Provision Unix accounts/roles/groups to Directory server using OIM

Hi,
I have a requirement to integrated large number of Unix servers with LDAP (OID or Sun Directory Server) for Centralized Authentication and Authorization and to provision Unix accounts/roles/groups to Directory server using OIM, I have following queries.
1. If using PAM_LDAP then what are the schema changes required in ldap to support it ?
2. Does OIM's out of box connector for OID or Sun Directory Server supports Unix accounts/roles/groups provisioning to Directory server ? If not, can it be extend ? or do I need to write a custom connector ?
3. If I use Oracle Authentication Services for OS for centralized unix account management then OIM provisioning is same as #2 or different ?
Thanks
Nitin

yes. iPlanet connector support for multivalued attribute. Go through the connector doc. It will let you know how to extend its functionality.
--nayan

Similar Messages

Add a posixaccount user in posixgroup in sun directory server using java

Hi
Anybody now how to add posixaccount user in posixgroup in sun directory server using java code.
I am able to add normal directory server user in ldap group in java.
But i am getting any luck to add posixaccount user in posixgroup.
I know we can set uid value in memberuid attribute but how to add through java program.
Anybody can paste code for that.
Thanks.

To CRabel,
My company have restriction on using the open sources product/code, but i will take a look on netscape ldap sdk as a reference~
To raghu1978 ,
i find a product call Directory Editor 1 2005Q1, I hope it is useful.
thz all~

Can't access my Directory Server using the Console installed on a machine

can't access my Directory Server using the Console installed on a remote server, lookied into knowledge base article 4693, but still same any idea ?

I too am having problems accessing Directory server from Netscape Console installed on Winxp.
If I try to open Directory server it doesn't give any error. No windows nothing.
If I try th same from the machine on which it is installed everything is fine. What is strange is that it did open a couple of times. But at the same time I can open the admin server, Netscape Messaging server from the xp box. Searching all over for a solution. Any help/pointers would be greatly appreciated.
Config details:
iDS4.13, iMS 5.0, running on Sol 8 box
Netscape Console 4.2 on WinXP.
Thanks

Roles in iPlanet Directory Server v5.0 und JNDI.

Hi!
I have the following problem:
How can I find and change the Role object in iPlanet Directory Server v5.0 via JNDI? It's possible ?
Regards,
Andriy

