)
         at com.installshield.product.service.product.PureJavaProductServiceImpl$InstallProduct.checkUninstallerJVMResolution(PureJavaProductServiceImpl.java:4793)
         at com.installshield.product.service.product.PureJavaProductServiceImpl$InstallProduct.install(PureJavaProductServiceImpl.java:4554)
         at com.installshield.product.service.product.PureJavaProductServiceImpl$Installer.execute(PureJavaProductServiceImpl.java:3758)
         at com.installshield.wizard.service.AsynchronousOperation.run(AsynchronousOperation.java:41)
         at java.lang.Thread.run(Unknown Source)
    (Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.execTool, err, Cannot run program "C:\Program": CreateProcess error=2, The system cannot find the file specified
    (Apr 14, 2011 6:19:38 AM), Install, com.installshield.wizardx.ascii.ModifyFile, msg2, ASCII file C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif does not exist and will be created.
    (Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, gen exp
    (Apr 14, 2011 6:19:38 AM), Install, com.oracle.installshield.adpwd.ldapModify, err, C:\Program Files\oracle\OIMADPasswordSync\prepAD.ldif (The system cannot find the file specified)
    Anyone fixed it. I have checked JAVA env is set in my machine
    C:\>echo %JAVA_HOME%
    D:\oracle\Middleware\jdk160_14_R27.6.5-32
    C:\>java -version
    java version "1.6.0_12"
    Java(TM) SE Runtime Environment (build 1.6.0_12-b04)
    Java HotSpot(TM) Client VM (build 11.2-b01, mixed mode)
    Did anyone fix the issue?

  • AD password sync connector configuration for OIM Cluster

    Hi
    I have OIM running on clustered environment in two nodes.
    I have some AD domain controller. I need to install the AD password sync connector (version 9.1.1) in the AD domain controller.
    I remember that in the earlier versions we need to install the user management console and then change the value in xlConfig file to have both the node name.
    Version 9.1.1 is changed to use the SPML webservices. I have installed the SPML WS in both the nodes.
    My question is where do i specify in the AD password sync connector that I have two server as there is no xlConfig or any other config file that I can give both the server address.
    I referred the following PDF http://download.oracle.com/docs/cd/E11223_01/doc.910/e11218.pdf
    Thanks
    Narendar Doshi

    have you tried importing the cert in cacerts under $JAVA_HOME?

  • How configure password sync connector in OIM cluster environmet

    Hi,
    i want some inputs to configure password sync connector in OIM cluster environmet.
    Thanks,

    Use a load balanced URL.
    -Kevin

  • Password Sync Connector Error 11gR2

    Hi all,
    I am using following products
    IDM 11.1.2.0,
    activedirectory-11.1.1.5.0 connector with Patch P14190610_111150_Generic.
    MSFT_PSync_91150 for Password Sync.
    Please let me know that AD Password Sync Connector 9.1.1.5 can be configured with OIM *11gR2* ?
    Because I am getting error *"Password updation failed in child process "* I have used the same connector with OIM 11.1.1.5.0 (11gR1) and it was working fine. do i need to make any changes / settings in the OIM for AD Resource also?
    Thanks

