Problem authenticating user in Active Directory cross domain

Hi,
We have two different AD servers serving our London and Tokyo networks. My application runs in London network but used by both London and Tokyo users.
The two ADs have domain trust setup between them. I have groups defined in London AD to which users from both the London and Tokyo ADs are assigned.
'm trying to connect to London AD using the "users credentials" and retrieve the groups they are assigned to.
I can connect to the London AD using any of the London user and I could retrieve the groups. But when I use a Tokyo user credentials to connect using the London AD server 'm getting Security exception with a code indicating "User Not Found".
The code I use which is very basic is given below . The code below run as such gives me the following error,
[LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece.
If I change in the code below, Provider URL to Tokyo AD Server URL then it works but I can't use that due to security restrictions. As per the Windows Team the domain trust should allow me to connect/bind to the London AD Server with the Tokyo credentials.
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "london ldap server url");
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.REFERRAL, "follow");
env.put(Context.SECURITY_PRINCIPAL, "[email protected]");
env.put(Context.SECURITY_CREDENTIALS, "password");
env.put(LdapContext.CONTROL_FACTORIES, "com.sun.jndi.ldap.ControlFactory");
ctx = new InitialLdapContext(env, null);
I would like to know how to authenticate a user in a cross domain Active Directory environment. I read in one of the blogs that the "simple bind" will not work for cross domain user authentication. Unfortunately the blogger didn't mention what would work :( . Any help is much appreciated.
Please bear with me if my query is a naive one and point me in the right direction.
Thanks
Jothi

Hi Praveen,
to avoid losing data when user objects are moved to new locations in the LDAP server, it is possible to configure the User Management Engine to use the value of a specific unique attribute as part of the unique ID instead of the distinguished name.
For this, you have to change the following UME properties:
For user objects: ume.ldap.unique_user_attribute=<attributename>
For account objects: ume.ldap.unique_uacc_attribute=<attributename>
For group objects: ume.ldap.unique_grup_attribute=<attributename>
Be aware that the attribute (i.e. cn or uid) must be unique in the configured user/group path.
Please read SAPNote 777640 for more information regarding this problem and the way to change the UME properties.
Best regards,
Robert

Similar Messages

Adding a user in Active Directory

Hi fellows,
I am having a serious problem in creating a new user in active directory. i am using LDAP JNDI code. I can delete and update users attributes, but fail to create users.
ctx.createSubcontext("newuser,full domain", attributes);
when i specify a new user in "newuser" it gives exception invalidnameexception. I don't understand how to create a new entry within the directory structure of predefined tree. by the way, i can create users by active directory explorer but java application is giving exceptions.
Any help will be highly appreciated.

A DistinguishedName is of the form e.g. "cn=username, ou=Users,dc=hostname,dc=com". In other words it contains attribute names and values for each name component. Evidently your DN doesn't do that.

802.1x PEAP Machine Authentication with MS Active Directory

802.1x PEAP Machine and User Authentication with MS Active Directory:
I have a simple pilot-text environment, with
- Microsoft XP Client,
- Cisco 2960 Switch,
- ACS Solution Engine (4.1.4)
- MS Active Directory on Win 2003 Server
The Remote Agent (at 4.1.4) is on the same server as the MS AD.
User Authentication works correctly, but Machine Authentication fails.
Failed machine authenticaton is reported in the "Failed Attempts" log of the ACS SE.
The Remote Agent shows an error:
See Attachment.
Without Port-Security the XP workstation is able to log on to the domain.
Many thanks for any indication.
Regards,
Stephan Imhof

Is host/TestClientMan.Test.local the name of the machine? What does the AAA tell for you the reason it fails?

Creating a windows user in Active Directory

I am trying to create a user in Active Directory that can log on as any other Windows user, but when I try to log into Windows, I get the following error message:
"The local policy of this system does not allow you to logon interactively".
Are there any attributes or objectclass settings that must be set for the user to allow interactive logons?
Thanks in advance!

This has nothing to do with JNDI, the object class or attributes.
I assume that you are trying to logon locally to the domain controller with the new user that you have just created.
By default, the domain controller's policy only allows specific users or members of a group to logon locally at the domain domain controller's console.
Either edit the domain controller'sgroup policy and add your newly created user to the list of users permitted to logon locally, or add the user to a group which has already been granted permission to logon locally.

Saving the password of a user in active directory using java

Hello, i am trying to use java to build a class that creates a user in Active directory 2012.But the problem is that when the user is created the password is not being saved.
Can anybody help on this knowing that i tried to save in the fields userPassword and unicodePwd.
Thanks.

DirContext ctx = new InitialDirContext(pr);
          BasicAttributes entry = new BasicAttributes(true);
          String entryDN = "cn=CharbelHad,ou=test users,dc=test,dc=dev";
          Attribute cn = new BasicAttribute("cn", "ChHad");
          Attribute street = (new BasicAttribute("streetAddress", "Ach"));
          Attribute loginPreW2k = (new BasicAttribute("sAMAccountName", "[email protected]"));
          Attribute login = (new BasicAttribute("userPrincipalName", "[email protected]"));
          Attribute sn = (new BasicAttribute("sn", "Chl"));
          Attribute pwd = new BasicAttribute("unicodePwd", "\"Ch@341\"".getBytes("UTF-8"));
Attribute userAccountControl = new BasicAttribute("userAccountControl", "512");
          Attribute oc = new BasicAttribute("objectClass");
          oc.add("top");
          oc.add("person");
          oc.add("organizationalPerson");
          oc.add("user");
          // build the entry
          entry.put(cn);
          entry.put(street);
          entry.put(sn);
          entry.put(userAccountControl);
          entry.put(pwd);
          entry.put(login);
          entry.put(loginPreW2k);
          entry.put(oc);
          ctx.createSubcontext(entryDN, entry);