Hi,
It is not necessary to go in such a way for going and adding the corresponding roles.
For eg
Here is an LDIF file which plays an important role in making the attributes.
Here is an sample fedup.ldif file
dn: uid=timb,ou=Customers,o=fedup.com
objectclass: customer
objectclass: inetorgperson
objectclass: organizationalPerson
objectclass: person
objectclass: top
cn: Tim Briggs
uid: timb
givenname: Tim
customerid: timb
sn: Briggs
facsimiletelephonenumber: 4101
telephonenumber: 4145
creatorsname: uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot
createtimestamp: 20000401084012Z
aci: (target="ldap:///uid=timb,ou=Customers,o=fedup.com")(targetattr="*")(version 3.0; acl "unknown"; allow (all) userdn = "ldap:///anyone": )
ou: Customers
mail: [email protected]
userpassword: bakru
modifiersname: uid=admin,ou=Administrators,ou=TopologyManagement,o=NetscapeRoot
modifytimeStamp: 20000502084001Z
Here I have sepecified userid as timb and password as bakru and with corresponding roles in aci.
After making the LDIF file you have to import it in Directory server.
For that you have to Iplanet Console menu, from there click on Import for the ldif file to get imported.
Or else you can go for ldapadd, ldapmodify commands.
Also if you are going to add new attributes which is not known by Directory server, Please follow these process.
Creation of our own USER SCHEMA Files:-
It is necessary for adding the attributes which are not defined in the
Netscape directory server. In the above, customerid which is defined in ldif
file is not existing in the directory server.
Here is the Schema file for attributes:(ie for defining for eg customer id).
The name of the file is slapd.user_at.conf:-
attribute customerid customerid-oid cis single
attribute packageid packageid-oid cis single
attribute receivedate receivedate-oid cis single
attribute shipdate shipdate-oid cis single
attribute shipperid shipperid-oid dn single
attribute receiveid receiveid-oid dn single
#Java Attributes
# Schema for storing java objects and java object references
attribute javaClassName 1.3.6.1.4.1.42.2.27.4.1.1 ces single
attribute javaCodebase 1.3.6.1.4.1.42.2.27.4.1.6 ces
attribute javaSerializedData 1.3.6.1.4.1.42.2.27.4.1.7 bin single
attribute javaRemoteLocation 1.3.6.1.4.1.42.2.27.4.1.8 ces single
attribute javaFactory 1.3.6.1.4.1.42.2.27.4.1.4 ces single
attribute javaReferenceAddress 1.3.6.1.4.1.42.2.27.4.1.3 ces
Here is Schema file for your own object classes:-
The name of the file is Slapd.user_oc.conf:-
In the similar way we assume that there are no "customer" class in the object classes
defined in the LDAP, so we will have to create our own "customer" Object class.
Also it extends inetOrgPerson to add some new attributes such as "customerid".
The object class of an entry specifies what attributes are required and what
attributes are allowed in a particular entry.
Also for eg, Package classes in the object class is created.
Here is the sample file for creating the above:-
objectclass package
oid package-oid
superior top
requires
packageid,
receiveid,
shipdate,
shipperid
allows
description,
ou,
receivedate
objectclass customer
oid customer-oid
superior inetorgperson
requires
customerid
allows
c
#JAVA Schema
# Schema for storing java objects and java object references
objectclass javaContainer
oid 1.3.6.1.4.1.42.2.27.4.2.1
superior top
requires
cn
objectclass javaObject
oid 1.3.6.1.4.1.42.2.27.4.2.4
superior top
requires
javaClassName
allows
javaCodebase
objectclass javaSerializedObject
oid 1.3.6.1.4.1.42.2.27.4.2.5
superior javaObject
requires
javaSerializedData
objectclass javaRemoteObject
oid 1.3.6.1.4.1.42.2.27.4.2.6
superior javaObject
requires
javaRemoteLocation
objectclass javaNamingReference
oid 1.3.6.1.4.1.42.2.27.4.2.7
superior javaObject
requires
javaReferenceAddress,
javaFactory
STEP 4: Loading the USER SCHEMA files in Directory Server:-
All the attributes created above should be added to the corresponding directory server,
in order to make it as a common attribute.
Steps for adding the User Schema files to the Directory Server:-
1. Copy the above user schema files to the appropriate instance of Netscape Directory Server
created above so that the existing LDIF file which is used in the Netscape directory
server is not appended or overwritten.
2. For eg, put it in "NetscapeServer/slapd-HostName/config" to replace the empty
files "slapd.user_at.conf" and "slapd.user_oc.conf" by default.
3. Then restart the Directory Server.
I hope this will help you.
Thanks
Bakrudeen
Technical Support Engineer
Sun MicroSystems Inc, India

Retrieving user data from Directory Server using java code

Can anyone send java code to bind to directory server and retrieve the user information from server instance.

To CRabel,
My company have restriction on using the open sources product/code, but i will take a look on netscape ldap sdk as a reference~
To raghu1978 ,
i find a product call Directory Editor 1 2005Q1, I hope it is useful.
thz all~

Can't start NT service for Directory Server using other acc. than LocalSys.

Hi!
I'm using Directory Server 5.1 on a Windows 2000 machine.
I wrote a Plug-In for DS that needs Administrator Access to the NT Domain. So I tried to run the DS-Service as Administrator but the service can not start. I just keeps in status "starting...".
I don't get any error message and the errorlog doesn't contain anything.
Has anyone an idea?
Thanks!
Florian

I forgot to tell one thing: I use SSL, without SSL I do not have this problem. Perhaps it's only the popup I get when starting DS, where I have to enter the certificate password?