    thanks for your reply,
    Please can you help me on the following ....
    I have installed AD PasswordSync Connector 9.1.1.5.0 (MSFT_AD_PSync_9.1.1.5.0) with newly released patch MSFT_AD_PSync_9.1.1.5.6 (patch 14627510). I am getting error that Password updation failed in child process
    its not making any sence as the same connector was working fine with 11gR1. I have uninstalled and reconfigured the connector but no luck.
    Can you through some light on it?
    what i think that there is some communication issue between IDM and AD server, I have check the communication and found no issue. is it that SSL is compulsory for this connector although its not mentioned in any of the document.
    +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
    ebug [10/09/12 14:09:27] Inside sgsloidi::setParameters
    Debug [10/09/12 14:09:27] The SOAP start element is
    Debug [10/09/12 14:09:27] <processRequest xmlns=""><sOAPElement>
    Debug [10/09/12 14:09:27] The SOAP end element is
    Debug [10/09/12 14:09:27] </sOAPElement></processRequest>
    Debug [10/09/12 14:09:27] The path is
    Debug [10/09/12 14:09:27] /spmlws/OIMProvisioning
    Debug [10/09/12 14:09:27] End of sgsloidi::setParameters
    Debug [10/09/12 14:09:27] Begin function sgsloidi::queryADUserAttribute()
    Debug [10/09/12 14:09:27] Inside sgsladac c-tor
    Debug [10/09/12 14:09:27] AD Host
    Debug [10/09/12 14:09:27] 172.20.20.135
    Debug [10/09/12 14:09:27]
    Debug [10/09/12 14:09:27] AD Port
    Debug [10/09/12 14:09:27] 389
    Debug [10/09/12 14:09:27]
    Debug [10/09/12 14:09:27] AD Base DN
    Debug [10/09/12 14:09:27] DC=YYYt,DC=vvv,DC=www
    Debug [10/09/12 14:09:27]
    Debug [10/09/12 14:09:27] Inside ConnectToADSI
    Debug [10/09/12 14:09:27]
    ADSI Bind success full
    Debug [10/09/12 14:09:27] Begin function sgsladac::searchAttrValue()
    Debug [10/09/12 14:09:27] [Base DN : DC=yyy,DC=vvv,DC=www]; [Filter : (&(objectClass=user)(samAccountName=IDM005))]; [Attribute : samAccountName]
    Debug [10/09/12 14:09:27] Search success with one result.
    Debug [10/09/12 14:09:27] End function sgsladac::searchAttrValue()
    Debug [10/09/12 14:09:27] End function sgsloidi::queryADUserAttribute()
    Debug [10/09/12 14:09:27] Inside sgsladac destructor
    Debug [10/09/12 14:09:27] <env:Envelope xmlns:env="http://schemas.xmlsoap.org/soap/envelope/"><env:Header/><env:Body><env:Fault><faultcode>env:Client</faultcode><faultstring>Unknown method</faultstring></env:Fault></env:Body></env:Envelope>
    Debug [10/09/12 14:09:27] Inside sgsloidiOIMGeneralErrorHandler
    Debug [10/09/12 14:09:27] Unable to update IDM005. There are error messages in the searchReponse. Please check log for details
    Debug [10/09/12 14:09:27] Inside sgsladds::sgslperwriteData YOOOO
    Debug [10/09/12 14:09:27] Inside sgsladac c-tor
    Debug [10/09/12 14:09:27] AD Host
    Debug [10/09/12 14:09:27] 172.20.20.135
    Debug [10/09/12 14:09:27]
    Debug [10/09/12 14:09:27] AD Port
    Debug [10/09/12 14:09:27] 389
    Debug [10/09/12 14:09:27]
    Debug [10/09/12 14:09:27] AD Base DN
    Debug [10/09/12 14:09:27] DC=yyy,DC=vvv,DC=www
    Debug [10/09/12 14:09:27]
    Debug [10/09/12 14:09:27] Only dataattribute
    Debug [10/09/12 14:09:27] Got Registry enteries
    Debug [10/09/12 14:09:27] contact
    Debug [10/09/12 14:09:27] description
    Debug [10/09/12 14:09:27] Got Entiredn
    Debug [10/09/12 14:09:27] OU=oimpwdsyncmoetest.gov.kw,ou=OIMADPasswordSync,DC=yyy,DC=vv,DC=wwww
    Debug [10/09/12 14:09:27] Encrypted record already exists in Datastore
    Debug [10/09/12 14:09:27] Already Exists
    Debug [10/09/12 14:09:27] Encrypted record already exists in Datastore
    Debug [10/09/12 14:09:27] Already Exists
    Debug [10/09/12 14:09:27] Inside sgsladdsSearchUser