Need Help creating new user in Active Directory

I am trying to create a new user in active directory via a java application. I have included the code that I am using. I am able to successfully bind to Active Directory. I have been able to change passwords, and delete users, but I have not been able to create a user.
ldapHost : "mta101.DOM101.CEL.ACC.AF.MIL"
domainName: "dc=dom101,dc=cel,dc=acc,dc=af,dc=mil"
existing account: CN=Brett K. Humpherys,OU=Users,OU=CEL
I get the following error on the createSubcontext statement:
javax.naming.directory.InvalidAttributeValueException: [LDAP: error code 21 - 00000057: LdapErr: DSID-0C09098B, comment: Error in attribute conversion operation, data 0, v893 ; remaining name 'CN=test1,OU=Users,OU=CEL'
I have commented out the password portion and change the ObjectCategory to a 32 and get the same error.
    public GblStatus createAccount7(DbaDb dbConn,
                                    String jsrcName,
                                    String personName,
                                    String username,
                                    String password)
      Hashtable ldapEnv = new Hashtable(11);
      ldapEnv.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
      ldapEnv.put(Context.PROVIDER_URL, "ldap://" + this.ldapHost + ":636");
      ldapEnv.put(Context.SECURITY_AUTHENTICATION, "simple");
      ldapEnv.put(Context.SECURITY_PROTOCOL, "ssl");
      ldapEnv.put(Context.REFERRAL, "ignore");
      ldapEnv.put(Context.SECURITY_PRINCIPAL,"cn=" + this.adminAcct + ",cn=users," + this.domainName);
      ldapEnv.put(Context.SECURITY_CREDENTIALS, this.adminPwd);
       try
        // Create the initial context
        DirContext ctx = new InitialDirContext(ldapEnv);
        BasicAttributes attrs = new BasicAttributes();
        BasicAttribute ocs = new BasicAttribute("objectclass");
        ocs.add("top");
        ocs.add("person");
        ocs.add("organizationalPerson");
        ocs.add("user");
        attrs.put(ocs);
        BasicAttribute gn = new BasicAttribute("givenName", "test1");
        attrs.put(gn);
        BasicAttribute sn = new BasicAttribute("sn", "");
        attrs.put(sn);
        BasicAttribute cn = new BasicAttribute("cn", "test1");
        attrs.put(cn);
        BasicAttribute uac = new BasicAttribute("userAccountControl", "66048");
        attrs.put(uac);
        BasicAttribute sam = new BasicAttribute("sAMAccountName", "test1");
        attrs.put(sam);
        BasicAttribute disName = new BasicAttribute("displayName", "test1");
        attrs.put(disName);
        BasicAttribute userPrincipalName = new BasicAttribute
                                      ("userPrincipalName", "[email protected]");
        attrs.put(userPrincipalName);
        BasicAttribute instanceType = new BasicAttribute("instanceType", "4");
        attrs.put(instanceType);
        BasicAttribute objectCategory = new BasicAttribute
                  ("objectCategory","CN=User,CN=Schema,CN=Configuration," + domainName);
        attrs.put(objectCategory);
        String newVal = new String("\"password\"");
        byte _bytes[] = newVal.getBytes("Unicode");
byte bytes[] = new byte[_bytes.length - 2];
System.arraycopy(_bytes, 2, bytes, 0, _bytes.length - 2);
BasicAttribute attribute = new BasicAttribute("unicodePwd");
attribute.add((byte[]) bytes);
attrs.put(attribute);
ctx.createSubcontext("CN=test1,OU=Users,OU=CEL", attrs);
ctx.close();
catch (NameAlreadyBoundException nex)
System.out.println("User ID is already in use, please select a different user ID ...");
catch (Exception ex)
System.out.println("Failed to create user account... Please verify the user information...");
ex.printStackTrace();
return new GblStatus();
Any help would be much appreciated.

Hi .,
me too got up with same problem., can anyone help me.??
Someone help me to create attributes in AD using LDAP
package LDAPpack;
import javax.naming.*;
import javax.naming.directory.*;
import javax.naming.ldap.InitialLdapContext;
import javax.naming.ldap.LdapContext;
import java.util.Hashtable;
class CreateAttrs {
public static void main(String[] args) {
     Hashtable env = new Hashtable();
          env.put(Context.INITIAL_CONTEXT_FACTORY,"com.sun.jndi.ldap.LdapCtxFactory");
          env.put(Context.PROVIDER_URL, "ldap://10.242.6.166:389/");
          env.put(Context.SECURITY_AUTHENTICATION,"simple");
          env.put(Context.SECURITY_PRINCIPAL, "CN=cname,OU=Users,OU=Dealer,OU=Community,DC=test2,DC=org");
                    env.put(Context.SECURITY_CREDENTIALS, "password-1");
          LdapContext ctx =null;
          try {
               //ctx = new InitialLdapContext(env,null);
               try {
ctx = new InitialLdapContext(env,null);
               catch(NamingException e) {
System.out.println("Login failed");
System.exit(0);
if(ctx!=null){
System.out.println("Login Successful");
byte[] buf = new byte[] {0, 1, 2, 3, 4, 5, 6, 7}; // same data
     // Create a multivalued attribute with 4 String values
     BasicAttribute oc = new BasicAttribute("objectClassNew", "topNew");
     oc.add("personNew");
     oc.add("organizationalPersonNew");
     // Create an attribute with a byte array
     BasicAttribute photo = new BasicAttribute("jpegPhotoNew", buf);
     // Create attribute set
     BasicAttributes attrs = new BasicAttributes(true);
     attrs.put(oc);
     attrs.put(photo);
     Attributes attrs1 = ctx.getAttributes("CN=cname,OU=Users,OU=Dealer,OU=Community,DC=test2,DC=org");
System.out.println(attrs1);
Context result = ctx.createSubcontext("CN=cname,OU=Users,OU=Dealer,OU=Community,DC=test2,DC=org", attrs);
//i got error here; i attach the error below.
     ctx.close();
System.out.println("close");
     catch(NamingException e){
          e.printStackTrace();
ERROR:
Login Successful
javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090B38, comment: Error in attribute conversion operation, data 0, vece
ANYONE HELP ME PLS.
Edited by: vencer on Jun 19, 2008 12:38 AM

How to create user in Active directory

Hello,
I'm trying to create a user in active directory via the following example:
String userName = "cn=Jef Klak,ou=Ps Users,ou=Users,ou=Managed,dc=xxx,dc=local";
     Attributes attrs = new BasicAttributes(false);
     Attribute oc = new BasicAttribute("objectClass");
     oc.add("top");
     oc.add("person");
     oc.add("organizationalPerson");
     oc.add("user");
     attrs.put(oc);
          attrs.put("cn","Jef Klak");
          attrs.put("giveName","Jef");
          attrs.put("sn","Klak");
          attrs.put("displayName","Klak, Jef");
          attrs.put("description","IR");
          attrs.put("userPrincipalName","[email protected]");
          attrs.put("mail","[email protected]");
          attrs.put("company", "XXX");
          attrs.put("sAMAccountName","jk666");
attrs.put("userAccountControl",Integer.toString(UF_NORMAL_ACCOUNT + UF_DONT_EXPIRE_PASSWD+ UF_ACCOUNTDISABLE));
          Context result = fctx.createSubcontext(userName, attrs);
As a result I'm getting the following error:
javax.naming.directory.NoSuchAttributeException: [LDAP: error code 16 - 00000057: LdapErr: DSID-0C090B38, comment: Error in attribute conversion operation, data 0, vece
remaining name 'cn=Jef Klak,ou=Ps Users,ou=Users,ou=Managed,dc=xxx,dc=local'
Anybody any tips or advice on this one? Or maybe a working examples how to add users in AD?
Listing entries in the AD is no problem, so it's only adding them.
Many thanks,
Filip

          attrs.put("giveName","Jef");
javax.naming.directory.NoSuchAttributeExceptionSpelling error.