Trying to add a role on a remote server using windows powershell.

Im reading a book that wants us to install a role on a remote computer using powershell. The comands below is what we are sopuse to use and nothing happens. Does anyone know why?
function Invoke-WindowsFeatureBatchDeployment {
param (
[parameter( mandatory)]
[string[]] $ ComputerNames,
[parameter( mandatory)]
[string]
$ ConfigurationFilePath )
# Deploy the features on multiple computers simultaneously.
$ jobs = @()
foreach( $ ComputerName in $ ComputerNames) {
$ jobs + = Start-Job -Command { Install-WindowsFeature -ConfigurationFilePath
$ using:ConfigurationFilePath -ComputerName $ using:ComputerName -Restart } } Receive-Job -Job $ jobs -Wait | Select-Object Success, RestartNeeded, ExitCode, FeatureResult }
Then after this he states it is going to want a few parameters, for example.
# Sample Invocation $ ServerNames = 'TestServer_01', 'LabServer_02' Invoke-WindowsFeatureBatchDeployment -ComputerNames $ ServerNames -ConfigurationFilePath C:\ RemoteDesktopConfig.xml

I've been working on this for the last hour or so and here is what I got. Any ideas?
PS C:\Users\Administrator> foreach ($computerName in $ComputerNames) {
>> param (
>> [parameter (mandatory) ]
>> [string[]] $ComputerNames,
>> [parameter (mandatory)]
>> [string] $ConfigurationFilePath
>> )
>> $jobs = @()
>> foreach ($computerName in $ComputerNames) {
>> $jobs += Start-Job -Command {
>> Instal-WindowsFeature
>> -ConfigurationFilePath
>> $using:ConfigurationFilePath
>> -ComputerName
>> $using:ComputerName
>> }
>> }
>> Receive-Job -Job $jobs -Wait | Select-Object
>> }
>> $ServerNames = 'WIN-AN69NIQ6ARI'
>> Invoke-WindowsFeatureBatchDeployment
>> -ComputerNames $ServerNames
>> -ConfigurationFilePath C:\Users\Administrator\Desktop\DeploymentConfigTemplate.xml
>>
Invoke-WindowsFeatureBatchDeployment : The term 'Invoke-WindowsFeatureBatchDeployment' is not recognized as the name
of a cmdlet, function, script file, or operable program. Check the spelling of the name, or if a path was included,
verify that the path is correct and try again.
At line:21 char:1
+ Invoke-WindowsFeatureBatchDeployment
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (Invoke-WindowsFeatureBatchDeployment:String) [], CommandNotFoundExcepti
   on
    + FullyQualifiedErrorId : CommandNotFoundException
-ComputerNames : The term '-ComputerNames' is not recognized as the name of a cmdlet, function, script file, or
operable program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
again.
At line:22 char:1
+ -ComputerNames $ServerNames
+ ~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (-ComputerNames:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException
-ConfigurationFilePath : The term '-ConfigurationFilePath' is not recognized as the name of a cmdlet, function, script
file, or operable program. Check the spelling of the name, or if a path was included, verify that the path is correct
and try again.
At line:23 char:1
+ -ConfigurationFilePath C:\Users\Administrator\Desktop\DeploymentConfigTemplate.x ...
+ ~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : ObjectNotFound: (-ConfigurationFilePath:String) [], CommandNotFoundException
    + FullyQualifiedErrorId : CommandNotFoundException

How to track changes on the directory server using the ChangeLog facility?

The ldap search filter should read "cn=changelog"
So the query should be something like
ldapsearch -b "yourbase" -D "yourbind" -w passwd -s sub
"cn=changelog"
To make the output readabel, you may need the option -o if you use the iDS ldapsearch. If you use the Sun ldapsearch, the -o is not needed.

Roles in Directory Server?

Does access manager support the role mechanism used by Sun directory server 5.2 and above? Are there any inconsistencies that I should be aware of. I would like to set up roles in the directory and use access (and identity) manager in the future.