    Debug [10/09/12 14:09:27] Firing Search Request
    Debug [10/09/12 14:09:27] AD search for a user objectGUID is successfull
    Debug [10/09/12 14:09:27] Count success
    Debug [10/09/12 14:09:27] Search result fetched
    Debug [10/09/12 14:09:27] 0:430 6 314 420 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAn+Kii3Krv0GOKE3aE8a/vwAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAAQZgAAAAEAACAAAADVc9Vqwy5JzRFSKTMKlZcowXUmtY/Giw1nYgIz01HZQgAAAAAOgAAAAAIAACAAAADnr10j8OQlKm35BMRt7yKNNQYNeR2JRPMQrlWheBs3XUAAAAB6it/wjG20tJgo5T9euni2Jldb/agmY5RDsoKVpvLnHAkptSd4OUIIaysGAWkqfv9iK69FtzUuh+DcmgkdSLtOQAAAAGMpkx8yFJaKXwnzoCZyElCZbrzdg5f3GNj+S56lk4/UpVij9hFk5VeysObVw21NClzmGnuiBRtO+WF+LzChEUM=
    Debug [10/09/12 14:09:27] --------------------&&&----------------
    Debug [10/09/12 14:09:27] Inside sgsladds::sgsladdsgetData NEW Look
    Debug [10/09/12 14:09:27] 0:430 6 314 420 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAn+Kii3Krv0GOKE3aE8a/vwAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAAQZgAAAAEAACAAAADVc9Vqwy5JzRFSKTMKlZcowXUmtY/Giw1nYgIz01HZQgAAAAAOgAAAAAIAACAAAADnr10j8OQlKm35BMRt7yKNNQYNeR2JRPMQrlWheBs3XUAAAAB6it/wjG20tJgo5T9euni2Jldb/agmY5RDsoKVpvLnHAkptSd4OUIIaysGAWkqfv9iK69FtzUuh+DcmgkdSLtOQAAAAGMpkx8yFJaKXwnzoCZyElCZbrzdg5f3GNj+S56lk4/UpVij9hFk5VeysObVw21NClzmGnuiBRtO+WF+LzChEUM=
    Debug [10/09/12 14:09:27] Encoded Data Extracted in sgsladdsgetData
    Debug [10/09/12 14:09:27] 430 6 314 420 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAn+Kii3Krv0GOKE3aE8a/vwAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAAQZgAAAAEAACAAAADVc9Vqwy5JzRFSKTMKlZcowXUmtY/Giw1nYgIz01HZQgAAAAAOgAAAAAIAACAAAADnr10j8OQlKm35BMRt7yKNNQYNeR2JRPMQrlWheBs3XUAAAAB6it/wjG20tJgo5T9euni2Jldb/agmY5RDsoKVpvLnHAkptSd4OUIIaysGAWkqfv9iK69FtzUuh+DcmgkdSLtOQAAAAGMpkx8yFJaKXwnzoCZyElCZbrzdg5f3GNj+S56lk4/UpVij9hFk5VeysObVw21NClzmGnuiBRtO+WF+LzChEUM=
    Debug [10/09/12 14:09:27] Moving out sgsladdsgetData
    Debug [10/09/12 14:09:27] Encoded Data Extracted
    Debug [10/09/12 14:09:27] 430 6 314 420 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAn+Kii3Krv0GOKE3aE8a/vwAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAAQZgAAAAEAACAAAADVc9Vqwy5JzRFSKTMKlZcowXUmtY/Giw1nYgIz01HZQgAAAAAOgAAAAAIAACAAAADnr10j8OQlKm35BMRt7yKNNQYNeR2JRPMQrlWheBs3XUAAAAB6it/wjG20tJgo5T9euni2Jldb/agmY5RDsoKVpvLnHAkptSd4OUIIaysGAWkqfv9iK69FtzUuh+DcmgkdSLtOQAAAAGMpkx8yFJaKXwnzoCZyElCZbrzdg5f3GNj+S56lk4/UpVij9hFk5VeysObVw21NClzmGnuiBRtO+WF+LzChEUM=
    Debug [10/09/12 14:09:27] Incrementing the MAX_RETRY LIMIT:
    Debug [10/09/12 14:09:27] 1
    Debug [10/09/12 14:09:27] numretries ======
    Debug [10/09/12 14:09:27] 1
    Debug [10/09/12 14:09:27] Inside sgslcodsupdateChild
    Debug [10/09/12 14:09:27] 1:430 6 314 420 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAn+Kii3Krv0GOKE3aE8a/vwAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAAQZgAAAAEAACAAAADVc9Vqwy5JzRFSKTMKlZcowXUmtY/Giw1nYgIz01HZQgAAAAAOgAAAAAIAACAAAADnr10j8OQlKm35BMRt7yKNNQYNeR2JRPMQrlWheBs3XUAAAAB6it/wjG20tJgo5T9euni2Jldb/agmY5RDsoKVpvLnHAkptSd4OUIIaysGAWkqfv9iK69FtzUuh+DcmgkdSLtOQAAAAGMpkx8yFJaKXwnzoCZyElCZbrzdg5f3GNj+S56lk4/UpVij9hFk5VeysObVw21NClzmGnuiBRtO+WF+LzChEUM=
    Debug [10/09/12 14:09:27]
    Encrypted record data updated successfully
    Debug [10/09/12 14:09:27] Inside sgsladac destructor
    Debug [10/09/12 14:09:27] End of sgsloidiOIMGeneralErrorHandler
    Debug [10/09/12 14:09:27] Password updation failed in child process
    Debug [10/09/12 14:09:27]
    Relaxing while processing records from datastore
    Debug [10/09/12 14:09:29]
    About to UNBIND datastore after processing the Records
    Debug [10/09/12 14:09:29]
    Deleting datastore object pointer
    Debug [10/09/12 14:09:30] Datastore --- Connect to AD
    Debug [10/09/12 14:09:30]