Creating users in Active Directory through LDAP connector

Hello,
If we need to create users in Active directory using LDAP connector, what are the options for the following:
1) Update back into SAP from AD. LDAP connector updates only in one direction i.e from SAP to Active directory.
2) Can we add additional fields in LDAPMAP which are not standard e.g can we we write our own code to extract data from HR to map the value with an attritube within Active directory?
Regards,
Ahmad

Hello!
I noticed the email in my inbox and understand the reason for deleting it - checked the rules again - no problem with that.
Here is the posting again - sanitized this time.
You can create users in LDAP/AD from SAP without a problem. SAP provides function modules to create/maintain/delete users with LDAP attributes in the correct ou path.
You can also perform group membership assignment in LDAP from SAP if needed.
I have done this quite a few times at different companies that use SAP HCM.
A userid in SAP is created automatically during hiring action with default password e.g. birthday of employee and certain authorization roles based on configured information.
The userid is then created right away in LDAP in the correct ou path (controlled via custom configuration table) and LDAP group membership is assigned.
A job runs every 8 hours to perform delta updates in LDAP.
The userid in SAP and LDAP are locked automatically if the user is terminated using termination action in HR.

Is there a way to authenticate an iPad to our WLAN using a digital certificate and then authorize the user in Active Directory?

We want to authenticate both a device (iPad) to our corporate WLAN, but after authenticating the device we would also like to authentiate the user in Active Directory if possible. Has anyone had any experience with this?

You need to make sure that the server sends the "GeoTrust DV SSL CA" intermediate certificate.
See:
* http://www.networking4all.com/en/support/tools/site+check/ (www.ucfs.net)
* https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=SO9557
* https://knowledge.geotrust.com/support/knowledge-base/index?page=content&id=AR1422

Add user to Active directory using SAP ABAP

Hi Experts,
I am currently working on a security refractor project where we are planning on automating the user creation process in business object and Oracle Hyperion using GRC-BW.
Our Hyperion user management is based on active directory/LDAP groups.
So say for example - we have a new user say ABC and in GRC he select the SAP-BW role 'HYP_FINANCE_USA' then I want to write a program in BW which will see who all users are assigned to 'HYP_FINANCE_USA' role and will go an update the active directory distribution list group named 'HYP_FINANCE_USA'.
Has anyone written a ABAP program or used standard function modules/BADI's etc to add/delete user from active directory/LDAP group ?

Would you post your code? I have yet to see any working jndi code to add a user to AD. Thanks.

Authentication Plug-ins for active directory Multiple Domains(oidspad2.sh)