Please check Access Manager Admin guide on page 87.
ftp://docs-pdf.sun.com/817-7647/817-7647.pdf
Copy from above manual. Jerry
Roles are a Directory Server entry mechanism similar to the concept of a group. A group has members; a role has members. A role�s members are LDAP entries that possess the role. The criteria of the role itself is defined as an LDAP entry with attributes, identified by the Distinguished Name (DN) attribute of the entry. Directory Server has a number of different types of roles but Access Manager can manage only one of them: the managed role.

How to install directory server/client on Solaris 9 for dummys

Hi,
after reading hunderts of pages, after asking questions in forums without getting the right answers, i was able to install the directory server in our company.
Here is the summary i made for myself. Perhaps it helps others to avoid the same problems.
Set up a Directory Server (sun one ds 5.1)
Present situation:
-Nisplus is installed
-Solaris OS 9 sparc 64bit is installed
-DS5 Software is normally already installed in Solaris 9. Check off with 'pkginfo | grep IPLT*'
-Otherwise install from Solaris OS 9 Disc1 with 'pkgadd -d IPLTxxxx .'
-Software setup with '/usr/sbin/directoryserver setup'
     Install admin- and directory server.
     For Directory Server use port 389 (necessary for later use of SSL)
     For Admin Server use any empty port > 1024
     Run directoryserver as root (necessary for using port 389 and for -starting servers from console)
     Use default Directory Manager DN cn=Directory manager
     Use your domain as DIT (default information tree) example: dc=example, dc=com
     As second DIT, setup installs o=NetscapeRoot. Don't change this DIT at all!!!!!
The server stores all the default schemas there which are absolutely important for the directoy
server. Don't change anything there !
-Configure software with 'idsconfig'
     Preferred - and default server xxx.xxx.xxx.xxx (ip_adds of your directory server)
     Use default search scope one
     Use credential's Proxy
     Use authentication Simple (you may change this later if needed)
     All the rest should remain on default settings
     You will be asked for a proxy passwort
-Start the directoryserver console with '/usr/sbin/directoryserver startconsole'
-If it's not yet running, start the directory server from console or with command 'directoryserver -s instance_name start'
-If it's not yet running, start the admin server from console or with command 'directoyserver start-admin'
-On directoryserver's gui at configuraton/password set password encryption to 'unix crypt algorithm (CRYPT)'
Import Data
-Get Data from Nisplus with
     'niscat passwd.org_dir passwd.ldap'
     'niscat hosts.org_dir hosts.ldap'
     'niscat groups.org_dir groups.ldap'
     etc
-adjust the files. (try it out with one entry of a file only. You may delete this entry with the gui very easy if it's not successfull.
-hosts.ldap must look like
xxx.xxx.xxx.xxx machine1
xxx.xxx.xxx.xxx machine2
xxx.xxx.xxx.xxx machine3
     First value is the ip-address, second one is the hostname.
     If you have more than one hostname per machine, use a second line (don't write 2 names behind the ip-address like you did in nisplus!!!)
Change content of files into ldif format
-perl migrate_hosts.pl hosts.ldap hosts.ldif
-perl migrate passwd.pl passwd.ldap passwd.ldif
-You may download the above perl-Files from http://www.padl.com
Change the converted passwd.ldif File as follows:
-before change:
dn: uid=mario,ou=People,dc=krinfo,dc=ch
uid: mario
cn: mario
objectClass: account
objectClass: posixAccount
objectClass: top
userPassword: {crypt}6O9m3uK./T/rM
loginShell: /bin/bash
uidNumber: 1020
gidNumber: 14
homeDirectory: /home/mario
-after change:
dn: uid=mario,ou=People,dc=krinfo,dc=ch
uid: mario
cn: mario
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount <--- this line must be inserted
objectClass: top
userPassword: {crypt}6O9m3uK./T/rM
loginShell: /bin/bash
uidNumber: 1020
gidNumber: 14
homeDirectory: /home/mario
Insert the line for every entry in the passwd.ldif file
You may now import all these xxxx.ldif files into the directory server with
-ldapadd -h name_of_directoryserver -D "cn=Directory Manager" -w password -f XXXXX.ldif
You may use this commands later to import further data.
-Initialise a client
'ldapclient -a proxyDN=cn=proxyagent,ou=profile,dc=example,dc=com init xxx.xxx.xxx.xxx'
The xxx.xxx.xxx.xxx at the end is the ip address of the directory server
-This will make a client with data taken from the default profile from the directory server. This profile has been produced with the earlier command idsconfig and can be changed if needed.
-The System will ask you for the proxy password (given the first time in idsconfig dialog)
-You may now look at the produces files
in '/var/ldap/ldap_client_file' for the client settings
in '/var/ldap/ldap_client_cred' for the proxy settings
'ldapclient list' shows the settings of the client
With 'ldaplist -h' you may see all the existing entries with their objects.
Activate the client
-If it's not yet running, start '/usr/lib/ldap/ldap_cachemgr'
-All nisplus daemons/programs have been stopped by ldapclient command. If not, stop them manually.
-/etc/nsswitch.conf should have been copied from /etc/nsswitch.ldap from ldapclient too.
-If not, do it manually.
example
passwd: files ldap
group: files ldap
hosts ldap dns files
etc
I recommend to change the file '/etc/nsswitch.ldap' because the system oftens copies nsswitch.ldap to nsswitch.conf and if nsswitch.ldap is adapted, you must now change it again and again.
you may now check whether ldap is working fine with the following requests:
getent passwd username
getent hosts hostname
getent groups
getent network
These commands should give you the requested answer.
Be sure to clean:
/etc/hosts      inside is only your workstation and the directory server
/etc/passwd     only default and local entries
/etc/groups only default and local entries
etc
try a telnet to your own machine to check, whether password and automount of your home_dirctory works fine.
I failed here. All was working fine, but the password exchange did not because of credential/authentication problems.
Best regards and good luck
Mario