  • OIM AD Password Sync issue

    HI,
    I am doing OIM 9.1.01 AD Password Sync.
    I installed AD Password Sync connector in AD Machine. During installation it asked to mention OIM host name and SPML port for that i deployed SMPL in OIM using command line successfully.
    While installation AD Password Sync Connector in Oracle Identity Manager Configuration Parameters i have given like these.
    Host : rwoim
    Port : 8080 (sample value)
    Administrator Login :admin
    Administrator Password: admin1234
    OIM User Attribute : Users.User ID
    OIM Application Server Type : WebLogic
    Use SSL : Yes
    Client Certificate Subject Name : TQL17
    where in Port parameter (Enter the number of the port at which the Oracle Identity Manager SPML Web service is listening.
    Sample value: 8080)
    But i don't know which port SPML using and its enable or not in OIM server. I am strucked at installation.
    Please give any one suggestion.
    regards
    Ramu

    Hi Sagar,
    i had success with OIM AD Password Sync process with AD Port 389 and SPML Port 7001 and passwords are updating from AD to OIM successfully.
    From OIM over AD SSL passwords are updating in AD successfully.
    But when again reinstalled the AD Password Sync connector with AD Port 636, passwords are not updating from AD to OIM.
    Below the log file saying ldap_connect failed with
    Debug [2/6/2012 5:25:35 PM] Server Down
    ***********Inside sgslldpcopenLDAPConnection****************
    Debug [2/6/2012 5:25:35 PM] Inside sgsladac c-tor
    Debug [2/6/2012 5:25:35 PM] AD Host
    Debug [2/6/2012 5:25:35 PM] 10.129.149.137
    Debug [2/6/2012 5:25:35 PM]
    Debug [2/6/2012 5:25:35 PM] AD Port
    Debug [2/6/2012 5:25:35 PM] 636
    Debug [2/6/2012 5:25:35 PM]
    Debug [2/6/2012 5:25:35 PM] AD Base DN
    Debug [2/6/2012 5:25:35 PM] DC=oimad,DC=com
    Debug [2/6/2012 5:25:35 PM]
    Debug [2/6/2012 5:25:35 PM]
    Debugging the code
    Debug [2/6/2012 5:25:35 PM] Inside ConnectToADSI
    Debug [2/6/2012 5:25:35 PM]
    ldap_connect failed with
    Debug [2/6/2012 5:25:35 PM] Server Down
    Debug [2/6/2012 5:25:35 PM]
    Debug [2/6/2012 5:25:35 PM]
    Connection to AD failed
    Debug [2/6/2012 5:25:35 PM]
    ***********Out of openLDAPConnection****************
    Debug [2/6/2012 5:25:35 PM] Inside sgsladac destructor
    regards
    Ramu

  • Password Sync Connector for AD

    Hello All,
    I am newbie.
    In my organization, we are trying to set up a password sync connector to change/update passwords iin microsoft active directory.
    We are planning to have a simple form that interacts with OIM. And OIM provisions the password update to the corresponding user record in Active Directory.
    Form has
    Username:--
    Old password:--
    New password:--
    After the password is updated in the OIM, I am not sure how to provision it to Active directory.
    Please help me out with this.
    Regards,
    VSN

    See this post.
    Re: how to trigger update in oim attribute to resource
    You'll need to trigger the password change from the OIM User Profile onto your target application form. This would then trigger the Password Updated task on that provisioning process definition.
    -Kevin

  • 64 bit Password Sync Connector - Win2K3 -X64

    Hey all,
    I am trying to get all of my WIndows DC's doing Password Synchronization. I install the Password sync connector on each DC, both x86 and x64. THey are all configured correctly with logging enabled in the registry. The x86 servers create logs and are synchronizing passwords back to the OIM server.
    THe x64 DC's are not working at all. No logs are generated and no passwords are synchronized.
    Not really sure what to do to get them working...
    Any help would be greatly appreciated.

    Try adding -Xms3G to start with a 3GB heap. I suspect that you will not be able to and hence you have a much smaller heap than you expect. Also note that there are limits on what you can allocate depending the values used to configure the old and young generation and the size of the survivor spaces etc - check out the GC ergonomics/tuning guide on java.sun.com.

  • OIM-AD password sync not working

    Hi All,
    I am trying to sync password b/w AD and OIM. I have installed the password sync connector and followed the steps specified in the connector document. However when i change the password in AD, it is not reflected in OIM.
    The connector version is 11.1.1.5. And the following have been done
    1. deployed SPML-DSML service
    2. Tested the SPML-DSML service
    3. Installed the connector
    4. Enabled the logs
    5. Configured IT resource and enabled SSL
    But the password changed in AD is not reflected in OIM. Please let me know if any additional steps have to performed.
    Thanks