hi ,
i have use note 294791.1 from metalink to try link to active directory i have 2 one is staff and another is student
i first ran oidspadi.sh to create plugin for staff it works then i edit the 2 script to oidspad2.pls and oidspad2.sh with the require changes inside the files then i ran it it work but now the problem is the first ad now cant work this is my changes below
FOR oidspad2.pls
Rem
Rem $Header: oidspada.pls 02-aug-2004.04:45:11 saroy Exp $
Rem
Rem oidspads.pls
Rem
Rem Copyright (c) 2002, 2004, Oracle. All rights reserved.
Rem
Rem NAME
Rem oidspada.pls - 9.0.4 OID Password Active Directory
Rem External Authentication Plug-in
Rem
Rem
Rem NOTES
Rem <other useful comments, qualifications, etc.>
Rem
Rem MODIFIED (MM/DD/YY)
Rem saroy 08/02/04 - Fix for bug 3807482
Rem qdinh 01/27/04 - bug 3374115
Rem dlin 01/08/04 - pingan perf
Rem dlin 08/22/03 - 3111770 bug fix
Rem dlin 08/27/03 - change the way to get name
Rem dlin 08/13/03 - bug 2962082 fix
Rem dlin 02/21/03 - plug-in install changes
Rem dlin 02/13/03 - dlin_bug-2625027
Rem dlin 02/05/03 - fix ssl & failover
Rem dlin 01/31/03 - dlin_adextauth1
Rem dlin 01/30/03 - Created
Rem
SET echo off;
SET serveroutput off;
SET feedback off;
SET verify off;
CREATE OR REPLACE PACKAGE OIDADPSW2 AS
PROCEDURE when_bind_replace (ldapplugincontext IN ODS.plugincontext,
result OUT INTEGER,
dn IN VARCHAR2,
passwd IN VARCHAR2,
rc OUT INTEGER,
errormsg OUT VARCHAR2
PROCEDURE when_compare_replace (ldapplugincontext IN ODS.plugincontext,
result OUT INTEGER,
dn IN VARCHAR2,
attrname IN VARCHAR2,
attrval IN VARCHAR2,
rc OUT INTEGER,
errormsg OUT VARCHAR2
AD_HANDLE DBMS_LDAP.session DEFAULT NULL;
END OIDADPSW2;
SHOW ERROR
CREATE OR REPLACE PACKAGE BODY OIDADPSW2 AS
SUBTYPE LDAP_SESSION IS RAW(32);
SUBTYPE LDAP_MESSAGE IS RAW(32);
SUBTYPE LDAP_BER_ELEMENT IS RAW(32);
SUBTYPE ATTRLIST IS DBMS_LDAP.STRING_COLLECTION;
SUBTYPE MOD_ARRAY IS RAW(32);
SUBTYPE BERLIST IS DBMS_LDAP.BERVAL_COLLECTION;
PROCEDURE when_bind_replace (ldapplugincontext IN ODS.plugincontext,
result OUT INTEGER,
dn IN VARCHAR2,
passwd IN VARCHAR2,
rc OUT INTEGER,
errormsg OUT VARCHAR2
IS
retval pls_integer;
lresult BOOLEAN;
my_session DBMS_LDAP.session;
my_session1 DBMS_LDAP.session;
tmp_session DBMS_LDAP.session;
adupname VARCHAR2(1024) DEFAULT NULL;
BEGIN
plg_debug( '=== Begin when_bind_replace()');
DBMS_LDAP.USE_EXCEPTION := FALSE;
result := 49;
adupname := LDAP_PLUGIN.get_adupname(ldapplugincontext);
IF (adupname IS NULL) THEN
result := 1;
plg_debug('Can not get ADUserPrincipalName');
rc := DBMS_LDAP.SUCCESS;
errormsg := 'Exception in when_bind_replace: Can not get ADUserPrincipalName';
plg_debug( '=== End when_bind_replace() ===');
RETURN;
END IF;
plg_debug( 'Go to AD for authentication');
-- externally authenticate user
IF ('&1' = 'n') THEN
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&2', &3);
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
-- Retry logic should be invoked only
-- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
-- Should free the old session if retry logic kept failing
-- to cause the number of outstanding sessions exceeding the
-- limit session number
     IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&4', &5);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
     plg_debug( 'simple_bind_res again: ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
     OIDADPSW2.AD_HANDLE := tmp_session;
     ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
     plg_debug( 'unbind_res result ' || TO_CHAR(retval));
     END IF;
     END IF;
ELSE
-- SSL bind
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&6', &7);
     plg_debug( 'ldap_session initialized: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
     retval := DBMS_LDAP.open_ssl(my_session,
                         'file:' || '&8', '&9', 2);
     IF (retval != 0) THEN
     plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'open_ssl: ' || TO_CHAR(retval));
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
-- Retry logic should be invoked only
-- when retval = LDAP_UNWILLING_TO_PERFORM
-- or LDAP_UNAVAILABLE
     IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&10', &11);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.open_ssl(my_session1,
                         'file:' || '&12', '&13', 2);
     IF (retval != 0) THEN
     plg_debug( 'retry open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session1);
     plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'retry open_ssl: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
     plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
     OIDADPSW2.AD_HANDLE := tmp_session;
     ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
     plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
     END IF;
     END IF;
END IF;
-- for failover to connect to the secondary server
IF ('&14' = 'y' AND retval != 0) THEN
IF ('&15' = 'n') THEN
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&16', &17);
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
plg_debug( 'ldap_session initialized: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
     IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&18', &19);
     plg_debug( 'retry ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
     plg_debug( 'retry simple_bind_res again: ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
          OIDADPSW2.AD_HANDLE := tmp_session;
     ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
          plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
     END IF;
     END IF;
ELSE
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&20', &21);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
     retval := DBMS_LDAP.open_ssl(my_session,
                         'file:' || '&22', '&23', 2);
     IF (retval != 0) THEN
     plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'open_ssl: ' || TO_CHAR(retval));
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, passwd);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
-- Retry logic should be invoked only
-- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
     IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&24', &25);
     plg_debug( 'retry ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.open_ssl(my_session1,
                         'file:' || '&26', '&27', 2);
     IF (retval != 0) THEN
     plg_debug( 'retry open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'retry open_ssl: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, passwd);
     plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
          OIDADPSW2.AD_HANDLE := tmp_session;
     ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
     plg_debug( 'unbind_res result ' || TO_CHAR(retval));
     END IF;
     END IF;
     END IF;
END IF;
IF (retval = 0) THEN
result := 0;
plg_debug('AD auth return TRUE');
ELSE
     result := retval;
plg_debug('AD auth return FALSE or ERROR');
END IF;
-- retval := DBMS_LDAP.unbind_s(my_session);
-- plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
rc := DBMS_LDAP.SUCCESS;
errormsg := 'No error msg.';
plg_debug( '=== End when_bind_replace() ===');
EXCEPTION
WHEN OTHERS THEN
rc := DBMS_LDAP.OPERATIONS_ERROR;
     retval := DBMS_LDAP.unbind_s(OIDADPSW2.AD_HANDLE);
     OIDADPSW2.AD_HANDLE := NULL;
     plg_debug( ' exception unbind_res returns ' || TO_CHAR(retval));
errormsg := 'Exception: when_bind_replace plugin';
plg_debug( 'Exception in when_bind_replace(). Error code is ' ||
          TO_CHAR(sqlcode));
plg_debug( ' ' || Sqlerrm);
END;
PROCEDURE when_compare_replace (ldapplugincontext IN ODS.plugincontext,
result OUT INTEGER,
dn IN VARCHAR2,
attrname IN VARCHAR2,
attrval IN VARCHAR2,
rc OUT INTEGER,
errormsg OUT VARCHAR2
IS
retval pls_integer;
lresult BOOLEAN;
my_session DBMS_LDAP.session;
my_session1 DBMS_LDAP.session;
tmp_session DBMS_LDAP.session;
adupname VARCHAR2(1024) DEFAULT NULL;
BEGIN
plg_debug( '=== Begin when_compare_replace()');
result := DBMS_LDAP.COMPARE_FALSE;
DBMS_LDAP.USE_EXCEPTION := FALSE;
adupname := LDAP_PLUGIN.get_adupname(ldapplugincontext);
IF (adupname IS NULL) THEN
result := DBMS_LDAP.COMPARE_FALSE;
plg_debug('Can not get ADuserPrincipalName');
rc := DBMS_LDAP.SUCCESS;
errormsg := 'Exception in when_compare_replace: Can not get ADUserPrincipalName';
plg_debug( '=== End when_compare_replace() ===');
RETURN;
END IF;
-- externally authenticate user
IF ('&28' = 'n') THEN
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&29', &30);
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
-- Retry logic should be invoked only
-- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&31', &32);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
     plg_debug( 'simple_bind_res again: ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
     OIDADPSW2.AD_HANDLE := tmp_session;
ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
     plg_debug( 'unbind_res result ' || TO_CHAR(retval));
     END IF;
     END IF;
ELSE
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&33', &34);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
     retval := DBMS_LDAP.open_ssl(my_session,
                         'file:' || '&35', '&36', 2);
     IF (retval != 0) THEN
     plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'open_ssl: ' || TO_CHAR(retval));
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
-- Retry logic should be invoked only
-- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&37', &38);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.open_ssl(my_session1,
                         'file:' || '&39', '&40', 2);
IF (retval != 0) THEN
     plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'open_ssl: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
     plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
     OIDADPSW2.AD_HANDLE := tmp_session;
ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
     plg_debug( 'unbind_res result ' || TO_CHAR(retval));
     END IF;
     END IF;
END IF;
-- for failover to connect to the secondary AD
IF ('&41' = 'y' AND retval != 0) THEN
IF ('&42' = 'n') THEN
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&43', &44);
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
-- Retry logic should be invoked only
-- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
     IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&45', &46);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
     plg_debug( 'simple_bind_res again: ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
          OIDADPSW2.AD_HANDLE := tmp_session;
ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
     plg_debug( 'unbind_res result ' || TO_CHAR(retval));
     END IF;
     END IF;
     ELSE
     IF (OIDADPSW2.AD_HANDLE IS NULL) THEN
     my_session := DBMS_LDAP.init('&47', &48);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session,1,8)));
     retval := DBMS_LDAP.open_ssl(my_session,
                         'file:' || '&49', '&50', 2);
     IF (retval != 0) THEN
     plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'open_ssl: ' || TO_CHAR(retval));
     OIDADPSW2.AD_HANDLE := my_session;
     ELSE
     my_session := OIDADPSW2.AD_HANDLE;
     END IF;
retval := DBMS_LDAP.simple_bind_s(my_session, adupname, attrval);
plg_debug( 'simple_bind_res: ' || TO_CHAR(retval));
-- Retry logic should be invoked only
-- when retval = LDAP_UNWILLING_TO_PERFORM || LDAP_UNAVAILABLE
     IF (retval = 52 OR retval = 53 OR retval = 81) THEN
     retval := DBMS_LDAP.unbind_s(my_session);
plg_debug( 'retry unbind_res returns ' || TO_CHAR(retval));