Directory Server 5.1 does not support Kerberos authentication.
Beside this there are some extensions in MS kerberos authentication that makes it almost impossible to have a MS client authenticate with something else than AD.
Regards,
Ludovic.

Active Directory 2003 and Sun One Directory Server 5.2

I just installed Sun One Directory Server 5.2 on a Linux machine. I want to configure LDAP on that machine so that it can be authenticated on Active Directory 2003. How do I go about doing this?

Active Directory server is a "directory server" (and kerberos server.) If your linux client authenticates against Active Directory it doesn't have to involve the Sun Directory Server at all. You have several general approaches you could investigate:
1. Linux client gets accounts and and authentication via LDAP from Active Directory
If you use AD to handle unix LDAP authentication (opt 1) you may need to extend schema in AD to add the unix password field. I haven't tried it yet, but hope to.
2. Linux client gets accounts from AD LDAP and authorization from AD Kerberos.
There should be docs on support.microsoft.com on enabling kerberos support for non-Win clients.
3. Linux client (with samba client installed, with winbind or pam_smb to support unix level services) gets accounts and authentication as a "Windows" client from Active directory "Windows server"
Check the samba.org docn or forums- I think this is a pretty common solution.
4. Linux client gets account information from Sun Directory server but uses kerberos (against active directory) for authentication.
There should be docs on support.microsoft.com on enabling kerberos support for non-Win clients.
5 Linux client gets account and authorization from Sun Directory server, which the sun Directory server configured to use Active Directory as a Kerberos server.
Probably incredibly complex.