    Hi Raghav,
    Please find the log below
    Debug [1/19/2012 3:54:05 PM] Inside sgsladds::sgslperwriteData YOOOO
    Debug [1/19/2012 3:54:05 PM] Inside sgsladac c-tor
    Debug [1/19/2012 3:54:05 PM] AD Host
    Debug [1/19/2012 3:54:05 PM] localhost
    Debug [1/19/2012 3:54:05 PM]
    Debug [1/19/2012 3:54:05 PM] AD Port
    Debug [1/19/2012 3:54:05 PM] 636
    Debug [1/19/2012 3:54:05 PM]
    Debug [1/19/2012 3:54:05 PM] AD Base DN
    Debug [1/19/2012 3:54:05 PM] DC=abc,DC=xyz,DC=com
    Debug [1/19/2012 3:54:05 PM]
    Debug [1/19/2012 3:54:05 PM] Only dataattribute
    Debug [1/19/2012 3:54:05 PM] Got Registry enteries
    Debug [1/19/2012 3:54:05 PM] contact
    Debug [1/19/2012 3:54:05 PM] description
    Debug [1/19/2012 3:54:05 PM] Got Entiredn
    Debug [1/19/2012 3:54:05 PM] OU=oimpwdsynctms.abc.xyz,ou=org1,DC=abc,DC=xyz,DC=com
    Debug [1/19/2012 3:54:05 PM] Encrypted record already exists in Datastore
    Debug [1/19/2012 3:54:05 PM] Already Exists
    Debug [1/19/2012 3:54:05 PM] Encrypted record already exists in Datastore
    Debug [1/19/2012 3:54:05 PM] Already Exists
    Debug [1/19/2012 3:54:05 PM] Inside sgsladdsSearchUser
    Debug [1/19/2012 3:54:05 PM] Firing Search Request
    Debug [1/19/2012 3:54:05 PM] AD search for a user objectGUID is successfull
    Debug [1/19/2012 3:54:05 PM] Count success
    Debug [1/19/2012 3:54:05 PM] Search result fetched
    Debug [1/19/2012 3:54:05 PM] 0:319 10 230 308 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA6msQnVk0HkW+zmHr7+2nyAAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAADZgAAqAAAABAAAABU2g1ES3TOo35N6+zJPunGAAAAAASAAACgAAAAEAAAAEsx8lF3vt0oEaE0BhubB/A4AAAAl0IEcVLgvhvZryqKTWzBkjEatBoCMvekzXvlLlUfj/moGrX2NgWL9zlmeLKY9scstvPONOalbbgUAAAArNCxOGd02kIZELgCavo2IZpN5ZA=
    Debug [1/19/2012 3:54:05 PM] --------------------&&&----------------
    Debug [1/19/2012 3:54:05 PM] Inside sgsladds::sgsladdsgetData NEW Look
    Debug [1/19/2012 3:54:05 PM] 0:319 10 230 308 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA6msQnVk0HkW+zmHr7+2nyAAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAADZgAAqAAAABAAAABU2g1ES3TOo35N6+zJPunGAAAAAASAAACgAAAAEAAAAEsx8lF3vt0oEaE0BhubB/A4AAAAl0IEcVLgvhvZryqKTWzBkjEatBoCMvekzXvlLlUfj/moGrX2NgWL9zlmeLKY9scstvPONOalbbgUAAAArNCxOGd02kIZELgCavo2IZpN5ZA=
    Debug [1/19/2012 3:54:05 PM] Encoded Data Extracted in sgsladdsgetData
    Debug [1/19/2012 3:54:05 PM] 319 10 230 308 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA6msQnVk0HkW+zmHr7+2nyAAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAADZgAAqAAAABAAAABU2g1ES3TOo35N6+zJPunGAAAAAASAAACgAAAAEAAAAEsx8lF3vt0oEaE0BhubB/A4AAAAl0IEcVLgvhvZryqKTWzBkjEatBoCMvekzXvlLlUfj/moGrX2NgWL9zlmeLKY9scstvPONOalbbgUAAAArNCxOGd02kIZELgCavo2IZpN5ZA=
    Debug [1/19/2012 3:54:05 PM] Moving out sgsladdsgetData
    Debug [1/19/2012 3:54:05 PM] Encoded Data Extracted
    Debug [1/19/2012 3:54:05 PM] 319 10 230 308 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA6msQnVk0HkW+zmHr7+2nyAAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAADZgAAqAAAABAAAABU2g1ES3TOo35N6+zJPunGAAAAAASAAACgAAAAEAAAAEsx8lF3vt0oEaE0BhubB/A4AAAAl0IEcVLgvhvZryqKTWzBkjEatBoCMvekzXvlLlUfj/moGrX2NgWL9zlmeLKY9scstvPONOalbbgUAAAArNCxOGd02kIZELgCavo2IZpN5ZA=
    Debug [1/19/2012 3:54:05 PM] MAX_RETRY LIMIT count is not updated: OIM is down
    Debug [1/19/2012 3:54:05 PM] 0
    Debug [1/19/2012 3:54:05 PM] numretries ======
    Debug [1/19/2012 3:54:05 PM] 0
    Debug [1/19/2012 3:54:05 PM] Inside sgslcodsupdateChild
    Debug [1/19/2012 3:54:05 PM] 0:319 10 230 308 AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAA6msQnVk0HkW+zmHr7+2nyAAAAAAmAAAAUABhAHMAcwB3AG8AcgBkACAARQBuAGMAcgBwAHQAaQBvAG4AAAADZgAAqAAAABAAAABU2g1ES3TOo35N6+zJPunGAAAAAASAAACgAAAAEAAAAEsx8lF3vt0oEaE0BhubB/A4AAAAl0IEcVLgvhvZryqKTWzBkjEatBoCMvekzXvlLlUfj/moGrX2NgWL9zlmeLKY9scstvPONOalbbgUAAAArNCxOGd02kIZELgCavo2IZpN5ZA=
    Debug [1/19/2012 3:54:05 PM]
    Encrypted record data updated successfully
    Debug [1/19/2012 3:54:05 PM] Inside sgsladac destructor
    Debug [1/19/2012 3:54:05 PM] Password updation failed in child process
    Debug [1/19/2012 3:54:05 PM]
    Relaxing while processing records from datastore
    I have provided the correct port numbers and also my certificate is same as the OIM server name. But still when the password is changed in AD, its not updated in OIM.
    Thanks,
    Bhavana