     my_session1 := DBMS_LDAP.init('&51', &52);
     plg_debug( 'ldap_session: ' || RAWTOHEX(SUBSTR(my_session1,1,8)));
     tmp_session := my_session1;
     retval := DBMS_LDAP.open_ssl(my_session1,
                         'file:' || '&53', '&54', 2);
     IF (retval != 0) THEN
     plg_debug( 'open_ssl failed error: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.unbind_s(my_session1);
     plg_debug( 'unbind_res returns ' || TO_CHAR(retval));
     result := 82;
     RETURN;
     END IF;
     plg_debug( 'open_ssl: ' || TO_CHAR(retval));
     retval := DBMS_LDAP.simple_bind_s(my_session1, adupname, attrval);
     plg_debug( 'simple_bind_res: again ' || TO_CHAR(retval));
     IF (retval != 52 AND retval != 53 AND retval != 81) THEN
          OIDADPSW2.AD_HANDLE := tmp_session;
     ELSE
     retval := DBMS_LDAP.unbind_s(tmp_session);
     plg_debug( 'unbind_res result ' || TO_CHAR(retval));
     END IF;
     END IF;
     END IF;
END IF;
IF (retval = 0) THEN
result := DBMS_LDAP.COMPARE_TRUE;
plg_debug('AD auth return TRUE');
ELSE
result := DBMS_LDAP.COMPARE_FALSE;
plg_debug('AD auth return FALSE or ERROR');
END IF;
-- retval := DBMS_LDAP.unbind_s(my_session);
-- plg_debug( 'unbind_res Returns ' || TO_CHAR(retval));
rc := DBMS_LDAP.SUCCESS;
errormsg := 'No error msg.';
plg_debug( '=== End when_compare_replace() ===');
EXCEPTION
WHEN OTHERS THEN
rc := DBMS_LDAP.OPERATIONS_ERROR;
errormsg := 'Exception: when_compare_replace plugin';
plg_debug( 'Exception in when_compare_replace(). Error code is ' ||
          TO_CHAR(sqlcode));
plg_debug( ' ' || Sqlerrm);
     retval := DBMS_LDAP.unbind_s(OIDADPSW2.AD_HANDLE);
     OIDADPSW2.AD_HANDLE := NULL;
END;
END OIDADPSW2;
SHOW ERRORS
EXIT;
-- usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
-- isfailover, isfailoverssl, sechost, secport, sechost, secsslport
-- secwalletloc, secwalletpwd
-- usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
-- isfailover, isfailoverssl, sechost, secport, sechost, secsslport
-- secwalletloc, secwalletpwd
FOR oidspadi.sh
#!/bin/sh
# $Header: oidspadi.sh 13-may-2005.13:48:51 saroy Exp $
# oidspadi.sh
# Copyright (c) 2002, 2005, Oracle. All rights reserved.
# NAME
# oidspadi.sh - AD external authentication plug-in install
# DESCRIPTION
# <short description of component this file declares/defines>
# NOTES
# <other useful comments, qualifications, etc.>
# MODIFIED (MM/DD/YY)
# saroy 05/13/05 - Fix for bug 4233817
# saroy 02/18/05 - Fix for bug 4054414
# saroy 11/02/04 - Fix for bug 3980370
# qdinh 01/19/04 - bug 3374115
# dlin 07/10/03 - turn off debug
# dlin 02/21/03 - plug-in install changes
# dlin 02/13/03 - dlin_bug-2625027
# dlin 07/22/02 - Creation
ADHOST="A"
ADPORT="1"
ADSSLPORT="1"
WALLETLOC="A"
WALLETPWD="A"
WALLETPWD2="A"
CONNECT="A"
ODSPWD="A"
ODSPWD2="A"
OIDHOST="A"
OIDPORT="1"
ORCLADMINPWD="A"
ORCLADMINPWD2="A"
PRGDN="A"
SCUSB="A"
EP="A"
ISSSL="n"
ISFAILOVER="n"
ISFAILOVERSSL="n"
SECADHOST="A"
SECADPORT="1"
SECADSSLPORT="1"
SECWALLETLOC="A"
SECWALLETPWD="A"
SECWALLETPWD2="A"
clear
echo "---------------------------------------------"
echo " OID Active Directory Plug-in Configuration"
echo "---------------------------------------------"
echo " "
echo "Please make sure Database and OID are up and running."
echo " "
LDAP_DIR=${ORACLE_HOME}/ldap
LDAP_LOG=${LDAP_DIR}/log
## ORACLE_HOME
if [ -z $ORACLE_HOME ] ; then
echo " ORACLE_HOME must be set for this installation script"
exit 0
fi
# gather required information
if [ ${ADHOST} = "A" ] ; then
printf "Please enter Active Directory host name: "
read ADHOST
fi
## active directory host name is required
if [ "${ADHOST}" = "" ]
then
echo "Active Directory host name is required";
exit 1;
fi
printf "Do you want to use SSL to connect to Active Directory? (y/n) "
read ISSSL
if [ "${ISSSL}" = "n" ]
then
if [ ${ADPORT} = "1" ] ; then
printf "Please enter Active Directory port number [389]: "
read ADPORT
if [ "${ADPORT}" = "" ]
then
ADPORT="389"
fi
fi
fi
if [ "${ISSSL}" = "y" ]
then
if [ ${ADSSLPORT} = "1" ] ; then
printf "Please enter Active Directory SSL port number [636]: "
read ADSSLPORT
if [ "${ADSSLPORT}" = "" ]
then
ADSSLPORT="636"
fi
fi
if [ ${WALLETLOC} = "A" ] ; then
echo " "
printf "Please enter Oracle wallet location: "
read WALLETLOC
fi
## wallet location is required
if [ "${WALLETLOC}" = "" ]
then
echo "Oracle wallet location is required";
exit 1;
fi
if [ ${WALLETPWD} = "A" ] ; then
printf "Please enter Oracle wallet password: "
stty -echo ; read WALLETPWD ; stty echo ; echo
fi
if [ "${WALLETPWD}" = "" ]
then
echo "Oracle wallet password is required";
exit 1;
fi
if [ ${WALLETPWD2} = "A" ] ; then
printf "Please enter confirmed Oracle wallet password: "
stty -echo ; read WALLETPWD2 ; stty echo ; echo
fi
if [ "${WALLETPWD}" != "${WALLETPWD2}" ]
then
echo "The input passwords are not matched";
exit 1;
fi
fi
if [ ${CONNECT} = "A" ] ; then
echo " "
printf "Please enter DB connect string: "
read CONNECT
fi
if [ ${ODSPWD} = "A" ] ; then
printf "Please enter ODS password: "
stty -echo ; read ODSPWD ; stty echo ; echo
fi
## password is required
if [ "${ODSPWD}" = "" ]
then
echo "ODS password is required";
exit 1;
fi
if [ ${ODSPWD2} = "A" ] ; then
printf "Please enter confirmed ODS password: "
stty -echo ; read ODSPWD2 ; stty echo ; echo
fi
if [ "${ODSPWD}" != "${ODSPWD2}" ]
then
echo "The input passwords are not matched";
exit 1;
fi
if [ "${CONNECT}" = "" ]
then
CMDNAME="$ORACLE_HOME/bin/sqlplus -s ods/${ODSPWD} "
else
CMDNAME="$ORACLE_HOME/bin/sqlplus -s ods/${ODSPWD}@${CONNECT} "
fi
# Check if ODS password and connect string is correct
${ORACLE_HOME}/bin/sqlplus -L ods/${ODSPWD}@${CONNECT} << END 1>/dev/null 2>/dev/null
exit;
END
if [ $? -ne 0 ]; then
echo "Incorrect connect string or ODS password specified"
exit 1;
fi
if [ ${OIDHOST} = "A" ] ; then
echo " "
printf "Please enter OID host name: "
read OIDHOST
fi
## oid host is required
if [ "${OIDHOST}" = "" ]
then
echo "OID host name is required";
exit 1;
fi
if [ ${OIDPORT} = "1" ] ; then
printf "Please enter OID port number [389]: "
read OIDPORT
if [ "${OIDPORT}" = "" ]
then
OIDPORT="389"
fi
fi
# Check if OID host and port is correct
${ORACLE_HOME}/bin/ldapbind -h ${OIDHOST} -p ${OIDPORT} 1>/dev/null 2>/dev/null
if [ $? -ne 0 ]; then
echo "Incorrect OID host or port specified"
exit 1;
fi
if [ ${ORCLADMINPWD} = "A" ] ; then
printf "Please enter orcladmin password: "
stty -echo ; read ORCLADMINPWD ; stty echo ; echo
fi
if [ "${ORCLADMINPWD}" = "" ]
then
echo "orcladmin password is required";
exit 1;
fi
if [ ${ORCLADMINPWD2} = "A" ] ; then
printf "Please enter confirmed orcladmin password: "
stty -echo ; read ORCLADMINPWD2 ; stty echo ; echo
fi
if [ "${ORCLADMINPWD}" != "${ORCLADMINPWD2}" ]
then
echo "The input passwords are not matched";
exit 1;
fi
# Check if orcladmin password is correct
${ORACLE_HOME}/bin/ldapbind -h ${OIDHOST} -p ${OIDPORT} -D 'cn=orcladmin' -w ${ORCLADMINPWD} 1>/dev/null 2>/dev/null
if [ $? -ne 0 ]; then
echo "Incorrect orcladmin password specified"
exit 1;
fi
echo " "
if [ ${SCUSB} = "A" ] ; then
printf "Please enter the subscriber common user search base [orclcommonusersearchbase]: "
read SCUSB
if [ "${SCUSB}" = "" ]
then
SCUSB=`${ORACLE_HOME}/bin/ldapsearch -h ${OIDHOST} -p ${OIDPORT} -D 'cn=orcladmin' -w ${ORCLADMINPWD} -s base -b 'cn=common,cn=products,cn=oraclecontext' -L 'objectclass=*' orclcommonusersearchbase | head -2 | grep -v 'dn:' | awk '{printf $2}'`
fi
fi
if [ ${PRGDN} = "A" ] ; then
printf "Please enter the Plug-in Request Group DN: "
read PRGDN
fi
if [ ${EP} = "A" ] ; then
printf "Please enter the exception entry property [(!(objectclass=orcladuser))]: "
read EP
if [ "${EP}" = "" ]
then
EP='(!(objectclass=orcladuser))'
fi
fi
echo " "
printf "Do you want to setup the backup Active Directory for failover? (y/n) "
read ISFAILOVER
if [ "${ISFAILOVER}" = "y" ]
then
if [ ${SECADHOST} = "A" ] ; then
printf "Please enter the backup Active Directory host name: "
read SECADHOST
if [ "${SECADHOST}" = "" ]
then
echo "Backup Active Directory host name is required";
exit 1;
fi
fi
printf "Do you want to use SSL to connect to the backup Active Directory? (y/n) "
read ISFAILOVERSSL
if [ "${ISFAILOVERSSL}" = "n" ]
then
if [ ${SECADPORT} = "1" ] ; then
printf "Please enter the backup Active Directory port number [389]: "
read SECADPORT
if [ "${SECADPORT}" = "" ]
then
SECADPORT="389"
fi
fi
fi
if [ "${ISFAILOVERSSL}" = "y" ]
then
if [ ${SECADSSLPORT} = "1" ] ; then
printf "Please enter the backup Active Directory SSL port number [636]: "
read SECADSSLPORT
if [ "${SECADSSLPORT}" = "" ]
then
SECADSSLPORT="636"
fi
fi
if [ ${SECWALLETLOC} = "A" ] ; then
echo " "
printf "Please enter Oracle wallet location: "
read SECWALLETLOC
fi
## wallet location is required
if [ "${SECWALLETLOC}" = "" ]
then
echo "Oracle wallet location is required";
exit 1;
fi
if [ ${SECWALLETPWD} = "A" ] ; then
printf "Please enter Oracle wallet password: "
stty -echo ; read SECWALLETPWD ; stty echo ; echo
fi
if [ "${SECWALLETPWD}" = "" ]
then
echo "Oracle wallet password is required";
exit 1;
fi
if [ ${SECWALLETPWD2} = "A" ] ; then
printf "Please enter confirmed Oracle wallet password: "
stty -echo ; read SECWALLETPWD2 ; stty echo ; echo
fi
     if [ "${SECWALLETPWD}" != "${SECWALLETPWD2}" ]
     then
     echo "The input passwords are not matched";
     exit 1;
     fi
fi
fi
# install the plug-in PL/SQL packages
echo " "
echo "Installing Plug-in Packages ..."
echo " "
# install plug-in debug tool
cp $ORACLE_HOME/ldap/admin/oidspdsu.pls $LDAP_LOG
chmod +w $LDAP_LOG/oidspdsu.pls
echo "EXIT;" >> $LDAP_LOG/oidspdsu.pls
${CMDNAME} @$LDAP_LOG/oidspdsu.pls
rm $LDAP_LOG/oidspdsu.pls
${CMDNAME} @$ORACLE_HOME/ldap/admin/oidspdof.pls
# install plug-in packages
${CMDNAME} @$ORACLE_HOME/ldap/admin/oidspad2.pls ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} 2>&1 ; stty echo ; echo
#stty -echo; eval ${CMDNAME} @$ORACLE_HOME/ldap/admin/oidspad2.pls ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${ISSSL} ${ADHOST} ${ADPORT} ${ADHOST} ${ADPORT} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ADHOST} ${ADSSLPORT} ${WALLETLOC} ${WALLETPWD} ${ISFAILOVER} ${ISFAILOVERSSL} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADPORT} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} ${SECADHOST} ${SECADSSLPORT} ${SECWALLETLOC} ${SECWALLETPWD} 2>&1 ; stty echo ; echo
# usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
# isfailover, isfailoverssl, sechost, secport, sechost, secsslport
# secwalletloc, secwalletpwd
# usessl, adhost, adport, adhost, adsslport, walletloc, walletpwd
# isfailover, isfailoverssl, sechost, secport, sechost, secsslport
# secwalletloc, secwalletpwd
# register the plug-ins
echo " "
echo "Registering Plug-ins ..."
echo " "
$ORACLE_HOME/bin/ldapadd -h ${OIDHOST} -p ${OIDPORT} -D cn=orcladmin -w ${ORCLADMINPWD} << EOF
dn: cn=adwhencompare2,cn=plugin,cn=subconfigsubentry
objectclass:orclPluginConfig
objectclass:top
orclpluginname:OIDADPSW2
orclplugintype:operational
orclplugintiming:when
orclpluginldapoperation:ldapcompare
orclpluginenable:1
orclpluginversion:1.0.1
orclPluginIsReplace:1
cn:adwhencompare2
orclpluginsubscriberdnlist:${SCUSB}
orclpluginattributelist:userpassword
orclpluginrequestgroup:${PRGDN}
orclpluginentryproperties:${EP}
dn: cn=adwhenbind2,cn=plugin,cn=subconfigsubentry
objectclass:orclPluginConfig
objectclass:top
orclpluginname:OIDADPSW2
orclplugintype:operational
orclplugintiming:when
orclpluginldapoperation:ldapbind
orclpluginenable:1
orclpluginversion:1.0.1
orclPluginIsReplace:1
cn:adwhenbind2
orclpluginsubscriberdnlist:${SCUSB}
orclpluginrequestgroup:${PRGDN}
orclpluginentryproperties:${EP}
EOF
cat <<DONE
Done.
DONE