Auto-Provisioning Guest Accounts

Guys
Whilst on a recent wireless PVT I heard mention of a method of auto provisioning guest accounts.
The system appeared to use some sort of keypad device that the guest entered details into. This device then used Radius to generate a guest account with username and password credentials then being printed out for the guest.
I am fully aware of the NAC Guest Server and WCS capabilities. This is a different system entirely.
Can anyone throw on any light on this for me please?
Regards
Roger

I know ISE can do this also, but I don't know of anything else that does this.
Thanks,
Scott Fella
Sent from my iPhone

Urgent help on Sun One Directory server 5.1

Hi All,
Am trying to access sun one directory server using the JAVA api provided by the tool itself. Developed an application to access that server and perform several operation.
When I try to unassign a user from a group, all the users from that group are getting unassigned. Can there me any scenario in which this can happen. The user(no an admin user) who is used to connect to the LDAP server has all privileges to do operations on that group. More over this issue is very inconsistent, we could notice only once in separate environment (once per environment) and there hence cannot
be reproducible.
Below is snippet which remove a user from a group.
LDAPAttribute attr = new LDAPAttribute( "uniquemember", userEntryDN );
LDAPModification ldapMod = new LDAPModification( LDAPModification.DELETE, attr );
ldapConnection.modify( myEntryDN, ldapMod );
Any help on will be greatful.
Thanks in advance
-Sri

TTT

Directory Utility wont connect to Open Directory Server on Xserv 10.5.1

I am trying to set up the ical service on the xserve, I have the server set up as the OD master when I went into the directory utility app it would not located the server until I changed the search policy to custom which included LDAPv3. Once I did that the server popped up in the directory utility list but it says "server is not responding"
Any one else having this issue or know what might be the solution?

Have you tried adding the server to the client using 'servername.local' instead of its DNS name? I have had flaky problems adding clients to the directory server using the DNS name and found using 'servername.local' to be much more reliable.

Migration Users with MD5 Passwords to Directory Server 6.1 on Solaris 10

Hi,
We are currently in a requirement of migrating some users to a application database to inside LDAP. Currently Application maintained the passwords in the MD5 hash form. Typical 32 digit Hex value - 41da76f0fc3ec62a6939e634bfb6a342
Is there a way we can migrate these Users password to directory Server as-is so that they don't end up facing the prospect of resetting post migration.
I have done some of the initial ground work but seems to be missing other critical info if at all it's possible.
I believe it's possible to have CRYPT password policy (which directory server uses from underlying OS) as one of the plug-ins to configure in a way that underlying CRYPT utility starts to process/provide/support MD5 hashes. I got it to work, my using the below command on DSEE instance:
dsconf set-plugin-prop -p 389 CRYPT argument:'$md5$'
But for some reasons the MD5 hash (Sun MD5 library) provides does not match with the original hash value. It's 22 char long (as I have not specified any salt length) so I am assuming it's Base64 encoded. I have a perl script which converts the original 32-digit hex values to a base64 encoded representation (which I have also verified with other open source tools)
Is there a way I can tweak CRYPT utility or something so that it understands typical standard MD5 hashes. (Confused between Sun MD5 and BSD (Linux) MD5 - none of them seems to match standard MD5 generated value).
Any leads on this would be really helpful ?

Just to reclarify or throw more information:
a password - cleartext value - testuser1 has 32-digit HEX value as - 41da76f0fc3ec62a6939e634bfb6a342
Same password when converted to Base64 pattern becomes - Qdp28Pw+xippOeY0v7ajQg==
But when I use pwdhash utility in DSE after configuring CRYPT to use MD5 hashes it becomes -
{crypt}$md5$$LiB/H70zXr3xfQPoXVuUQ1
I used below command :
pwdhash -D /opt/SUNWdsee/dsee6/ds6/slapd-oha-dev -s CRYPT testuser1
Actual hash value of pwdhash is -LiB/H70zXr3xfQPoXVuUQ1 with rest of the prefix is to meet RFC standard and salt and algo name separator.
I am wondering if Sun MD5 default uses any salt even when I haven't used or DS does it. Or if any other MD5 option is there which can be used.
Thanks,
Gaurav

Provision Unix accounts/roles/groups to Directory server using OIM

Similar Messages

Maybe you are looking for