  • Configuration settings for the AD Password Sync Connector

    Hi,
    I am looking for information on how do retries work for the OIM Password (Sync) Connector for Active Directory. We are currently using version 9.1.1.5.10. If anyone can help answer any of the below questions, it will be very appreciated. Also, if there is a doc that explains this, please do let me know. The official connector doc on the Oracle site provides a good architectural overview but it does not talk about any of these registry settings.
    a) What does this registry setting "OIMConfig\ConfigSleepTime" control
    b) What does this registry setting "OIMConfig\MAX_RETRIES" control
    c) What does this registry setting "OIMConfig\SleepTime" control
    - In my experience this is the time when the password update thread kicks off. So in other words it represents the max latency between when you change a password in AD and when it will get pushed down to OIM. If you set this to 300 seconds, then you are looking at a worse case scenario of a 300 second lag between the time you changed your AD password and when it was pushed to OIM.
    d) According to this doc, http://docs.oracle.com/cd/E11223_01/doc.910/e11218/overview.htm#CEGHJCJE, bullet #6 states:
    "If Oracle Identity Manager rejects the password change, then the password update thread keeps resending SPML requests until the retry count reaches the maximum number of retries."
    I am trying to understand what is the reasoning behind having the connector retry the password update if OIM has already rejected it once. Is there a possible scenario where OIM would reject a password update the first time and then accept the same password update on a second attempt?
    e) Referring back to question #d above, what is the frequency at which the connector will attempt retries?
    Thanks
    Aspi Engineer
    Putnam Investments

    That is the problem...
    When I installed the connector I didn't get any error and I get a message the connector was installed ok. I think I will reinstall it.
    Thanks,
    Renato

  • AD Password Sync Connector Issue

    Hi All,
    I am using OIM 11.1.1.5.4 which is in LDAP Sync with OID via OVD. Also OIM and OAM is integrated.
    I am using AD user management connector (11.1.1.1.5 ) in OIM and also m using AD password Sync Connector (9.1)
    Previously when checked, password sync connector was updating the changed password of AD in OID. I.e when a password was changed in AD it was getting reflected in OID databse (It was checked through LDAPBIND Command) but was not reflected in OIM database.(i.e when we tried to login into OIM's unprotected URL,we were not able to login into OIM with this new password of AD).
    Now when tested, the changed password in AD is reflected in OIM database.(i.e when tried with unprotected URL of OIM we are able to login into OIM and design console with this new password of AD ) but this password is not propogating to OID.(i.e LDAP bind is failing for the new passord which was resetted in AD) and also when tried to login in OIM on SSO page it is not able to login.
    I need the password updated in AD should be replected in OID as we are using SSO.
    Can ane one please help on it.
    Thanks!!
    TJ

    Hi,
    when i am updating password in OIM it is resetting the password in OID.
    Also just want to ask when we install password sync connector on Ad machine it asks for AD ip and port.
    Now AD is enabled on 389 port which is non ssl port .The ssl port of AD is 636.
    So please guide me which port we have to give while configuring
    Thanks!!
    TJ
    Edited by: user13405070 on Nov 29, 2012 1:02 AM

  • AD password sync connector.

    Hi,
    What are the pros and cons of AD password sync connector? can some tell those in details.
    Thanks

    AD password will be in synch with OIM. AD password we use for entering in windows so at that time it will be useful to have synch with OIM.