Hi,
This is a problem that is not made clear in the note. What is probably happening here is that both plugins are being fired when a user logs in. OID will only read the value returned from the final plugin to fire. This can be a problem if the user authenticates correctly against the first plug-in but fails on the second. This is entirely legitimate as this note tells you to configure this way but the OID only observes the final result. The note doesn't tell us this.
Here's an example:
We've two OID User users in different containers: cn=Al is in container cn=usersA,dc=oracle,dc=com and cn=BOB is in container cn=usersB,dc=oracle,dc=com.
We have two plugins: pluginA and PluginB. Installed in that order.
When Al logs in the two plugins fire. pluginA finds Al and returns a true, but then pluginB fires and returns a false undoing the good result. OID only accepts the final answer and so rejects the user. When Bob logins in both plugins fire again but it's the second plugin that returns the answer again. This is true and bob gets in.
There's a couple of ways around this and one of the more effective ways is to associate the plugin with the dn. So in our example, we associate the pluginA to fire only for the dn cn=usersA,dc=oracle,dc=com and pluginB only to fire when a user is in cn=usersB,dc=oracle,dc=com. This gets around the problem of mulitple plugins firing and giving conflicting answers as the appropriate plugin only fires once.
I've used this solution in a realtime environment when connecting and provisioning multiple ADs into one OID and found it to be extremely effective.
Another solution is to associate the plugins with groups.
Both of these options may be configured easily by modifying the plugin properties in ODM. Don't forget to restart OID after you've made the changes.
HTH!
Phil.
If