  • AD Password Sync connector functionality

    Hi,
    I have installed AD Password Sync connector as per the documentation. I have added the User Defined field USR_UDF_PWDCHANGEDINDICATION and also field USR_UDF_PASSSTATUS.
    After installation I have done changes in the xlconfig.xml file and in that file under <Results></Results> tab i specified results to be shown in the USR_UDF_PASSSTATUS field.
    now when i am changing the user's password in Active Directory natively then i can find from log that it is first setting the value of USR_UDF_PWDCHANGEDINDICATION filed to ADSYNC_TRUE and then after changing password in OIM, it is setting it back to ADSYNC_FALSE.
    But I am getting error in updating USR_UDF_PASSSTATUS field... follwoing error come in log file:
    22 Aug 2008 09:36:35 INFO Set the value of UDF field to ADSYNCH_TRUE value
    22 Aug 2008 09:36:35 INFO Going to update the USR_UDF_PWDCHANGEDINDICATION to ADSYNCH_TRUE
    22 Aug 2008 09:36:37 INFO update the value of USR_UDF_PWDCHANGEDINDICATION to ADSYNCH_TRUE
    22 Aug 2008 09:36:37 INFO Invoking OIM API for setting Password
    22 Aug 2008 09:37:01 INFO Password changed
    22 Aug 2008 09:37:01 ERROR Unable to update status
    Thor.API.Exceptions.tcStaleDataUpdateException
         at com.thortech.xl.ejb.beansimpl.tcUserOperationsBean.updateUserData(Unknown Source)
         at com.thortech.xl.ejb.beansimpl.tcUserOperationsBean.updateUser(Unknown Source)
         at com.thortech.xl.ejb.beans.tcUserOperationsSession.updateUser(Unknown Source)
         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
         at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:324)
         at org.jboss.invocation.Invocation.performCall(Invocation.java:345)
         at org.jboss.ejb.StatelessSessionContainer$ContainerInterceptor.invoke(StatelessSessionContainer.java:214)
         at org.jboss.resource.connectionmanager.CachedConnectionInterceptor.invoke(CachedConnectionInterceptor.java:149)
         at org.jboss.ejb.plugins.StatelessSessionInstanceInterceptor.invoke(StatelessSessionInstanceInterceptor.java:154)
         at org.jboss.webservice.server.ServiceEndpointInterceptor.invoke(ServiceEndpointInterceptor.java:54)
         at org.jboss.ejb.plugins.CallValidationInterceptor.invoke(CallValidationInterceptor.java:48)
         at org.jboss.ejb.plugins.AbstractTxInterceptor.invokeNext(AbstractTxInterceptor.java:106)
         at org.jboss.ejb.plugins.TxInterceptorCMT.runWithTransactions(TxInterceptorCMT.java:335)
         at org.jboss.ejb.plugins.TxInterceptorCMT.invoke(TxInterceptorCMT.java:166)
         at org.jboss.ejb.plugins.SecurityInterceptor.invoke(SecurityInterceptor.java:153)
         at org.jboss.ejb.plugins.LogInterceptor.invoke(LogInterceptor.java:192)
         at org.jboss.ejb.plugins.ProxyFactoryFinderInterceptor.invoke(ProxyFactoryFinderInterceptor.java:122)
         at org.jboss.ejb.SessionContainer.internalInvoke(SessionContainer.java:624)
         at org.jboss.ejb.Container.invoke(Container.java:873)
         at sun.reflect.GeneratedMethodAccessor116.invoke(Unknown Source)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:324)
         at org.jboss.mx.interceptor.ReflectedDispatcher.invoke(ReflectedDispatcher.java:141)
         at org.jboss.mx.server.Invocation.dispatch(Invocation.java:80)
         at org.jboss.mx.server.Invocation.invoke(Invocation.java:72)
         at org.jboss.mx.server.AbstractMBeanInvoker.invoke(AbstractMBeanInvoker.java:245)
         at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:644)
         at org.jboss.invocation.jrmp.server.JRMPInvoker$MBeanServerAction.invoke(JRMPInvoker.java:805)
         at org.jboss.invocation.jrmp.server.JRMPInvoker.invoke(JRMPInvoker.java:406)
         at sun.reflect.GeneratedMethodAccessor138.invoke(Unknown Source)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
         at java.lang.reflect.Method.invoke(Method.java:324)
         at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:261)
         at sun.rmi.transport.Transport$1.run(Transport.java:148)
         at java.security.AccessController.doPrivileged(Native Method)
         at sun.rmi.transport.Transport.serviceCall(Transport.java:144)
         at sun.rmi.transport.tcp.TCPTransport.handleMessages(TCPTransport.java:460)
         at sun.rmi.transport.tcp.TCPTransport$ConnectionHandler.run(TCPTransport.java:701)
         at java.lang.Thread.run(Thread.java:534)
         at sun.rmi.transport.StreamRemoteCall.exceptionReceivedFromServer(Unknown Source)
         at sun.rmi.transport.StreamRemoteCall.executeCall(Unknown Source)
         at sun.rmi.server.UnicastRef.invoke(Unknown Source)
         at org.jboss.invocation.jrmp.server.JRMPInvoker_Stub.invoke(Unknown Source)
         at org.jboss.invocation.jrmp.interfaces.JRMPInvokerProxy.invoke(JRMPInvokerProxy.java:119)
         at org.jboss.invocation.InvokerInterceptor.invokeInvoker(InvokerInterceptor.java:227)
         at org.jboss.invocation.InvokerInterceptor.invoke(InvokerInterceptor.java:167)
         at org.jboss.proxy.TransactionInterceptor.invoke(TransactionInterceptor.java:46)
         at org.jboss.proxy.SecurityInterceptor.invoke(SecurityInterceptor.java:55)
         at org.jboss.proxy.ejb.StatelessSessionInterceptor.invoke(StatelessSessionInterceptor.java:97)
         at org.jboss.proxy.ClientContainer.invoke(ClientContainer.java:86)
         at $Proxy4.updateUser(Unknown Source)
         at Thor.API.Operations.tcUserOperationsClient.updateUser(Unknown Source)
         at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
         at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
         at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
         at java.lang.reflect.Method.invoke(Unknown Source)
         at Thor.API.Base.SecurityInvocationHandler$1.run(Unknown Source)
         at Thor.API.Security.LoginHandler.jbossLoginSession.runAs(Unknown Source)
         at Thor.API.Base.SecurityInvocationHandler.invoke(Unknown Source)
         at $Proxy2.updateUser(Unknown Source)
         at com.thortech.xl.integration.adpasswordsynch.ChangePassword.changePassword(Unknown Source)
         at com.thortech.xl.integration.adpasswordsynch.ChangePassword.main(Unknown Source)
    22 Aug 2008 09:37:01 INFO Set the value of UDF field to ADSYNCH_FALSE value
    22 Aug 2008 09:37:01 INFO Going to update the USR_UDF_PWDCHANGEDINDICATION to ADSYNCH_FALSE
    22 Aug 2008 09:37:01 INFO changed the USR_UDF_PWDCHANGEDINDICATION to ADSYNCH_FALSE
    22 Aug 2008 09:37:01 INFO Password synch over
    22 Aug 2008 09:37:01 INFO Before System.exit(0):
    Also, when I am changing password in Active Directory in OIM, Change User Password is task run for Active Directory and it is updating the password in Active Directory again.
    Can someone please tell me, is it proper functionality of AD Password Sync. Actually I am really confused with the functionality of this AD password sync connector.
    Thanks & Regards,
    Yash Shah