SAP User Authentication via Windows Active Directory

The non-profit company I work for as an SAP Security Admin has been using SAP since 1999. We are currently running ECC 6.0, BI 7.0, and CRM 7.0. With fewer than 300 SAP users, we have not implemented CUA, so each of our multiple clients in these systems is managed independently.
The company recently licensed and implemented some non-SAP software to be used by all of our employees (~1200) in keeping track of & catagorizing their work time; a very handy feature of this software is that it depends upon Windows Active Directory for user authentication. Therefore, each employee logs into this time-keeping package by entering his/her standard PC userID & password. If you can log onto your PC, you can log into the time-keeping software.
That got me thinking & researching, because our SAP users - especially those who have access to three or more SAP clients - must maintain their passwords independently in each SAP client that they hope to access in the future. I'm certainly not the first person who has thought of how nice it would be to permit SAP users to log into all SAP clients across the landscape in which they have defined userIDs, using the same password that they are using to log into their PCs (i.e., the password that is stored & maintained in Windows Active Directory). My quest has led me to find presentations on this topic that typically involve modules we aren't using & very complicated configurations that we really lack the time & resources to employ; or, to third-party solution providers who claim to be certified SAP partners who would love to sell us more software to provide this convenience, usually irelated to single sign-on, LDAP, etc. The lowest pricing tier for such software usually would cover many times the number of SAP users we have to serve here - and it feels like trying to push in a tack using a sledgehammer. It is true that we have not used the same userID for our PCs that we have defined in SAP, so there would need to be some way to translate from one to the other, but our PC password rules are consistent with those we have configured in SAP clients, so it seems to me it should be very simple. Can anyone lead me to a more straightforward solution? If not, can you articulate why this has to be so complicated using SAP software when it seems so simple using relatively inexpensive timekeeping sotware?

>
Gagan Deep Kaushal wrote:
> Hi Tim,
>
> Its nice to see video.
>
> Is that mean using different username on OS and SAP level still we can achieve SSO.
>
> Correct if if am wrong.
> The only thing we need to maintain SNC name.
Once installed, yes. This is all you need to maintain when users are added. You can even use LDAP if you like to sync all user info between SAP and MS AD domain, but this cannot sync the password, so using SNC authentication instead of using SAP passwords is ideal.
>
> So for user test1 i can manage name as p:test2..... ??
Yes, that is correct. The mapping is maintained using standard SAP user management, such as su01. The user in AD domain might have long account name, e.g. "firstname.verylonglastname" which is too big for use as a SAP username so you can map this long AD account name onto a SAP user called FIRSTLAST in one or more SAP clients.
>
> I think that is what Ronald is also looking, user name need not to be same.
>
> Regards,
> Gagan Deep Kaushal

Active Directory Cross Forest Domain Migration

Dear All,
We are in the process to rebuild new Active Directory infrastructure. Multiple single forest domains in organization which needs to be consolidated/migrated on single Active Directory Domain. For this consolidation, have some queries to be addressed before
going to start consolidation.
What is the best practices and what tool should we use for domain migration/consolidation
Active directory is on Windows 2003, forest and domain level is on Windows 2003, this will support to Windows 2012 R2 forest and domain functional level, will be migrated
directly from windows 2003 to windows 2012?
When move users to new domain, how will they access the other resources on the network. For e.g. Printer, File server, local web base application
After moving some computers to new domain would be possible to access remaining computers on old domain?
How the file server data will be moved? Best practices with NTFS folder permissions and users rights?
Is there any policy to register network printers on new Active Directory domain?
How users would be access web base application on new domain as their FQDN would be define with old domain name? Any option to change old domain FQDN with new domain that would be describe with any URL link?
Kindly give your valuable input to meet the desire result.
Thanks in Advance.