    That is the problem...
    When I installed the connector I didn't get any error and I get a message the connector was installed ok. I think I will reinstall it.
    Thanks,
    Renato

  • AD Password Sync Connector in SSL Mode

    Hi,
    The AD Password Sycn connector works fine with non-SSL , but not in SSL mode.
    This is the log generated-
    Debug [11/19/12 15:35:08] Start getting config parameters from registry
    Debug [11/19/12 15:35:08] oimhost is
    Debug [11/19/12 15:35:08] abc.com
    Debug [11/19/12 15:35:08]
    Debug [11/19/12 15:35:08] oimport is
    Debug [11/19/12 15:35:08] 14001
    Debug [11/19/12 15:35:08]
    Debug [11/19/12 15:35:08] oimsslclient is
    Debug [11/19/12 15:35:08] PwdSync
    Debug [11/19/12 15:35:08]
    Debug [11/19/12 15:35:08] oimuserattr is
    Debug [11/19/12 15:35:08] Users.User ID
    Debug [11/19/12 15:35:08]
    Debug [11/19/12 15:35:08] oimusessl is
    Debug [11/19/12 15:35:08] Y
    Debug [11/19/12 15:35:08]
    Debug [11/19/12 15:35:08] oimappservertype is
    Debug [11/19/12 15:35:08] 1
    Debug [11/19/12 15:35:08]
    Debug [11/19/12 15:35:08] End of sgsloidi::getConfigParamters
    Debug [11/19/12 15:35:08] Inside sgsloidi::setParameters
    Debug [11/19/12 15:35:08] The SOAP start element is
    Debug [11/19/12 15:35:08] <processRequest xmlns=""><sOAPElement>
    Debug [11/19/12 15:35:08] The SOAP end element is
    Debug [11/19/12 15:35:08] </sOAPElement></processRequest>
    Debug [11/19/12 15:35:08] The path is
    Debug [11/19/12 15:35:08] /spmlws/OIMProvisioning
    Debug [11/19/12 15:35:08] End of sgsloidi::setParameters
    Debug [11/19/12 15:35:09] Look for client cert
    Debug [11/19/12 15:35:09] Search the opened store
    Debug [11/19/12 15:35:09] Inside sgsloidiOIMDownErrorHandler
    Please suggest.

    Instead of explicitly stating 636 for SSL,
    Use the same port 389 for ssl and also configure oim port to be same(ex:140001) which is the ssl port for oim in the configuration of OIM Password Sync.
    Export Certificates from AD to java security keystore and to weblogic keystore
    Export .pem certificate created on OIM host machine to AD.
    Restart weblogic, oim and AD
    Everything would work fine.
    For all the other information, refer to doc.

Maybe you are looking for

  • Can you edit multiple images from a PDF in photoshop?

    I scan a lot of old publications with images and drawings. The images are in greyscale, but my scanner produces better results set to color. As such, I have to convert the images to greyscale in Photoshop from Acrobat. I have several PS actions that

  • Time machine deleted files on external HD

    Ok so I bought an external hard drive to not only backup my computer, but to have a place to put some video footage on. So I opted for the time machine backup of course. First thing I did was add over 90 gb of film to the hardrive directly before bac

  • Acrobat 8.1.4 crashes after update

    I hope you can help me!  I have a computer that has Adobe Acrobat 8.1, which after upgrading to 8.1.4 crashed. When the program opens, it begins opening all newer documents in the history, until it reaches about 50 documents.  The program then crashe

  • Multi line values in mail forms to send emails

    Hi All, Ours is CRM 2007 application, as part of new capability adding to the system, we need to send email to customer with few details once service tickets saved in the system. we decided to use mail forms to create the template and send email to t

  • [SOLVED] firefox3 : huge icons and large fonts with big pixels issue

    hi all, i have a weird issue regarding firefox3b3 (and firefox3b4 from mozilla.org as well). Firefox2.0.12 is running fine, but the beta of 3 has insanely huge fonts and icons so big that I cannot use it properly. I have removed my .mozilla folder bu