Dear Lucky,
Ya you can Migrate contents from multiple forest domain. Using ADMT (Active Directory Migration Tool)is the best way to migrate AD content. But you can't migrate from Windows Server 2003 to Windows Server 2012 R2, cause in Windwos Server 2012 R2 don't
have the supportebility of Windows Sever 2003.And not only users you can also migrate all others info (i.e. Computer object info, groups info, Exchange mailbox info, security info).You can migrate users face by face, means which peoples are in old domain they
can access old domain and new users are in new domain.For more info please follow the given link:
http://technet.microsoft.com/en-us/library/cc974332(v=WS.10).aspx
Mithun Dey Web: http://cloudmithun.wordpress.com If this may give your necessary resolution please mark it as Answre.

Setting the logonHours attribute for a user in Active Directory

Hi Anyone,
I'm a brasilian guy and I need your help. How can I set the logonHours attribute on my Active Directory?
I have this code but it doesn't works good:
    public void setLogonHours(boolean[] logonHoursBits){
        int i;
        int j;
        int k;
        int index21 = 0;
        int index24 = 0;
        byte[] byteLogonHour = new byte[21];
        byte byte8Hours = 0;
        for(i=0; i <= 6; i++){
            for(j=1; j <= 3; j++){
                for(k=7; k >= 0; k--){
                    if (i < 6){
                        if (logonHoursBits[i] == (boolean)(index24 == 0) ? true : false){
                            byte8Hours += (byte)Math.pow(2,k);
                    else{
                        if (logonHoursBits[0] == (boolean)(index24 == 0) ? true : false){
                            byte8Hours += (byte)Math.pow(2,k);
                    index24++;
                byteLogonHour[index21] = byte8Hours;
                index21++;
            index24 = 0;
        try{
            String nome = "CN=Dryelle,OU=Pesquisa,DC=cifya,DC=com,DC=br";
            ctx = new InitialLdapContext(env,null);
            ModificationItem logonHours[] = new ModificationItem[1];
            logonHours[0]= new ModificationItem(DirContext.REPLACE_ATTRIBUTE, new BasicAttribute("logonHours",byteLogonHour));
            ctx.modifyAttributes(name,logonHours);
            System.out.println("Atributo logonHours alterado com sucesso.");
        catch (NamingException e) {
           System.err.println("Problema na altera??o " + e);
    }the code set the attribute but wrong. Can anyone help-me? It's making me crazy.
Sorry about my poor english.
Tks.
Edited by: th_slopes on Aug 15, 2008 5:50 PM

DirContext ctx = new InitialDirContext(pr);
          BasicAttributes entry = new BasicAttributes(true);
          String entryDN = "cn=CharbelHad,ou=test users,dc=test,dc=dev";
          Attribute cn = new BasicAttribute("cn", "ChHad");
          Attribute street = (new BasicAttribute("streetAddress", "Ach"));
          Attribute loginPreW2k = (new BasicAttribute("sAMAccountName", "[email protected]"));
          Attribute login = (new BasicAttribute("userPrincipalName", "[email protected]"));
          Attribute sn = (new BasicAttribute("sn", "Chl"));
          Attribute pwd = new BasicAttribute("unicodePwd", "\"Ch@341\"".getBytes("UTF-8"));
Attribute userAccountControl = new BasicAttribute("userAccountControl", "512");
          Attribute oc = new BasicAttribute("objectClass");
          oc.add("top");
          oc.add("person");
          oc.add("organizationalPerson");
          oc.add("user");
          // build the entry
          entry.put(cn);
          entry.put(street);
          entry.put(sn);
          entry.put(userAccountControl);
          entry.put(pwd);
          entry.put(login);
          entry.put(loginPreW2k);
          entry.put(oc);
          ctx.createSubcontext(entryDN, entry);

Error while trying to provision OIM user to Active Directory using SSL

Hi All,
I am able to see the users through LDAP browser using SSL but am getting the following error while trying to provision OIM users to AD using SSL.
I am using Microsoft Active Directory connector type 9.11.
Response: Connection Error encountered
Response Description: Error encountered while connecting to target system
I did some testing using "Diagnostic Dashboard" and the following are the results.
Test Name: Target System SSL Trust Verification: Passed
Test Name: Test Basic Connectivity: Failed
Exceptions:
ITResource information values are not correct. Enter the correct values.
java.lang.reflect.InvocationTargetException
javax.naming.CommunicationException: simple bind failed:
unable to find valid certification path to requested target.Test Name: Test Provisioning:Failed
Note: Without SLL all the above tests got Passed.
Can anybody help me out from this issue.
Thanks in advance.
Pradeep Kumar.

I am able to connect to AD using 636 port number from LDAP browser and as the following test got Passed i think that my certificatee should be correct.
Test Name: Target System SSL Trust Verification.
Input Parameters
Target System: idm.orademo.com
Port: 636 Certificate Store
Location: /usr/java/jdk1.6.0_14/jre/lib/security/cacerts
Result : Passed
ITResource Values:
ADAM LockoutThreshold Value
ADGroup LookUp Definition     Lookup.ADReconciliation.GroupLookup
Admin FQDN     cn=Administrator,cn=Users,dc=orademo,dc=com
Admin Password     *******
Allow Password Provisioning     yes
AtMap ADGroup     AtMap.ADGroup
AtMap ADUser     AtMap.AD
Invert Display Name     no
Port Number     636
Remote Manager Prov Lookup     AtMap.AD.RemoteScriptlookUp
Remote Manager Prov Script Path
Root Context     dc=orademo,dc=com
Server Address     idm.orademo.com
Target Locale: TimeZone     GMT
UPN Domain     orademo.com
Use SSL     yes
isADAM     no
isLookupDN     no
isUserDeleteLeafNode     no
Thansk & Regards,
Pradeep Kumar.

Problem authenticating user in Active Directory cross domain

Similar Messages

Maybe you are looking for